Edit tour

Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf

Overview

General Information

Sample name:	SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Analysis ID:	1431618
MD5:	4db7683981c68458797406a57473edc2
SHA1:	5dccc73091c7dc31e6d48b1a05e409d329bc56a1
SHA256:	cfb725265679f3f74f05d45cb53baf1b685ed3eab92a61be23eadfd14aea3245
Tags:	elf
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample is packed with UPX

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431618
Start date and time:	2024-04-25 14:39:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/0@125/0

Runtime Messages

Command:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
PID:	6251
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6251, Parent: 6172, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf

SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf New Fork (PID: 6253, Parent: 6251)

SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf New Fork (PID: 6255, Parent: 6251)

SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf New Fork (PID: 6257, Parent: 6251)

SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf New Fork (PID: 6259, Parent: 6257)

SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf New Fork (PID: 6260, Parent: 6257)

dash New Fork (PID: 6310, Parent: 4331)

rm (PID: 6310, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.J5CWaKPzax /tmp/tmp.EXVfvdsdqT /tmp/tmp.9jIARiRVwZ

dash New Fork (PID: 6311, Parent: 4331)

rm (PID: 6311, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.J5CWaKPzax /tmp/tmp.EXVfvdsdqT /tmp/tmp.9jIARiRVwZ

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x10664:$x1: POST /cdn-cgi/ 0x109e8:$s1: LCOGQGPTGP
6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x10664:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x10664:$x1: POST /cdn-cgi/ 0x109e8:$s1: LCOGQGPTGP
6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x10664:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x10664:$x1: POST /cdn-cgi/ 0x109e8:$s1: LCOGQGPTGP
6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x10664:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x10664:$x1: POST /cdn-cgi/ 0x109e8:$s1: LCOGQGPTGP
6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x10664:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6251	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6255	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6259	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6260	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Click to see the 15 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf	ReversingLabs: Detection: 67%
Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf	Virustotal: Detection: 59%			Perma Link

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6251)	Socket: 127.0.0.1::29103	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::81	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::8443	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::9009	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::13883	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::19481	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::4444	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	Socket: 0.0.0.0::9789	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::23	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::81	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::8443	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::9009	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::1337	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::13883	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::19481	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::4444	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	Socket: 0.0.0.0::9789	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219

Source: global traffic

DNS traffic detected: DNS query: www.sushiking.world

Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 39294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39294
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Source: LOAD without section mappings

Program segment: 0x8000

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	SIGKILL sent: pid: 6259, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6259)	SIGKILL sent: pid: 936, result: successful	Jump to behavior

Source: 6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/0@125/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6196/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6234/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6234/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/4331/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6235/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6235/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2033/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2033/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1582/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2275/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2275/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/3088/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1612/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1612/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1579/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1699/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1335/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1698/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2028/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2028/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1334/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1576/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1576/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2302/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/3236/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/3236/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2025/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2025/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2146/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2146/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/910/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/4444/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/4445/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/912/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/4446/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/759/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/517/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/4447/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2307/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/918/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1594/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1594/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2285/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2285/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6083/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2281/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2281/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1349/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1349/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1623/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1623/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/761/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1622/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1622/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/884/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1983/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1983/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2038/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2038/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1586/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1586/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1465/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1465/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1344/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1344/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1860/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1463/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1463/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2156/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/2156/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/801/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1629/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1629/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1627/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1627/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1900/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/1900/exe	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6253/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6257/fd	Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6253)	File opened: /proc/6257/exe	Jump to behavior

Source: /usr/bin/dash (PID: 6310)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.J5CWaKPzax /tmp/tmp.EXVfvdsdqT /tmp/tmp.9jIARiRVwZ			Jump to behavior
Source: /usr/bin/dash (PID: 6311)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.J5CWaKPzax /tmp/tmp.EXVfvdsdqT /tmp/tmp.9jIARiRVwZ			Jump to behavior

Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf

Submission file: segment LOAD with 7.9426 entropy (max. 8.0)

Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf (PID: 6251)

Queries kernel information via 'uname':

Jump to behavior

Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6251.1.0000562c55a64000.0000562c55b92000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6255.1.0000562c55a64000.0000562c55b92000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6259.1.0000562c55a64000.0000562c55b92000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6260.1.0000562c55a64000.0000562c55b92000.rw-.sdmp	Binary or memory string: U,V!/etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6251.1.00007ffce7f7f000.00007ffce7fa0000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6255.1.00007ffce7f7f000.00007ffce7fa0000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6259.1.00007ffce7f7f000.00007ffce7fa0000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6260.1.00007ffce7f7f000.00007ffce7fa0000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6251.1.0000562c55a64000.0000562c55b92000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6255.1.0000562c55a64000.0000562c55b92000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6259.1.0000562c55a64000.0000562c55b92000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6260.1.0000562c55a64000.0000562c55b92000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6251.1.00007ffce7f7f000.00007ffce7fa0000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6255.1.00007ffce7f7f000.00007ffce7fa0000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6259.1.00007ffce7f7f000.00007ffce7fa0000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf, 6260.1.00007ffce7f7f000.00007ffce7fa0000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6251, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6255, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6260, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6251.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6255.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.00007f7c04017000.00007f7c04029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6251, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6255, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6260, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf	68%	ReversingLabs	Linux.Trojan.Mirai
SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf	59%	Virustotal		Browse
SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf	100%	Avira	ANDROID/Mirai.ojlez

