Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
dNLKZA6IVs

Overview

General Information

Sample Name:dNLKZA6IVs
Analysis ID:679625
MD5:407a38109a75cc3a5845952e359e2255
SHA1:d75de51babdf08188f91d4e854160349e5c0185e
SHA256:6874279cf48edce8cef28cce5c397462f5eadad07887dfabfb8caccf5899c436
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679625
Start date and time: 06/08/202207:00:302022-08-06 07:00:30 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 37s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:dNLKZA6IVs
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal76.troj.lin@0/0@46/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/dNLKZA6IVs
PID:6231
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • dNLKZA6IVs (PID: 6231, Parent: 6125, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/dNLKZA6IVs
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
dNLKZA6IVsJoeSecurity_Mirai_8Yara detected MiraiJoe Security

    PCAP (Network Traffic)

    SourceRuleDescriptionAuthorStrings
    dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      6329.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        6231.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6243.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: dNLKZA6IVsAvira: detected
            Multi AV Scanner detection for submitted file
            Source: dNLKZA6IVsVirustotal: Detection: 43%Perma Link
            Source: dNLKZA6IVsMetadefender: Detection: 34%Perma Link
            Source: dNLKZA6IVsReversingLabs: Detection: 73%

            Networking

            barindex
            Uses known network protocols on non-standard ports
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43848
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43854
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43864
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43892
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43900
            Source: global trafficTCP traffic: 192.168.2.23:52808 -> 105.110.101.85:7547
            Source: global trafficTCP traffic: 192.168.2.23:53436 -> 46.23.109.40:1312
            Source: global trafficTCP traffic: 192.168.2.23:41062 -> 160.177.155.129:7547
            Source: /tmp/dNLKZA6IVs (PID: 6231)Socket: 127.0.0.1::1312
            Source: /tmp/dNLKZA6IVs (PID: 6242)Socket: 0.0.0.0::0
            Source: /tmp/dNLKZA6IVs (PID: 6242)Socket: 0.0.0.0::53413
            Source: /tmp/dNLKZA6IVs (PID: 6242)Socket: 0.0.0.0::80
            Source: /tmp/dNLKZA6IVs (PID: 6242)Socket: 0.0.0.0::37215
            Source: unknownDNS traffic detected: queries for: arcticboatz.cz
            Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 33186
            Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
            Source: unknownTCP traffic detected without corresponding DNS query: 202.183.87.80
            Source: unknownTCP traffic detected without corresponding DNS query: 36.42.218.83
            Source: unknownTCP traffic detected without corresponding DNS query: 194.196.235.203
            Source: unknownTCP traffic detected without corresponding DNS query: 13.73.112.158
            Source: unknownTCP traffic detected without corresponding DNS query: 150.164.107.187
            Source: unknownTCP traffic detected without corresponding DNS query: 216.199.69.80
            Source: unknownTCP traffic detected without corresponding DNS query: 173.207.17.142
            Source: unknownTCP traffic detected without corresponding DNS query: 213.127.78.7
            Source: unknownTCP traffic detected without corresponding DNS query: 203.182.69.185
            Source: unknownTCP traffic detected without corresponding DNS query: 205.173.56.210
            Source: unknownTCP traffic detected without corresponding DNS query: 85.228.242.238
            Source: unknownTCP traffic detected without corresponding DNS query: 1.74.17.104
            Source: unknownTCP traffic detected without corresponding DNS query: 249.5.201.220
            Source: unknownTCP traffic detected without corresponding DNS query: 177.139.176.115
            Source: unknownTCP traffic detected without corresponding DNS query: 124.42.216.148
            Source: unknownTCP traffic detected without corresponding DNS query: 58.28.185.231
            Source: unknownTCP traffic detected without corresponding DNS query: 106.155.249.145
            Source: unknownTCP traffic detected without corresponding DNS query: 158.216.238.194
            Source: unknownTCP traffic detected without corresponding DNS query: 250.119.196.96
            Source: unknownTCP traffic detected without corresponding DNS query: 141.250.43.84
            Source: unknownTCP traffic detected without corresponding DNS query: 198.17.151.16
            Source: unknownTCP traffic detected without corresponding DNS query: 125.125.170.224
            Source: unknownTCP traffic detected without corresponding DNS query: 136.235.223.149
            Source: unknownTCP traffic detected without corresponding DNS query: 160.227.81.22
            Source: unknownTCP traffic detected without corresponding DNS query: 156.87.251.190
            Source: unknownTCP traffic detected without corresponding DNS query: 87.127.18.159
            Source: unknownTCP traffic detected without corresponding DNS query: 35.49.77.188
            Source: unknownTCP traffic detected without corresponding DNS query: 255.92.209.243
            Source: unknownTCP traffic detected without corresponding DNS query: 192.232.208.136
            Source: unknownTCP traffic detected without corresponding DNS query: 31.100.170.253
            Source: unknownTCP traffic detected without corresponding DNS query: 185.17.188.238
            Source: unknownTCP traffic detected without corresponding DNS query: 89.194.161.18
            Source: unknownTCP traffic detected without corresponding DNS query: 86.246.249.152
            Source: unknownTCP traffic detected without corresponding DNS query: 164.133.121.43
            Source: unknownTCP traffic detected without corresponding DNS query: 91.156.255.156
            Source: unknownTCP traffic detected without corresponding DNS query: 153.12.230.92
            Source: unknownTCP traffic detected without corresponding DNS query: 5.41.66.217
            Source: unknownTCP traffic detected without corresponding DNS query: 211.27.62.93
            Source: unknownTCP traffic detected without corresponding DNS query: 155.33.13.129
            Source: unknownTCP traffic detected without corresponding DNS query: 243.162.254.159
            Source: unknownTCP traffic detected without corresponding DNS query: 92.118.213.235
            Source: unknownTCP traffic detected without corresponding DNS query: 240.121.246.82
            Source: unknownTCP traffic detected without corresponding DNS query: 196.137.131.205
            Source: unknownTCP traffic detected without corresponding DNS query: 246.162.150.3
            Source: unknownTCP traffic detected without corresponding DNS query: 151.130.194.29
            Source: unknownTCP traffic detected without corresponding DNS query: 207.80.114.120
            Source: unknownTCP traffic detected without corresponding DNS query: 17.254.113.95
            Source: unknownTCP traffic detected without corresponding DNS query: 78.160.7.163
            Source: unknownTCP traffic detected without corresponding DNS query: 90.27.52.240
            Source: unknownTCP traffic detected without corresponding DNS query: 42.119.61.176
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: /tmp/dNLKZA6IVs (PID: 6242)SIGKILL sent: pid: 936, result: successful
            Source: Initial sampleString containing 'busybox' found: /bin/busybox AK1K2
            Source: Initial sampleString containing 'busybox' found: /bin/busybox cp /bin/busybox retrieve && >retrieve && /bin/busybox chmod 777 retrieve && /bin/busybox cp /bin/busybox .t && >.t && /bin/busybox chmod 777 .t
            Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -en '%s' %s %s && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'
            Source: Initial sampleString containing 'busybox' found: >%st && cd %s && >retrieve; >.t/bin/busybox cp /bin/busybox retrieve && >retrieve && /bin/busybox chmod 777 retrieve && /bin/busybox cp /bin/busybox .t && >.t && /bin/busybox chmod 777 .t
            Source: Initial sampleString containing 'busybox' found: >>>/bin/busybox echo -en '%s' %s %s && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'
            Source: classification engineClassification label: mal76.troj.lin@0/0@46/0
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/491/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/793/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/772/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/796/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/774/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/797/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/777/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/799/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/658/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/912/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/759/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/936/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/918/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/1/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/761/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/785/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/884/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/720/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/721/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/788/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/789/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/800/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/801/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/847/fd
            Source: /tmp/dNLKZA6IVs (PID: 6242)File opened: /proc/904/fd

