Edit tour

Linux Analysis Report
morte.mpsl.elf

Overview

General Information

Sample name:	morte.mpsl.elf
Analysis ID:	1635304
MD5:	bf6111a35077252dcd92c915d37a824a
SHA1:	910bc8be3b54bdaf36bba6dcc48d78d6e590eba6
SHA256:	04cb19dfda51cf42df9b6a118ef9f656e5c403160346bef2456dd100f2fed325
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes the "rm" command used to delete files or directories

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635304
Start date and time:	2025-03-11 15:22:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	morte.mpsl.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/morte.mpsl.elf
PID:	6235
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6220, Parent: 4331)

rm (PID: 6220, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.YQKVwkPd75 /tmp/tmp.anNUr5E4il /tmp/tmp.080OxqwOOi

dash New Fork (PID: 6221, Parent: 4331)

rm (PID: 6221, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.YQKVwkPd75 /tmp/tmp.anNUr5E4il /tmp/tmp.080OxqwOOi

morte.mpsl.elf (PID: 6235, Parent: 6156, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/morte.mpsl.elf

morte.mpsl.elf New Fork (PID: 6237, Parent: 6235)

morte.mpsl.elf New Fork (PID: 6239, Parent: 6237)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: morte.mpsl.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: morte.mpsl.elf

ReversingLabs: Detection: 36%

Source: global traffic

TCP traffic: 192.168.2.23:49712 -> 176.65.134.62:2025

Source: /tmp/morte.mpsl.elf (PID: 6237)

Socket: 127.0.0.1:16384

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.134.62

Source: morte.mpsl.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: LOAD without section mappings

Program segment: 0x100000

Source: classification engine

Classification label: mal60.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /usr/bin/dash (PID: 6220)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.YQKVwkPd75 /tmp/tmp.anNUr5E4il /tmp/tmp.080OxqwOOi			Jump to behavior
Source: /usr/bin/dash (PID: 6221)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.YQKVwkPd75 /tmp/tmp.anNUr5E4il /tmp/tmp.080OxqwOOi			Jump to behavior

Source: morte.mpsl.elf

Submission file: segment LOAD with 7.9548 entropy (max. 8.0)

Source: /tmp/morte.mpsl.elf (PID: 6235)

Queries kernel information via 'uname':

Jump to behavior

Source: morte.mpsl.elf, 6235.1.000055e94a686000.000055e94a72d000.rw-.sdmp, morte.mpsl.elf, 6239.1.000055e94a686000.000055e94a70d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: morte.mpsl.elf, 6235.1.000055e94a686000.000055e94a72d000.rw-.sdmp, morte.mpsl.elf, 6239.1.000055e94a686000.000055e94a70d000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: morte.mpsl.elf, 6235.1.00007fffea4c0000.00007fffea4e1000.rw-.sdmp, morte.mpsl.elf, 6239.1.00007fffea4c0000.00007fffea4e1000.rw-.sdmp	Binary or memory string: yxx86_64/usr/bin/qemu-mipsel/tmp/morte.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/morte.mpsl.elf
Source: morte.mpsl.elf, 6235.1.00007fffea4c0000.00007fffea4e1000.rw-.sdmp, morte.mpsl.elf, 6239.1.00007fffea4c0000.00007fffea4e1000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
morte.mpsl.elf	37%	ReversingLabs	Linux.Trojan.Mirai
morte.mpsl.elf	100%	Avira	EXP/ELF.Agent.M.28

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	morte.mpsl.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
176.65.134.62	unknown	Germany	56325	DIOGELO-ASGB	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.65.134.62	morte.sh4.elf	Get hash	malicious	Unknown	Browse
	morte.arm7.elf	Get hash	malicious	Unknown	Browse
	morte.sh4.elf	Get hash	malicious	Unknown	Browse
	morte.ppc.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Unknown	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	morte.arm7.elf	Get hash	malicious	Unknown	Browse
	morte.x64.elf	Get hash	malicious	Unknown	Browse
	morte.m68k.elf	Get hash	malicious	Unknown	Browse
	morte.x86.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	Mozi.m.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	Mozi.m.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	Mozi.m.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	Mozi.m.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	morte.arm6.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
CANONICAL-ASGB	morte.arm6.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
INIT7CH	Mozi.m.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
DIOGELO-ASGB	morte.sh4.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.arm7.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.ppc.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.arm.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.arm7.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.x64.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.m68k.elf	Get hash	malicious	Unknown	Browse	176.65.134.62
	morte.x86.elf	Get hash	malicious	Unknown	Browse	176.65.134.62