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
www.sushiking.world	8%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.sushiking.world	unknown	unknown	false	8%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
79.110.48.149	unknown	Germany	57287	OTAVANET-ASCZ	false
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
79.110.48.149	SecuriteInfo.com.Linux.Siggen.9999.23595.2512.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Get hash	malicious	Mirai	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
34.249.145.219	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.9999.198.19634.elf	Get hash	malicious	Mirai	Browse
	i6MGE0UeYG.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	Ptge3TuHFs.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	520VcHQQj7.elf	Get hash	malicious	Unknown	Browse
	jssKanl7bD.elf	Get hash	malicious	Mirai, Okiru	Browse
	quv5jvj4v0.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.DownLoader.533.23350.4113.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Get hash	malicious	Mirai	Browse
	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Get hash	malicious	Mirai	Browse
	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Get hash	malicious	Mirai	Browse
	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OTAVANET-ASCZ	SecuriteInfo.com.Linux.Siggen.9999.23595.2512.elf	Get hash	malicious	Mirai	Browse	79.110.48.149
	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Get hash	malicious	Mirai	Browse	79.110.48.149
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse	79.110.48.149
	skid.arm7.elf	Get hash	malicious	Mirai	Browse	79.110.49.174
	HROFrIvvVk.elf	Get hash	malicious	Mirai	Browse	79.110.49.195
	https://79.110.48.52/nicko.vbs	Get hash	malicious	Unknown	Browse	79.110.48.52
	PO_1100620230526.pdf(39kb).exe	Get hash	malicious	Remcos, RedLine, XpertRAT	Browse	79.110.48.151
	https://prc-homes.uk/wp-images/26738903/content/Security_on_your_card_account.html	Get hash	malicious	HTMLPhisher	Browse	79.110.48.18
	https://towntalkeg.com/wp-images/108373893032/Security_on_your_card_account.html	Get hash	malicious	HTMLPhisher	Browse	79.110.48.18
	0xc2s.x86.elf	Get hash	malicious	Unknown	Browse	79.110.48.91
CANONICAL-ASGB	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	ldCdti5sRA.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	vlxx.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gCqnbN34QY.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	ldCdti5sRA.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	vlxx.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gCqnbN34QY.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	SecuriteInfo.com.Linux.Siggen.9999.12445.30549.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	g1wkNJ0Ncz.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	vlxx.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	XM3JcqhdgB.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	VUjiythPAQ.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	TGIQpNxMb0.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	qnW5l5Iegw	Get hash	malicious	Xmrig	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
AMAZON-02US	https://us-west-2.protection.sophos.com/?d=google.co.za&u=aHR0cHM6Ly9nb29nbGUuY28uemEvYW1wL3Mvd3d3Lmdvb2dsZS5jb20lMkZ1cmwlM0ZzYSUzREQlMjZxJTNEaHR0cHMlM0ElMkYlMkZlbWFpbGluZy5taXJhYmF1ZC1hbS5jb20lMkZ0bC5waHAlMjUzRnAlMjUzRDVwMCUyRnQyJTJGcnMlMkYxZTYlMkZyeSUyRnJzJTJGJTJGaHR0cHMlM0ElMkYlMkZmaXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20lMjUyNTJGdjAlMjUyNTJGYiUyNTI1MkZteS1hd2Vzb21lLXByb2plY3QtaWQtMzU4ODkuYXBwc3BvdC5jb20lMjUyNTJGbyUyNTI1MkZzb3NmcmUuaHRtbCUyNTI1M0ZhbHQlMjUyNTNEbWVkaWElMjUyNTI2dG9rZW4lMjUyNTNENzBmZDlmZWMtZWM4Mi00YjQ1LTkwMmQtMmFhM2Q3NTgwYzNiJTI2dXN0JTNEMTcxNDEyMzE0MDAwMDAwMCUyNnVzZyUzREFPdlZhdzJ5SzhVRkpvWmVuUkRWdUJMLXNmY20lMjZobCUzRGVuJTI2c291cmNlJTNEZ21haWwjYTJ4MVkyRnpRR04wYlhOdmFHbHZMbU52YlE9PQ==&p=m&i=NjFjOWM1NjJmM2YxNmYxMDA2OTJjYWZj&t=THJkcUUxZW9PQzAvNFZ0aWxoalJFOStYQ0dWVXgvYjJ6aS82eTZoUDhJcz0=&h=276fada438bf49c2be0403c28d11d4f4&s=AVNPUEhUT0NFTkNSWVBUSVZ-gOCnEu8L0hbaTxie_PLqb02g0uIV3TDGiGYGiGwGbDIPB11limBksw9z8tTzOiKEbBHGOtpfybJD4FbJxpna6swSu6rycA6MG9n6CTc4aMLN4lGfbapv3cHB_2jaSF4	Get hash	malicious	HTMLPhisher	Browse	18.244.202.11
	vlxx.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	34.243.160.129
	vlxx.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	52.52.107.112
	bJC4H147mB.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	https://itniy4gbb.cc.rs6.net/tn.jsp?f=001DpCT81a7BIE926OduG6KmKkwKebSAbUZq28C52DoY-FfQJyM_2Gq3l18V1j7KWwJQTfGlQ_HSq0vC8xqJqFST9z0CwmpWgUieBjKckdJcSODJ_3vu5MzvaSoOGbGY9SjpWQtg9-aAXm1e6VV91z84Q2_wlyDMR98&c=i37ZFF5Dy2QSFqOfb2TVpr5vkMFqaR6DdoQbIhzcRV7G2oFwX8NEvA==&ch=2ErEiCYnoykaXa1uoD0AgTD1vOpSqc6zh3ef32Gb4XR_ut8_qvmzHA==&c=&ch=&__=/mrlZp0zmTKgGvsPpx0JUyCMjGZr4J6/Z2dvbnphbGV6c2FsYXNAc2FuaXRhcy5lcw==	Get hash	malicious	HTMLPhisher	Browse	108.156.152.88
	https://docs.google.com/presentation/d/e/2PACX-1vRA7cYu2pjKyfaCRROgTu4J2OpPGWE_raEqtGhCVl21QDvJzZsVPQtIU_FG6khcCjqxbwzOTOoBBBx6/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse	3.5.218.63
	http://survey-smiles.com	Get hash	malicious	Unknown	Browse	52.209.139.15
	https://app.milanote.com/1RZbnl1zfBXuaf?p=r2B66sphbV4	Get hash	malicious	Unknown	Browse	3.163.101.92
	http://decktop.us/gORiyf	Get hash	malicious	HTMLPhisher	Browse	76.223.31.44