            Hooking and other Techniques for Hiding and Protection

            barindex
            Uses known network protocols on non-standard ports
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43848
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43854
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43864
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43892
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 43900
            Source: /tmp/dNLKZA6IVs (PID: 6231)Queries kernel information via 'uname':
            Source: dNLKZA6IVs, 6231.1.000055d649b2a000.000055d649c58000.rw-.sdmp, dNLKZA6IVs, 6329.1.000055d649b2a000.000055d649c58000.rw-.sdmp, dNLKZA6IVs, 6243.1.000055d649b2a000.000055d649c58000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
            Source: dNLKZA6IVs, 6231.1.00007ffce2172000.00007ffce2193000.rw-.sdmp, dNLKZA6IVs, 6329.1.00007ffce2172000.00007ffce2193000.rw-.sdmp, dNLKZA6IVs, 6243.1.00007ffce2172000.00007ffce2193000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/dNLKZA6IVsSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dNLKZA6IVs
            Source: dNLKZA6IVs, 6231.1.000055d649b2a000.000055d649c58000.rw-.sdmp, dNLKZA6IVs, 6329.1.000055d649b2a000.000055d649c58000.rw-.sdmp, dNLKZA6IVs, 6243.1.000055d649b2a000.000055d649c58000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
            Source: dNLKZA6IVs, 6231.1.00007ffce2172000.00007ffce2193000.rw-.sdmp, dNLKZA6IVs, 6329.1.00007ffce2172000.00007ffce2193000.rw-.sdmp, dNLKZA6IVs, 6243.1.00007ffce2172000.00007ffce2193000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

            Stealing of Sensitive Information

            barindex
            Yara detected Mirai
            Source: Yara matchFile source: dump.pcap, type: PCAP
            Source: Yara matchFile source: dNLKZA6IVs, type: SAMPLE
            Source: Yara matchFile source: 6329.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6231.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6243.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Yara detected Mirai
            Source: Yara matchFile source: dump.pcap, type: PCAP
            Source: Yara matchFile source: dNLKZA6IVs, type: SAMPLE
            Source: Yara matchFile source: 6329.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6231.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6243.1.00007f5c4c017000.00007f5c4c02e000.r-x.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
            OS Credential Dumping            		11
            Security Software Discovery            		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
            Encrypted Channel            		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
            Non-Standard Port            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
            Non-Application Layer Protocol            		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer2
            Application Layer Protocol            		SIM Card SwapCarrier Billing Fraud

