Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
csqe8VS0YI

Overview

General Information

Sample Name:csqe8VS0YI
Analysis ID:626473
MD5:beae05ed2e1e2189d5f44fe5fe95111a
SHA1:ad4d569675210467533e6093f3b13f805c860a28
SHA256:a5cb465d21d9171b83bbbb658bbea9c875e421e37603f5e576c6387570fed6c6
Tags:32elfmiraimotorola
Infos:

Detection

Mirai
Score:60
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626473
Start date and time: 14/05/202204:14:292022-05-14 04:14:29 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 41s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:csqe8VS0YI
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal60.troj.lin@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/csqe8VS0YI
PID:6230
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: csqe8VS0YIVirustotal: Detection: 54%Perma Link

    Networking

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58834
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58842
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58844
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58848
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58858
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58864
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58868
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58870
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58874
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58876
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36090
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36092
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36094
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36098
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36100
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36104
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36108
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36110
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36112
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36118
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46728
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46730
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46732
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46734
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46738
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46744
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46756
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46768
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46780
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46782
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37450
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37456
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37464
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37484
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37492
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37498
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37502
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37510
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37520
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37532
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 49996
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50000
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50006
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50008
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50012
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50016
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50018
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50026
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50028
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50030
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
    Source: /tmp/csqe8VS0YI (PID: 6232)Socket: 0.0.0.0::0
    Source: /tmp/csqe8VS0YI (PID: 6238)Socket: 0.0.0.0::0
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 107.172.197.117
    Source: unknownTCP traffic detected without corresponding DNS query: 13.0.164.21
    Source: unknownTCP traffic detected without corresponding DNS query: 109.74.44.219
    Source: unknownTCP traffic detected without corresponding DNS query: 91.146.53.149
    Source: unknownTCP traffic detected without corresponding DNS query: 200.3.132.206
    Source: unknownTCP traffic detected without corresponding DNS query: 40.130.28.180
    Source: unknownTCP traffic detected without corresponding DNS query: 57.50.234.50
    Source: unknownTCP traffic detected without corresponding DNS query: 84.225.48.252
    Source: unknownTCP traffic detected without corresponding DNS query: 87.116.152.152
    Source: unknownTCP traffic detected without corresponding DNS query: 16.40.254.63
    Source: unknownTCP traffic detected without corresponding DNS query: 109.221.53.232
    Source: unknownTCP traffic detected without corresponding DNS query: 125.158.147.235
    Source: unknownTCP traffic detected without corresponding DNS query: 180.235.64.76
    Source: unknownTCP traffic detected without corresponding DNS query: 119.114.96.176
    Source: unknownTCP traffic detected without corresponding DNS query: 254.156.93.201
    Source: unknownTCP traffic detected without corresponding DNS query: 200.12.231.204
    Source: unknownTCP traffic detected without corresponding DNS query: 170.237.5.40
    Source: unknownTCP traffic detected without corresponding DNS query: 20.137.109.105
    Source: unknownTCP traffic detected without corresponding DNS query: 12.150.146.55
    Source: unknownTCP traffic detected without corresponding DNS query: 155.29.204.24
    Source: unknownTCP traffic detected without corresponding DNS query: 188.213.44.241
    Source: unknownTCP traffic detected without corresponding DNS query: 249.23.145.34
    Source: unknownTCP traffic detected without corresponding DNS query: 200.18.228.173
    Source: unknownTCP traffic detected without corresponding DNS query: 75.41.202.169
    Source: unknownTCP traffic detected without corresponding DNS query: 126.105.222.202
    Source: unknownTCP traffic detected without corresponding DNS query: 153.70.148.14
    Source: unknownTCP traffic detected without corresponding DNS query: 23.23.94.132
    Source: unknownTCP traffic detected without corresponding DNS query: 65.213.102.187
    Source: unknownTCP traffic detected without corresponding DNS query: 207.168.78.221
    Source: unknownTCP traffic detected without corresponding DNS query: 48.40.215.16
    Source: unknownTCP traffic detected without corresponding DNS query: 240.52.146.115
    Source: unknownTCP traffic detected without corresponding DNS query: 92.232.247.111
    Source: unknownTCP traffic detected without corresponding DNS query: 196.172.39.72
    Source: unknownTCP traffic detected without corresponding DNS query: 178.149.134.76
    Source: unknownTCP traffic detected without corresponding DNS query: 126.44.231.157
    Source: unknownTCP traffic detected without corresponding DNS query: 141.194.26.246
    Source: unknownTCP traffic detected without corresponding DNS query: 87.78.65.88
    Source: unknownTCP traffic detected without corresponding DNS query: 219.200.159.231
    Source: unknownTCP traffic detected without corresponding DNS query: 170.246.202.65
    Source: unknownTCP traffic detected without corresponding DNS query: 59.36.111.29
    Source: unknownTCP traffic detected without corresponding DNS query: 200.244.143.83
    Source: unknownTCP traffic detected without corresponding DNS query: 216.72.26.76
    Source: unknownTCP traffic detected without corresponding DNS query: 60.205.3.37
    Source: unknownTCP traffic detected without corresponding DNS query: 174.243.166.20
    Source: unknownTCP traffic detected without corresponding DNS query: 121.65.191.75
    Source: unknownTCP traffic detected without corresponding DNS query: 247.197.213.37
    Source: unknownTCP traffic detected without corresponding DNS query: 60.139.134.173
    Source: unknownTCP traffic detected without corresponding DNS query: 190.182.241.250
    Source: unknownTCP traffic detected without corresponding DNS query: 191.61.152.28
    Source: unknownTCP traffic detected without corresponding DNS query: 251.42.123.253
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: /tmp/csqe8VS0YI (PID: 6232)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/csqe8VS0YI (PID: 6238)SIGKILL sent: pid: 936, result: successful
    Source: classification engineClassification label: mal60.troj.lin@0/0@0/0
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/491/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/793/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/772/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/796/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/774/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/797/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/777/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/799/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/658/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/912/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/759/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/936/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/918/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/1/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/761/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/785/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/884/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/720/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/721/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/788/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/789/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/800/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/801/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/847/fd
    Source: /tmp/csqe8VS0YI (PID: 6232)File opened: /proc/904/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/491/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/793/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/772/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/796/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/774/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/797/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/777/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/799/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/658/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/912/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/759/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/936/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/918/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/1/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/761/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/785/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/884/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/720/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/721/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/788/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/789/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/800/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/801/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/847/fd
    Source: /tmp/csqe8VS0YI (PID: 6238)File opened: /proc/904/fd

    Hooking and other Techniques for Hiding and Protection

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58834
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58842
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58844
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58848
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58858
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58864
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58868
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58870
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58874
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 58876
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36090
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36092
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36094
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36098
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36100
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36104
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36108
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36110
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36112
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36118
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46728
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46730
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46732
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46734
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46738
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46744
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46756
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46768
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46780
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46782
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37450
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37456
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37464
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37484
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37492
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37498
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37502
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37510
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37520
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37532
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 49996
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50000
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50006
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50008
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50012
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50016
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50018
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50026
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50028
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50030
    Source: /tmp/csqe8VS0YI (PID: 6230)Queries kernel information via 'uname':
    Source: csqe8VS0YI, 6230.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6232.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6329.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6347.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6335.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6233.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6340.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6239.1.000000002ca05d23.00000000ffe813ce.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/m68k
    Source: csqe8VS0YI, 6230.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6232.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6329.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6347.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6335.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6233.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6340.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6239.1.000000008aa52aac.000000001b30196b.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
    Source: csqe8VS0YI, 6230.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6232.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6329.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6347.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6335.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6233.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6340.1.000000002ca05d23.00000000ffe813ce.rw-.sdmp, csqe8VS0YI, 6239.1.000000002ca05d23.00000000ffe813ce.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
    Source: csqe8VS0YI, 6230.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6232.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6329.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6347.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6335.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6233.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6340.1.000000008aa52aac.000000001b30196b.rw-.sdmp, csqe8VS0YI, 6239.1.000000008aa52aac.000000001b30196b.rw-.sdmpBinary or memory string: Piyx86_64/usr/bin/qemu-m68k/tmp/csqe8VS0YISUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/csqe8VS0YI

    Stealing of Sensitive Information

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
    OS Credential Dumping    		11
    Security Software Discovery    		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626473 Sample: csqe8VS0YI Startdate: 14/05/2022 Architecture: LINUX Score: 60 42 209.252.203.215, 23 WINDSTREAMUS United States 2->42 44 193.240.171.255 WEST-IP-COMMUNICATIONSUS United Kingdom 2->44 46 98 other IPs or domains 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Mirai 2->50 52 Uses known network protocols on non-standard ports 2->52 10 csqe8VS0YI 2->10         started        signatures3 process4 process5 12 csqe8VS0YI 10->12         started        14 csqe8VS0YI 10->14         started        16 csqe8VS0YI 10->16         started        process6 18 csqe8VS0YI 12->18         started        20 csqe8VS0YI 12->20         started        22 csqe8VS0YI 14->22         started        24 csqe8VS0YI 14->24         started        26 csqe8VS0YI 14->26         started        process7 28 csqe8VS0YI 18->28         started        30 csqe8VS0YI 18->30         started        32 csqe8VS0YI 18->32         started        34 csqe8VS0YI 22->34         started        36 csqe8VS0YI 22->36         started        process8 38 csqe8VS0YI 28->38         started        40 csqe8VS0YI 28->40         started       

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    csqe8VS0YI54%VirustotalBrowse

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    158.192.236.239
    		unknownFrance
    		9159CreditAgricoleFRfalse
    47.238.157.74
    		unknownUnited States
    		20115CHARTER-20115USfalse
    23.71.43.196
    		unknownUnited States
    		7922COMCAST-7922USfalse
    145.209.166.104
    		unknownNetherlands
    		1101IP-EEND-ASIP-EENDBVNLfalse
    60.117.131.82
    		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
    76.106.206.30
    		unknownUnited States
    		7922COMCAST-7922USfalse
    182.248.57.101
    		unknownJapan2516KDDIKDDICORPORATIONJPfalse
    220.104.136.94
    		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
    36.253.250.150
    		unknownNepal
    		38565NCELL-AS-NPNcellPvtLtdNPfalse
    90.251.212.247
    		unknownUnited Kingdom
    		5378VodafoneGBfalse
    253.30.98.154
    		unknownReserved
    		unknownunknownfalse
    53.189.202.203
    		unknownGermany
    		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
    60.86.254.10
    		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
    69.142.24.95
    		unknownUnited States
    		7922COMCAST-7922USfalse
    196.102.183.56
    		unknownKenya
    		33771SAFARICOM-LIMITEDKEfalse
    121.126.241.161
    		unknownKorea Republic of
    		4766KIXS-AS-KRKoreaTelecomKRfalse
    63.211.32.11
    		unknownUnited States
    		3356LEVEL3USfalse
    167.20.171.244
    		unknownUnited States
    		11273FDCSGNETUSfalse
    78.36.89.177
    		unknownRussian Federation
    		12389ROSTELECOM-ASRUfalse
    125.137.19.123
    		unknownKorea Republic of
    		4766KIXS-AS-KRKoreaTelecomKRfalse
    194.96.24.204
    		unknownAustria
    		1901EUNETAT-ASA1TelekomAustriaAGATfalse
    16.66.203.61
    		unknownUnited States
    		unknownunknownfalse
    157.25.81.76
    		unknownPoland
    		5588GTSCEGTSCentralEuropeAntelGermanyCZfalse
    78.119.21.74
    		unknownFrance
    		8228CEGETEL-ASFRfalse
    71.119.37.51
    		unknownUnited States
    		701UUNETUSfalse
    61.58.244.28
    		unknownTaiwan; Republic of China (ROC)
    		9676SAVECOM-TWSaveComInternationIncTWfalse
    110.90.152.15
    		unknownChina
    		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
    191.64.65.243
    		unknownColombia
    		26611COMCELSACOfalse
    157.247.81.176
    		unknownAustria
    		8447TELEKOM-ATA1TelekomAustriaAGATfalse
    164.171.252.182
    		unknownUnited States
    		22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
    157.169.11.71
    		unknownFrance
    		2418FR-ASNBLOCK2FR-MAN-SOPHIA-ANTIPOLISEUfalse
    247.23.178.56
    		unknownReserved
    		unknownunknownfalse
    199.77.160.247
    		unknownUnited States
    		3549LVLT-3549USfalse
    141.72.50.93
    		unknownGermany
    		553BELWUEBelWue-KoordinationEUfalse
    197.2.168.196
    		unknownTunisia
    		37705TOPNETTNfalse
    122.93.82.223
    		unknownChina
    		9394CTTNETChinaTieTongTelecommunicationsCorporationCNfalse
    57.198.102.60
    		unknownBelgium
    		2686ATGS-MMD-ASUSfalse
    171.206.181.115
    		unknownUnited States
    		10794BANKAMERICAUSfalse
    72.12.236.220
    		unknownUnited States
    		23175POGOZONEUSfalse
    5.106.241.192
    		unknownIran (ISLAMIC Republic Of)
    		197207MCCI-ASIRfalse
    117.142.77.183
    		unknownChina
    		56040CMNET-GUANGDONG-APChinaMobilecommunicationscorporationfalse
    185.57.37.79
    		unknownUnited Kingdom
    		202206MOTIVEGBfalse
    4.45.158.73
    		unknownUnited States
    		3356LEVEL3USfalse
    86.9.17.184
    		unknownUnited Kingdom
    		5089NTLGBfalse
    175.253.176.76
    		unknownKorea Republic of
    		4766KIXS-AS-KRKoreaTelecomKRfalse
    149.22.102.39
    		unknownUnited States
    		48945IFNL-ASGBfalse
    123.213.36.98
    		unknownKorea Republic of
    		9318SKB-ASSKBroadbandCoLtdKRfalse
    193.240.171.255
    		unknownUnited Kingdom
    		32880WEST-IP-COMMUNICATIONSUSfalse
    46.225.224.140
    		unknownIran (ISLAMIC Republic Of)
    		56402DADEHGOSTAR-ASAS12880-DataCommunicationCompanyofIranfalse
    77.37.132.41
    		unknownRussian Federation
    		42610NCNET-ASRUfalse
    82.13.54.81
    		unknownUnited Kingdom
    		5089NTLGBfalse
    108.243.44.253
    		unknownUnited States
    		7018ATT-INTERNET4USfalse
    253.11.226.229
    		unknownReserved
    		unknownunknownfalse
    212.63.201.26
    		unknownSweden
    		30880SPACEDUMP-ASThisASNislocatedonSTHIXatTulegatanStokafalse
    43.90.242.228
    		unknownJapan4249LILLY-ASUSfalse
    217.171.229.85
    		unknownNetherlands
    		39647REDHOSTING-ASNLfalse
    130.172.61.17
    		unknownUnited States
    		12173UAUSfalse
    186.253.253.55
    		unknownBrazil
    		26615TIMSABRfalse
    82.41.252.140
    		unknownUnited Kingdom
    		5089NTLGBfalse
    101.196.10.60
    		unknownChina
    		58519CHINATELECOM-CTCLOUDCloudComputingCorporationCNfalse
    78.0.185.207
    		unknownCroatia (LOCAL Name: Hrvatska)
    		5391T-HTCroatianTelecomIncHRfalse
    37.140.115.105
    		unknownRussian Federation
    		8369INTERSVYAZ-AS38-BKomsomolskyprospektRUfalse
    168.92.214.232
    		unknownUnited States
    		2707FIRSTCOMM-AS1USfalse
    133.30.102.10
    		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
    218.174.111.179
    		unknownTaiwan; Republic of China (ROC)
    		3462HINETDataCommunicationBusinessGroupTWfalse
    121.47.14.242
    		unknownChina
    		9811BJGYsritcorpbeijingCNfalse
    154.23.227.237
    		unknownUnited States
    		174COGENT-174USfalse
    172.50.129.167
    		unknownUnited States
    		21928T-MOBILE-AS21928USfalse
    47.177.246.214
    		unknownUnited States
    		5650FRONTIER-FRTRUSfalse
    131.2.148.22
    		unknownUnited States
    		61458GOBIERNOAUTONOMOMUNICIPALDELAPAZBOfalse
    16.80.45.102
    		unknownUnited States
    		unknownunknownfalse
    222.58.250.219
    		unknownChina
    		9394CTTNETChinaTieTongTelecommunicationsCorporationCNfalse
    38.216.139.33
    		unknownUnited States
    		174COGENT-174USfalse
    211.77.208.95
    		unknownTaiwan; Republic of China (ROC)
    		9674FET-TWFarEastToneTelecommunicationCoLtdTWfalse
    168.222.253.144
    		unknownUnited States
    		2386INS-ASUSfalse
    77.75.95.129
    		unknownLebanon
    		43019FARAHNETLBfalse
    20.87.29.200
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    88.75.86.235
    		unknownGermany
    		3209VODANETInternationalIP-BackboneofVodafoneDEfalse
    157.194.75.140
    		unknownUnited States
    		4704SANNETRakutenMobileIncJPfalse
    121.84.13.175
    		unknownJapan17511OPTAGEOPTAGEIncJPfalse
    187.211.112.31
    		unknownMexico
    		8151UninetSAdeCVMXfalse
    180.79.223.180
    		unknownChina
    		17429BGCTVNETBEIJINGGEHUACATVNETWORKCOLTDCNfalse
    14.136.29.157
    		unknownHong Kong
    		9269HKBN-AS-APHongKongBroadbandNetworkLtdHKfalse
    43.24.50.81
    		unknownJapan4249LILLY-ASUSfalse
    253.191.50.137
    		unknownReserved
    		unknownunknownfalse
    151.102.159.77
    		unknownUnited States
    		32104WELLMONT-TNUSfalse
    206.215.223.109
    		unknownUnited States
    		11139CWC-ROC-11139DMfalse
    249.32.109.223
    		unknownReserved
    		unknownunknownfalse
    192.156.4.224
    		unknownUnited States
    		721DNIC-ASBLK-00721-00726USfalse
    113.2.23.226
    		unknownChina
    		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
    39.26.92.198
    		unknownKorea Republic of
    		4766KIXS-AS-KRKoreaTelecomKRfalse
    199.98.250.182
    		unknownUnited States
    		174COGENT-174USfalse
    209.252.203.215
    		unknownUnited States
    		7029WINDSTREAMUSfalse
    63.251.15.172
    		unknownUnited States
    		32475SINGLEHOP-LLCUSfalse
    184.134.171.230
    		unknownUnited States
    		5778CENTURYLINK-LEGACY-EMBARQ-RCMTUSfalse
    35.188.132.78
    		unknownUnited States
    		15169GOOGLEUSfalse
    5.10.3.237
    		unknownGermany
    		198726KOMDSLDEfalse
    84.244.129.204
    		unknownNetherlands
    		20495WEDAREwd6NETBVNLfalse
    208.127.60.11
    		unknownUnited States
    		396982GOOGLE-PRIVATE-CLOUDUSfalse
    75.112.13.129
    		unknownUnited States
    		33363BHN-33363USfalse

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    ⊘No context

    ASNs

    ⊘No context

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    ⊘No created / dropped files found

    Static File Info

    General

    File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
    Entropy (8bit):6.212939322901568
    TrID:
    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
    File name:csqe8VS0YI
    File size:53056
    MD5:beae05ed2e1e2189d5f44fe5fe95111a
    SHA1:ad4d569675210467533e6093f3b13f805c860a28
    SHA256:a5cb465d21d9171b83bbbb658bbea9c875e421e37603f5e576c6387570fed6c6
    SHA512:950a85fe50fed766415ba25b66a321eb59ed39332815d1a3c2297549f7a68aca90fff3e7ef20c58aa0a7382c64360dc1141fbe6dfa66556931ce1d1d8c0142ea
    SSDEEP:768:mLGOe2kf9e9X9nberzI2vcv/QP3w5gFHviPuzWeHXpi2UJTMDnH638g5:mL/4f8F1eB0ApFvimzpZi2UJanHY8A
    TLSH:A8333ADAB902AD7DF98BEABE80170E0AB23123541053073777EBFC937E321549956E46
    File Content Preview:.ELF.......................D...4.........4. ...(.................................. ....................p.......... .dt.Q............................NV..a....da.....N^NuNV..J9...pf>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X........pN^NuNV..N^NuN

    Static ELF Info

    ELF header

    Class:ELF32
    Data:2's complement, big endian
    Version:1 (current)
    Machine:MC68000
    Version Number:0x1
    Type:EXEC (Executable file)
    OS/ABI:UNIX - System V
    ABI Version:0
    Entry Point Address:0x80000144
    Flags:0x0
    ELF Header Size:52
    Program Header Offset:52
    Program Header Size:32
    Number of Program Headers:3
    Section Header Offset:52656
    Section Header Size:40
    Number of Section Headers:10
    Header String Table Index:9

    Sections

    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
    NULL0x00x00x00x00x0000
    .initPROGBITS0x800000940x940x140x00x6AX002
    .textPROGBITS0x800000a80xa80xc5d60x00x6AX004
    .finiPROGBITS0x8000c67e0xc67e0xe0x00x6AX002
    .rodataPROGBITS0x8000c68c0xc68c0x56e0x00x2A002
    .ctorsPROGBITS0x8000ec000xcc000x80x00x3WA004
    .dtorsPROGBITS0x8000ec080xcc080x80x00x3WA004
    .dataPROGBITS0x8000ec140xcc140x15c0x00x3WA004
    .bssNOBITS0x8000ed700xcd700x23c0x00x3WA004
    .shstrtabSTRTAB0x00xcd700x3e0x00x0001

    Program Segments

    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
    LOAD0x00x800000000x800000000xcbfa0xcbfa4.23270x5R E0x2000.init .text .fini .rodata
    LOAD0xcc000x8000ec000x8000ec000x1700x3ac0.27750x6RW 0x2000.ctors .dtors .data .bss
    GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

    Network Behavior

    Network Port Distribution

    TCP Packets

    TimestampSource PortDest PortSource IPDest IP
    May 14, 2022 04:15:14.904967070 CEST609881312192.168.2.23107.172.197.117
    May 14, 2022 04:15:14.959037066 CEST4232523192.168.2.2313.0.164.21
    May 14, 2022 04:15:14.959187984 CEST4232523192.168.2.23109.74.44.219
    May 14, 2022 04:15:14.959194899 CEST4232523192.168.2.2391.146.53.149
    May 14, 2022 04:15:14.959196091 CEST4232523192.168.2.23200.3.132.206
    May 14, 2022 04:15:14.959227085 CEST4232523192.168.2.2340.130.28.180
    May 14, 2022 04:15:14.959243059 CEST4232523192.168.2.2357.50.234.50
    May 14, 2022 04:15:14.959252119 CEST4232523192.168.2.2384.225.48.252
    May 14, 2022 04:15:14.959259987 CEST4232523192.168.2.2387.116.152.152
    May 14, 2022 04:15:14.959275961 CEST4232523192.168.2.2316.40.254.63
    May 14, 2022 04:15:14.959295034 CEST4232523192.168.2.23109.221.53.232
    May 14, 2022 04:15:14.959325075 CEST4232523192.168.2.23125.158.147.235
    May 14, 2022 04:15:14.959325075 CEST4232523192.168.2.23180.235.64.76
    May 14, 2022 04:15:14.959336996 CEST4232523192.168.2.23119.114.96.176
    May 14, 2022 04:15:14.959342957 CEST4232523192.168.2.23254.156.93.201
    May 14, 2022 04:15:14.959351063 CEST4232523192.168.2.23200.12.231.204
    May 14, 2022 04:15:14.959351063 CEST4232523192.168.2.23170.237.5.40
    May 14, 2022 04:15:14.959353924 CEST4232523192.168.2.2320.137.109.105
    May 14, 2022 04:15:14.959374905 CEST4232523192.168.2.2312.150.146.55
    May 14, 2022 04:15:14.959374905 CEST4232523192.168.2.23155.29.204.24
    May 14, 2022 04:15:14.959379911 CEST4232523192.168.2.23188.213.44.241
    May 14, 2022 04:15:14.959427118 CEST4232523192.168.2.23249.23.145.34
    May 14, 2022 04:15:14.959455013 CEST4232523192.168.2.23200.18.228.173
    May 14, 2022 04:15:14.959469080 CEST4232523192.168.2.2375.41.202.169
    May 14, 2022 04:15:14.959496975 CEST4232523192.168.2.23126.105.222.202
    May 14, 2022 04:15:14.959521055 CEST4232523192.168.2.23153.70.148.14
    May 14, 2022 04:15:14.959546089 CEST4232523192.168.2.2323.23.94.132
    May 14, 2022 04:15:14.959573030 CEST4232523192.168.2.2365.213.102.187
    May 14, 2022 04:15:14.959614992 CEST4232523192.168.2.23207.168.78.221
    May 14, 2022 04:15:14.959631920 CEST4232523192.168.2.2348.40.215.16
    May 14, 2022 04:15:14.959657907 CEST4232523192.168.2.23240.52.146.115
    May 14, 2022 04:15:14.959662914 CEST4232523192.168.2.2392.232.247.111
    May 14, 2022 04:15:14.959681034 CEST4232523192.168.2.23196.172.39.72
    May 14, 2022 04:15:14.959709883 CEST4232523192.168.2.23178.149.134.76
    May 14, 2022 04:15:14.959732056 CEST4232523192.168.2.23126.44.231.157
    May 14, 2022 04:15:14.959733963 CEST4232523192.168.2.23141.194.26.246
    May 14, 2022 04:15:14.959736109 CEST4232523192.168.2.2387.78.65.88
    May 14, 2022 04:15:14.959772110 CEST4232523192.168.2.23219.200.159.231
    May 14, 2022 04:15:14.959777117 CEST4232523192.168.2.23170.246.202.65
    May 14, 2022 04:15:14.959781885 CEST4232523192.168.2.2359.36.111.29
    May 14, 2022 04:15:14.959799051 CEST4232523192.168.2.23200.244.143.83
    May 14, 2022 04:15:14.959810972 CEST4232523192.168.2.23216.72.26.76
    May 14, 2022 04:15:14.959829092 CEST4232523192.168.2.2360.205.3.37
    May 14, 2022 04:15:14.959826946 CEST4232523192.168.2.23174.243.166.20
    May 14, 2022 04:15:14.959840059 CEST4232523192.168.2.23121.65.191.75
    May 14, 2022 04:15:14.959846973 CEST4232523192.168.2.23247.197.213.37
    May 14, 2022 04:15:14.959847927 CEST4232523192.168.2.2360.139.134.173
    May 14, 2022 04:15:14.959853888 CEST4232523192.168.2.23190.182.241.250
    May 14, 2022 04:15:14.959862947 CEST4232523192.168.2.23191.61.152.28
    May 14, 2022 04:15:14.959867001 CEST4232523192.168.2.23251.42.123.253
    May 14, 2022 04:15:14.959867954 CEST4232523192.168.2.2360.123.110.201
    May 14, 2022 04:15:14.959880114 CEST4232523192.168.2.23109.42.1.50
    May 14, 2022 04:15:14.959883928 CEST4232523192.168.2.23101.216.131.38
    May 14, 2022 04:15:14.959894896 CEST4232523192.168.2.2336.61.244.68
    May 14, 2022 04:15:14.959906101 CEST4232523192.168.2.23196.165.59.180
    May 14, 2022 04:15:14.959908962 CEST4232523192.168.2.2357.105.242.240
    May 14, 2022 04:15:14.959914923 CEST4232523192.168.2.239.6.80.81
    May 14, 2022 04:15:14.959933996 CEST4232523192.168.2.23149.229.171.126
    May 14, 2022 04:15:14.959980011 CEST4232523192.168.2.23183.75.208.148
    May 14, 2022 04:15:14.959981918 CEST4232523192.168.2.2369.69.73.25
    May 14, 2022 04:15:14.959984064 CEST4232523192.168.2.2372.100.17.186
    May 14, 2022 04:15:14.959994078 CEST4232523192.168.2.23165.107.202.137
    May 14, 2022 04:15:14.960017920 CEST4232523192.168.2.23152.36.230.131
    May 14, 2022 04:15:14.960022926 CEST4232523192.168.2.23150.152.199.77
    May 14, 2022 04:15:14.960046053 CEST4232523192.168.2.23120.62.103.182
    May 14, 2022 04:15:14.960068941 CEST4232523192.168.2.2396.211.15.31
    May 14, 2022 04:15:14.960073948 CEST4232523192.168.2.2337.186.116.2
    May 14, 2022 04:15:14.960093021 CEST4232523192.168.2.2384.49.28.141
    May 14, 2022 04:15:14.960103035 CEST4232523192.168.2.23125.34.129.240
    May 14, 2022 04:15:14.960115910 CEST4232523192.168.2.23126.16.148.163
    May 14, 2022 04:15:14.960216999 CEST4232523192.168.2.2313.151.80.119
    May 14, 2022 04:15:14.960248947 CEST4232523192.168.2.2341.16.169.156
    May 14, 2022 04:15:14.960257053 CEST4232523192.168.2.23171.195.93.106
    May 14, 2022 04:15:14.960269928 CEST4232523192.168.2.23118.45.189.65
    May 14, 2022 04:15:14.960292101 CEST4232523192.168.2.23152.10.123.104
    May 14, 2022 04:15:14.960311890 CEST4232523192.168.2.2335.110.131.37
    May 14, 2022 04:15:14.960321903 CEST4232523192.168.2.23107.249.44.203
    May 14, 2022 04:15:14.960335016 CEST4232523192.168.2.23163.208.148.211
    May 14, 2022 04:15:14.960344076 CEST4232523192.168.2.23250.41.230.109
    May 14, 2022 04:15:14.960346937 CEST4232523192.168.2.23164.61.94.18
    May 14, 2022 04:15:14.960349083 CEST4232523192.168.2.23149.171.126.223
    May 14, 2022 04:15:14.960360050 CEST4232523192.168.2.23149.78.217.189
    May 14, 2022 04:15:14.960361004 CEST4232523192.168.2.2362.60.170.135
    May 14, 2022 04:15:14.960362911 CEST4232523192.168.2.23116.6.209.241
    May 14, 2022 04:15:14.960391998 CEST4232523192.168.2.23153.50.83.201
    May 14, 2022 04:15:14.960400105 CEST4232523192.168.2.2344.202.88.106
    May 14, 2022 04:15:14.960423946 CEST4232523192.168.2.23195.100.56.41
    May 14, 2022 04:15:14.960433006 CEST4232523192.168.2.2383.188.126.129
    May 14, 2022 04:15:14.960449934 CEST4232523192.168.2.2340.255.135.233
    May 14, 2022 04:15:14.960468054 CEST4232523192.168.2.2334.96.173.160
    May 14, 2022 04:15:14.960481882 CEST4232523192.168.2.23102.177.42.145
    May 14, 2022 04:15:14.960525990 CEST4232523192.168.2.23144.22.24.218
    May 14, 2022 04:15:14.960529089 CEST4232523192.168.2.2360.192.178.63
    May 14, 2022 04:15:14.960550070 CEST4232523192.168.2.23178.0.108.10
    May 14, 2022 04:15:14.960580111 CEST4232523192.168.2.2363.111.61.158
    May 14, 2022 04:15:14.960588932 CEST4232523192.168.2.23167.168.103.109
    May 14, 2022 04:15:14.960599899 CEST4232523192.168.2.23191.55.43.90
    May 14, 2022 04:15:14.960618973 CEST4232523192.168.2.2343.134.190.188
    May 14, 2022 04:15:14.960623026 CEST4232523192.168.2.23211.36.146.121
    May 14, 2022 04:15:14.960628986 CEST4232523192.168.2.23207.170.160.198

    System Behavior

    General

    Start time:04:15:13
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:/tmp/csqe8VS0YI
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:15:13
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:05
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:05
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:05
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:10
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:10
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:05
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:05
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:15:13
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:15:13
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:15:13
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:05
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:18:05
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:15:13
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc

    General

    Start time:04:15:13
    Start date:14/05/2022
    Path:/tmp/csqe8VS0YI
    Arguments:n/a
    File size:4463432 bytes
    MD5 hash:cd177594338c77b895ae27c33f8f86cc