Edit tour

Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf

Overview

General Information

Sample name:	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Analysis ID:	1431613
MD5:	f117efee9e82c956ec950aa7d4a3fa32
SHA1:	30e845fc5486cf50cbfe784d840076a9815a70b5
SHA256:	85440e7e88ed123e20f7347b6923d501aa2b81c6147185a927005b239ae7b526
Tags:	elf
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431613
Start date and time:	2024-04-25 14:35:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/0@113/0

Runtime Messages

Command:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
PID:	6217
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6217, Parent: 6140, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf

SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf New Fork (PID: 6219, Parent: 6217)

SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf New Fork (PID: 6220, Parent: 6217)

SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf New Fork (PID: 6222, Parent: 6217)

SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf New Fork (PID: 6225, Parent: 6222)

SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf New Fork (PID: 6226, Parent: 6222)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x106a4:$x1: POST /cdn-cgi/ 0x10a28:$s1: LCOGQGPTGP
6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x106a4:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x106a4:$x1: POST /cdn-cgi/ 0x10a28:$s1: LCOGQGPTGP
6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x106a4:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x106a4:$x1: POST /cdn-cgi/ 0x10a28:$s1: LCOGQGPTGP
6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x106a4:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x106a4:$x1: POST /cdn-cgi/ 0x10a28:$s1: LCOGQGPTGP
6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x106a4:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6217	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6219	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6220	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6226	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Click to see the 15 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Virustotal: Detection: 60%			Perma Link
Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	ReversingLabs: Detection: 67%

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6217)	Socket: 127.0.0.1::29103	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::23	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::81	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::8443	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::9009	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::13883	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::19481	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::4444	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	Socket: 0.0.0.0::9789	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::81	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::8443	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::9009	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::13883	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::19481	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::4444	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	Socket: 0.0.0.0::9789	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: global traffic

DNS traffic detected: DNS query: www.sushiking.world

Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Source: LOAD without section mappings

Program segment: 0x8000

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6219)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	SIGKILL sent: pid: 6219, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	SIGKILL sent: pid: 759, result: successful	Jump to behavior

Source: 6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/0@113/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2033/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2033/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1582/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2275/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1612/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1612/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1579/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1699/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1335/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1698/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2028/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2028/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1334/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1576/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1576/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/3236/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2025/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2025/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2146/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/910/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/912/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/759/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/517/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/918/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1594/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1594/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2285/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2281/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1349/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1349/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1623/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1623/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/761/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1622/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1622/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/884/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1983/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1983/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2038/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2038/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1586/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1586/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1465/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1465/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1344/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1344/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1860/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1860/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1463/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1463/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2156/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/801/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1629/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1629/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1627/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1627/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1900/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1900/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/491/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2294/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2050/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/2050/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1877/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1877/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/772/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1633/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1633/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1599/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1599/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1632/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1632/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1477/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/1477/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6225)	File opened: /proc/774/exe	Jump to behavior

Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf

Submission file: segment LOAD with 7.9449 entropy (max. 8.0)

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf (PID: 6217)

Queries kernel information via 'uname':

Jump to behavior

Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6217.1.00007ffead5cc000.00007ffead5ed000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6219.1.00007ffead5cc000.00007ffead5ed000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6220.1.00007ffead5cc000.00007ffead5ed000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6226.1.00007ffead5cc000.00007ffead5ed000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6217.1.000056175aff8000.000056175b126000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6219.1.000056175aff8000.000056175b126000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6220.1.000056175aff8000.000056175b126000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6226.1.000056175aff8000.000056175b126000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6217.1.000056175aff8000.000056175b126000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6219.1.000056175aff8000.000056175b126000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6220.1.000056175aff8000.000056175b126000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6226.1.000056175aff8000.000056175b126000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6217.1.00007ffead5cc000.00007ffead5ed000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6219.1.00007ffead5cc000.00007ffead5ed000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6220.1.00007ffead5cc000.00007ffead5ed000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf, 6226.1.00007ffead5cc000.00007ffead5ed000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6219, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6226, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6217.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6219.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6220.1.00007f9f90017000.00007f9f90029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6217, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6219, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6226, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	60%	Virustotal		Browse
SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	68%	ReversingLabs	Linux.Trojan.Mirai
SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	100%	Avira	ANDROID/Mirai.xorzm