            Malware Configuration

            ⊘No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 679625 Sample: dNLKZA6IVs Startdate: 06/08/2022 Architecture: LINUX Score: 76 25 arcticboatz.cz 2->25 27 106.10.231.220 YAHOO-SG3internetcontentproviderSG Singapore 2->27 29 99 other IPs or domains 2->29 31 Antivirus / Scanner detection for submitted sample 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 Yara detected Mirai 2->35 37 Uses known network protocols on non-standard ports 2->37 9 dNLKZA6IVs 2->9         started        signatures3 process4 process5 11 dNLKZA6IVs 9->11         started        13 dNLKZA6IVs 9->13         started        15 dNLKZA6IVs 9->15         started        17 dNLKZA6IVs 9->17         started        process6 19 dNLKZA6IVs 11->19         started        21 dNLKZA6IVs 11->21         started        process7 23 dNLKZA6IVs 19->23         started       

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            dNLKZA6IVs44%VirustotalBrowse
            dNLKZA6IVs34%MetadefenderBrowse
            dNLKZA6IVs73%ReversingLabsLinux.Trojan.Mirai
            dNLKZA6IVs100%AviraLINUX/Mirai.krmnq

            Dropped Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            arcticboatz.cz12%VirustotalBrowse

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            arcticboatz.cz
            		46.23.109.40
            		truetrueunknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            140.245.130.189
            		unknownUnited States
            		22488CENGAGE-NYALBUSfalse
            179.99.190.111
            		unknownBrazil
            		27699TELEFONICABRASILSABRfalse
            160.177.155.129
            		unknownMorocco
            		36903MT-MPLSMAfalse
            163.39.57.194
            		unknownUnited States
            		1659ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationCfalse
            252.34.227.164
            		unknownReserved
            		unknownunknownfalse
            116.100.223.37
            		unknownViet Nam
            		24086VIETTEL-AS-VNViettelCorporationVNfalse
            157.117.193.135
            		unknownJapan9605DOCOMONTTDOCOMOINCJPfalse
            147.196.107.48
            		unknownFrance
            		2527SO-NETSo-netEntertainmentCorporationJPfalse
            115.21.18.96
            		unknownKorea Republic of
            		4766KIXS-AS-KRKoreaTelecomKRfalse
            71.56.55.19
            		unknownUnited States
            		7922COMCAST-7922USfalse
            187.188.56.79
            		unknownMexico
            		22884TOTALPLAYTELECOMUNICACIONESSADECVMXfalse
            42.25.215.245
            		unknownKorea Republic of
            		9644SKTELECOM-NET-ASSKTelecomKRfalse
            104.156.153.64
            		unknownUnited States
            		32391SRCACCESSUSfalse
            95.106.170.150
            		unknownRussian Federation
            		12389ROSTELECOM-ASRUfalse
            84.35.150.57
            		unknownNetherlands
            		21221INFOPACT-ASTheNetherlandsNLfalse
            40.220.55.208
            		unknownUnited States
            		4249LILLY-ASUSfalse
            124.207.149.250
            		unknownChina
            		4808CHINA169-BJChinaUnicomBeijingProvinceNetworkCNfalse
            125.193.114.56
            		unknownJapan2518BIGLOBEBIGLOBEIncJPfalse
            253.132.90.144
            		unknownReserved
            		unknownunknownfalse
            41.97.15.205
            		unknownAlgeria
            		36947ALGTEL-ASDZfalse
            47.101.21.217
            		unknownChina
            		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse
            200.164.68.140
            		unknownBrazil
            		7738TelemarNorteLesteSABRfalse
            216.107.146.42
            		unknownUnited States
            		20278NEXEONUSfalse
            106.10.231.220
            		unknownSingapore
            		56173YAHOO-SG3internetcontentproviderSGfalse
            248.239.3.124
            		unknownReserved
            		unknownunknownfalse
            206.176.20.180
            		unknownUnited States
            		22851NSU-SDUSfalse
            178.178.13.56
            		unknownRussian Federation
            		25159SONICDUO-ASRUfalse
            221.4.223.185
            		unknownChina
            		17816CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovifalse
            149.109.163.226
            		unknownSaudi Arabia
            		25019SAUDINETSTC-ASSAfalse
            54.44.2.152
            		unknownUnited States
            		14618AMAZON-AESUSfalse
            62.78.181.0
            		unknownFinland
            		16086DNAFIfalse
            154.91.52.21
            		unknownSeychelles
            		62468VPSQUANUSfalse
            163.151.39.94
            		unknownUnited States
            		36161WESTCHESTERCOUNTY-NYUSfalse
            181.152.32.197
            		unknownColombia
            		26611COMCELSACOfalse
            108.28.236.149
            		unknownUnited States
            		701UUNETUSfalse
            111.6.69.172
            		unknownChina
            		24445CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCNfalse
            78.93.243.132
            		unknownSaudi Arabia
            		25233AWALNET-ASNSAfalse
            60.87.12.18
            		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
            119.107.244.169
            		unknownJapan2516KDDIKDDICORPORATIONJPfalse
            18.163.241.145
            		unknownUnited States
            		16509AMAZON-02USfalse
            126.58.95.160
            		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
            72.23.5.57
            		unknownUnited States
            		27364ACS-INTERNETUSfalse
            44.97.4.214
            		unknownUnited States
            		7377UCSDUSfalse
            45.244.146.89
            		unknownEgypt
            		24863LINKdotNET-ASEGfalse