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.9389079282914405
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
File size:	26'652 bytes
MD5:	4db7683981c68458797406a57473edc2
SHA1:	5dccc73091c7dc31e6d48b1a05e409d329bc56a1
SHA256:	cfb725265679f3f74f05d45cb53baf1b685ed3eab92a61be23eadfd14aea3245
SHA512:	5f8bf56e74c46241edff3d13c7c9679b569f2b0d2d64268af5d900b66141bf7e7246a42288839ab1dfd475dc911a8408a03ded16239b43eb95ac908f5d70f7e6
SSDEEP:	768:Aaue2jtp+Fi2ZH+WwSyPaeYmZUOAVqTPs3UozW:ke2pp+FioHQZEqTCzW
TLSH:	78C2E1242A51AB31C5755470DD2E8ECB37AC0FF8A0EF35B729B50B442ACA54E64F85CE
File Content Preview:	.ELF...a..........(.........4...........4. ...(...................../g../g..........................................Q.td............................s.y.UPX!....................S..........?.E.h;.}...^..........e.>Z.e..}~y...6..)R.M......[.8...Kx.%..}.I..B{

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0xd580
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x672f	0x672f	7.9426	0x5	R E	0x8000
LOAD	0x1a9c	0x21a9c	0x21a9c	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 14:40:08.113743067 CEST	48924	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:40:08.436516047 CEST	80	48924	79.110.48.149	192.168.2.23
Apr 25, 2024 14:40:08.952729940 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 25, 2024 14:40:13.560090065 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 25, 2024 14:40:14.583937883 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 25, 2024 14:40:16.989327908 CEST	48926	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:40:17.280148029 CEST	80	48926	79.110.48.149	192.168.2.23
Apr 25, 2024 14:40:18.248761892 CEST	39294	443	192.168.2.23	34.249.145.219
Apr 25, 2024 14:40:18.248815060 CEST	443	39294	34.249.145.219	192.168.2.23
Apr 25, 2024 14:40:18.248918056 CEST	39294	443	192.168.2.23	34.249.145.219
Apr 25, 2024 14:40:18.249176979 CEST	39294	443	192.168.2.23	34.249.145.219
Apr 25, 2024 14:40:18.249207973 CEST	443	39294	34.249.145.219	192.168.2.23
Apr 25, 2024 14:40:41.460489988 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 25, 2024 14:40:43.507970095 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 25, 2024 14:40:47.298655987 CEST	48930	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:40:48.307307005 CEST	48930	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:40:48.602952957 CEST	80	48930	79.110.48.149	192.168.2.23
Apr 25, 2024 14:40:51.157326937 CEST	48932	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:40:51.476488113 CEST	80	48932	79.110.48.149	192.168.2.23
Apr 25, 2024 14:40:58.029484987 CEST	48934	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:40:58.328188896 CEST	80	48934	79.110.48.149	192.168.2.23
Apr 25, 2024 14:41:01.880964994 CEST	48936	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:41:02.203814983 CEST	80	48936	79.110.48.149	192.168.2.23
Apr 25, 2024 14:41:06.757700920 CEST	48938	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:41:07.057032108 CEST	80	48938	79.110.48.149	192.168.2.23
Apr 25, 2024 14:41:10.128307104 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 25, 2024 14:41:13.608283043 CEST	48940	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:41:13.927365065 CEST	80	48940	79.110.48.149	192.168.2.23
Apr 25, 2024 14:41:18.240997076 CEST	39294	443	192.168.2.23	34.249.145.219
Apr 25, 2024 14:41:18.284123898 CEST	443	39294	34.249.145.219	192.168.2.23
Apr 25, 2024 14:41:48.946667910 CEST	48942	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:41:49.962692976 CEST	48942	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:41:51.978420973 CEST	48942	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:41:52.301143885 CEST	80	48942	79.110.48.149	192.168.2.23
Apr 25, 2024 14:41:53.853307962 CEST	48944	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:41:54.147933960 CEST	80	48944	79.110.48.149	192.168.2.23
Apr 25, 2024 14:41:58.699629068 CEST	48946	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:41:59.020251989 CEST	80	48946	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:02.572540998 CEST	48948	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:02.866879940 CEST	80	48948	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:12.421847105 CEST	48950	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:12.742017031 CEST	80	48950	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:16.296785116 CEST	48952	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:16.591804028 CEST	80	48952	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:18.143589973 CEST	48954	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:18.442775965 CEST	80	48954	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:25.995372057 CEST	48956	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:26.289896011 CEST	80	48956	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:27.884440899 CEST	30102	39294	192.168.2.1	192.168.2.23
Apr 25, 2024 14:42:31.841689110 CEST	48958	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:32.139674902 CEST	80	48958	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:35.693563938 CEST	48960	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:36.012768984 CEST	80	48960	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:44.565414906 CEST	48962	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:44.857743025 CEST	80	48962	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:50.410398960 CEST	48964	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:50.733186960 CEST	80	48964	79.110.48.149	192.168.2.23
Apr 25, 2024 14:42:58.284360886 CEST	48966	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:42:58.604281902 CEST	80	48966	79.110.48.149	192.168.2.23
Apr 25, 2024 14:43:09.158176899 CEST	48968	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:43:09.477463961 CEST	80	48968	79.110.48.149	192.168.2.23
Apr 25, 2024 14:43:18.029758930 CEST	48970	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:43:18.322124958 CEST	80	48970	79.110.48.149	192.168.2.23
Apr 25, 2024 14:43:27.875205994 CEST	48972	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:43:28.197961092 CEST	80	48972	79.110.48.149	192.168.2.23
Apr 25, 2024 14:43:35.752018929 CEST	48974	80	192.168.2.23	79.110.48.149
Apr 25, 2024 14:43:36.046453953 CEST	80	48974	79.110.48.149	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 14:40:07.561259031 CEST	59382	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:07.671607971 CEST	53	59382	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:07.671993971 CEST	47248	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:07.782298088 CEST	53	47248	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:07.782423019 CEST	52172	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:07.892498970 CEST	53	52172	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:07.892671108 CEST	41296	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:08.002882004 CEST	53	41296	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:08.003006935 CEST	49373	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:08.113332033 CEST	53	49373	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:16.436328888 CEST	43823	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:16.546688080 CEST	53	43823	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:16.546979904 CEST	43205	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:16.657238007 CEST	53	43205	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:16.657505989 CEST	57931	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:16.768376112 CEST	53	57931	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:16.768546104 CEST	56326	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:16.878762960 CEST	53	56326	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:16.879035950 CEST	45437	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:16.989120960 CEST	53	45437	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:22.279937983 CEST	56958	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:27.284647942 CEST	53154	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:32.289172888 CEST	33951	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:37.293062925 CEST	51699	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:42.297494888 CEST	40315	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:50.603571892 CEST	55003	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:50.713721037 CEST	53	55003	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:50.714104891 CEST	37800	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:50.824773073 CEST	53	37800	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:50.824995995 CEST	39868	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:50.935035944 CEST	53	39868	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:50.935437918 CEST	33298	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:51.046464920 CEST	53	33298	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:51.046788931 CEST	42462	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:51.156920910 CEST	53	42462	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:57.476568937 CEST	36915	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:57.586621046 CEST	53	36915	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:57.586791039 CEST	36692	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:57.696903944 CEST	53	36692	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:57.697148085 CEST	48861	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:57.808834076 CEST	53	48861	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:57.808967113 CEST	44609	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:57.919137955 CEST	53	44609	8.8.8.8	192.168.2.23
