Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
0vFX7VXc9U

Overview

General Information

Sample Name:0vFX7VXc9U
Analysis ID:626466
MD5:5d6cccddcb88cb4daefbc964e23de098
SHA1:18e29b4aaad7d49a2b2adba64387494c6590c8dc
SHA256:1dfc810854844288a6f5c6b1e8dc25059bcff19c5585773956e568eaa4794970
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626466
Start date and time: 14/05/202204:00:302022-05-14 04:00:30 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 19s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:0vFX7VXc9U
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal68.spre.troj.evad.lin@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/0vFX7VXc9U
PID:6229
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • 0vFX7VXc9U (PID: 6229, Parent: 6122, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/0vFX7VXc9U
  • cleanup

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: 0vFX7VXc9UVirustotal: Detection: 40%Perma Link

    Networking

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54612
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54616
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54618
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54622
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54632
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54648
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54650
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54656
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
    Source: /tmp/0vFX7VXc9U (PID: 6231)Socket: 0.0.0.0::0
    Source: /tmp/0vFX7VXc9U (PID: 6231)Socket: 0.0.0.0::53413
    Source: /tmp/0vFX7VXc9U (PID: 6231)Socket: 0.0.0.0::80
    Source: /tmp/0vFX7VXc9U (PID: 6231)Socket: 0.0.0.0::37215
    Source: /tmp/0vFX7VXc9U (PID: 6237)Socket: 0.0.0.0::0
    Source: /tmp/0vFX7VXc9U (PID: 6237)Socket: 0.0.0.0::53413
    Source: /tmp/0vFX7VXc9U (PID: 6237)Socket: 0.0.0.0::80
    Source: /tmp/0vFX7VXc9U (PID: 6237)Socket: 0.0.0.0::37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 107.172.197.117
    Source: unknownTCP traffic detected without corresponding DNS query: 75.153.213.149
    Source: unknownTCP traffic detected without corresponding DNS query: 44.100.148.162
    Source: unknownTCP traffic detected without corresponding DNS query: 153.161.78.149
    Source: unknownTCP traffic detected without corresponding DNS query: 124.122.52.227
    Source: unknownTCP traffic detected without corresponding DNS query: 200.20.122.95
    Source: unknownTCP traffic detected without corresponding DNS query: 209.74.247.155
    Source: unknownTCP traffic detected without corresponding DNS query: 174.71.198.101
    Source: unknownTCP traffic detected without corresponding DNS query: 117.236.55.110
    Source: unknownTCP traffic detected without corresponding DNS query: 37.106.71.233
    Source: unknownTCP traffic detected without corresponding DNS query: 222.47.177.148
    Source: unknownTCP traffic detected without corresponding DNS query: 125.144.106.185
    Source: unknownTCP traffic detected without corresponding DNS query: 206.15.179.149
    Source: unknownTCP traffic detected without corresponding DNS query: 254.27.202.193
    Source: unknownTCP traffic detected without corresponding DNS query: 201.103.134.232
    Source: unknownTCP traffic detected without corresponding DNS query: 219.78.219.232
    Source: unknownTCP traffic detected without corresponding DNS query: 67.141.187.33
    Source: unknownTCP traffic detected without corresponding DNS query: 104.195.123.176
    Source: unknownTCP traffic detected without corresponding DNS query: 120.108.63.223
    Source: unknownTCP traffic detected without corresponding DNS query: 48.186.3.119
    Source: unknownTCP traffic detected without corresponding DNS query: 80.133.177.198
    Source: unknownTCP traffic detected without corresponding DNS query: 182.248.186.183
    Source: unknownTCP traffic detected without corresponding DNS query: 71.218.165.185
    Source: unknownTCP traffic detected without corresponding DNS query: 179.129.198.114
    Source: unknownTCP traffic detected without corresponding DNS query: 59.240.120.127
    Source: unknownTCP traffic detected without corresponding DNS query: 67.6.248.156
    Source: unknownTCP traffic detected without corresponding DNS query: 171.64.241.180
    Source: unknownTCP traffic detected without corresponding DNS query: 75.151.87.145
    Source: unknownTCP traffic detected without corresponding DNS query: 196.183.155.18
    Source: unknownTCP traffic detected without corresponding DNS query: 193.188.234.47
    Source: unknownTCP traffic detected without corresponding DNS query: 185.135.188.9
    Source: unknownTCP traffic detected without corresponding DNS query: 179.213.133.164
    Source: unknownTCP traffic detected without corresponding DNS query: 179.242.15.168
    Source: unknownTCP traffic detected without corresponding DNS query: 198.16.2.230
    Source: unknownTCP traffic detected without corresponding DNS query: 191.27.73.58
    Source: unknownTCP traffic detected without corresponding DNS query: 41.235.202.130
    Source: unknownTCP traffic detected without corresponding DNS query: 58.241.84.58
    Source: unknownTCP traffic detected without corresponding DNS query: 169.228.22.89
    Source: unknownTCP traffic detected without corresponding DNS query: 79.197.67.24
    Source: unknownTCP traffic detected without corresponding DNS query: 32.171.233.252
    Source: unknownTCP traffic detected without corresponding DNS query: 53.169.86.102
    Source: unknownTCP traffic detected without corresponding DNS query: 149.13.99.100
    Source: unknownTCP traffic detected without corresponding DNS query: 115.192.179.28
    Source: unknownTCP traffic detected without corresponding DNS query: 255.194.67.22
    Source: unknownTCP traffic detected without corresponding DNS query: 220.114.89.247
    Source: unknownTCP traffic detected without corresponding DNS query: 213.233.2.165
    Source: unknownTCP traffic detected without corresponding DNS query: 32.215.205.156
    Source: unknownTCP traffic detected without corresponding DNS query: 106.217.38.243
    Source: unknownTCP traffic detected without corresponding DNS query: 213.149.54.237
    Source: 0vFX7VXc9UString found in binary or memory: http://upx.sf.net

