Edit tour

Linux Analysis Report
JDrap683EN.elf

Overview

General Information

Sample name:JDrap683EN.elf
renamed because original name is a hash value
Original sample name:efb99007a653b4effbe81db8d630636a.elf
Analysis ID:1419340
MD5:efb99007a653b4effbe81db8d630636a
SHA1:7887a357ee4b46f62fdc76cdc03076c12a69ca4b
SHA256:1cad5bd1811be88d85085f3af14ec3c32659cfe82b62853c20ee910dcb7760c4
Tags:64elf
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1419340
Start date and time:2024-04-03 14:40:03 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 11s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:JDrap683EN.elf
renamed because original name is a hash value
Original Sample Name:efb99007a653b4effbe81db8d630636a.elf
Detection:MAL
Classification:mal68.troj.linELF@0/0@2/0
Command:/tmp/JDrap683EN.elf
PID:5573
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
i promise you its fine
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
JDrap683EN.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    JDrap683EN.elfLinux_Trojan_Gafgyt_9e9530a7unknownunknown
    • 0x8f5c:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
    JDrap683EN.elfLinux_Trojan_Gafgyt_807911a2unknownunknown
    • 0x9713:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
    JDrap683EN.elfLinux_Trojan_Gafgyt_d4227dbfunknownunknown
    • 0x5d02:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
    • 0x5e8c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
    JDrap683EN.elfLinux_Trojan_Gafgyt_d996d335unknownunknown
    • 0xbf7e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
    Click to see the 5 entries
    SourceRuleDescriptionAuthorStrings
    5577.1.0000000000400000.0000000000412000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5577.1.0000000000400000.0000000000412000.r-x.sdmpLinux_Trojan_Gafgyt_9e9530a7unknownunknown
      • 0x8f5c:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
      5577.1.0000000000400000.0000000000412000.r-x.sdmpLinux_Trojan_Gafgyt_807911a2unknownunknown
      • 0x9713:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
      5577.1.0000000000400000.0000000000412000.r-x.sdmpLinux_Trojan_Gafgyt_d4227dbfunknownunknown
      • 0x5d02:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
      • 0x5e8c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
      5577.1.0000000000400000.0000000000412000.r-x.sdmpLinux_Trojan_Gafgyt_d996d335unknownunknown
      • 0xbf7e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
      Click to see the 25 entries
      No Snort rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: JDrap683EN.elfVirustotal: Detection: 35%Perma Link
      Source: JDrap683EN.elfReversingLabs: Detection: 36%
      Source: JDrap683EN.elfJoe Sandbox ML: detected
      Source: JDrap683EN.elfString: /proc/%d/maps.arm.mips.mpsl.x86/proc//proc/self/exewgetftpgettftprebootcurl/proc/proc/%s/cmdline1
      Source: global trafficTCP traffic: 192.168.2.14:53470 -> 185.196.9.193:6666
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownTCP traffic detected without corresponding DNS query: 185.196.9.193
      Source: unknownDNS traffic detected: queries for: daisy.ubuntu.com
      Source: JDrap683EN.elfString found in binary or memory: http://fast.no/support/crawler.asp)
      Source: JDrap683EN.elfString found in binary or memory: http://feedback.redkolibri.com/
      Source: JDrap683EN.elfString found in binary or memory: http://www.baidu.com/search/spider.htm)
      Source: JDrap683EN.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
      Source: JDrap683EN.elfString found in binary or memory: http://www.billybobbot.com/crawler/)