Apr 25, 2024 14:40:57.919250011 CEST	45194	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:40:58.029397011 CEST	53	45194	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:01.328332901 CEST	40942	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:01.438394070 CEST	53	40942	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:01.438673019 CEST	59953	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:01.548835993 CEST	53	59953	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:01.549149036 CEST	48414	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:01.659481049 CEST	53	48414	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:01.659746885 CEST	45533	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:01.770061970 CEST	53	45533	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:01.770462036 CEST	53565	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:01.880614042 CEST	53	53565	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:06.204205990 CEST	53282	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:06.314966917 CEST	53	53282	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:06.315361023 CEST	56169	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:06.425687075 CEST	53	56169	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:06.426103115 CEST	44278	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:06.536216021 CEST	53	44278	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:06.536544085 CEST	43584	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:06.646641970 CEST	53	43584	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:06.646995068 CEST	37717	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:06.757262945 CEST	53	37717	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:13.056627035 CEST	37511	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:13.166735888 CEST	53	37511	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:13.166959047 CEST	47463	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:13.277139902 CEST	53	47463	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:13.277348995 CEST	53921	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:13.387511015 CEST	53	53921	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:13.387793064 CEST	50846	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:13.497778893 CEST	53	50846	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:13.498065948 CEST	43265	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:13.608064890 CEST	53	43265	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:23.934552908 CEST	34960	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:28.933044910 CEST	56486	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:33.933176041 CEST	53441	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:38.937551975 CEST	56851	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:43.942002058 CEST	60911	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:50.182017088 CEST	53	56851	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:53.301814079 CEST	40944	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:53.412024021 CEST	53	40944	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:53.412323952 CEST	43206	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:53.522459030 CEST	53	43206	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:53.522731066 CEST	43247	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:53.632661104 CEST	53	43247	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:53.632818937 CEST	46863	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:53.742932081 CEST	53	46863	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:53.743092060 CEST	57568	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:53.853065968 CEST	53	57568	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:58.147743940 CEST	33050	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:58.258069992 CEST	53	33050	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:58.258224010 CEST	45334	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:58.368407011 CEST	53	45334	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:58.368657112 CEST	45093	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:58.479062080 CEST	53	45093	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:58.479176998 CEST	42264	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:58.589138985 CEST	53	42264	8.8.8.8	192.168.2.23
Apr 25, 2024 14:41:58.589299917 CEST	53015	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:41:58.699491024 CEST	53	53015	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:02.020212889 CEST	41628	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:02.130573034 CEST	53	41628	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:02.130740881 CEST	60561	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:02.241035938 CEST	53	60561	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:02.241164923 CEST	47724	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:02.351187944 CEST	53	47724	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:02.351294994 CEST	42558	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:02.461388111 CEST	53	42558	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:02.461850882 CEST	47401	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:02.572213888 CEST	53	47401	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:11.866027117 CEST	49440	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:11.978164911 CEST	53	49440	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:11.978327990 CEST	40870	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:12.090689898 CEST	53	40870	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:12.090881109 CEST	59380	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:12.200954914 CEST	53	59380	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:12.201220036 CEST	58675	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:12.311253071 CEST	53	58675	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:12.311405897 CEST	46813	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:12.421546936 CEST	53	46813	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:15.742043018 CEST	55699	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:15.852236986 CEST	53	55699	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:15.852413893 CEST	36111	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:15.962650061 CEST	53	36111	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:15.962811947 CEST	54646	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:16.072999954 CEST	53	54646	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:16.073148966 CEST	51878	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:16.183120966 CEST	53	51878	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:16.183448076 CEST	49791	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:16.296529055 CEST	53	49791	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:17.592125893 CEST	55104	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:17.702182055 CEST	53	55104	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:17.702316999 CEST	48945	