    System Summary

    barindex
    Sample tries to kill multiple processes (SIGKILL)
    Source: /tmp/0vFX7VXc9U (PID: 6231)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 6231, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 720, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 759, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 788, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 800, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 847, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 884, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1334, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1335, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1860, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1872, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2096, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2097, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2102, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2180, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2208, result: successful
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: /tmp/0vFX7VXc9U (PID: 6231)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 6231, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 720, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 759, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 788, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 800, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 847, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 884, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1334, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1335, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1860, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1872, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2096, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2097, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2102, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2180, result: successful
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2208, result: successful
    Source: classification engineClassification label: mal68.spre.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Sample is packed with UPX
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/491/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/793/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/772/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/796/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/774/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/797/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/777/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/799/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/658/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/912/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/759/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/936/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/918/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/1/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/761/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/785/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/884/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/720/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/721/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/788/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/789/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/800/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/801/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/847/fd
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/904/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/6231/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2033/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2033/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1582/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1582/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2275/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1612/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1612/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1579/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1579/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1699/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1699/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1335/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1335/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1698/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1698/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2028/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2028/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1334/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1334/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1576/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1576/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2302/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/3236/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2025/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2025/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2146/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2146/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/910/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/912/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/912/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/912/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/759/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/759/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/759/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/517/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2307/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/918/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/918/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/918/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1594/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1594/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2285/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2281/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1349/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1349/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1623/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1623/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/761/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/761/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/761/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1622/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1622/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/884/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/884/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/884/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1983/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1983/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2038/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2038/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1586/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1586/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1465/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1465/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1344/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1344/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1860/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1860/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1463/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1463/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2156/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2156/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/800/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/800/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/800/exe
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/801/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/801/fd
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/801/exe

    Hooking and other Techniques for Hiding and Protection

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54612
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54616
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54618
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54622
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54632
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54648
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54650
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54656
    Source: /tmp/0vFX7VXc9U (PID: 6229)Queries kernel information via 'uname':
    Source: 0vFX7VXc9U, 6229.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6231.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6233.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6239.1.00000000631ea211.00000000c91328e8.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
    Source: 0vFX7VXc9U, 6229.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6231.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6233.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6239.1.0000000037e28d0d.00000000d1298c36.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/0vFX7VXc9USUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/0vFX7VXc9U
    Source: 0vFX7VXc9U, 6229.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6231.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6233.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6239.1.00000000631ea211.00000000c91328e8.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: 0vFX7VXc9U, 6229.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6231.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6233.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6239.1.0000000037e28d0d.00000000d1298c36.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