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.952528456177902
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	morte.mpsl.elf
File size:	49'116 bytes
MD5:	bf6111a35077252dcd92c915d37a824a
SHA1:	910bc8be3b54bdaf36bba6dcc48d78d6e590eba6
SHA256:	04cb19dfda51cf42df9b6a118ef9f656e5c403160346bef2456dd100f2fed325
SHA512:	521b2ab1d2d65929188c20ee1792fc4c420fc73d32c528b584477e1d1e62bf44899e52ee744c6c196c161fe6c80c7b4efdd5a4eb74b60bda5683b34d4d4d76eb
SSDEEP:	768:Hel5RgrzoHJ9NLe1f7sMNI9jWDWBPpVhqh+Xiu7G8f7PcSwic+4CPlgWg:iggHz1e1fNIAD6PpDqh+yYDPcSwicuc
TLSH:	8623E1FA855CB84ECE9EDCFEF14A0B61AF4196C4594B0E5DD70098C8A63A5013B9F47C
File Content Preview:	.ELF....................h...4...........4. ...(.........................................0...0.F.0.F....................4UPX!`.......DV..DV......U..........?.E.h;....#......b.L#0^.\..[....8..r.H.Q.!i.o+f}v...B.Q...Z..b....C..q+J.}.ra.........3.............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10ab68
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	2
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x100000	0x100000	0xbea5	0xbea5	7.9548	0x5	R E	0x10000
LOAD	0x9c30	0x469c30	0x469c30	0x0	0x0	0.0000	0x6	RW	0x10000