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
www.sushiking.world	8%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.sushiking.world	unknown	unknown	false	8%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
79.110.48.149	unknown	Germany	57287	OTAVANET-ASCZ	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
79.110.48.149	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OTAVANET-ASCZ	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse	79.110.48.149
	skid.arm7.elf	Get hash	malicious	Mirai	Browse	79.110.49.174
	HROFrIvvVk.elf	Get hash	malicious	Mirai	Browse	79.110.49.195
	https://79.110.48.52/nicko.vbs	Get hash	malicious	Unknown	Browse	79.110.48.52
	PO_1100620230526.pdf(39kb).exe	Get hash	malicious	Remcos, RedLine, XpertRAT	Browse	79.110.48.151
	https://prc-homes.uk/wp-images/26738903/content/Security_on_your_card_account.html	Get hash	malicious	HTMLPhisher	Browse	79.110.48.18
	https://towntalkeg.com/wp-images/108373893032/Security_on_your_card_account.html	Get hash	malicious	HTMLPhisher	Browse	79.110.48.18
	0xc2s.x86.elf	Get hash	malicious	Unknown	Browse	79.110.48.91
	oWlBd5huKm.elf	Get hash	malicious	Unknown	Browse	79.110.48.116
	JSJRrcfx4B.elf	Get hash	malicious	Unknown	Browse	79.110.48.116
CANONICAL-ASGB	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	ldCdti5sRA.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	vlxx.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gCqnbN34QY.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	PylIt4izlJ.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
CANONICAL-ASGB	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	ldCdti5sRA.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	vlxx.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gCqnbN34QY.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	PylIt4izlJ.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
INIT7CH	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.941257292192873
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
File size:	26'620 bytes
MD5:	f117efee9e82c956ec950aa7d4a3fa32
SHA1:	30e845fc5486cf50cbfe784d840076a9815a70b5
SHA256:	85440e7e88ed123e20f7347b6923d501aa2b81c6147185a927005b239ae7b526
SHA512:	d51989fb131e8b4287d268e58e5d279e15a4633f9322c88049279d5449a94767817a30e869f2dde1b29a59b8d706f0b9cf25cec41106a5a5544ae56a54c776ee
SSDEEP:	384:C7rcQHNG5qnQn7IjgoFVleXpWoR3CKyV145hw8ZpizQPPhymdGUop5hn:orcQlk7UgoNKWoAa5JiQPPs3Uozl
TLSH:	2DC2D0617AAD2EF2CBF00839FE7A44C333C159B8D0D9F6636859813C69D62066DDE542
File Content Preview:	.ELF...a..........(.....`...4...........4. ...(......................g...g..........................................Q.td............................s.y.UPX!....................R..........?.E.h;.}...^..........f.*......Q.$.AHQA@^...%........9_...y..'..g.~E