            251.106.255.31
            		unknownReserved
            		unknownunknownfalse
            65.67.37.241
            		unknownUnited States
            		7018ATT-INTERNET4USfalse
            253.194.92.93
            		unknownReserved
            		unknownunknownfalse
            146.122.131.195
            		unknownUnited States
            		22216SIEMENS-PLMUSfalse
            193.89.106.134
            		unknownDenmark
            		3292TDCTDCASDKfalse
            23.54.60.124
            		unknownUnited States
            		16625AKAMAI-ASUSfalse
            27.193.150.188
            		unknownChina
            		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
            200.246.226.12
            		unknownBrazil
            		4230CLAROSABRfalse
            187.123.171.57
            		unknownBrazil
            		28573CLAROSABRfalse
            81.221.46.157
            		unknownSwitzerland
            		1836GREENgreenchAGAutonomousSystemEUfalse
            189.6.24.53
            		unknownBrazil
            		28573CLAROSABRfalse
            65.71.94.243
            		unknownUnited States
            		7018ATT-INTERNET4USfalse
            117.241.122.77
            		unknownIndia
            		9829BSNL-NIBNationalInternetBackboneINfalse
            95.25.159.118
            		unknownRussian Federation
            		3216SOVAM-ASRUfalse
            36.228.128.198
            		unknownTaiwan; Republic of China (ROC)
            		3462HINETDataCommunicationBusinessGroupTWfalse
            158.193.226.165
            		unknownSlovakia (SLOVAK Republic)
            		2607SANETSlovakAcademicNetworkSKfalse
            12.122.193.204
            		unknownUnited States
            		7018ATT-INTERNET4USfalse
            92.29.42.240
            		unknownUnited Kingdom
            		13285OPALTELECOM-ASTalkTalkCommunicationsLimitedGBfalse
            2.46.240.136
            		unknownItaly
            		30722VODAFONE-IT-ASNITfalse
            124.20.249.100
            		unknownChina
            		7497CSTNET-AS-APComputerNetworkInformationCenterCNfalse
            103.117.108.117
            		unknownBangladesh
            		137935ILIS-AS-APILinkInternetServiceBDfalse
            36.73.61.185
            		unknownIndonesia
            		7713TELKOMNET-AS-APPTTelekomunikasiIndonesiaIDfalse
            80.178.27.50
            		unknownIsrael
            		9116GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSystefalse
            163.52.238.118
            		unknownunknown
            		2516KDDIKDDICORPORATIONJPfalse
            203.198.234.145
            		unknownHong Kong
            		4760HKTIMS-APHKTLimitedHKfalse
            201.103.48.20
            		unknownMexico
            		8151UninetSAdeCVMXfalse
            57.46.12.214
            		unknownBelgium
            		2686ATGS-MMD-ASUSfalse
            36.70.155.73
            		unknownIndonesia
            		7713TELKOMNET-AS-APPTTelekomunikasiIndonesiaIDfalse
            78.200.186.78
            		unknownFrance
            		12322PROXADFRfalse
            162.5.107.138
            		unknownUnited States
            		33348PIERCE-COUNTYUSfalse
            20.35.186.177
            		unknownUnited States
            		8070MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            178.122.24.177
            		unknownBelarus
            		6697BELPAK-ASBELPAKBYfalse
            162.97.87.246
            		unknownUnited States
            		3356LEVEL3USfalse
            41.145.10.73
            		unknownSouth Africa
            		5713SAIX-NETZAfalse
            155.244.147.141
            		unknownUnited States
            		668DNIC-AS-00668USfalse
            87.122.200.234
            		unknownGermany
            		8881VERSATELDEfalse
            121.17.44.98
            		unknownChina
            		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
            136.104.45.67
            		unknownUnited States
            		60311ONEFMCHfalse
            242.147.54.104
            		unknownReserved
            		unknownunknownfalse
            211.173.176.209
            		unknownKorea Republic of
            		18313PCN-AS-KRLGHelloVisionCorpKRfalse
            101.8.76.224
            		unknownTaiwan; Republic of China (ROC)
            		701UUNETUSfalse
            112.12.163.146
            		unknownChina
            		56041CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationCfalse
            104.33.227.124
            		unknownUnited States
            		20001TWC-20001-PACWESTUSfalse
            17.205.243.220
            		unknownUnited States
            		714APPLE-ENGINEERINGUSfalse
            181.12.5.240
            		unknownArgentina
            		7303TelecomArgentinaSAARfalse
            101.174.190.113
            		unknownAustralia
            		1221ASN-TELSTRATelstraCorporationLtdAUfalse
            57.238.159.174
            		unknownBelgium
            		2686ATGS-MMD-ASUSfalse
            17.132.134.142
            		unknownUnited States
            		714APPLE-ENGINEERINGUSfalse
            120.171.58.235
            		unknownIndonesia
            		4761INDOSAT-INP-APINDOSATInternetNetworkProviderIDfalse
            124.115.165.91
            		unknownChina
            		4835CHINANET-IDC-SNChinaTelecomGroupCNfalse
            178.107.239.74
            		unknownUnited Kingdom
            		12576EELtdGBfalse
            37.182.243.58
            		unknownItaly
            		30722VODAFONE-IT-ASNITfalse
            209.79.27.199
            		unknownUnited States
            		32492DANAUSfalse
            74.11.108.131
            		unknownUnited States
            		7029WINDSTREAMUSfalse
            37.113.150.151
            		unknownRussian Federation
            		41661ERTH-CHEL-ASRUfalse
            90.152.66.151
            		unknownUnited Kingdom
            		8220COLTCOLTTechnologyServicesGroupLimitedGBfalse