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 15:23:00.720314026 CET	49712	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:00.725086927 CET	2025	49712	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:00.725179911 CET	49712	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:00.764708996 CET	49712	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:00.769397974 CET	2025	49712	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:00.769453049 CET	49712	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:00.774091959 CET	2025	49712	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:01.779114962 CET	43928	443	192.168.2.23	91.189.91.42
Mar 11, 2025 15:23:04.549494982 CET	2025	49712	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:04.549765110 CET	49712	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:04.549997091 CET	49712	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:04.550842047 CET	49714	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:04.555587053 CET	2025	49714	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:04.555704117 CET	49714	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:04.556612015 CET	49714	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:04.561346054 CET	2025	49714	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:04.561405897 CET	49714	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:04.566097021 CET	2025	49714	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:05.383276939 CET	2025	49714	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:05.383563042 CET	49714	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:05.383591890 CET	49714	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:05.384485960 CET	49716	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:05.389183998 CET	2025	49716	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:05.389244080 CET	49716	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:05.390094995 CET	49716	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:05.394795895 CET	2025	49716	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:05.394865990 CET	49716	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:05.399523973 CET	2025	49716	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:06.230988979 CET	2025	49716	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:06.231139898 CET	49716	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:06.231226921 CET	49716	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:06.231802940 CET	49718	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:06.236550093 CET	2025	49718	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:06.236645937 CET	49718	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:06.237473011 CET	49718	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:06.242168903 CET	2025	49718	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:06.242234945 CET	49718	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:06.246917963 CET	2025	49718	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:07.042309999 CET	2025	49718	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:07.042418003 CET	49718	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.042455912 CET	49718	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.042956114 CET	49720	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.047665119 CET	2025	49720	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:07.047739029 CET	49720	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.048578978 CET	49720	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.053225040 CET	2025	49720	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:07.053282976 CET	49720	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.057965994 CET	2025	49720	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:07.410291910 CET	42836	443	192.168.2.23	91.189.91.43
Mar 11, 2025 15:23:07.816164970 CET	2025	49720	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:07.816286087 CET	49720	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.816342115 CET	49720	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.817038059 CET	49722	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.821747065 CET	2025	49722	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:07.821897984 CET	49722	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.822652102 CET	49722	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.827305079 CET	2025	49722	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:07.827377081 CET	49722	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:07.832110882 CET	2025	49722	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:08.434581995 CET	42516	80	192.168.2.23	109.202.202.202
Mar 11, 2025 15:23:08.630917072 CET	2025	49722	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:08.631122112 CET	49722	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:08.631154060 CET	49722	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:08.631793976 CET	49724	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:08.636512041 CET	2025	49724	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:08.636696100 CET	49724	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:08.637640953 CET	49724	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:08.642291069 CET	2025	49724	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:08.642466068 CET	49724	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:08.647130013 CET	2025	49724	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:09.434937954 CET	2025	49724	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:09.435225010 CET	49724	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:09.435266972 CET	49724	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:09.435941935 CET	49726	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:09.440639973 CET	2025	49726	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:09.440722942 CET	49726	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:09.441606045 CET	49726	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:09.446234941 CET	2025	49726	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:09.446280003 CET	49726	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:09.451098919 CET	2025	49726	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:10.278822899 CET	2025	49726	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:10.279043913 CET	49726	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:10.279223919 CET	49726	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:10.279884100 CET	49728	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:10.284586906 CET	2025	49728	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:10.284677982 CET	49728	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:10.285840988 CET	49728	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:10.290556908 CET	2025	49728	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:10.290626049 CET	49728	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:10.295332909 CET	2025	49728	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:11.121597052 CET	2025	49728	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:11.121824026 CET	49728	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.121918917 CET	49728	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.122817993 CET	49730	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.128164053 CET	2025	49730	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:11.128242016 CET	49730	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.129726887 CET	49730	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.135456085 CET	2025	49730	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:11.135530949 CET	49730	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.141050100 CET	2025	49730	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:11.939416885 CET	2025	49730	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:11.939735889 CET	49730	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.939850092 CET	49730	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.940848112 CET	49732	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.946453094 CET	2025	49732	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:11.946526051 CET	49732	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.947794914 CET	49732	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.953048944 CET	2025	49732	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:11.953109026 CET	49732	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:11.958771944 CET	2025	49732	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:12.732049942 CET	2025	49732	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:12.732203007 CET	49732	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:12.732253075 CET	49732	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:12.732896090 CET	49734	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:12.737654924 CET	2025	49734	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:12.737703085 CET	49734	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:12.738805056 CET	49734	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:12.743654966 CET	2025	49734	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:12.743701935 CET	49734	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:12.748378038 CET	2025	49734	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:13.567764997 CET	2025	49734	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:13.567903042 CET	49734	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:13.567935944 CET	49734	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:13.568485022 CET	49736	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:13.573172092 CET	2025	49736	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:13.573230982 CET	49736	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:13.573950052 CET	49736	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:13.578627110 CET	2025	49736	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:13.578675032 CET	49736	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:13.583323956 CET	2025	49736	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:14.362520933 CET	2025	49736	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:14.362725973 CET	49736	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:14.362802029 CET	49736	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:14.363626003 CET	49738	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:14.368657112 CET	2025	49738	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:14.368758917 CET	49738	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:14.369970083 CET	49738	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:14.374641895 CET	2025	49738	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:14.374701023 CET	49738	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:14.379371881 CET	2025	49738	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:15.205965042 CET	2025	49738	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:15.206224918 CET	49738	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:15.206301928 CET	49738	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:15.207206964 CET	49740	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:15.211921930 CET	2025	49740	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:15.212007999 CET	49740	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:15.213135958 CET	49740	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:15.217794895 CET	2025	49740	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:15.217840910 CET	49740	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:15.222790956 CET	2025	49740	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:16.009407043 CET	2025	49740	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:16.009538889 CET	49740	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.009572983 CET	49740	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.010237932 CET	49742	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.016083002 CET	2025	49742	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:16.016179085 CET	49742	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.017011881 CET	49742	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.022032976 CET	2025	49742	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:16.022102118 CET	49742	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.027152061 CET	2025	49742	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:16.862277985 CET	2025	49742	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:16.862432003 CET	49742	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.862478018 CET	49742	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.863161087 CET	49744	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.867865086 CET	2025	49744	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:16.868042946 CET	49744	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.869025946 CET	49744	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.874640942 CET	2025	49744	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:16.874754906 CET	49744	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:16.880254984 CET	2025	49744	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:17.711456060 CET	2025	49744	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:17.711651087 CET	49744	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:17.711745024 CET	49744	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:17.712384939 CET	49746	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:17.717103958 CET	2025	49746	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:17.717200994 CET	49746	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:17.718050957 CET	49746	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:17.722723961 CET	2025	49746	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:17.722820997 CET	49746	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:17.727490902 CET	2025	49746	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:18.516916037 CET	2025	49746	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:18.517054081 CET	49746	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:18.517091036 CET	49746	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:18.517688990 CET	49748	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:18.522444010 CET	2025	49748	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:18.522507906 CET	49748	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:18.523319006 CET	49748	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:18.528146029 CET	2025	49748	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:18.528278112 CET	49748	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:18.533085108 CET	2025	49748	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:22.000332117 CET	43928	443	192.168.2.23	91.189.91.42
Mar 11, 2025 15:23:28.528918028 CET	49748	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:28.533694983 CET	2025	49748	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:28.789968967 CET	2025	49748	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:28.790195942 CET	49748	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:34.286452055 CET	42836	443	192.168.2.23	91.189.91.43
Mar 11, 2025 15:23:38.381863117 CET	42516	80	192.168.2.23	109.202.202.202
Mar 11, 2025 15:23:44.440948009 CET	2025	49748	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:44.441327095 CET	49748	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:44.446033001 CET	2025	49748	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:45.443867922 CET	49750	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:45.450059891 CET	2025	49750	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:45.450133085 CET	49750	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:45.451092005 CET	49750	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:45.455730915 CET	2025	49750	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:45.455786943 CET	49750	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:45.460491896 CET	2025	49750	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:52.710091114 CET	2025	49750	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:52.710477114 CET	49750	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:52.715146065 CET	2025	49750	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:53.712636948 CET	49752	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:53.717341900 CET	2025	49752	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:53.717432976 CET	49752	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:53.718620062 CET	49752	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:53.723294020 CET	2025	49752	176.65.134.62	192.168.2.23
Mar 11, 2025 15:23:53.723365068 CET	49752	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:23:53.728029013 CET	2025	49752	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:00.939034939 CET	2025	49752	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:00.939302921 CET	49752	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:00.943994045 CET	2025	49752	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:01.941274881 CET	49754	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:01.946021080 CET	2025	49754	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:01.946100950 CET	49754	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:01.946923971 CET	49754	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:01.951601982 CET	2025	49754	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:01.951653004 CET	49754	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:01.956340075 CET	2025	49754	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:02.954493999 CET	43928	443	192.168.2.23	91.189.91.42
Mar 11, 2025 15:24:21.015126944 CET	2025	49754	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:21.015486002 CET	49754	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:21.021632910 CET	2025	49754	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:22.017575026 CET	49756	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:22.022448063 CET	2025	49756	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:22.022546053 CET	49756	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:22.023741961 CET	49756	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:22.028429031 CET	2025	49756	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:22.028587103 CET	49756	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:22.033297062 CET	2025	49756	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:38.070343018 CET	2025	49756	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:38.070693016 CET	49756	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:38.075620890 CET	2025	49756	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:39.072910070 CET	49758	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:39.077706099 CET	2025	49758	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:39.077768087 CET	49758	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:39.078630924 CET	49758	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:39.083314896 CET	2025	49758	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:39.083373070 CET	49758	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:39.088093996 CET	2025	49758	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:55.117281914 CET	2025	49758	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:55.117507935 CET	49758	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:55.122668982 CET	2025	49758	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:56.120444059 CET	49760	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:56.808145046 CET	2025	49760	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:56.808279037 CET	49760	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:56.809787989 CET	49760	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:56.814553976 CET	2025	49760	176.65.134.62	192.168.2.23
Mar 11, 2025 15:24:56.814601898 CET	49760	2025	192.168.2.23	176.65.134.62
Mar 11, 2025 15:24:56.820544958 CET	2025	49760	176.65.134.62	192.168.2.23