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:17.812402010 CEST	53	48945	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:17.812614918 CEST	46236	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:17.922672987 CEST	53	46236	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:17.922820091 CEST	49239	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:18.033011913 CEST	53	49239	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:18.033188105 CEST	55350	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:18.143389940 CEST	53	55350	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:25.442331076 CEST	54807	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:25.552623987 CEST	53	54807	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:25.553100109 CEST	51071	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:25.663248062 CEST	53	51071	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:25.663655043 CEST	43570	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:25.773850918 CEST	53	43570	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:25.774182081 CEST	44880	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:25.884248972 CEST	53	44880	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:25.884788990 CEST	55725	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:25.994925976 CEST	53	55725	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:31.289905071 CEST	54082	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:31.400162935 CEST	53	54082	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:31.400471926 CEST	50553	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:31.510391951 CEST	53	50553	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:31.510576963 CEST	49929	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:31.620702982 CEST	53	49929	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:31.620857000 CEST	59918	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:31.731089115 CEST	53	59918	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:31.731245041 CEST	46534	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:31.841420889 CEST	53	46534	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:35.139875889 CEST	45756	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:35.249830961 CEST	53	45756	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:35.250417948 CEST	55520	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:35.360599995 CEST	53	55520	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:35.361006975 CEST	50266	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:35.471096039 CEST	53	50266	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:35.471322060 CEST	49683	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:35.581975937 CEST	53	49683	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:35.582199097 CEST	57053	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:35.693192959 CEST	53	57053	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:44.012273073 CEST	58008	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:44.122466087 CEST	53	58008	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:44.122771025 CEST	52483	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:44.232994080 CEST	53	52483	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:44.233294964 CEST	58279	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:44.343329906 CEST	53	58279	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:44.343575954 CEST	46989	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:44.453754902 CEST	53	46989	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:44.454015970 CEST	59250	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:44.565205097 CEST	53	59250	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:49.857693911 CEST	38611	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:49.967822075 CEST	53	38611	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:49.968147039 CEST	41628	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:50.078286886 CEST	53	41628	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:50.078813076 CEST	52126	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:50.188848972 CEST	53	52126	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:50.189078093 CEST	51348	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:50.299186945 CEST	53	51348	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:50.299597979 CEST	54909	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:50.410079956 CEST	53	54909	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:57.732839108 CEST	39698	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:57.842860937 CEST	53	39698	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:57.843067884 CEST	51128	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:57.953200102 CEST	53	51128	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:57.953428984 CEST	36566	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:58.063457012 CEST	53	36566	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:58.063730955 CEST	57678	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:58.173702955 CEST	53	57678	8.8.8.8	192.168.2.23
Apr 25, 2024 14:42:58.173876047 CEST	59952	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:42:58.284090042 CEST	53	59952	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:08.603586912 CEST	45172	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:08.715282917 CEST	53	45172	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:08.715630054 CEST	47463	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:08.825793028 CEST	53	47463	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:08.826188087 CEST	34082	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:08.936424971 CEST	53	34082	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:08.936880112 CEST	53860	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:09.047096014 CEST	53	53860	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:09.047527075 CEST	49114	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:09.157818079 CEST	53	49114	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:17.476852894 CEST	34513	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:17.586781979 CEST	53	34513	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:17.587143898 CEST	54149	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:17.697321892 CEST	53	54149	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:17.697829008 CEST	51855	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:17.807945013 CEST	53	51855	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:17.808315039 CEST	52287	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:17.918411970 CEST	53	52287	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:17.918962955 CEST	53069	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:18.029055119 CEST	53	53069	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:27.321808100 CEST	38766	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:27.432040930 CEST	53	38766	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:27.432737112 CEST	32947	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:27.542809010 CEST	53	32947	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:27.543425083 CEST	48119	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:27.653589964 CEST	53	48119	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:27.654161930 CEST	41993	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:27.764249086 CEST	53	41993	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:27.764653921 CEST	33826	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:27.874694109 CEST	53	33826	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:35.197743893 CEST	53620	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:35.307998896 CEST	53	53620	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:35.308542967 CEST	35258	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:35.418844938 CEST	53	35258	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:35.419102907 CEST	56284	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:35.529413939 CEST	53	56284	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:35.529823065 CEST	38787	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:35.641057968 CEST	53	38787	8.8.8.8	192.168.2.23
Apr 25, 2024 14:43:35.641366959 CEST	48129	53	192.168.2.23	8.8.8.8
Apr 25, 2024 14:43:35.751553059 CEST	53	48129	8.8.8.8	192.168.2.23