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            ⊘No created / dropped files found

            Static File Info

            General

            File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
            Entropy (8bit):6.130935158584685
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:dNLKZA6IVs
            File size:95440
            MD5:407a38109a75cc3a5845952e359e2255
            SHA1:d75de51babdf08188f91d4e854160349e5c0185e
            SHA256:6874279cf48edce8cef28cce5c397462f5eadad07887dfabfb8caccf5899c436
            SHA512:291ef493c14caecfa5c2b69ebad48edc8df741f9c454562bc0e0322dc917c6d252672f116767f52f4d4a7dda299c260551decbd2f367531c16b9bbae3aa49a3e
            SSDEEP:1536:OM8MGxYUd9YdLabp+1xOOLnRVTSphZ6CqhaSbuqL3Csvc3JY4h:iBx/di6E6OLnbO3ohYE/c5vh
            TLSH:8E9349C1B881A626C6D152BBFF5F418C331697A8D2DA33128C295F61778E92F0E37749
            File Content Preview:.ELF...a..........(.........4...@s......4. ...(......................k...k...............k...k...k......$3..........Q.td..................................-...L."...zR..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

            Static ELF Info

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:ARM
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:ARM - ABI
            ABI Version:0
            Entry Point Address:0x8190
            Flags:0x202
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:3
            Section Header Offset:95040
            Section Header Size:40
            Number of Section Headers:10
            Header String Table Index:9

            Sections

            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x80940x940x180x00x6AX004
            .textPROGBITS0x80b00xb00x14a200x00x6AX0016
            .finiPROGBITS0x1cad00x14ad00x140x00x6AX004
            .rodataPROGBITS0x1cae40x14ae40x21040x00x2A004
            .ctorsPROGBITS0x26bec0x16bec0x80x00x3WA004
            .dtorsPROGBITS0x26bf40x16bf40x80x00x3WA004
            .dataPROGBITS0x26c000x16c000x7000x00x3WA004
            .bssNOBITS0x273000x173000x2c100x00x3WA004
            .shstrtabSTRTAB0x00x173000x3e0x00x0001

            Program Segments

            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x80000x80000x16be80x16be86.14740x5R E0x8000.init .text .fini .rodata
            LOAD0x16bec0x26bec0x26bec0x7140x33244.37330x6RW 0x8000.ctors .dtors .data .bss
            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