System Behavior

Analysis Process: dash PID: 6220, Parent PID: 4331

General

Start time (UTC):	14:22:50
Start date (UTC):	11/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6220, Parent PID: 4331

General

Start time (UTC):	14:22:50
Start date (UTC):	11/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.YQKVwkPd75 /tmp/tmp.anNUr5E4il /tmp/tmp.080OxqwOOi
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Analysis Process: dash PID: 6221, Parent PID: 4331

General

Start time (UTC):	14:22:50
Start date (UTC):	11/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6221, Parent PID: 4331

General

Start time (UTC):	14:22:50
Start date (UTC):	11/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.YQKVwkPd75 /tmp/tmp.anNUr5E4il /tmp/tmp.080OxqwOOi
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Analysis Process: morte.mpsl.elf PID: 6235, Parent PID: 6156

General

Start time (UTC):	14:22:59
Start date (UTC):	11/03/2025
Path:	/tmp/morte.mpsl.elf
Arguments:	/tmp/morte.mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Chronological Activities

Analysis Process: morte.mpsl.elf PID: 6237, Parent PID: 6235

General

Start time (UTC):	14:23:00
Start date (UTC):	11/03/2025
Path:	/tmp/morte.mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Chronological Activities

Analysis Process: morte.mpsl.elf PID: 6239, Parent PID: 6237

General

Start time (UTC):	14:23:00
Start date (UTC):	11/03/2025
Path:	/tmp/morte.mpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report morte.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 6220, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6220, Parent PID: 4331

General

Analysis Process: dash PID: 6221, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6221, Parent PID: 4331

General

Analysis Process: morte.mpsl.elf PID: 6235, Parent PID: 6156

General

Chronological Activities

Analysis Process: morte.mpsl.elf PID: 6237, Parent PID: 6235

General

Chronological Activities

Analysis Process: morte.mpsl.elf PID: 6239, Parent PID: 6237

General

Chronological Activities

Linux Analysis Report
morte.mpsl.elf