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0xd560
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x670f	0x670f	7.9449	0x5	R E	0x8000
LOAD	0x1adc	0x21adc	0x21adc	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 14:35:50.581615925 CEST	48876	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:35:50.876079082 CEST	80	48876	79.110.48.149	192.168.2.23
Apr 25, 2024 14:35:52.064095020 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 25, 2024 14:35:57.428019047 CEST	48878	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:35:57.439369917 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 25, 2024 14:35:57.750550032 CEST	80	48878	79.110.48.149	192.168.2.23
Apr 25, 2024 14:35:58.719235897 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 25, 2024 14:36:02.302853107 CEST	48880	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:36:02.623368979 CEST	80	48880	79.110.48.149	192.168.2.23
Apr 25, 2024 14:36:08.175637007 CEST	48882	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:36:08.470767975 CEST	80	48882	79.110.48.149	192.168.2.23
Apr 25, 2024 14:36:12.797342062 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 25, 2024 14:36:14.022171021 CEST	48884	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:36:14.321185112 CEST	80	48884	79.110.48.149	192.168.2.23
Apr 25, 2024 14:36:23.035945892 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 25, 2024 14:36:23.872318029 CEST	48886	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:36:24.167100906 CEST	80	48886	79.110.48.149	192.168.2.23
Apr 25, 2024 14:36:29.178925037 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 25, 2024 14:36:29.719827890 CEST	48888	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:36:30.014640093 CEST	80	48888	79.110.48.149	192.168.2.23
Apr 25, 2024 14:36:39.579319954 CEST	48890	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:36:39.875395060 CEST	80	48890	79.110.48.149	192.168.2.23
Apr 25, 2024 14:36:49.427670002 CEST	48892	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:36:49.751920938 CEST	80	48892	79.110.48.149	192.168.2.23
Apr 25, 2024 14:36:53.303884029 CEST	48894	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:36:53.596808910 CEST	80	48894	79.110.48.149	192.168.2.23
Apr 25, 2024 14:36:53.751518011 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 25, 2024 14:37:03.148961067 CEST	48896	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:03.444053888 CEST	80	48896	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:04.997112989 CEST	48898	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:05.295742035 CEST	80	48898	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:12.850564003 CEST	48900	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:13.169856071 CEST	80	48900	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:14.228636980 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 25, 2024 14:37:18.724064112 CEST	48902	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:19.047348022 CEST	80	48902	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:23.600157022 CEST	48904	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:23.895833015 CEST	80	48904	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:32.447602034 CEST	48906	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:32.746452093 CEST	80	48906	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:34.299386024 CEST	48908	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:34.593770027 CEST	80	48908	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:40.147305012 CEST	48910	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:40.439692020 CEST	80	48910	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:42.992296934 CEST	48912	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:43.313064098 CEST	80	48912	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:46.866069078 CEST	48914	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:47.163981915 CEST	80	48914	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:57.714306116 CEST	48916	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:58.008858919 CEST	80	48916	79.110.48.149	192.168.2.23
Apr 25, 2024 14:37:59.561834097 CEST	48918	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:37:59.856386900 CEST	80	48918	79.110.48.149	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 14:35:50.029800892 CEST	47895	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:50.139934063 CEST	53	47895	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:50.140319109 CEST	39005	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:50.250314951 CEST	53	39005	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:50.250475883 CEST	46921	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:50.360691071 CEST	53	46921	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:50.360860109 CEST	40069	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:50.470968008 CEST	53	40069	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:50.471100092 CEST	59665	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:50.581119061 CEST	53	59665	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:56.876336098 CEST	43513	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:56.986542940 CEST	53	43513	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:56.986859083 CEST	48859	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:57.096868992 CEST	53	48859	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:57.097084999 CEST	44831	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:57.207196951 CEST	53	44831	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:57.207439899 CEST	55743	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:57.317477942 CEST	53	55743	8.8.8.8	192.168.2.23
Apr 25, 2024 14:35:57.317744017 CEST	47844	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:35:57.427810907 CEST	53	47844	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:01.750426054 CEST	52364	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:01.860541105 CEST	53	52364	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:01.860865116 CEST	38615	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:01.971131086 CEST	53	38615	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:01.971462965 CEST	44261	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:02.081646919 CEST	53	44261	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:02.082000971 CEST	33746	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:02.192224979 CEST	53	33746	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:02.192471981 CEST	52913	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:02.302525997 CEST	53	52913	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:07.623281956 CEST	53024	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:07.733460903 CEST	53	53024	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:07.733906031 CEST	39441	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:07.844140053 