    Stealing of Sensitive Information

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information    		1
    OS Credential Dumping    		11
    Security Software Discovery    		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626466 Sample: 0vFX7VXc9U Startdate: 14/05/2022 Architecture: LINUX Score: 68 24 5.19.186.80, 23 ZTELECOM-ASRU Russian Federation 2->24 26 40.131.167.165 WINDSTREAMUS United States 2->26 28 98 other IPs or domains 2->28 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected Mirai 2->34 36 Uses known network protocols on non-standard ports 2->36 38 Sample is packed with UPX 2->38 8 0vFX7VXc9U 2->8         started        signatures3 process4 process5 10 0vFX7VXc9U 8->10         started        12 0vFX7VXc9U 8->12         started        15 0vFX7VXc9U 8->15         started        signatures6 17 0vFX7VXc9U 10->17         started        20 0vFX7VXc9U 10->20         started        22 0vFX7VXc9U 10->22         started        40 Sample tries to kill multiple processes (SIGKILL) 12->40 process7 signatures8 30 Sample tries to kill multiple processes (SIGKILL) 17->30

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    0vFX7VXc9U40%VirustotalBrowse

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.net0vFX7VXc9Ufalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      159.199.38.171
      		unknownUnited States
      		11363FUJITSU-USAUSfalse
      126.210.129.155
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      193.197.13.107
      		unknownGermany
      		553BELWUEBelWue-KoordinationEUfalse
      38.162.241.46
      		unknownUnited States
      		174COGENT-174USfalse
      158.34.190.148
      		unknownUnited States
      		721DNIC-ASBLK-00721-00726USfalse
      17.68.111.77
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      202.211.43.114
      		unknownJapan23637BI-CDN-IXEquinixJpapanEnterpriseKKJPfalse
      58.49.78.189
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      187.44.116.221
      		unknownBrazil
      		28303UNASSIGNEDfalse
      167.194.166.140
      		unknownUnited States
      		2897GEORGIA-1USfalse
      155.103.234.205
      		unknownUnited States
      		17055UTAHUSfalse
      117.20.6.89
      		unknownAustralia
      		45671AS45671-NET-AUWholesaleServicesProviderAUfalse
      123.123.10.10
      		unknownChina
      		4808CHINA169-BJChinaUnicomBeijingProvinceNetworkCNfalse
      211.215.142.151
      		unknownKorea Republic of
      		9318SKB-ASSKBroadbandCoLtdKRfalse
      184.183.128.14
      		unknownUnited States
      		22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
      27.91.141.132
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      191.69.208.120
      		unknownColombia
      		26611COMCELSACOfalse
      179.181.230.189
      		unknownBrazil
      		18881TELEFONICABRASILSABRfalse
      106.178.36.12
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      79.212.37.114
      		unknownGermany
      		3320DTAGInternetserviceprovideroperationsDEfalse
      242.191.215.50
      		unknownReserved
      		unknownunknownfalse
      173.159.96.56
      		unknownUnited States
      		10507SPCSUSfalse
      192.70.114.91
      		unknownFrance
      		2200FR-RENATERReseauNationaldetelecommunicationspourlaTecfalse
      188.65.30.16
      		unknownOman
      		15679CISOMfalse
      252.233.33.84
      		unknownReserved
      		unknownunknownfalse
      155.174.155.129
      		unknownUnited States
      		797AMERITECH-ASUSfalse
      190.87.78.146
      		unknownEl Salvador
      		14754TelguaGTfalse
      18.132.24.3
      		unknownUnited States
      		16509AMAZON-02USfalse
      112.135.85.14
      		unknownSri Lanka
      		9329SLTINT-AS-APSriLankaTelecomInternetLKfalse
      122.238.160.53
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      63.222.211.96
      		unknownUnited States
      		3491BTN-ASNUSfalse
      47.111.235.144
      		unknownChina
      		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse
      60.78.199.133
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      113.151.235.184
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      210.151.10.111
      		unknownJapan4725ODNSoftBankMobileCorpJPfalse
      67.150.211.85
      		unknownUnited States
      		209CENTURYLINK-US-LEGACY-QWESTUSfalse
      221.161.108.168
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      172.127.100.178
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      241.170.151.161
      		unknownReserved
      		unknownunknownfalse
      209.221.88.255
      		unknownCanada
      		17054AS17054USfalse
      255.103.13.193
      		unknownReserved
      		unknownunknownfalse
      216.46.11.151
      		unknownCanada
      		11478OPENFACECAfalse
      189.197.247.189
      		unknownMexico