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 25, 2024 14:41:50.182619095 CEST	192.168.2.23	8.8.8.8	cff1	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 14:40:07.561259031 CEST	192.168.2.23	8.8.8.8	0x7596	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:07.671993971 CEST	192.168.2.23	8.8.8.8	0x7596	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:07.782423019 CEST	192.168.2.23	8.8.8.8	0x7596	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:07.892671108 CEST	192.168.2.23	8.8.8.8	0x7596	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:08.003006935 CEST	192.168.2.23	8.8.8.8	0x7596	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:16.436328888 CEST	192.168.2.23	8.8.8.8	0xc71c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:16.546979904 CEST	192.168.2.23	8.8.8.8	0xc71c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:16.657505989 CEST	192.168.2.23	8.8.8.8	0xc71c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:16.768546104 CEST	192.168.2.23	8.8.8.8	0xc71c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:16.879035950 CEST	192.168.2.23	8.8.8.8	0xc71c	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:22.279937983 CEST	192.168.2.23	8.8.8.8	0x7b42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:27.284647942 CEST	192.168.2.23	8.8.8.8	0x7b42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:32.289172888 CEST	192.168.2.23	8.8.8.8	0x7b42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:37.293062925 CEST	192.168.2.23	8.8.8.8	0x7b42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:42.297494888 CEST	192.168.2.23	8.8.8.8	0x7b42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:50.603571892 CEST	192.168.2.23	8.8.8.8	0xff30	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:50.714104891 CEST	192.168.2.23	8.8.8.8	0xff30	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:50.824995995 CEST	192.168.2.23	8.8.8.8	0xff30	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:50.935437918 CEST	192.168.2.23	8.8.8.8	0xff30	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:51.046788931 CEST	192.168.2.23	8.8.8.8	0xff30	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:57.476568937 CEST	192.168.2.23	8.8.8.8	0xec82	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:57.586791039 CEST	192.168.2.23	8.8.8.8	0xec82	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:57.697148085 CEST	192.168.2.23	8.8.8.8	0xec82	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:57.808967113 CEST	192.168.2.23	8.8.8.8	0xec82	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:40:57.919250011 CEST	192.168.2.23	8.8.8.8	0xec82	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:01.328332901 CEST	192.168.2.23	8.8.8.8	0x1b7b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:01.438673019 CEST	192.168.2.23	8.8.8.8	0x1b7b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:01.549149036 CEST	192.168.2.23	8.8.8.8	0x1b7b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:01.659746885 CEST	192.168.2.23	8.8.8.8	0x1b7b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:01.770462036 CEST	192.168.2.23	8.8.8.8	0x1b7b	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:06.204205990 CEST	192.168.2.23	8.8.8.8	0x8430	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:06.315361023 CEST	192.168.2.23	8.8.8.8	0x8430	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:06.426103115 CEST	192.168.2.23	8.8.8.8	0x8430	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:06.536544085 CEST	192.168.2.23	8.8.8.8	0x8430	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:06.646995068 CEST	192.168.2.23	8.8.8.8	0x8430	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:13.056627035 CEST	192.168.2.23	8.8.8.8	0x6fd6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:13.166959047 CEST	192.168.2.23	8.8.8.8	0x6fd6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:13.277348995 CEST	192.168.2.23	8.8.8.8	0x6fd6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:13.387793064 CEST	192.168.2.23	8.8.8.8	0x6fd6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:13.498065948 CEST	192.168.2.23	8.8.8.8	0x6fd6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:23.934552908 CEST	192.168.2.23	8.8.8.8	0x7336	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:28.933044910 CEST	192.168.2.23	8.8.8.8	0x7336	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:33.933176041 CEST	192.168.2.23	8.8.8.8	0x7336	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:38.937551975 CEST	192.168.2.23	8.8.8.8	0x7336	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:43.942002058 CEST	192.168.2.23	8.8.8.8	0x7336	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:53.301814079 CEST	192.168.2.23	8.8.8.8	0xb663	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:53.412323952 CEST	192.168.2.23	8.8.8.8	0xb663	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:53.522731066 CEST	192.168.2.23	8.8.8.8	0xb663	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:53.632818937 CEST	192.168.2.23	8.8.8.8	0xb663	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:53.743092060 CEST	192.168.2.23	8.8.8.8	0xb663	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:58.147743940 CEST	192.168.2.23	8.8.8.8	0xafd7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:58.258224010 CEST	192.168.2.23	8.8.8.8	0xafd7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:58.368657112 CEST	192.168.2.23	8.8.8.8	0xafd7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:58.479176998 CEST	192.168.2.23	8.8.8.8	0xafd7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:41:58.589299917 CEST	192.168.2.23	8.8.8.8	0xafd7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:02.020212889 CEST	192.168.2.23	8.8.8.8	0x5ec6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:02.130740881 CEST	192.168.2.23	8.8.8.8	0x5ec6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:02.241164923 CEST	192.168.2.23	8.8.8.8	0x5ec6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:02.351294994 CEST	192.168.2.23	8.8.8.8	0x5ec6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:02.461850882 CEST	192.168.2.23	8.8.8.8	0x5ec6	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:11.866027117 CEST	192.168.2.23	8.8.8.8	0xcee7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:11.978327990 CEST	192.168.2.23	8.8.8.8	0xcee7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:12.090881109 