CEST	53	39441	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:07.844388962 CEST	57294	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:07.954448938 CEST	53	57294	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:07.954689026 CEST	34532	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:08.064841032 CEST	53	34532	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:08.065288067 CEST	54572	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:08.175261974 CEST	53	54572	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:13.470621109 CEST	45641	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:13.580807924 CEST	53	45641	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:13.580955029 CEST	39228	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:13.690932989 CEST	53	39228	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:13.691189051 CEST	46765	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:13.801220894 CEST	53	46765	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:13.801589012 CEST	52526	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:13.911470890 CEST	53	52526	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:13.911767006 CEST	60324	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:14.021842957 CEST	53	60324	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:23.320401907 CEST	36871	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:23.430723906 CEST	53	36871	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:23.431000948 CEST	47894	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:23.541033030 CEST	53	47894	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:23.541444063 CEST	53342	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:23.651331902 CEST	53	53342	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:23.651582003 CEST	43227	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:23.761626005 CEST	53	43227	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:23.761878014 CEST	57847	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:23.871936083 CEST	53	57847	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:29.166985989 CEST	42244	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:29.277332067 CEST	53	42244	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:29.277672052 CEST	51776	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:29.387856007 CEST	53	51776	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:29.388217926 CEST	53005	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:29.498334885 CEST	53	53005	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:29.498569012 CEST	46436	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:29.608783007 CEST	53	46436	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:29.609164953 CEST	55554	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:29.719322920 CEST	53	55554	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:39.013951063 CEST	52723	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:39.124265909 CEST	53	52723	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:39.124530077 CEST	60642	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:39.241702080 CEST	53	60642	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:39.242007971 CEST	59672	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:39.352181911 CEST	53	59672	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:39.352577925 CEST	39649	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:39.465344906 CEST	53	39649	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:39.465555906 CEST	34982	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:39.579123974 CEST	53	34982	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:48.874870062 CEST	59068	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:48.985481977 CEST	53	59068	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:48.985651970 CEST	54184	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:49.095779896 CEST	53	54184	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:49.095948935 CEST	45580	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:49.206079960 CEST	53	45580	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:49.206393003 CEST	42958	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:49.316584110 CEST	53	42958	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:49.317078114 CEST	34677	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:49.427330971 CEST	53	34677	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:52.751997948 CEST	57718	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:52.862090111 CEST	53	57718	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:52.862340927 CEST	32979	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:52.972428083 CEST	53	32979	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:52.972651005 CEST	59974	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:53.082742929 CEST	53	59974	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:53.083133936 CEST	59684	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:53.193279028 CEST	53	59684	8.8.8.8	192.168.2.23
Apr 25, 2024 14:36:53.193588972 CEST	38908	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:36:53.303713083 CEST	53	38908	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:02.595879078 CEST	59733	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:02.705939054 CEST	53	59733	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:02.706279993 CEST	37631	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:02.816416025 CEST	53	37631	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:02.816859007 CEST	34345	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:02.927129984 CEST	53	34345	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:02.927498102 CEST	33071	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:03.037945032 CEST	53	33071	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:03.038263083 CEST	55882	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:03.148700953 CEST	53	55882	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:04.444401026 CEST	55481	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:04.554420948 CEST	53	55481	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:04.554721117 CEST	51906	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:04.664988041 CEST	53	51906	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:04.665282965 CEST	40660	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:04.775449991 CEST	53	40660	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:04.775926113 CEST	34625	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:04.886169910 CEST	53	34625	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:04.886570930 CEST	41447	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:04.996771097 CEST	53	41447	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:12.295269966 CEST	42531	