      		13999MegaCableSAdeCVMXfalse
      145.245.19.10
      		unknownSwitzerland
      		2047ASN-ROCHE-BASLEGlobalcorporateIPnetworkCHfalse
      57.62.76.32
      		unknownBelgium
      		2686ATGS-MMD-ASUSfalse
      202.231.94.147
      		unknownJapan2519VECTANTARTERIANetworksCorporationJPfalse
      135.166.174.163
      		unknownUnited States
      		14962NCR-252USfalse
      165.26.68.176
      		unknownUnited States
      		14381CATERPILLAR-INCUSfalse
      147.147.16.159
      		unknownUnited Kingdom
      		6871PLUSNETUKInternetServiceProviderGBfalse
      4.138.164.110
      		unknownUnited States
      		3356LEVEL3USfalse
      34.38.58.196
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      84.239.71.93
      		unknownFrance
      		20926PULSATION-ASFRfalse
      152.47.196.81
      		unknownUnited States
      		81NCRENUSfalse
      188.103.181.52
      		unknownGermany
      		3209VODANETInternationalIP-BackboneofVodafoneDEfalse
      85.186.170.195
      		unknownRomania
      		6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
      34.66.240.213
      		unknownUnited States
      		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
      20.151.130.134
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      177.167.27.22
      		unknownBrazil
      		26615TIMSABRfalse
      247.149.253.146
      		unknownReserved
      		unknownunknownfalse
      243.95.58.195
      		unknownReserved
      		unknownunknownfalse
      5.19.186.80
      		unknownRussian Federation
      		41733ZTELECOM-ASRUfalse
      62.8.167.45
      		unknownGermany
      		20676PLUSNETDEfalse
      68.40.94.171
      		unknownUnited States
      		7922COMCAST-7922USfalse
      176.67.2.141
      		unknownUkraine
      		25133MCLAUT-ASUAfalse
      110.3.119.105
      		unknownJapan10013FBDCFreeBitCoLtdJPfalse
      24.232.201.65
      		unknownArgentina
      		10318TelecomArgentinaSAARfalse
      24.237.4.6
      		unknownUnited States
      		8047GCIUSfalse
      58.253.21.183
      		unknownChina
      		17622CNCGROUP-GZChinaUnicomGuangzhounetworkCNfalse
      212.214.203.146
      		unknownSweden
      		3246TDCSONGTele2BusinessTDCSwedenSEfalse
      47.19.240.28
      		unknownUnited States
      		6128CABLE-NET-1USfalse
      79.94.237.131
      		unknownFrance
      		15557LDCOMNETFRfalse
      12.170.33.63
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      35.115.167.133
      		unknownUnited States
      		237MERIT-AS-14USfalse
      40.131.167.165
      		unknownUnited States
      		7029WINDSTREAMUSfalse
      168.223.68.65
      		unknownUnited States
      		7202FAMUUSfalse
      251.241.122.248
      		unknownReserved
      		unknownunknownfalse
      188.102.19.180
      		unknownGermany
      		3209VODANETInternationalIP-BackboneofVodafoneDEfalse
      121.137.248.232
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      5.40.190.26
      		unknownSpain
      		43160ES-MDC-DATACENTERMalagaDataCenterESfalse
      92.175.5.148
      		unknownFrance
      		3215FranceTelecom-OrangeFRfalse
      201.188.216.73
      		unknownChile
      		7418TELEFONICACHILESACLfalse
      120.168.146.194
      		unknownIndonesia
      		4761INDOSAT-INP-APINDOSATInternetNetworkProviderIDfalse
      242.205.249.210
      		unknownReserved
      		unknownunknownfalse
      129.3.73.40
      		unknownUnited States
      		14433SUNY-OSWEGO-ASNUSfalse
      135.251.35.234
      		unknownUnited States
      		10455LUCENT-CIOUSfalse
      192.89.10.120
      		unknownFinland
      		1759TSF-IP-CORETeliaFinlandOyjEUfalse
      250.57.212.23
      		unknownReserved
      		unknownunknownfalse
      36.118.159.83
      		unknownChina
      		4847CNIX-APChinaNetworksInter-ExchangeCNfalse
      24.69.73.98
      		unknownCanada
      		6327SHAWCAfalse
      117.53.253.20
      		unknownKorea Republic of
      		9770SPEEDONSTV-AS-KRLGHelloVisionCorpKRfalse
      253.198.199.189
      		unknownReserved
      		unknownunknownfalse
      113.35.47.165
      		unknownJapan17506UCOMARTERIANetworksCorporationJPfalse
      31.53.204.8
      		unknownUnited Kingdom
      		2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
      194.223.115.79
      		unknownUnited Kingdom
      		138384RMNI-AS-APRakutenMobileNetworkIncJPfalse
      254.55.175.61
      		unknownReserved
      		unknownunknownfalse
      186.112.241.175
      		unknownColombia
      		3816COLOMBIATELECOMUNICACIONESSAESPCOfalse
      202.137.122.48
      		unknownPhilippines
      		38553DCTECHDVO-AS-APInternetServiceProviderandDataCenterPfalse
      119.109.212.116
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      45.25.50.42
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      99.11.105.169
      		unknownUnited States
      		7018ATT-INTERNET4USfalse