      System Summary

      barindex
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
      Source: JDrap683EN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
      Source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
      Source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
      Source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
      Source: classification engineClassification label: mal68.troj.linELF@0/0@2/0
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754179/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755027/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754971/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754299/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754731/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754851/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754611/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754779/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754899/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754539/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754659/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754419/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755075/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754443/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754563/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754203/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754323/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755019/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754803/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754923/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754371/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754491/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754131/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755067/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754251/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755003/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754995/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754755/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754875/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754515/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754635/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755091/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755051/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754683/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755099/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755115/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754467/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754587/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754227/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754347/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754827/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754947/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754707/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754395/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755123/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754155/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15755043/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5575)File opened: /proc/15754275/mapsJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/3760/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/3761/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/1583/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/2672/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/110/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/3759/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/111/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/112/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/113/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/234/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/1577/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/114/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/235/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/115/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/116/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/117/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/118/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/119/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/10/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/917/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/3758/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/11/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/12/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/13/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/14/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/15/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/16/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/17/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/18/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/19/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/1593/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/240/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/120/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/3094/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/121/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/242/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/3406/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/1/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/122/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/243/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/2/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/123/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/244/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/1589/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/3/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/124/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/245/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/1588/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/125/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/4/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/246/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/3402/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/126/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/5/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/247/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/127/cmdlineJump to behavior
      Source: /tmp/JDrap683EN.elf (PID: 5576)File opened: /proc/6/cmdlineJump to behavior

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: JDrap683EN.elf, type: SAMPLE
      Source: Yara matchFile source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
      Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
      Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
      Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
      Source: Initial sampleUser agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
      Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
      Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
      Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: JDrap683EN.elf, type: SAMPLE
      Source: Yara matchFile source: 5577.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5574.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5573.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity Information1
      Scripting
      Valid AccountsWindows Management Instrumentation1
      Scripting
      Path InterceptionDirect Volume Access1
      OS Credential Dumping
      System Service DiscoveryRemote ServicesData from Local System1
      Data Obfuscation
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Non-Standard Port
      Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
      Non-Application Layer Protocol
      Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
      Application Layer Protocol
      Traffic DuplicationData Destruction
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1419340 Sample: JDrap683EN.elf Startdate: 03/04/2024 Architecture: LINUX Score: 68 21 185.196.9.193, 53470, 53472, 53474 SIMPLECARRIERCH Switzerland 2->21 23 daisy.ubuntu.com 2->23 25 Malicious sample detected (through community Yara rule) 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected Mirai 2->29 31 Machine Learning detection for sample 2->31 9 JDrap683EN.elf 2->9         started        signatures3 process4 process5 11 JDrap683EN.elf 9->11         started        process6 13 JDrap683EN.elf 11->13         started        15 JDrap683EN.elf 11->15         started        17 JDrap683EN.elf 11->17         started        process7 19 JDrap683EN.elf 13->19         started       
      SourceDetectionScannerLabelLink
      JDrap683EN.elf36%VirustotalBrowse
      JDrap683EN.elf37%ReversingLabsLinux.Trojan.Gafgyt
      JDrap683EN.elf100%Joe Sandbox ML
      No Antivirus matches
      No Antivirus matches
      SourceDetectionScannerLabelLink
      http://www.billybobbot.com/crawler/)100%URL Reputationphishing
      http://www.billybobbot.com/crawler/)100%URL Reputationphishing
      http://fast.no/support/crawler.asp)0%URL Reputationsafe
      http://feedback.redkolibri.com/0%URL Reputationsafe
      http://feedback.redkolibri.com/0%URL Reputationsafe