CEST	192.168.2.23	8.8.8.8	0xcee7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:12.201220036 CEST	192.168.2.23	8.8.8.8	0xcee7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:12.311405897 CEST	192.168.2.23	8.8.8.8	0xcee7	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:15.742043018 CEST	192.168.2.23	8.8.8.8	0xb706	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:15.852413893 CEST	192.168.2.23	8.8.8.8	0xb706	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:15.962811947 CEST	192.168.2.23	8.8.8.8	0xb706	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:16.073148966 CEST	192.168.2.23	8.8.8.8	0xb706	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:16.183448076 CEST	192.168.2.23	8.8.8.8	0xb706	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:17.592125893 CEST	192.168.2.23	8.8.8.8	0x6b94	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:17.702316999 CEST	192.168.2.23	8.8.8.8	0x6b94	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:17.812614918 CEST	192.168.2.23	8.8.8.8	0x6b94	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:17.922820091 CEST	192.168.2.23	8.8.8.8	0x6b94	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:18.033188105 CEST	192.168.2.23	8.8.8.8	0x6b94	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:25.442331076 CEST	192.168.2.23	8.8.8.8	0xcb83	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:25.553100109 CEST	192.168.2.23	8.8.8.8	0xcb83	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:25.663655043 CEST	192.168.2.23	8.8.8.8	0xcb83	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:25.774182081 CEST	192.168.2.23	8.8.8.8	0xcb83	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:25.884788990 CEST	192.168.2.23	8.8.8.8	0xcb83	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:31.289905071 CEST	192.168.2.23	8.8.8.8	0x99dd	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:31.400471926 CEST	192.168.2.23	8.8.8.8	0x99dd	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:31.510576963 CEST	192.168.2.23	8.8.8.8	0x99dd	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:31.620857000 CEST	192.168.2.23	8.8.8.8	0x99dd	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:31.731245041 CEST	192.168.2.23	8.8.8.8	0x99dd	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:35.139875889 CEST	192.168.2.23	8.8.8.8	0x9868	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:35.250417948 CEST	192.168.2.23	8.8.8.8	0x9868	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:35.361006975 CEST	192.168.2.23	8.8.8.8	0x9868	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:35.471322060 CEST	192.168.2.23	8.8.8.8	0x9868	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:35.582199097 CEST	192.168.2.23	8.8.8.8	0x9868	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:44.012273073 CEST	192.168.2.23	8.8.8.8	0x1081	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:44.122771025 CEST	192.168.2.23	8.8.8.8	0x1081	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:44.233294964 CEST	192.168.2.23	8.8.8.8	0x1081	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:44.343575954 CEST	192.168.2.23	8.8.8.8	0x1081	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:44.454015970 CEST	192.168.2.23	8.8.8.8	0x1081	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:49.857693911 CEST	192.168.2.23	8.8.8.8	0x83d0	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:49.968147039 CEST	192.168.2.23	8.8.8.8	0x83d0	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:50.078813076 CEST	192.168.2.23	8.8.8.8	0x83d0	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:50.189078093 CEST	192.168.2.23	8.8.8.8	0x83d0	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:50.299597979 CEST	192.168.2.23	8.8.8.8	0x83d0	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:57.732839108 CEST	192.168.2.23	8.8.8.8	0x967e	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:57.843067884 CEST	192.168.2.23	8.8.8.8	0x967e	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:57.953428984 CEST	192.168.2.23	8.8.8.8	0x967e	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:58.063730955 CEST	192.168.2.23	8.8.8.8	0x967e	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:42:58.173876047 CEST	192.168.2.23	8.8.8.8	0x967e	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:08.603586912 CEST	192.168.2.23	8.8.8.8	0x9f96	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:08.715630054 CEST	192.168.2.23	8.8.8.8	0x9f96	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:08.826188087 CEST	192.168.2.23	8.8.8.8	0x9f96	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:08.936880112 CEST	192.168.2.23	8.8.8.8	0x9f96	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:09.047527075 CEST	192.168.2.23	8.8.8.8	0x9f96	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:17.476852894 CEST	192.168.2.23	8.8.8.8	0xec42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:17.587143898 CEST	192.168.2.23	8.8.8.8	0xec42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:17.697829008 CEST	192.168.2.23	8.8.8.8	0xec42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:17.808315039 CEST	192.168.2.23	8.8.8.8	0xec42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:17.918962955 CEST	192.168.2.23	8.8.8.8	0xec42	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:27.321808100 CEST	192.168.2.23	8.8.8.8	0x138f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:27.432737112 CEST	192.168.2.23	8.8.8.8	0x138f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:27.543425083 CEST	192.168.2.23	8.8.8.8	0x138f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:27.654161930 CEST	192.168.2.23	8.8.8.8	0x138f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:27.764653921 CEST	192.168.2.23	8.8.8.8	0x138f	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:35.197743893 CEST	192.168.2.23	8.8.8.8	0xd3e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:35.308542967 CEST	192.168.2.23	8.8.8.8	0xd3e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:35.419102907 CEST	192.168.2.23	8.8.8.8	0xd3e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:35.529823065 CEST	192.168.2.23	8.8.8.8	0xd3e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false
Apr 25, 2024 14:43:35.641366959 CEST	192.168.2.23	8.8.8.8	0xd3e3	Standard query (0)	www.sushiking.world	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6251, Parent PID: 6172