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
      Entropy (8bit):7.929417373612622
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:0vFX7VXc9U
      File size:25004
      MD5:5d6cccddcb88cb4daefbc964e23de098
      SHA1:18e29b4aaad7d49a2b2adba64387494c6590c8dc
      SHA256:1dfc810854844288a6f5c6b1e8dc25059bcff19c5585773956e568eaa4794970
      SHA512:1847514de3f1c5940ffead1621460b99b793b3f80550397985e8ac6672cafa5950e5bcaf9a66d605b5847052183cf934a1cc5e7ef1bb1d1ad0aa71d11abf793e
      SSDEEP:768:5X9nxn8o9wnBoWzEQf2EjKb3pOIs3UozH:5tn+o9wjfBAZO9zH
      TLSH:21B2D0727015F8B7C7E600B76AEDCA83FA800EF8D0E8B3291465099DE9D4846BBF1547
      File Content Preview:.ELF...a..........(.........4...........4. ...(......................`...`...............^..........................Q.td..............................CvUPX!........0...0.......R..........?.E.h;.}...^..........f.Z.6..(fw....&.x:.E.......oe.`.S..T.......n..

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:ARM
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:ARM - ABI
      ABI Version:0
      Entry Point Address:0xcf10
      Flags:0x202
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x80000x80000x60bf0x60bf4.04860x5R E0x8000
      LOAD0x5ee00x1dee00x1dee00x00x00.00000x6RW 0x8000
      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      May 14, 2022 04:06:47.165482044 CEST42836443192.168.2.2391.189.91.43
      May 14, 2022 04:06:47.622730970 CEST609881312192.168.2.23107.172.197.117
      May 14, 2022 04:06:47.649099112 CEST3244323192.168.2.2375.153.213.149
      May 14, 2022 04:06:47.649204016 CEST3244323192.168.2.2344.100.148.162
      May 14, 2022 04:06:47.649205923 CEST3244323192.168.2.23153.161.78.149
      May 14, 2022 04:06:47.649209023 CEST3244323192.168.2.23124.122.52.227
      May 14, 2022 04:06:47.649218082 CEST3244323192.168.2.23200.20.122.95
      May 14, 2022 04:06:47.649226904 CEST3244323192.168.2.23209.74.247.155
      May 14, 2022 04:06:47.649228096 CEST3244323192.168.2.23174.71.198.101
      May 14, 2022 04:06:47.649244070 CEST3244323192.168.2.23117.236.55.110
      May 14, 2022 04:06:47.649250984 CEST3244323192.168.2.2337.106.71.233
      May 14, 2022 04:06:47.649257898 CEST3244323192.168.2.23222.47.177.148
      May 14, 2022 04:06:47.649274111 CEST3244323192.168.2.23125.144.106.185
      May 14, 2022 04:06:47.649287939 CEST3244323192.168.2.23206.15.179.149
      May 14, 2022 04:06:47.649288893 CEST3244323192.168.2.23254.27.202.193
      May 14, 2022 04:06:47.649317980 CEST3244323192.168.2.23201.103.134.232
      May 14, 2022 04:06:47.649319887 CEST3244323192.168.2.23219.78.219.232
      May 14, 2022 04:06:47.649323940 CEST3244323192.168.2.2367.141.187.33
      May 14, 2022 04:06:47.649323940 CEST3244323192.168.2.23104.195.123.176
      May 14, 2022 04:06:47.649332047 CEST3244323192.168.2.23120.108.63.223
      May 14, 2022 04:06:47.649334908 CEST3244323192.168.2.2348.186.3.119
      May 14, 2022 04:06:47.649338961 CEST3244323192.168.2.2380.133.177.198
      May 14, 2022 04:06:47.649342060 CEST3244323192.168.2.23182.248.186.183
      May 14, 2022 04:06:47.649362087 CEST3244323192.168.2.23186.227.10.184
      May 14, 2022 04:06:47.649370909 CEST3244323192.168.2.2371.218.165.185
      May 14, 2022 04:06:47.649377108 CEST3244323192.168.2.23179.129.198.114