      Download Network PCAP: filteredfull

      NameIPActiveMaliciousAntivirus DetectionReputation
      daisy.ubuntu.com
      162.213.35.25
      truefalse
        high
        NameSourceMaliciousAntivirus DetectionReputation
        http://www.baidu.com/search/spider.html)JDrap683EN.elffalse
          high
          http://www.billybobbot.com/crawler/)JDrap683EN.elftrue
          • URL Reputation: phishing
          • URL Reputation: phishing
          unknown
          http://fast.no/support/crawler.asp)JDrap683EN.elffalse
          • URL Reputation: safe
          unknown
          http://feedback.redkolibri.com/JDrap683EN.elffalse
          • URL Reputation: safe
          • URL Reputation: safe
          unknown
          http://www.baidu.com/search/spider.htm)JDrap683EN.elffalse
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            185.196.9.193
            unknownSwitzerland
            42624SIMPLECARRIERCHfalse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            185.196.9.193Nv1aZU26YO.elfGet hashmaliciousMiraiBrowse
              D8OrlQhDGl.elfGet hashmaliciousMiraiBrowse
                Y2tzBVyXex.elfGet hashmaliciousMiraiBrowse
                  27RpVWZvbb.elfGet hashmaliciousMiraiBrowse
                    ZrSV2me7r2.elfGet hashmaliciousMiraiBrowse
                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      daisy.ubuntu.comSeJgJltjgu.elfGet hashmaliciousMirai, GafgytBrowse
                      • 162.213.35.24
                      XXsOGfMoub.elfGet hashmaliciousMirai, GafgytBrowse
                      • 162.213.35.24
                      4kHnvdSJn8.elfGet hashmaliciousGafgyt, MiraiBrowse
                      • 162.213.35.25
                      63wE9zWXAf.elfGet hashmaliciousMirai, GafgytBrowse
                      • 162.213.35.24
                      7n89nEPSkV.elfGet hashmaliciousMirai, GafgytBrowse
                      • 162.213.35.25
                      quJhXkPtvO.elfGet hashmaliciousMirai, GafgytBrowse
                      • 162.213.35.24
                      D8OrlQhDGl.elfGet hashmaliciousMiraiBrowse
                      • 162.213.35.25
                      NEl7fh6qgr.elfGet hashmaliciousGafgyt, MiraiBrowse
                      • 162.213.35.25
                      Y2tzBVyXex.elfGet hashmaliciousMiraiBrowse
                      • 162.213.35.25
                      27RpVWZvbb.elfGet hashmaliciousMiraiBrowse
                      • 162.213.35.24
                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      SIMPLECARRIERCHNv1aZU26YO.elfGet hashmaliciousMiraiBrowse
                      • 185.196.9.193
                      D8OrlQhDGl.elfGet hashmaliciousMiraiBrowse
                      • 185.196.9.193
                      Y2tzBVyXex.elfGet hashmaliciousMiraiBrowse
                      • 185.196.9.193
                      27RpVWZvbb.elfGet hashmaliciousMiraiBrowse
                      • 185.196.9.193
                      ZrSV2me7r2.elfGet hashmaliciousMiraiBrowse
                      • 185.196.9.193
                      dekont.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                      • 185.196.11.12
                      gfYewT10Hk.exeGet hashmaliciousQuasarBrowse
                      • 185.196.10.233
                      9sSx6u3Hhp.exeGet hashmaliciousAsyncRATBrowse
                      • 185.196.10.233
                      tdsWKDnPqg.exeGet hashmaliciousQuasarBrowse
                      • 185.196.10.233
                      govFLMmsZl.exeGet hashmaliciousPureLog Stealer, Quasar, zgRATBrowse
                      • 185.196.10.233
                      No context
                      No context
                      No created / dropped files found
                      File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
                      Entropy (8bit):6.345412237168828
                      TrID:
                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                      File name:JDrap683EN.elf
                      File size:76'248 bytes
                      MD5:efb99007a653b4effbe81db8d630636a
                      SHA1:7887a357ee4b46f62fdc76cdc03076c12a69ca4b
                      SHA256:1cad5bd1811be88d85085f3af14ec3c32659cfe82b62853c20ee910dcb7760c4
                      SHA512:d669850f9cfa228d5746418305837e56ec0d1209980a978724f2f3dbd8ad6221c867f9e176acba697d51cf6ee045f65147d55a1e28eaa858b6792dbb943282e5
                      SSDEEP:1536:xZXiEECTMfKRK1U1zsM40Ggl1LH20W592B3hpha/wDDDDDDDDDDDDDDDzDzDDDDg:PXSbKR31zsxI1hW590hpha/
                      TLSH:99733A13A68391FCC896C2F4226FB336ED73B43F0175B15A67C4ED915E98D252B2DA80
                      File Content Preview:.ELF..............>.......@.....@.......X'..........@.8...@.......................@.......@..... ....... ........................ ....... Q...... Q..............u..............Q.td....................................................H...._........H........