General

Start time (UTC):	12:40:06
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Arguments:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6253, Parent PID: 6251

General

Start time (UTC):	12:40:06
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6255, Parent PID: 6251

General

Start time (UTC):	12:40:06
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6257, Parent PID: 6251

General

Start time (UTC):	12:40:06
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6259, Parent PID: 6257

General

Start time (UTC):	12:40:06
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6260, Parent PID: 6257

General

Start time (UTC):	12:40:07
Start date (UTC):	25/04/2024
Path:	/tmp/SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dash PID: 6310, Parent PID: 4331

General

Start time (UTC):	12:41:17
Start date (UTC):	25/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6310, Parent PID: 4331

General

Start time (UTC):	12:41:17
Start date (UTC):	25/04/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.J5CWaKPzax /tmp/tmp.EXVfvdsdqT /tmp/tmp.9jIARiRVwZ
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6311, Parent PID: 4331

General

Start time (UTC):	12:41:17
Start date (UTC):	25/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6311, Parent PID: 4331

General

Start time (UTC):	12:41:17
Start date (UTC):	25/04/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.J5CWaKPzax /tmp/tmp.EXVfvdsdqT /tmp/tmp.9jIARiRVwZ
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

System Behavior

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6251, Parent PID: 6172

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6253, Parent PID: 6251

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6255, Parent PID: 6251

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6257, Parent PID: 6251

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6259, Parent PID: 6257

General

Chronological Activities

Analysis Process: SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf PID: 6260, Parent PID: 6257

General

Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.9486.16606.elf