            Network Behavior

            Network Port Distribution

            TCP Packets

            TimestampSource PortDest PortSource IPDest IP
            Aug 6, 2022 07:05:48.543663979 CEST754752808105.110.101.85192.168.2.23
            Aug 6, 2022 07:05:48.543857098 CEST528087547192.168.2.23105.110.101.85
            Aug 6, 2022 07:05:48.544434071 CEST754752802105.110.101.85192.168.2.23
            Aug 6, 2022 07:05:48.544549942 CEST528027547192.168.2.23105.110.101.85
            Aug 6, 2022 07:05:49.041810036 CEST754752808105.110.101.85192.168.2.23
            Aug 6, 2022 07:05:49.042152882 CEST528087547192.168.2.23105.110.101.85
            Aug 6, 2022 07:05:49.043477058 CEST754752802105.110.101.85192.168.2.23
            Aug 6, 2022 07:05:49.043653965 CEST528027547192.168.2.23105.110.101.85
            Aug 6, 2022 07:05:49.539753914 CEST754752808105.110.101.85192.168.2.23
            Aug 6, 2022 07:05:49.540065050 CEST528087547192.168.2.23105.110.101.85
            Aug 6, 2022 07:05:49.540445089 CEST754752802105.110.101.85192.168.2.23
            Aug 6, 2022 07:05:49.540549040 CEST528027547192.168.2.23105.110.101.85
            Aug 6, 2022 07:05:50.648637056 CEST4736223192.168.2.23202.183.87.80
            Aug 6, 2022 07:05:50.648715019 CEST4736223192.168.2.2336.42.218.83
            Aug 6, 2022 07:05:50.648736000 CEST4736223192.168.2.23194.196.235.203
            Aug 6, 2022 07:05:50.648781061 CEST4736223192.168.2.2313.73.112.158
            Aug 6, 2022 07:05:50.648782015 CEST4736223192.168.2.23150.164.107.187
            Aug 6, 2022 07:05:50.648782969 CEST4736223192.168.2.23216.199.69.80
            Aug 6, 2022 07:05:50.648797035 CEST4736223192.168.2.23173.207.17.142
            Aug 6, 2022 07:05:50.648843050 CEST4736223192.168.2.23213.127.78.7
            Aug 6, 2022 07:05:50.648845911 CEST4736223192.168.2.23203.182.69.185
            Aug 6, 2022 07:05:50.648847103 CEST4736223192.168.2.23205.173.56.210
            Aug 6, 2022 07:05:50.648849010 CEST4736223192.168.2.2385.228.242.238
            Aug 6, 2022 07:05:50.648859024 CEST4736223192.168.2.231.74.17.104
            Aug 6, 2022 07:05:50.648885012 CEST4736223192.168.2.2392.244.110.210
            Aug 6, 2022 07:05:50.648916960 CEST4736223192.168.2.23249.5.201.220
            Aug 6, 2022 07:05:50.648941040 CEST4736223192.168.2.23177.139.176.115
            Aug 6, 2022 07:05:50.648947954 CEST4736223192.168.2.23124.42.216.148
            Aug 6, 2022 07:05:50.648960114 CEST4736223192.168.2.2358.28.185.231
            Aug 6, 2022 07:05:50.648967028 CEST4736223192.168.2.23106.155.249.145
            Aug 6, 2022 07:05:50.648983955 CEST4736223192.168.2.23158.216.238.194
            Aug 6, 2022 07:05:50.648989916 CEST4736223192.168.2.23250.119.196.96
            Aug 6, 2022 07:05:50.649002075 CEST4736223192.168.2.23141.250.43.84
            Aug 6, 2022 07:05:50.649003029 CEST4736223192.168.2.23198.17.151.16
            Aug 6, 2022 07:05:50.649012089 CEST4736223192.168.2.23125.125.170.224
            Aug 6, 2022 07:05:50.649023056 CEST4736223192.168.2.23136.235.223.149
            Aug 6, 2022 07:05:50.649030924 CEST4736223192.168.2.23160.227.81.22
            Aug 6, 2022 07:05:50.649045944 CEST4736223192.168.2.23156.87.251.190
            Aug 6, 2022 07:05:50.649056911 CEST4736223192.168.2.2387.127.18.159
            Aug 6, 2022 07:05:50.649074078 CEST4736223192.168.2.2335.49.77.188
            Aug 6, 2022 07:05:50.649080992 CEST4736223192.168.2.23255.92.209.243
            Aug 6, 2022 07:05:50.649084091 CEST4736223192.168.2.23192.232.208.136
            Aug 6, 2022 07:05:50.649097919 CEST4736223192.168.2.2331.100.170.253
            Aug 6, 2022 07:05:50.649118900 CEST4736223192.168.2.23185.17.188.238
            Aug 6, 2022 07:05:50.649125099 CEST4736223192.168.2.2389.194.161.18
            Aug 6, 2022 07:05:50.649131060 CEST4736223192.168.2.2386.246.249.152
            Aug 6, 2022 07:05:50.649147987 CEST4736223192.168.2.23164.133.121.43
            Aug 6, 2022 07:05:50.649158955 CEST4736223192.168.2.2391.156.255.156
            Aug 6, 2022 07:05:50.649162054 CEST4736223192.168.2.23153.12.230.92
            Aug 6, 2022 07:05:50.649183035 CEST4736223192.168.2.235.41.66.217
            Aug 6, 2022 07:05:50.649185896 CEST4736223192.168.2.23211.27.62.93
            Aug 6, 2022 07:05:50.649199963 CEST4736223192.168.2.23155.33.13.129
            Aug 6, 2022 07:05:50.649208069 CEST4736223192.168.2.23243.162.254.159
            Aug 6, 2022 07:05:50.649224043 CEST4736223192.168.2.2392.118.213.235
            Aug 6, 2022 07:05:50.649243116 CEST4736223192.168.2.23240.121.246.82
            Aug 6, 2022 07:05:50.649245024 CEST4736223192.168.2.23196.137.131.205
            Aug 6, 2022 07:05:50.649259090 CEST4736223192.168.2.23246.162.150.3
            Aug 6, 2022 07:05:50.649274111 CEST4736223192.168.2.23151.130.194.29
            Aug 6, 2022 07:05:50.649276018 CEST4736223192.168.2.23207.80.114.120
            Aug 6, 2022 07:05:50.649292946 CEST4736223192.168.2.2317.254.113.95
            Aug 6, 2022 07:05:50.649296045 CEST4736223192.168.2.23217.110.29.85
            Aug 6, 2022 07:05:50.649302006 CEST4736223192.168.2.2378.160.7.163
            Aug 6, 2022 07:05:50.649322987 CEST4736223192.168.2.2390.27.52.240
            Aug 6, 2022 07:05:50.649327040 CEST4736223192.168.2.2342.119.61.176
            Aug 6, 2022 07:05:50.649328947 CEST4736223192.168.2.2392.17.155.224
            Aug 6, 2022 07:05:50.649333954 CEST4736223192.168.2.2338.50.189.207
            Aug 6, 2022 07:05:50.649347067 CEST4736223192.168.2.23103.144.200.63
            Aug 6, 2022 07:05:50.649354935 CEST4736223192.168.2.2313.81.50.119
            Aug 6, 2022 07:05:50.649367094 CEST4736223192.168.2.2395.3.112.196
            Aug 6, 2022 07:05:50.649377108 CEST4736223192.168.2.23210.46.111.149
            Aug 6, 2022 07:05:50.649380922 CEST4736223192.168.2.23156.65.137.130
            Aug 6, 2022 07:05:50.649400949 CEST4736223192.168.2.23142.131.208.248
            Aug 6, 2022 07:05:50.649420977 CEST4736223192.168.2.23155.133.46.75
            Aug 6, 2022 07:05:50.649452925 CEST4736223192.168.2.23206.98.210.239
            Aug 6, 2022 07:05:50.649483919 CEST4736223192.168.2.23193.23.107.187
            Aug 6, 2022 07:05:50.649487019 CEST4736223192.168.2.23187.61.76.89
            Aug 6, 2022 07:05:50.649496078 CEST4736223192.168.2.2375.104.247.250
            Aug 6, 2022 07:05:50.649521112 CEST4736223192.168.2.2345.234.120.175
            Aug 6, 2022 07:05:50.649544001 CEST4736223192.168.2.2389.170.84.70
            Aug 6, 2022 07:05:50.649544954 CEST4736223192.168.2.2371.246.183.81
            Aug 6, 2022 07:05:50.649553061 CEST4736223192.168.2.23155.38.18.52
            Aug 6, 2022 07:05:50.649564981 CEST4736223192.168.2.23218.174.172.252
            Aug 6, 2022 07:05:50.649565935 CEST4736223192.168.2.23164.50.136.168
            Aug 6, 2022 07:05:50.649568081 CEST4736223192.168.2.2338.6.96.163
            Aug 6, 2022 07:05:50.649585009 CEST4736223192.168.2.23112.124.224.44
            Aug 6, 2022 07:05:50.649596930 CEST4736223192.168.2.2312.103.117.19
            Aug 6, 2022 07:05:50.649604082 CEST4736223192.168.2.23177.56.17.28
            Aug 6, 2022 07:05:50.649607897 CEST4736223192.168.2.235.70.70.210
            Aug 6, 2022 07:05:50.649616003 CEST4736223192.168.2.2395.210.230.145
            Aug 6, 2022 07:05:50.649622917 CEST4736223192.168.2.2318.169.152.105
            Aug 6, 2022 07:05:50.649631023 CEST4736223192.168.2.2348.170.249.160
            Aug 6, 2022 07:05:50.649636984 CEST4736223192.168.2.2332.73.40.239
            Aug 6, 2022 07:05:50.649655104 CEST4736223192.168.2.2382.8.134.203
            Aug 6, 2022 07:05:50.649672031 CEST4736223192.168.2.23206.100.116.87
            Aug 6, 2022 07:05:50.649683952 CEST4736223192.168.2.23185.185.88.113
            Aug 6, 2022 07:05:50.649693012 CEST4736223192.168.2.23241.13.155.48
            Aug 6, 2022 07:05:50.649710894 CEST4736223192.168.2.23147.84.192.56
            Aug 6, 2022 07:05:50.649727106 CEST4736223192.168.2.23145.149.231.21
            Aug 6, 2022 07:05:50.649739981 CEST4736223192.168.2.2359.61.192.81
            Aug 6, 2022 07:05:50.649763107 CEST4736223192.168.2.23188.221.224.134