                      ELF header

                      Class:ELF64
                      Data:2's complement, little endian
                      Version:1 (current)
                      Machine:Advanced Micro Devices X86-64
                      Version Number:0x1
                      Type:EXEC (Executable file)
                      OS/ABI:UNIX - System V
                      ABI Version:0
                      Entry Point Address:0x400194
                      Flags:0x0
                      ELF Header Size:64
                      Program Header Offset:64
                      Program Header Size:56
                      Number of Program Headers:3
                      Section Header Offset:75608
                      Section Header Size:64
                      Number of Section Headers:10
                      Header String Table Index:9
                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                      NULL0x00x00x00x00x0000
                      .initPROGBITS0x4000e80xe80x130x00x6AX001
                      .textPROGBITS0x4001000x1000xe0b60x00x6AX0016
                      .finiPROGBITS0x40e1b60xe1b60xe0x00x6AX001
                      .rodataPROGBITS0x40e1e00xe1e00x38400x00x2A0032
                      .ctorsPROGBITS0x5120000x120000x100x00x3WA008
                      .dtorsPROGBITS0x5120100x120100x100x00x3WA008
                      .dataPROGBITS0x5120400x120400x6d80x00x3WA0032
                      .bssNOBITS0x5127200x127180x6ed00x00x3WA0032
                      .shstrtabSTRTAB0x00x127180x3e0x00x0001
                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                      LOAD0x00x4000000x4000000x11a200x11a206.51520x5R E0x100000.init .text .fini .rodata
                      LOAD0x120000x5120000x5120000x7180x75f02.36090x6RW 0x100000.ctors .dtors .data .bss
                      GNU_STACK0x00x00x00x00x00.00000x6RW 0x8