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:12.405419111 CEST	53	42531	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:12.405787945 CEST	40804	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:12.518126011 CEST	53	40804	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:12.518579960 CEST	47755	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:12.628695011 CEST	53	47755	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:12.629153967 CEST	35537	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:12.739725113 CEST	53	35537	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:12.740180016 CEST	48015	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:12.850209951 CEST	53	48015	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:18.169766903 CEST	35648	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:18.280375957 CEST	53	35648	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:18.280822992 CEST	40910	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:18.391762018 CEST	53	40910	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:18.392184973 CEST	35201	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:18.502337933 CEST	53	35201	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:18.502739906 CEST	58023	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:18.612987041 CEST	53	58023	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:18.613509893 CEST	53053	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:18.723736048 CEST	53	53053	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:23.047219038 CEST	35163	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:23.157778978 CEST	53	35163	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:23.157983065 CEST	41933	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:23.268198967 CEST	53	41933	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:23.268551111 CEST	46123	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:23.378741980 CEST	53	46123	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:23.379196882 CEST	43302	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:23.489449978 CEST	53	43302	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:23.489798069 CEST	43685	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:23.599912882 CEST	53	43685	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:31.895241976 CEST	46476	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:32.005235910 CEST	53	46476	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:32.005624056 CEST	33267	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:32.115766048 CEST	53	33267	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:32.116038084 CEST	35986	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:32.226067066 CEST	53	35986	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:32.226418972 CEST	41658	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:32.336692095 CEST	53	41658	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:32.337027073 CEST	43094	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:32.447339058 CEST	53	43094	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:33.746685982 CEST	35614	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:33.857031107 CEST	53	35614	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:33.857203960 CEST	35205	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:33.967458010 CEST	53	35205	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:33.967727900 CEST	56728	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:34.077831984 CEST	53	56728	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:34.078115940 CEST	37238	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:34.188481092 CEST	53	37238	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:34.188812017 CEST	57602	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:34.298969030 CEST	53	57602	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:39.593517065 CEST	53775	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:39.703664064 CEST	53	53775	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:39.704370022 CEST	49335	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:39.814502001 CEST	53	49335	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:39.814930916 CEST	33076	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:39.925401926 CEST	53	33076	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:39.925585985 CEST	52376	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:40.035562038 CEST	53	52376	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:40.036022902 CEST	54265	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:40.146887064 CEST	53	54265	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:42.439851046 CEST	59266	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:42.550148010 CEST	53	59266	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:42.550574064 CEST	45605	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:42.660603046 CEST	53	45605	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:42.660865068 CEST	33684	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:42.771040916 CEST	53	33684	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:42.771255016 CEST	39474	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:42.881530046 CEST	53	39474	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:42.881810904 CEST	33027	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:42.992031097 CEST	53	33027	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:46.313194990 CEST	46310	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:46.423449993 CEST	53	46310	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:46.423774958 CEST	46507	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:46.533792019 CEST	53	46507	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:46.534116983 CEST	48417	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:46.644293070 CEST	53	48417	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:46.644678116 CEST	52255	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:46.754909039 CEST	53	52255	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:46.755311966 CEST	37076	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:46.865783930 CEST	53	37076	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:57.162923098 CEST	47297	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:57.273216009 CEST	53	47297	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:57.273364067 CEST	53228	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:57.383452892 CEST	53	53228	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:57.383625031 CEST	44528	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:57.493685961 CEST	53	44528	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:57.493838072 CEST	53558	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:57.603848934 CEST	53	53558	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:57.603979111 CEST	35259	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:57.714163065 CEST	53	35259	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:59.009258032 CEST	53261	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:59.119596958 CEST	53	53261	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:59.119849920 CEST	59325	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:59.230546951 CEST	53	59325	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:59.230782032 CEST	46846	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:59.341023922 CEST	53	46846	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:59.341281891 CEST	41496	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:59.451292038 CEST	53	41496	8.8.8.8	192.168.2.23