      May 14, 2022 04:06:47.649382114 CEST3244323192.168.2.2359.240.120.127
      May 14, 2022 04:06:47.649391890 CEST3244323192.168.2.2367.6.248.156
      May 14, 2022 04:06:47.649409056 CEST3244323192.168.2.23171.64.241.180
      May 14, 2022 04:06:47.649411917 CEST3244323192.168.2.2375.151.87.145
      May 14, 2022 04:06:47.649434090 CEST3244323192.168.2.23196.183.155.18
      May 14, 2022 04:06:47.649451971 CEST3244323192.168.2.23193.188.234.47
      May 14, 2022 04:06:47.649458885 CEST3244323192.168.2.23185.135.188.9
      May 14, 2022 04:06:47.649461031 CEST3244323192.168.2.23179.213.133.164
      May 14, 2022 04:06:47.649472952 CEST3244323192.168.2.23179.242.15.168
      May 14, 2022 04:06:47.649477959 CEST3244323192.168.2.23198.16.2.230
      May 14, 2022 04:06:47.649487972 CEST3244323192.168.2.23191.27.73.58
      May 14, 2022 04:06:47.649494886 CEST3244323192.168.2.2341.235.202.130
      May 14, 2022 04:06:47.649497032 CEST3244323192.168.2.2358.241.84.58
      May 14, 2022 04:06:47.649513006 CEST3244323192.168.2.23169.228.22.89
      May 14, 2022 04:06:47.649522066 CEST3244323192.168.2.2379.197.67.24
      May 14, 2022 04:06:47.649528980 CEST3244323192.168.2.2332.171.233.252
      May 14, 2022 04:06:47.649547100 CEST3244323192.168.2.2353.169.86.102
      May 14, 2022 04:06:47.649557114 CEST3244323192.168.2.23149.13.99.100
      May 14, 2022 04:06:47.649566889 CEST3244323192.168.2.23115.192.179.28
      May 14, 2022 04:06:47.649574995 CEST3244323192.168.2.23255.194.67.22
      May 14, 2022 04:06:47.649579048 CEST3244323192.168.2.23220.114.89.247
      May 14, 2022 04:06:47.649579048 CEST3244323192.168.2.23213.233.2.165
      May 14, 2022 04:06:47.649590969 CEST3244323192.168.2.2332.215.205.156
      May 14, 2022 04:06:47.649606943 CEST3244323192.168.2.23106.217.38.243
      May 14, 2022 04:06:47.649625063 CEST3244323192.168.2.23213.149.54.237
      May 14, 2022 04:06:47.649646044 CEST3244323192.168.2.23136.152.202.182
      May 14, 2022 04:06:47.649662971 CEST3244323192.168.2.23246.41.209.242
      May 14, 2022 04:06:47.649665117 CEST3244323192.168.2.23216.206.132.166
      May 14, 2022 04:06:47.649671078 CEST3244323192.168.2.2393.145.222.200
      May 14, 2022 04:06:47.649676085 CEST3244323192.168.2.2343.189.64.76
      May 14, 2022 04:06:47.649687052 CEST3244323192.168.2.23152.140.126.31
      May 14, 2022 04:06:47.649701118 CEST3244323192.168.2.23242.147.110.117
      May 14, 2022 04:06:47.649705887 CEST3244323192.168.2.2363.169.226.62
      May 14, 2022 04:06:47.649707079 CEST3244323192.168.2.23120.186.49.8
      May 14, 2022 04:06:47.649719954 CEST3244323192.168.2.2376.1.90.95
      May 14, 2022 04:06:47.649734020 CEST3244323192.168.2.23101.16.255.230
      May 14, 2022 04:06:47.649734974 CEST3244323192.168.2.23180.241.64.96
      May 14, 2022 04:06:47.649745941 CEST3244323192.168.2.23196.130.242.76
      May 14, 2022 04:06:47.649779081 CEST3244323192.168.2.2387.219.35.54
      May 14, 2022 04:06:47.649797916 CEST3244323192.168.2.23243.248.0.5
      May 14, 2022 04:06:47.649808884 CEST3244323192.168.2.23206.96.219.213
      May 14, 2022 04:06:47.649820089 CEST3244323192.168.2.23204.48.209.151
      May 14, 2022 04:06:47.649836063 CEST3244323192.168.2.23177.49.126.125