                      Download Network PCAP: filteredfull

                      • Total Packets: 37
                      • 6666 undefined
                      • 53 (DNS)
                      TimestampSource PortDest PortSource IPDest IP
                      Apr 3, 2024 14:41:01.862679005 CEST534706666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:02.106304884 CEST666653470185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:02.106369972 CEST534706666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:02.106426001 CEST534706666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:02.349659920 CEST666653470185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:02.349678993 CEST666653470185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:02.349714041 CEST534706666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:02.349714994 CEST666653470185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:02.594959021 CEST666653470185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:11.349894047 CEST534726666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:11.596709967 CEST666653472185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:11.596776009 CEST534726666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:11.596807003 CEST534726666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:11.840188980 CEST666653472185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:11.840202093 CEST666653472185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:11.840213060 CEST666653472185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:11.840261936 CEST534726666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:12.083226919 CEST666653472185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:20.840543032 CEST534746666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:21.089143991 CEST666653474185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:21.089268923 CEST534746666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:21.089314938 CEST534746666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:21.332789898 CEST666653474185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:21.332813978 CEST666653474185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:21.332830906 CEST666653474185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:21.332890987 CEST534746666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:21.576313972 CEST666653474185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:30.333139896 CEST534766666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:30.576040983 CEST666653476185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:30.576205015 CEST534766666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:30.576277971 CEST534766666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:30.818974018 CEST666653476185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:30.819020033 CEST666653476185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:30.819036007 CEST666653476185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:30.819096088 CEST534766666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:31.062438011 CEST666653476185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:39.819272995 CEST534786666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:40.061903000 CEST666653478185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:40.062077045 CEST534786666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:40.062114954 CEST534786666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:40.306495905 CEST666653478185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:40.306518078 CEST666653478185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:40.306534052 CEST666653478185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:40.306622982 CEST534786666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:40.549145937 CEST666653478185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:49.306793928 CEST534806666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:49.552381039 CEST666653480185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:49.552604914 CEST534806666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:49.552644968 CEST534806666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:49.794953108 CEST666653480185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:49.795128107 CEST666653480185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:49.795149088 CEST666653480185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:49.795279980 CEST534806666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:50.037698030 CEST666653480185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:58.795494080 CEST534826666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:59.038721085 CEST666653482185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:59.038851976 CEST534826666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:59.038904905 CEST534826666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:59.282586098 CEST666653482185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:59.282599926 CEST666653482185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:59.282692909 CEST534826666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:41:59.282857895 CEST666653482185.196.9.193192.168.2.14
                      Apr 3, 2024 14:41:59.525995016 CEST666653482185.196.9.193192.168.2.14
                      Apr 3, 2024 14:42:08.283159971 CEST534846666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:42:08.526447058 CEST666653484185.196.9.193192.168.2.14
                      Apr 3, 2024 14:42:08.526581049 CEST534846666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:42:08.526581049 CEST534846666192.168.2.14185.196.9.193
                      Apr 3, 2024 14:42:08.769754887 CEST666653484185.196.9.193192.168.2.14
                      Apr 3, 2024 14:43:48.025985003 CEST4517453192.168.2.148.8.8.8
                      Apr 3, 2024 14:43:48.181813002 CEST53451748.8.8.8192.168.2.14
                      Apr 3, 2024 14:43:48.181889057 CEST4517453192.168.2.148.8.8.8
                      Apr 3, 2024 14:43:48.181952000 CEST4517453192.168.2.148.8.8.8
                      Apr 3, 2024 14:43:48.183114052 CEST53451748.8.8.8192.168.2.14
                      Apr 3, 2024 14:43:48.183157921 CEST4517453192.168.2.148.8.8.8
                      Apr 3, 2024 14:43:48.339585066 CEST53451748.8.8.8192.168.2.14
                      Apr 3, 2024 14:43:48.339611053 CEST53451748.8.8.8192.168.2.14
                      Apr 3, 2024 14:43:48.339667082 CEST4517453192.168.2.148.8.8.8
                      Apr 3, 2024 14:43:50.339520931 CEST53451748.8.8.8192.168.2.14
                      Apr 3, 2024 14:43:50.339734077 CEST4517453192.168.2.148.8.8.8
                      Apr 3, 2024 14:43:50.495915890 CEST53451748.8.8.8192.168.2.14
                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                      Apr 3, 2024 14:43:48.025985003 CEST192.168.2.148.8.8.80x54aeStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                      Apr 3, 2024 14:43:48.181952000 CEST192.168.2.148.8.8.80x15b6Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                      Apr 3, 2024 14:43:48.183114052 CEST8.8.8.8192.168.2.140x54aeNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                      Apr 3, 2024 14:43:48.183114052 CEST8.8.8.8192.168.2.140x54aeNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                      System Behavior

                      Start time (UTC):12:41:01
                      Start date (UTC):03/04/2024
                      Path:/tmp/JDrap683EN.elf
                      Arguments:/tmp/JDrap683EN.elf
                      File size:76248 bytes
                      MD5 hash:efb99007a653b4effbe81db8d630636a

                      Start time (UTC):12:41:01
                      Start date (UTC):03/04/2024
                      Path:/tmp/JDrap683EN.elf
                      Arguments:-
                      File size:76248 bytes
                      MD5 hash:efb99007a653b4effbe81db8d630636a

                      Start time (UTC):12:41:01
                      Start date (UTC):03/04/2024
                      Path:/tmp/JDrap683EN.elf
                      Arguments:-
                      File size:76248 bytes
                      MD5 hash:efb99007a653b4effbe81db8d630636a

                      Start time (UTC):12:41:01
                      Start date (UTC):03/04/2024
                      Path:/tmp/JDrap683EN.elf
                      Arguments:-
                      File size:76248 bytes
                      MD5 hash:efb99007a653b4effbe81db8d630636a

                      Start time (UTC):12:41:01
                      Start date (UTC):03/04/2024
                      Path:/tmp/JDrap683EN.elf
                      Arguments:-
                      File size:76248 bytes
                      MD5 hash:efb99007a653b4effbe81db8d630636a

                      Start time (UTC):12:41:01
                      Start date (UTC):03/04/2024
                      Path:/tmp/JDrap683EN.elf
                      Arguments:-
                      File size:76248 bytes
                      MD5 hash:efb99007a653b4effbe81db8d630636a