Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
IdTVrdi0dC

Overview

General Information

Sample Name:IdTVrdi0dC
Analysis ID:634906
MD5:4a6d63615986750505074e2fd62fb4ff
SHA1:0549d8ba0c4cd7cdeb4ebc37e9dacad3c7186c8f
SHA256:2eaced3f2dd6c845cc0cd8591a2d4959c20d45d3b1364195a7b42d4bf0879d91
Tags:32elfmiraipowerpc
Infos:

Detection

Mirai
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Sample is packed with UPX
Uses known network protocols on non-standard ports
Connects to many ports of the same IP (likely port scanning)
Sample contains only a LOAD segment without any section mappings
Yara signature match
Deletes log files
HTTP GET or POST without a user agent
Uses the "uname" system call to query kernel version information (possible evasion)
Executes commands using a shell command-line interpreter
Executes the "systemctl" command used for controlling the systemd system and service manager
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:634906
Start date and time: 27/05/202201:58:172022-05-27 01:58:17 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 24s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:IdTVrdi0dC
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal76.troj.evad.lin@0/53@0/0
  • Report size exceeded maximum capacity and may have missing network information.
  • VT rate limit hit for: http://185.44.81.114/bins/mips;
Command:/tmp/IdTVrdi0dC
PID:6293
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:
  • system is lnxubuntu20
  • systemd New Fork (PID: 6208, Parent: 1)
  • logrotate (PID: 6208, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf
    • gzip (PID: 6272, Parent: 6208, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip
    • sh (PID: 6273, Parent: 6208, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
      • sh New Fork (PID: 6274, Parent: 6273)
      • invoke-rc.d (PID: 6274, Parent: 6273, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart
        • runlevel (PID: 6275, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel
        • systemctl (PID: 6278, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service
        • ls (PID: 6279, Parent: 6274, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups
        • systemctl (PID: 6280, Parent: 6274, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service
    • gzip (PID: 6281, Parent: 6208, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip
    • sh (PID: 6282, Parent: 6208, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
      • sh New Fork (PID: 6283, Parent: 6282)
      • rsyslog-rotate (PID: 6283, Parent: 6282, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate
        • systemctl (PID: 6284, Parent: 6283, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service
  • systemd New Fork (PID: 6209, Parent: 1)
  • install (PID: 6209, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man
  • systemd New Fork (PID: 6249, Parent: 1)
  • find (PID: 6249, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
  • systemd New Fork (PID: 6277, Parent: 1)
  • mandb (PID: 6277, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet
  • cleanup
SourceRuleDescriptionAuthorStrings
IdTVrdi0dCSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0xa00c:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0xa07b:$s2: $Id: UPX
  • 0xa02c:$s3: $Info: This file is packed with the UPX executable packer
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    Timestamp:192.168.2.23156.244.81.14158806528692027339 05/27/22-01:59:36.594856
    SID:2027339
    Source Port:58806
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.238.54.10360812372152835222 05/27/22-01:59:24.080046
    SID:2835222
    Source Port:60812
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.33.10341864528692027339 05/27/22-01:59:27.282691
    SID:2027339
    Source Port:41864
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.238.58.24450826528692027339 05/27/22-02:01:55.686882
    SID:2027339
    Source Port:50826
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.90.22041412528692027339 05/27/22-02:01:24.819246
    SID:2027339
    Source Port:41412
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.111.15343688528692027339 05/27/22-02:02:36.420093
    SID:2027339
    Source Port:43688
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.230.26.5053942372152835222 05/27/22-02:00:48.185738
    SID:2835222
    Source Port:53942
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.235.98.5460298528692027339 05/27/22-02:02:03.588566
    SID:2027339
    Source Port:60298
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.13.11156632528692027339 05/27/22-02:02:28.936352
    SID:2027339
    Source Port:56632
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.87.18949872372152835222 05/27/22-02:01:06.220662
    SID:2835222
    Source Port:49872
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.239.152.5940308528692027339 05/27/22-02:01:21.193697
    SID:2027339
    Source Port:40308
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.77.19948134372152835222 05/27/22-02:01:06.437312
    SID:2835222
    Source Port:48134
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.86.12946264372152835222 05/27/22-02:02:18.660029
    SID:2835222
    Source Port:46264
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.230.28.8541732528692027339 05/27/22-02:00:19.002233
    SID:2027339
    Source Port:41732
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.106.12856702528692027339 05/27/22-02:01:11.642375
    SID:2027339
    Source Port:56702
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.230.22.3938096372152835222 05/27/22-02:00:16.837999
    SID:2835222
    Source Port:38096