      May 14, 2022 04:06:47.649842024 CEST3244323192.168.2.23120.57.198.94
      May 14, 2022 04:06:47.649852991 CEST3244323192.168.2.2396.86.42.255
      May 14, 2022 04:06:47.649867058 CEST3244323192.168.2.2378.244.164.235
      May 14, 2022 04:06:47.649871111 CEST3244323192.168.2.23196.124.245.95
      May 14, 2022 04:06:47.649884939 CEST3244323192.168.2.23111.4.207.39
      May 14, 2022 04:06:47.649898052 CEST3244323192.168.2.2374.5.123.44
      May 14, 2022 04:06:47.649899006 CEST3244323192.168.2.23204.229.212.180
      May 14, 2022 04:06:47.649910927 CEST3244323192.168.2.2314.173.89.122
      May 14, 2022 04:06:47.653451920 CEST3244323192.168.2.2352.255.19.210
      May 14, 2022 04:06:47.653487921 CEST3244323192.168.2.2381.110.79.148
      May 14, 2022 04:06:47.653500080 CEST3244323192.168.2.2392.173.20.82
      May 14, 2022 04:06:47.653507948 CEST3244323192.168.2.23205.150.211.112
      May 14, 2022 04:06:47.653526068 CEST3244323192.168.2.23112.132.129.238
      May 14, 2022 04:06:47.653527021 CEST3244323192.168.2.2373.223.213.175
      May 14, 2022 04:06:47.653544903 CEST3244323192.168.2.2379.54.60.235
      May 14, 2022 04:06:47.653553009 CEST3244323192.168.2.23154.21.85.34
      May 14, 2022 04:06:47.653559923 CEST3244323192.168.2.23171.26.120.57
      May 14, 2022 04:06:47.653568983 CEST3244323192.168.2.23194.49.84.7
      May 14, 2022 04:06:47.653590918 CEST3244323192.168.2.23175.172.90.242
      May 14, 2022 04:06:47.653592110 CEST3244323192.168.2.2332.127.243.128
      May 14, 2022 04:06:47.653594971 CEST3244323192.168.2.23170.17.160.193
      May 14, 2022 04:06:47.653599024 CEST3244323192.168.2.23217.254.86.172
      May 14, 2022 04:06:47.653610945 CEST3244323192.168.2.23208.29.163.165
      May 14, 2022 04:06:47.653611898 CEST3244323192.168.2.2342.179.104.4
      May 14, 2022 04:06:47.653620958 CEST3244323192.168.2.23125.107.88.197
      May 14, 2022 04:06:47.653635025 CEST3244323192.168.2.23130.239.118.166
      May 14, 2022 04:06:47.653636932 CEST3244323192.168.2.23254.240.91.4
      May 14, 2022 04:06:47.653655052 CEST3244323192.168.2.23117.142.14.183
      May 14, 2022 04:06:47.653661013 CEST3244323192.168.2.23205.133.77.82
      May 14, 2022 04:06:47.653671026 CEST3244323192.168.2.23155.50.19.164
      May 14, 2022 04:06:47.653682947 CEST3244323192.168.2.2382.24.191.155

      System Behavior

      General

      Start time:04:06:46
      Start date:14/05/2022
      Path:/tmp/0vFX7VXc9U
      Arguments:/tmp/0vFX7VXc9U
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:04:06:47
      Start date:14/05/2022
      Path:/tmp/0vFX7VXc9U
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:04:06:47
      Start date:14/05/2022
      Path:/tmp/0vFX7VXc9U
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:04:06:47
      Start date:14/05/2022
      Path:/tmp/0vFX7VXc9U
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:04:06:47
      Start date:14/05/2022
      Path:/tmp/0vFX7VXc9U
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:04:06:47
      Start date:14/05/2022
      Path:/tmp/0vFX7VXc9U
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      General

      Start time:04:06:47
      Start date:14/05/2022
      Path:/tmp/0vFX7VXc9U
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1