            DNS Queries

            TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
            Aug 6, 2022 07:05:50.702507019 CEST192.168.2.238.8.8.80x54beStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:05:54.752630949 CEST192.168.2.238.8.8.80xfd19Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:06:04.801067114 CEST192.168.2.238.8.8.80x7ed2Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:06:10.870327950 CEST192.168.2.238.8.8.80x901Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:06:13.919563055 CEST192.168.2.238.8.8.80x4d1dStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:06:23.967844963 CEST192.168.2.238.8.8.80xc51eStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:06:34.017163992 CEST192.168.2.238.8.8.80x7948Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:06:41.095558882 CEST192.168.2.238.8.8.80x3ffaStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:06:51.144331932 CEST192.168.2.238.8.8.80x3dcbStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:00.192339897 CEST192.168.2.238.8.8.80x4f47Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:08.239928961 CEST192.168.2.238.8.8.80xb150Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:11.288945913 CEST192.168.2.238.8.8.80x7f91Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:19.338779926 CEST192.168.2.238.8.8.80xdeb1Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:27.385957003 CEST192.168.2.238.8.8.80xbb86Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:28.435435057 CEST192.168.2.238.8.8.80x1086Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:35.483746052 CEST192.168.2.238.8.8.80x16d5Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:37.544806004 CEST192.168.2.238.8.8.80x9c30Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:40.602895021 CEST192.168.2.238.8.8.80xa552Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:44.651293039 CEST192.168.2.238.8.8.80xb4cfStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:49.700762987 CEST192.168.2.238.8.8.80x261bStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:07:59.748364925 CEST192.168.2.238.8.8.80x4783Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:09.796504974 CEST192.168.2.238.8.8.80xb28cStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:11.843915939 CEST192.168.2.238.8.8.80x6c65Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:15.962863922 CEST192.168.2.238.8.8.80x2e7Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:20.019285917 CEST192.168.2.238.8.8.80x261cStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:21.067440033 CEST192.168.2.238.8.8.80xe77aStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:29.115253925 CEST192.168.2.238.8.8.80xd4bfStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:32.161578894 CEST192.168.2.238.8.8.80x5241Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:39.616389990 CEST192.168.2.238.8.8.80x54beStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:41.209120035 CEST192.168.2.238.8.8.80x3989Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:43.674951077 CEST192.168.2.238.8.8.80xfd19Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:49.257905006 CEST192.168.2.238.8.8.80x4b22Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:52.303738117 CEST192.168.2.238.8.8.80xcee4Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:53.720870018 CEST192.168.2.238.8.8.80x7ed2Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:55.352310896 CEST192.168.2.238.8.8.80xc7deStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:08:58.767436981 CEST192.168.2.238.8.8.80x901Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:00.400082111 CEST192.168.2.238.8.8.80x4610Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:01.827549934 CEST192.168.2.238.8.8.80x4d1dStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:03.446547985 CEST192.168.2.238.8.8.80xc471Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:07.495101929 CEST192.168.2.238.8.8.80xf3b9Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:11.875713110 CEST192.168.2.238.8.8.80xc51eStandard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:16.541476965 CEST192.168.2.238.8.8.80x18f3Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:19.592694998 CEST192.168.2.238.8.8.80xb147Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:21.966418028 CEST192.168.2.238.8.8.80x7948Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:22.641074896 CEST192.168.2.238.8.8.80x3f83Standard query (0)arcticboatz.czA (IP address)IN (0x0001)
            Aug 6, 2022 07:09:23.690777063 CEST192.168.2.238.8.8.80x937dStandard query (0)arcticboatz.czA (IP address)IN (0x0001)

            DNS Answers

            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
            Aug 6, 2022 07:05:50.719547033 CEST8.8.8.8192.168.2.230x54beNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:05:54.772036076 CEST8.8.8.8192.168.2.230xfd19No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:06:04.818865061 CEST8.8.8.8192.168.2.230x7ed2No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:06:10.890026093 CEST8.8.8.8192.168.2.230x901No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:06:13.938627958 CEST8.8.8.8192.168.2.230x4d1dNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:06:23.987060070 CEST8.8.8.8192.168.2.230xc51eNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:06:34.037628889 CEST8.8.8.8192.168.2.230x7948No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:06:41.115243912 CEST8.8.8.8192.168.2.230x3ffaNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:06:51.163902998 CEST8.8.8.8192.168.2.230x3dcbNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:00.210024118 CEST8.8.8.8192.168.2.230x4f47No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:08.259632111 CEST8.8.8.8192.168.2.230xb150No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:11.308566093 CEST8.8.8.8192.168.2.230x7f91No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:19.356323004 CEST8.8.8.8192.168.2.230xdeb1No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:27.405544043 CEST8.8.8.8192.168.2.230xbb86No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:28.455080032 CEST8.8.8.8192.168.2.230x1086No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:35.504062891 CEST8.8.8.8192.168.2.230x16d5No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:37.573424101 CEST8.8.8.8192.168.2.230x9c30No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:40.622441053 CEST8.8.8.8192.168.2.230xa552No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:44.670378923 CEST8.8.8.8192.168.2.230xb4cfNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:49.720315933 CEST8.8.8.8192.168.2.230x261bNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:07:59.768058062 CEST8.8.8.8192.168.2.230x4783No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:09.814372063 CEST8.8.8.8192.168.2.230xb28cNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:11.875591993 CEST8.8.8.8192.168.2.230x6c65No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:15.982000113 CEST8.8.8.8192.168.2.230x2e7No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:20.038809061 CEST8.8.8.8192.168.2.230x261cNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:21.084737062 CEST8.8.8.8192.168.2.230xe77aNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:29.132872105 CEST8.8.8.8192.168.2.230xd4bfNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:32.180759907 CEST8.8.8.8192.168.2.230x5241No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:39.635659933 CEST8.8.8.8192.168.2.230x54beNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:41.228621960 CEST8.8.8.8192.168.2.230x3989No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:43.692435980 CEST8.8.8.8192.168.2.230xfd19No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:49.274925947 CEST8.8.8.8192.168.2.230x4b22No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:52.323026896 CEST8.8.8.8192.168.2.230xcee4No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:53.738450050 CEST8.8.8.8192.168.2.230x7ed2No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:55.369638920 CEST8.8.8.8192.168.2.230xc7deNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:08:58.795795918 CEST8.8.8.8192.168.2.230x901No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:00.417481899 CEST8.8.8.8192.168.2.230x4610No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:01.847336054 CEST8.8.8.8192.168.2.230x4d1dNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:03.466379881 CEST8.8.8.8192.168.2.230xc471No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:07.512717009 CEST8.8.8.8192.168.2.230xf3b9No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:11.894723892 CEST8.8.8.8192.168.2.230xc51eNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:16.560956955 CEST8.8.8.8192.168.2.230x18f3No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:19.612413883 CEST8.8.8.8192.168.2.230xb147No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:21.986105919 CEST8.8.8.8192.168.2.230x7948No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:22.660722971 CEST8.8.8.8192.168.2.230x3f83No error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)
            Aug 6, 2022 07:09:23.710640907 CEST8.8.8.8192.168.2.230x937dNo error (0)arcticboatz.cz46.23.109.40A (IP address)IN (0x0001)

            System Behavior

            General

            Start time:07:05:49
            Start date:06/08/2022
            Path:/tmp/dNLKZA6IVs
            Arguments:/tmp/dNLKZA6IVs
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            General

            Start time:07:05:49
            Start date:06/08/2022
            Path:/tmp/dNLKZA6IVs
            Arguments:n/a
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            General

            Start time:07:05:49
            Start date:06/08/2022
            Path:/tmp/dNLKZA6IVs
            Arguments:n/a
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            General

            Start time:07:05:49
            Start date:06/08/2022
            Path:/tmp/dNLKZA6IVs
            Arguments:n/a
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            General

            Start time:07:05:49
            Start date:06/08/2022
            Path:/tmp/dNLKZA6IVs
            Arguments:n/a
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            General

            Start time:07:05:49
            Start date:06/08/2022
            Path:/tmp/dNLKZA6IVs
            Arguments:n/a
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            General

            Start time:07:08:38
            Start date:06/08/2022
            Path:/tmp/dNLKZA6IVs
            Arguments:n/a
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            General

            Start time:07:05:49
            Start date:06/08/2022
            Path:/tmp/dNLKZA6IVs
            Arguments:n/a
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1