Apr 25, 2024 14:37:59.451558113 CEST	35824	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:37:59.561609030 CEST	53	35824	8.8.8.8	192.168.2.23
Apr 25, 2024 14:38:00.856729031 CEST	34723	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:38:00.966756105 CEST	53	34723	8.8.8.8	192.168.2.23
Apr 25, 2024 14:38:00.967185020 CEST	60901	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:38:01.077539921 CEST	53	60901	8.8.8.8	192.168.2.23
Apr 25, 2024 14:38:01.077897072 CEST	58888	53	192.168.2.23	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 14:35:50.029800892 CEST	192.168.2.23	8.8.8.8	0x25e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:50.140319109 CEST	192.168.2.23	8.8.8.8	0x25e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:50.250475883 CEST	192.168.2.23	8.8.8.8	0x25e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:50.360860109 CEST	192.168.2.23	8.8.8.8	0x25e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:50.471100092 CEST	192.168.2.23	8.8.8.8	0x25e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:56.876336098 CEST	192.168.2.23	8.8.8.8	0x6b3b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:56.986859083 CEST	192.168.2.23	8.8.8.8	0x6b3b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:57.097084999 CEST	192.168.2.23	8.8.8.8	0x6b3b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:57.207439899 CEST	192.168.2.23	8.8.8.8	0x6b3b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:35:57.317744017 CEST	192.168.2.23	8.8.8.8	0x6b3b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:01.750426054 CEST	192.168.2.23	8.8.8.8	0xbf27	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:01.860865116 CEST	192.168.2.23	8.8.8.8	0xbf27	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:01.971462965 CEST	192.168.2.23	8.8.8.8	0xbf27	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:02.082000971 CEST	192.168.2.23	8.8.8.8	0xbf27	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:02.192471981 CEST	192.168.2.23	8.8.8.8	0xbf27	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:07.623281956 CEST	192.168.2.23	8.8.8.8	0xdf5c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:07.733906031 CEST	192.168.2.23	8.8.8.8	0xdf5c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:07.844388962 CEST	192.168.2.23	8.8.8.8	0xdf5c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:07.954689026 CEST	192.168.2.23	8.8.8.8	0xdf5c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:08.065288067 CEST	192.168.2.23	8.8.8.8	0xdf5c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:13.470621109 CEST	192.168.2.23	8.8.8.8	0x500f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:13.580955029 CEST	192.168.2.23	8.8.8.8	0x500f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:13.691189051 CEST	192.168.2.23	8.8.8.8	0x500f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:13.801589012 CEST	192.168.2.23	8.8.8.8	0x500f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:13.911767006 CEST	192.168.2.23	8.8.8.8	0x500f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:23.320401907 CEST	192.168.2.23	8.8.8.8	0x4ec1	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:23.431000948 CEST	192.168.2.23	8.8.8.8	0x4ec1	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:23.541444063 CEST	192.168.2.23	8.8.8.8	0x4ec1	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:23.651582003 CEST	192.168.2.23	8.8.8.8	0x4ec1	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:23.761878014 CEST	192.168.2.23	8.8.8.8	0x4ec1	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:29.166985989 CEST	192.168.2.23	8.8.8.8	0x63e7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:29.277672052 CEST	192.168.2.23	8.8.8.8	0x63e7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:29.388217926 CEST	192.168.2.23	8.8.8.8	0x63e7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:29.498569012 CEST	192.168.2.23	8.8.8.8	0x63e7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:29.609164953 CEST	192.168.2.23	8.8.8.8	0x63e7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:39.013951063 CEST	192.168.2.23	8.8.8.8	0x60ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:39.124530077 CEST	192.168.2.23	8.8.8.8	0x60ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:39.242007971 CEST	192.168.2.23	8.8.8.8	0x60ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:39.352577925 CEST	192.168.2.23	8.8.8.8	0x60ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:39.465555906 CEST	192.168.2.23	8.8.8.8	0x60ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:48.874870062 CEST	192.168.2.23	8.8.8.8	0xa091	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:48.985651970 CEST	192.168.2.23	8.8.8.8	0xa091	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:49.095948935 CEST	192.168.2.23	8.8.8.8	0xa091	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:49.206393003 CEST	192.168.2.23	8.8.8.8	0xa091	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:49.317078114 CEST	192.168.2.23	8.8.8.8	0xa091	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:52.751997948 CEST	192.168.2.23	8.8.8.8	0xb0f5	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:52.862340927 CEST	192.168.2.23	8.8.8.8	0xb0f5	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:52.972651005 CEST	192.168.2.23	8.8.8.8	0xb0f5	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:53.083133936 CEST	192.168.2.23	8.8.8.8	0xb0f5	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:36:53.193588972 CEST	192.168.2.23	8.8.8.8	0xb0f5	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:02.595879078 CEST	192.168.2.23	8.8.8.8	0x3bdf	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:02.706279993 CEST	192.168.2.23	8.8.8.8	0x3bdf	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:02.816859007 CEST	192.168.2.23	8.8.8.8	0x3bdf	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:02.927498102 CEST	192.168.2.23	8.8.8.8	0x3bdf	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:03.038263083 CEST	192.168.2.23	8.8.8.8	0x3bdf	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:04.444401026 CEST	192.168.2.23	8.8.8.8	0x2b31	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:04.554721117 CEST	192.168.2.23	8.8.8.8	