Edit tour

Linux Analysis Report
g058ub3UiN.elf

Overview

General Information

Sample name:g058ub3UiN.elf
renamed because original name is a hash value
Original sample name:51515b9628e8db9d2a4c5c3b22c6a4ed.elf
Analysis ID:1440904
MD5:51515b9628e8db9d2a4c5c3b22c6a4ed
SHA1:fe4a59cabead4f21d29e38107c900c38ee7239c9
SHA256:c8ff876a466764ee3ef45df884f2276568df89934ef88d590bf16a615ae9edd5
Tags:32elfintelmirai
Infos:

Detection

Mirai
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Executes the "rm" command used to delete files or directories
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1440904
Start date and time:2024-05-14 00:24:10 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 26s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:g058ub3UiN.elf
renamed because original name is a hash value
Original Sample Name:51515b9628e8db9d2a4c5c3b22c6a4ed.elf
Detection:MAL
Classification:mal76.troj.linELF@0/0@2/0
  • VT rate limit hit for: g058ub3UiN.elf
Command:/tmp/g058ub3UiN.elf
PID:5483
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • g058ub3UiN.elf (PID: 5483, Parent: 5406, MD5: 51515b9628e8db9d2a4c5c3b22c6a4ed) Arguments: /tmp/g058ub3UiN.elf
  • dash New Fork (PID: 5526, Parent: 3633)
  • rm (PID: 5526, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.RxBlqVGvfi /tmp/tmp.EEMe0COUPF /tmp/tmp.hjbNOZQLZJ
  • dash New Fork (PID: 5527, Parent: 3633)
  • cat (PID: 5527, Parent: 3633, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.RxBlqVGvfi
  • dash New Fork (PID: 5528, Parent: 3633)
  • head (PID: 5528, Parent: 3633, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5529, Parent: 3633)
  • tr (PID: 5529, Parent: 3633, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5530, Parent: 3633)
  • cut (PID: 5530, Parent: 3633, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5531, Parent: 3633)
  • cat (PID: 5531, Parent: 3633, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.RxBlqVGvfi
  • dash New Fork (PID: 5532, Parent: 3633)
  • head (PID: 5532, Parent: 3633, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5533, Parent: 3633)
  • tr (PID: 5533, Parent: 3633, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5534, Parent: 3633)
  • cut (PID: 5534, Parent: 3633, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5535, Parent: 3633)
  • rm (PID: 5535, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.RxBlqVGvfi /tmp/tmp.EEMe0COUPF /tmp/tmp.hjbNOZQLZJ
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
g058ub3UiN.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    g058ub3UiN.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x1016c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x10180:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x10194:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x101a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x101bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x101d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x101e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x101f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x1020c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x10220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x10234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x10248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x1025c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x10270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x10284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x10298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x102ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x102c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x102d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x102e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x102fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    g058ub3UiN.elfLinux_Trojan_Mirai_268aac0bunknownunknown
    • 0x920f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
    g058ub3UiN.elfLinux_Trojan_Mirai_0cb1699cunknownunknown
    • 0x91c2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
    g058ub3UiN.elfLinux_Trojan_Mirai_70ef58f1unknownunknown
    • 0xa75d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
    • 0xa7fd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
    Click to see the 6 entries
    SourceRuleDescriptionAuthorStrings
    5483.1.0000000008048000.000000000805b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5483.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x1016c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10180:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10194:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x101a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x101bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x101d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x101e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x101f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1020c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1025c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5483.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Mirai_268aac0bunknownunknown
      • 0x920f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
      5483.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Mirai_0cb1699cunknownunknown
      • 0x91c2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
      5483.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Mirai_70ef58f1unknownunknown
      • 0xa75d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
      • 0xa7fd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
      Click to see the 8 entries
      No Snort rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: g058ub3UiN.elfAvira: detected
      Source: g058ub3UiN.elfReversingLabs: Detection: 44%
      Source: g058ub3UiN.elfJoe Sandbox ML: detected
      Source: unknownHTTPS traffic detected: 34.254.182.186:443 -> 192.168.2.14:59322 version: TLS 1.2
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
      Source: unknownNetwork traffic detected: HTTP traffic on port 59322 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 59322
      Source: unknownHTTPS traffic detected: 34.254.182.186:443 -> 192.168.2.14:59322 version: TLS 1.2

      System Summary

      barindex
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_485c4b13 Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_7d05725e Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
      Source: Process Memory Space: g058ub3UiN.elf PID: 5483, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
      Source: g058ub3UiN.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_485c4b13 reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a, id = 485c4b13-3c7c-47a7-b926-8237cb759ad7, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_7d05725e reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714, id = 7d05725e-db59-42a7-99aa-99de79728126, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
      Source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
      Source: Process Memory Space: g058ub3UiN.elf PID: 5483, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: classification engineClassification label: mal76.troj.linELF@0/0@2/0
      Source: /usr/bin/dash (PID: 5526)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.RxBlqVGvfi /tmp/tmp.EEMe0COUPF /tmp/tmp.hjbNOZQLZJJump to behavior
      Source: /usr/bin/dash (PID: 5535)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.RxBlqVGvfi /tmp/tmp.EEMe0COUPF /tmp/tmp.hjbNOZQLZJJump to behavior

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: g058ub3UiN.elf, type: SAMPLE
      Source: Yara matchFile source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: g058ub3UiN.elf PID: 5483, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: g058ub3UiN.elf, type: SAMPLE
      Source: Yara matchFile source: 5483.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: g058ub3UiN.elf PID: 5483, type: MEMORYSTR
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
      File Deletion
      OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
      Encrypted Channel
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Non-Application Layer Protocol
      Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
      Application Layer Protocol
      Automated ExfiltrationData Encrypted for Impact
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1440904 Sample: g058ub3UiN.elf Startdate: 14/05/2024 Architecture: LINUX Score: 76 14 34.254.182.186, 443, 59322 AMAZON-02US United States 2->14 16 daisy.ubuntu.com 2->16 18 Malicious sample detected (through community Yara rule) 2->18 20 Antivirus / Scanner detection for submitted sample 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 2 other signatures 2->24 6 dash rm 2->6         started        8 dash head 2->8         started        10 dash cat 2->10         started        12 8 other processes 2->12 signatures3 process4

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      g058ub3UiN.elf45%ReversingLabsLinux.Trojan.Mirai
      g058ub3UiN.elf100%AviraEXP/ELF.Mirai.Z.A
      g058ub3UiN.elf100%Joe Sandbox ML
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches

      Download Network PCAP: filteredfull

      NameIPActiveMaliciousAntivirus DetectionReputation
      daisy.ubuntu.com
      162.213.35.24
      truefalse
        high
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        34.254.182.186
        unknownUnited States
        16509AMAZON-02USfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        34.254.182.186SecuriteInfo.com.Linux.Siggen.9999.13162.26731.elfGet hashmaliciousUnknownBrowse
          bot.arm.elfGet hashmaliciousMirai, OkiruBrowse
            2oxo8KJQv0.elfGet hashmaliciousMiraiBrowse
              m-p.s-l.ISIS.elfGet hashmaliciousGafgytBrowse
                AJIfNQDddT.elfGet hashmaliciousMiraiBrowse
                  Aqua.x86-20240509-2041.elfGet hashmaliciousMiraiBrowse
                    SecuriteInfo.com.Linux.Siggen.9999.17714.21341.elfGet hashmaliciousMiraiBrowse
                      g4b2VGmd1s.elfGet hashmaliciousUnknownBrowse
                        k5u3qlfvl3.elfGet hashmaliciousUnknownBrowse
                          8oakb6bAZu.elfGet hashmaliciousMiraiBrowse
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            daisy.ubuntu.comSecuriteInfo.com.Linux.Siggen.9999.13162.26731.elfGet hashmaliciousUnknownBrowse
                            • 162.213.35.25
                            Qc2LYywLSU.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            jd8fmuz66T.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.25
                            yR5kMJRT0m.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            ZOLHuIF3KI.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            3ZpiV0RZOs.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            nLCP3IcKZ7.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            lEY2jC6GGS.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.25
                            Aqua.x86.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            Nj1T3XlYal.elfGet hashmaliciousUnknownBrowse
                            • 162.213.35.25
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            AMAZON-02USLnotJxlL40.elfGet hashmaliciousMiraiBrowse
                            • 54.171.230.55
                            SecuriteInfo.com.Linux.Siggen.9999.13162.26731.elfGet hashmaliciousUnknownBrowse
                            • 34.254.182.186
                            SecuriteInfo.com.Linux.Siggen.9999.20934.12421.elfGet hashmaliciousUnknownBrowse
                            • 54.171.230.55
                            https://hub.celtra.com/api//facebookMeta?app_id=534105289948762&display=page&ref=a65d5ccc_1431&redirect_uri=https://cache-ssl.celtra.com/api/facebook/redirect?fbSession%3D7644283941895671%26creativeId%3Da65d5ccc%26placementId%3D4ced5463%26sessionId%3Ds1522728483xebe71a37c522efx21852983%26purpose%3Dlive%26accountId%3D9d3aa781&name=Join+the+Debate&description=Is+our+new+Sourdough+King+a+Burger+or+a+Sandwich?&picture=https://cache-ssl.celtra.com/api/blobs/77ee9e8841f549aaee00a6b6d61677f1735ebe2447312e0edf21239d0ae562c8/ShareBK.png?transform%3Dcrush%26quality%3D256&link=https://pondokmultimedia.com/cgiGet hashmaliciousUnknownBrowse
                            • 108.138.176.206
                            http://ygi235na1ffvmwkacq8ua9qd046vulia.oastify.comGet hashmaliciousUnknownBrowse
                            • 54.77.139.23
                            Aqua.x86.elfGet hashmaliciousMiraiBrowse
                            • 54.217.10.153
                            36nbQNqTWQ.elfGet hashmaliciousGafgytBrowse
                            • 34.249.145.219
                            https://sacasqr3r3wesdgdzx.blob.core.windows.net/cdaswqrs242asdsasa/mhdihjhjudiuas.htmlGet hashmaliciousPhisherBrowse
                            • 18.155.173.102
                            https://thw.ny4yze.com/thw/Get hashmaliciousUnknownBrowse
                            • 13.226.210.17
                            REF# 5495941179-documentation 2032Pfile.msgGet hashmaliciousHTMLPhisherBrowse
                            • 35.76.214.141
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            fb4726d465c5f28b84cd6d14cedd13a7SecuriteInfo.com.Linux.Siggen.9999.20934.12421.elfGet hashmaliciousUnknownBrowse
                            • 34.254.182.186
                            Aqua.x86.elfGet hashmaliciousMiraiBrowse
                            • 34.254.182.186
                            bot.mips.elfGet hashmaliciousMirai, OkiruBrowse
                            • 34.254.182.186
                            2oxo8KJQv0.elfGet hashmaliciousMiraiBrowse
                            • 34.254.182.186
                            f4twIqJjVs.elfGet hashmaliciousMiraiBrowse
                            • 34.254.182.186
                            ZaakFRkzk0.elfGet hashmaliciousMiraiBrowse
                            • 34.254.182.186
                            0bB3bZhaGj.elfGet hashmaliciousUnknownBrowse
                            • 34.254.182.186
                            systemd-resolvedGet hashmaliciousUnknownBrowse
                            • 34.254.182.186
                            3omgEnWD0H.elfGet hashmaliciousMiraiBrowse
                            • 34.254.182.186
                            gviUvJIIUU.elfGet hashmaliciousMiraiBrowse
                            • 34.254.182.186
                            No context
                            No created / dropped files found
                            File type:
                            Entropy (8bit):6.308163474097732
                            TrID:
                            • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                            • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                            File name:g058ub3UiN.elf
                            File size:75'184 bytes
                            MD5:51515b9628e8db9d2a4c5c3b22c6a4ed
                            SHA1:fe4a59cabead4f21d29e38107c900c38ee7239c9
                            SHA256:c8ff876a466764ee3ef45df884f2276568df89934ef88d590bf16a615ae9edd5
                            SHA512:929ecc91428554d733fb9dae84f3ad6adce080dfa56fde692d5fcfe7602ea56b872ab05b8900c887d708f69cd3bac6d538b2e4587d4b81f026a1e10299001ca7
                            SSDEEP:1536:x26w3+g22eIVSJINxO5RSYdKo3UAR+w66SxbYgHWCc2E2PUdYByFtNHA:x2Ag22FVS2NxOldKoEW+f6XT32E2PMYF
                            TLSH:AF7318C0F98B41F2C607493010ABF63FDE31D5F942B0966EEF99AE39DE675429112788
                            File Content Preview:.ELF....................h...4... $......4. ...(...................... ... ...............!...............(..........Q.td............................U..S.......w0...h........[]...$.............U......=.....t..1....$......$.......u........t...$.............

                            Download Network PCAP: filteredfull

                            • Total Packets: 18
                            • 443 (HTTPS)
                            • 53 (DNS)
                            TimestampSource PortDest PortSource IPDest IP
                            May 14, 2024 00:24:55.924957991 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:11.540496111 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:11.846687078 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:11.848380089 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:11.848392963 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:11.848402023 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:11.848426104 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:11.848438025 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:11.848448038 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:11.848611116 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:11.848611116 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:11.848611116 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:11.848611116 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:11.848611116 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:11.848611116 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:11.849716902 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:12.157349110 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:12.157576084 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:12.157821894 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:12.466435909 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:12.466454983 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:12.466695070 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:12.466737032 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:12.468009949 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:12.774657011 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:12.774692059 CEST4435932234.254.182.186192.168.2.14
                            May 14, 2024 00:25:12.774779081 CEST59322443192.168.2.1434.254.182.186
                            May 14, 2024 00:25:12.774811983 CEST59322443192.168.2.1434.254.182.186
                            TimestampSource PortDest PortSource IPDest IP
                            May 14, 2024 00:24:52.467341900 CEST4383653192.168.2.141.1.1.1
                            May 14, 2024 00:24:52.467411041 CEST4116653192.168.2.141.1.1.1
                            May 14, 2024 00:24:52.621320963 CEST53411661.1.1.1192.168.2.14
                            May 14, 2024 00:24:52.622421980 CEST53438361.1.1.1192.168.2.14
                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            May 14, 2024 00:24:52.467341900 CEST192.168.2.141.1.1.10x2135Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                            May 14, 2024 00:24:52.467411041 CEST192.168.2.141.1.1.10xa73bStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            May 14, 2024 00:24:52.622421980 CEST1.1.1.1192.168.2.140x2135No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                            May 14, 2024 00:24:52.622421980 CEST1.1.1.1192.168.2.140x2135No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                            TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                            May 14, 2024 00:25:11.848448038 CEST34.254.182.186443192.168.2.1459322CN=motd.ubuntu.com CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USThu Mar 07 10:27:55 CET 2024 Fri Sep 04 02:00:00 CEST 2020Wed Jun 05 11:27:54 CEST 2024 Mon Sep 15 18:00:00 CEST 2025771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2fb4726d465c5f28b84cd6d14cedd13a7
                            CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025

                            System Behavior

                            Start time (UTC):22:24:50
                            Start date (UTC):13/05/2024
                            Path:/tmp/g058ub3UiN.elf
                            Arguments:/tmp/g058ub3UiN.elf
                            File size:75184 bytes
                            MD5 hash:51515b9628e8db9d2a4c5c3b22c6a4ed

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/rm
                            Arguments:rm -f /tmp/tmp.RxBlqVGvfi /tmp/tmp.EEMe0COUPF /tmp/tmp.hjbNOZQLZJ
                            File size:72056 bytes
                            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/cat
                            Arguments:cat /tmp/tmp.RxBlqVGvfi
                            File size:43416 bytes
                            MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/head
                            Arguments:head -n 10
                            File size:47480 bytes
                            MD5 hash:fd96a67145172477dd57131396fc9608

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/tr
                            Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                            File size:51544 bytes
                            MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/cut
                            Arguments:cut -c -80
                            File size:47480 bytes
                            MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/cat
                            Arguments:cat /tmp/tmp.RxBlqVGvfi
                            File size:43416 bytes
                            MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/head
                            Arguments:head -n 10
                            File size:47480 bytes
                            MD5 hash:fd96a67145172477dd57131396fc9608

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/tr
                            Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                            File size:51544 bytes
                            MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/cut
                            Arguments:cut -c -80
                            File size:47480 bytes
                            MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):22:25:11
                            Start date (UTC):13/05/2024
                            Path:/usr/bin/rm
                            Arguments:rm -f /tmp/tmp.RxBlqVGvfi /tmp/tmp.EEMe0COUPF /tmp/tmp.hjbNOZQLZJ
                            File size:72056 bytes
                            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b