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.105.12135478372152835222 05/27/22-02:01:56.434610
    SID:2835222
    Source Port:35478
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.127.8933082528692027339 05/27/22-02:01:11.692792
    SID:2027339
    Source Port:33082
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.107.17440134528692027339 05/27/22-02:00:15.088988
    SID:2027339
    Source Port:40134
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.9.8551482528692027339 05/27/22-01:59:14.781522
    SID:2027339
    Source Port:51482
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.106.3150638372152835222 05/27/22-02:00:15.083835
    SID:2835222
    Source Port:50638
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.92.11838502528692027339 05/27/22-01:59:45.871877
    SID:2027339
    Source Port:38502
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.124.13751360528692027339 05/27/22-02:00:46.025240
    SID:2027339
    Source Port:51360
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.247.26.4345236372152835222 05/27/22-01:59:23.853441
    SID:2835222
    Source Port:45236
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.230.19.4956760372152835222 05/27/22-02:00:33.943501
    SID:2835222
    Source Port:56760
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.102.4535730372152835222 05/27/22-02:01:54.932609
    SID:2835222
    Source Port:35730
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.48.19734100372152835222 05/27/22-02:00:08.376395
    SID:2835222
    Source Port:34100
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.245.62.16754588528692027339 05/27/22-02:00:19.890456
    SID:2027339
    Source Port:54588
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.86.19836702528692027339 05/27/22-02:00:35.358091
    SID:2027339
    Source Port:36702
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.78.9650658528692027339 05/27/22-02:00:11.610290
    SID:2027339
    Source Port:50658
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.74.18248786372152835222 05/27/22-01:59:44.097026
    SID:2835222
    Source Port:48786
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.95.9447898372152835222 05/27/22-02:02:06.304012
    SID:2835222
    Source Port:47898
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.52.2345700528692027339 05/27/22-02:01:58.218787
    SID:2027339
    Source Port:45700
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.91.9455170372152835222 05/27/22-02:00:17.323160
    SID:2835222
    Source Port:55170
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.122.12557538528692027339 05/27/22-02:00:35.351461
    SID:2027339
    Source Port:57538
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.74.5558358528692027339 05/27/22-02:02:21.920625
    SID:2027339
    Source Port:58358
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.115.25236214528692027339 05/27/22-01:59:30.621371
    SID:2027339
    Source Port:36214
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.224.24.19958360372152835222 05/27/22-01:59:34.881201
    SID:2835222
    Source Port:58360
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.78.25047808372152835222 05/27/22-02:01:59.662027
    SID:2835222
    Source Port:47808
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.82.15344694528692027339 05/27/22-02:01:58.247799
    SID:2027339
    Source Port:44694
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.41.16538674528692027339 05/27/22-01:59:15.425864
    SID:2027339
    Source Port:38674
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.92.4058054372152835222 05/27/22-02:00:25.009375
    SID:2835222
    Source Port:58054
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.234.227.14757440372152835222 05/27/22-02:01:55.609934
    SID:2835222
    Source Port:57440
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.106.24459616372152835222 05/27/22-01:59:12.396985
    SID:2835222
    Source Port:59616
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.2341.62.197.15951682372152835222 05/27/22-01:59:57.739942
    SID:2835222
    Source Port:51682
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.109.16240398528692027339 05/27/22-01:59:15.954194
    SID:2027339
    Source Port:40398
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.59.18246002528692027339 05/27/22-01:59:38.854059
    SID:2027339
    Source Port:46002
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.73.18634582528692027339 05/27/22-02:00:17.389933
    SID:2027339
    Source Port:34582
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.92.7152864528692027339 05/27/22-02:00:30.406969
    SID:2027339
    Source Port:52864
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.230.20.14348324528692027339 05/27/22-02:01:08.553112
    SID:2027339
    Source Port:48324
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.59.2146148528692027339 05/27/22-02:00:14.853376
    SID:2027339
    Source Port:46148
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.2341.78.122.21256684372152835222 05/27/22-02:01:37.012472
    SID:2835222
    Source Port:56684
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.15.19640402372152835222 05/27/22-01:59:20.356979
    SID:2835222
    Source Port:40402
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.85.13741602372152835222 05/27/22-02:00:07.712861
    SID:2835222
    Source Port:41602
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.224.15.11642572528692027339 05/27/22-02:00:37.881857
    SID:2027339
    Source Port:42572
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.91.10050030528692027339 05/27/22-02:00:18.551698
    SID:2027339
    Source Port:50030
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.70.15033964372152835222 05/27/22-01:59:34.757301
    SID:2835222
    Source Port:33964
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.247.17.7641420372152835222 05/27/22-02:01:13.912399
    SID:2835222
    Source Port:41420
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.64.14244396372152835222 05/27/22-02:00:29.460742
    SID:2835222
    Source Port:44396
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.84.3037158528692027339 05/27/22-02:01:06.103355
    SID:2027339
    Source Port:37158
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.234.231.8355454372152835222 05/27/22-01:59:47.462212
    SID:2835222
    Source Port:55454
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.58.14252614528692027339 05/27/22-02:01:55.460901
    SID:2027339
    Source Port:52614
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.69.21244796372152835222 05/27/22-02:00:07.160349
    SID:2835222
    Source Port:44796
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.2341.193.241.18951020528692027339 05/27/22-02:02:27.790700
    SID:2027339
    Source Port:51020
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.235.97.20942092528692027339 05/27/22-01:59:11.365155
    SID:2027339
    Source Port:42092
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.87.25341444528692027339 05/27/22-02:01:21.724866
    SID:2027339
    Source Port:41444
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.111.21334364372152835222 05/27/22-02:01:49.478596
    SID:2835222
    Source Port:34364
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.125.13759590528692027339 05/27/22-02:02:33.353508
    SID:2027339
    Source Port:59590
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.238.44.18340602372152835222 05/27/22-01:59:21.924982
    SID:2835222
    Source Port:40602
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.73.6741324372152835222 05/27/22-02:01:26.646996
    SID:2835222
    Source Port:41324
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.247.17.12945064372152835222 05/27/22-02:02:26.831090
    SID:2835222
    Source Port:45064
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.238.32.12940776372152835222 05/27/22-02:01:26.337550
    SID:2835222
    Source Port:40776
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.247.23.1940560372152835222 05/27/22-02:02:29.631312
    SID:2835222
    Source Port:40560
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.94.20449800372152835222 05/27/22-02:01:10.590932
    SID:2835222
    Source Port:49800
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.68.18940686528692027339 05/27/22-02:00:54.497921
    SID:2027339
    Source Port:40686
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.225.139.8359006528692027339 05/27/22-01:59:33.005431
    SID:2027339
    Source Port:59006
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.86.6052034372152835222 05/27/22-02:00:04.130060
    SID:2835222
    Source Port:52034
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.230.21.3951456372152835222 05/27/22-02:01:32.609232
    SID:2835222
    Source Port:51456
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.232.91.14047196372152835222 05/27/22-02:01:49.092359
    SID:2835222
    Source Port:47196
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.84.16442614372152835222 05/27/22-01:59:31.466307
    SID:2835222
    Source Port:42614
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.238.63.25155806372152835222 05/27/22-02:02:16.754251
    SID:2835222
    Source Port:55806
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23197.214.96.7640638528692027339 05/27/22-01:59:53.606556
    SID:2027339
    Source Port:40638
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.55.11643886372152835222 05/27/22-01:59:09.829867
    SID:2835222
    Source Port:43886
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.95.9744928372152835222 05/27/22-01:59:11.369422
    SID:2835222
    Source Port:44928
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.247.21.4256234372152835222 05/27/22-02:01:14.340412
    SID:2835222
    Source Port:56234
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.245.49.3060860372152835222 05/27/22-02:01:35.971454
    SID:2835222
    Source Port:60860
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.11.23657594528692027339 05/27/22-01:59:17.459127
    SID:2027339
    Source Port:57594
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.103.24836054372152835222 05/27/22-02:00:23.723270
    SID:2835222
    Source Port:36054
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23197.246.131.24551946372152835222 05/27/22-02:01:56.320167
    SID:2835222
    Source Port:51946
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.13.17332948372152835222 05/27/22-02:01:58.818532
    SID:2835222
    Source Port:32948
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.225.153.13438534528692027339 05/27/22-02:01:55.645339
    SID:2027339
    Source Port:38534
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.230.17.753602372152835222 05/27/22-02:00:57.236010
    SID:2835222
    Source Port:53602
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.90.17548954528692027339 05/27/22-02:01:12.861867
    SID:2027339
    Source Port:48954
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.225.153.11546282372152835222 05/27/22-02:00:30.753840
    SID:2835222
    Source Port:46282
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.83.20259496528692027339 05/27/22-01:59:50.344265
    SID:2027339
    Source Port:59496
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.48.21956620528692027339 05/27/22-02:01:12.803099
    SID:2027339
    Source Port:56620
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.64.9257610372152835222 05/27/22-01:59:29.238933
    SID:2835222
    Source Port:57610
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.119.15760482528692027339 05/27/22-01:59:39.082470
    SID:2027339
    Source Port:60482
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.100.9832892528692027339 05/27/22-02:01:55.160357
    SID:2027339
    Source Port:32892
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.74.22833762528692027339 05/27/22-02:02:01.306520
    SID:2027339
    Source Port:33762
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.227.241.1052928528692027339 05/27/22-02:01:50.961196
    SID:2027339
    Source Port:52928
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.79.2459036528692027339 05/27/22-02:01:03.615589
    SID:2027339
    Source Port:59036
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.50.7253032528692027339 05/27/22-02:01:17.282629
    SID:2027339
    Source Port:53032
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.97.16138488372152835222 05/27/22-02:00:16.843487
    SID:2835222
    Source Port:38488
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.116.8833914372152835222 05/27/22-01:59:52.728837
    SID:2835222
    Source Port:33914
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.115.9644040528692027339 05/27/22-02:01:55.737151
    SID:2027339
    Source Port:44040
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.235.96.15244412372152835222 05/27/22-02:01:39.860809
    SID:2835222
    Source Port:44412
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.75.4348582528692027339 05/27/22-02:00:26.512225
    SID:2027339
    Source Port:48582
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.81.1945382372152835222 05/27/22-02:02:04.097360
    SID:2835222
    Source Port:45382
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.224.21.15241288372152835222 05/27/22-02:01:54.117029
    SID:2835222
    Source Port:41288
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.114.18555492372152835222 05/27/22-02:00:34.147798
    SID:2835222
    Source Port:55492
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.10.7736376372152835222 05/27/22-02:01:58.507926
    SID:2835222
    Source Port:36376
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.240.107.12838328372152835222 05/27/22-02:01:36.170451
    SID:2835222
    Source Port:38328
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.115.23536014528692027339 05/27/22-02:00:28.975937
    SID:2027339
    Source Port:36014
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.110.15356256372152835222 05/27/22-02:01:58.258420
    SID:2835222
    Source Port:56256
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.224.9.8542998372152835222 05/27/22-02:00:44.448215
    SID:2835222
    Source Port:42998
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.83.8350380528692027339 05/27/22-02:01:58.512058
    SID:2027339
    Source Port:50380
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.107.16658722528692027339 05/27/22-02:02:21.932784
    SID:2027339
    Source Port:58722
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.81.24446998528692027339 05/27/22-01:59:46.159096
    SID:2027339
    Source Port:46998
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.230.19.20548094372152835222 05/27/22-02:02:34.126639
    SID:2835222
    Source Port:48094
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.119.15059104528692027339 05/27/22-02:01:32.144220
    SID:2027339
    Source Port:59104
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.247.24.749256372152835222 05/27/22-01:59:20.596556
    SID:2835222
    Source Port:49256
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.8.6239124528692027339 05/27/22-02:00:21.894988
    SID:2027339
    Source Port:39124
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.232.95.16152518372152835222 05/27/22-02:01:43.911283
    SID:2835222
    Source Port:52518
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.94.3637970372152835222 05/27/22-01:59:35.272349
    SID:2835222
    Source Port:37970
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.225.137.1545166528692027339 05/27/22-02:01:09.406968
    SID:2027339
    Source Port:45166
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.59.9150450528692027339 05/27/22-02:00:21.503092
    SID:2027339
    Source Port:50450
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.88.19835890528692027339 05/27/22-02:00:59.100766
    SID:2027339
    Source Port:35890
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.235.105.12336360528692027339 05/27/22-02:00:46.055414
    SID:2027339
    Source Port:36360
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.232.95.5137688528692027339 05/27/22-02:00:40.261876
    SID:2027339
    Source Port:37688
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.112.2640084372152835222 05/27/22-01:59:37.267591
    SID:2835222
    Source Port:40084
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.98.14046226528692027339 05/27/22-02:00:56.365384
    SID:2027339
    Source Port:46226
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.94.4832996372152835222 05/27/22-02:02:10.711942
    SID:2835222
    Source Port:32996
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.90.7648608372152835222 05/27/22-02:00:20.202547
    SID:2835222
    Source Port:48608
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.72.7235322528692027339 05/27/22-02:02:01.523460
    SID:2027339
    Source Port:35322
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.94.2639952528692027339 05/27/22-02:00:43.534578
    SID:2027339
    Source Port:39952
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.245.56.23437958372152835222 05/27/22-02:02:18.656583
    SID:2835222
    Source Port:37958
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.79.17551328372152835222 05/27/22-01:59:38.565688
    SID:2835222
    Source Port:51328
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.84.10859450372152835222 05/27/22-01:59:46.564418
    SID:2835222
    Source Port:59450
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.238.44.19044604372152835222 05/27/22-02:01:54.959373
    SID:2835222
    Source Port:44604
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.55.16844094372152835222 05/27/22-01:59:24.100328
    SID:2835222
    Source Port:44094
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.111.17045034528692027339 05/27/22-02:00:21.892038
    SID:2027339
    Source Port:45034
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.24.12737400372152835222 05/27/22-02:00:47.670144
    SID:2835222
    Source Port:37400
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.69.15439230528692027339 05/27/22-02:01:17.460017
    SID:2027339
    Source Port:39230
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.247.17.13241798528692027339 05/27/22-02:01:57.974569
    SID:2027339
    Source Port:41798
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.122.5936524372152835222 05/27/22-01:59:26.957137
    SID:2835222
    Source Port:36524
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.9.16241224372152835222 05/27/22-02:00:11.258185
    SID:2835222
    Source Port:41224
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.65.16838068372152835222 05/27/22-02:01:37.321901
    SID:2835222
    Source Port:38068
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.86.12647748528692027339 05/27/22-02:00:38.554220
    SID:2027339
    Source Port:47748
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.51.11539150372152835222 05/27/22-02:01:16.789476
    SID:2835222
    Source Port:39150
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.92.23237656372152835222 05/27/22-02:01:29.348977
    SID:2835222
    Source Port:37656
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.226.54.15733994372152835222 05/27/22-02:02:15.142084
    SID:2835222
    Source Port:33994
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.82.22034904528692027339 05/27/22-02:02:21.966924
    SID:2027339
    Source Port:34904
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.75.051058528692027339 05/27/22-01:59:20.270104
    SID:2027339
    Source Port:51058
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.112.5133208372152835222 05/27/22-02:00:07.655644
    SID:2835222
    Source Port:33208
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.225.156.2947620372152835222 05/27/22-01:59:25.449564
    SID:2835222
    Source Port:47620
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.74.23242836528692027339 05/27/22-01:59:35.587913
    SID:2027339
    Source Port:42836
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.224.18.6349984528692027339 05/27/22-02:01:58.907491
    SID:2027339
    Source Port:49984
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.120.11460550528692027339 05/27/22-01:59:30.128446
    SID:2027339
    Source Port:60550
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.238.61.25560542372152835222 05/27/22-02:00:06.879400
    SID:2835222
    Source Port:60542
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.13.22357166372152835222 05/27/22-01:59:25.691089
    SID:2835222
    Source Port:57166
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.224.31.13038708372152835222 05/27/22-02:01:40.026999
    SID:2835222
    Source Port:38708
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.59.12240468372152835222 05/27/22-02:02:18.907439
    SID:2835222
    Source Port:40468
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.240.105.7447002372152835222 05/27/22-01:59:55.467525
    SID:2835222
    Source Port:47002
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.244.76.4854348372152835222 05/27/22-01:59:30.483658
    SID:2835222
    Source Port:54348
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.227.243.25060450372152835222 05/27/22-01:59:52.671121
    SID:2835222
    Source Port:60450
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.224.18.15858570528692027339 05/27/22-02:01:55.533063
    SID:2027339
    Source Port:58570
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.93.225.7634494528692027339 05/27/22-02:01:24.598749
    SID:2027339
    Source Port:34494
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.235.102.6758594372152835222 05/27/22-02:01:55.776959
    SID:2835222
    Source Port:58594
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.118.19436896372152835222 05/27/22-02:01:32.653094
    SID:2835222
    Source Port:36896
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.250.113.24148532528692027339 05/27/22-01:59:55.530262
    SID:2027339
    Source Port:48532
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.225.141.24554112528692027339 05/27/22-02:02:13.388905
    SID:2027339
    Source Port:54112
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.225.135.13156976372152835222 05/27/22-02:01:37.392743
    SID:2835222
    Source Port:56976
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.241.82.4556192372152835222 05/27/22-02:00:24.990098
    SID:2835222
    Source Port:56192
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.254.65.19744380528692027339 05/27/22-02:00:38.336694
    SID:2027339
    Source Port:44380
    Destination Port:52869
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156.224.14.555720372152835222 05/27/22-02:00:57.236114
    SID:2835222
    Source Port:55720
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.23156