0x2b31	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:04.665282965 CEST	192.168.2.23	8.8.8.8	0x2b31	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:04.775926113 CEST	192.168.2.23	8.8.8.8	0x2b31	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:04.886570930 CEST	192.168.2.23	8.8.8.8	0x2b31	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:12.295269966 CEST	192.168.2.23	8.8.8.8	0xfcb8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:12.405787945 CEST	192.168.2.23	8.8.8.8	0xfcb8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:12.518579960 CEST	192.168.2.23	8.8.8.8	0xfcb8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:12.629153967 CEST	192.168.2.23	8.8.8.8	0xfcb8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:12.740180016 CEST	192.168.2.23	8.8.8.8	0xfcb8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:18.169766903 CEST	192.168.2.23	8.8.8.8	0xeae7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:18.280822992 CEST	192.168.2.23	8.8.8.8	0xeae7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:18.392184973 CEST	192.168.2.23	8.8.8.8	0xeae7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:18.502739906 CEST	192.168.2.23	8.8.8.8	0xeae7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:18.613509893 CEST	192.168.2.23	8.8.8.8	0xeae7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:23.047219038 CEST	192.168.2.23	8.8.8.8	0xde52	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:23.157983065 CEST	192.168.2.23	8.8.8.8	0xde52	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:23.268551111 CEST	192.168.2.23	8.8.8.8	0xde52	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:23.379196882 CEST	192.168.2.23	8.8.8.8	0xde52	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:23.489798069 CEST	192.168.2.23	8.8.8.8	0xde52	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:31.895241976 CEST	192.168.2.23	8.8.8.8	0x7665	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:32.005624056 CEST	192.168.2.23	8.8.8.8	0x7665	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:32.116038084 CEST	192.168.2.23	8.8.8.8	0x7665	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:32.226418972 CEST	192.168.2.23	8.8.8.8	0x7665	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:32.337027073 CEST	192.168.2.23	8.8.8.8	0x7665	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:33.746685982 CEST	192.168.2.23	8.8.8.8	0x887	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:33.857203960 CEST	192.168.2.23	8.8.8.8	0x887	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:33.967727900 CEST	192.168.2.23	8.8.8.8	0x887	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:34.078115940 CEST	192.168.2.23	8.8.8.8	0x887	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:34.188812017 CEST	192.168.2.23	8.8.8.8	0x887	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:39.593517065 CEST	192.168.2.23	8.8.8.8	0xdaf8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:39.704370022 CEST	192.168.2.23	8.8.8.8	0xdaf8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:39.814930916 CEST	192.168.2.23	8.8.8.8	0xdaf8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:39.925585985 CEST	192.168.2.23	8.8.8.8	0xdaf8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:40.036022902 CEST	192.168.2.23	8.8.8.8	0xdaf8	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:42.439851046 CEST	192.168.2.23	8.8.8.8	0xb2ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:42.550574064 CEST	192.168.2.23	8.8.8.8	0xb2ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:42.660865068 CEST	192.168.2.23	8.8.8.8	0xb2ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:42.771255016 CEST	192.168.2.23	8.8.8.8	0xb2ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:42.881810904 CEST	192.168.2.23	8.8.8.8	0xb2ed	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:46.313194990 CEST	192.168.2.23	8.8.8.8	0xfb7f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:46.423774958 CEST	192.168.2.23	8.8.8.8	0xfb7f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:46.534116983 CEST	192.168.2.23	8.8.8.8	0xfb7f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:46.644678116 CEST	192.168.2.23	8.8.8.8	0xfb7f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:46.755311966 CEST	192.168.2.23	8.8.8.8	0xfb7f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:57.162923098 CEST	192.168.2.23	8.8.8.8	0x1271	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:57.273364067 CEST	192.168.2.23	8.8.8.8	0x1271	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:57.383625031 CEST	192.168.2.23	8.8.8.8	0x1271	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:57.493838072 CEST	192.168.2.23	8.8.8.8	0x1271	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:57.603979111 CEST	192.168.2.23	8.8.8.8	0x1271	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:59.009258032 CEST	192.168.2.23	8.8.8.8	0xab75	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:59.119849920 CEST	192.168.2.23	8.8.8.8	0xab75	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:59.230782032 CEST	192.168.2.23	8.8.8.8	0xab75	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:59.341281891 CEST	192.168.2.23	8.8.8.8	0xab75	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:37:59.451558113 CEST	192.168.2.23	8.8.8.8	0xab75	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:38:00.856729031 CEST	192.168.2.23	8.8.8.8	0xfa3b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:38:00.967185020 CEST	192.168.2.23	8.8.8.8	0xfa3b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:38:01.077897072 CEST	192.168.2.23	8.8.8.8	0xfa3b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6217, Parent PID: 6140

General

Start time (UTC):	12:35:49
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Arguments:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6219, Parent PID: 6217

General

Start time (UTC):	12:35:49
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6220, Parent PID: 6217

General

Start time (UTC):	12:35:49
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6222, Parent PID: 6217

General

Start time (UTC):	12:35:49
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6225, Parent PID: 6222

General

Start time (UTC):	12:35:49
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6226, Parent PID: 6222

General

Start time (UTC):	12:35:49
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

System Behavior

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6217, Parent PID: 6140

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6219, Parent PID: 6217

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6220, Parent PID: 6217

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6222, Parent PID: 6217

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6225, Parent PID: 6222

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf PID: 6226, Parent PID: 6222

General

Chronological Activities

Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf