Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
zerarm.elf

Overview

General Information

Sample name:zerarm.elf
Analysis ID:1543153
MD5:df8ac01308ab6015e8ab997165338246
SHA1:14c6d9231087b174c621570e674bed0a7a681633
SHA256:1dd6b91e5c01b531acda095c662f649638e1a03ec141213504b1193834e89345
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1543153
Start date and time:2024-10-27 09:56:28 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 5s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zerarm.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@11/0
  • VT rate limit hit for: zerarm.elf
Command:/tmp/zerarm.elf
PID:6263
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
The Peoples Bank of China.
Standard Error:
  • system is lnxubuntu20
  • zerarm.elf (PID: 6263, Parent: 6183, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/zerarm.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: zerarm.elfReversingLabs: Detection: 50%

Networking

barindex
Source: global trafficTCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Source: global trafficDNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global trafficDNS traffic detected: malformed DNS query: yellowchink.pirate. [malformed]
Source: global trafficDNS traffic detected: malformed DNS query: burnthe.libre. [malformed]
Source: global trafficDNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Source: global trafficTCP traffic: 192.168.2.23:49448 -> 45.156.86.24:38241
Source: /tmp/zerarm.elf (PID: 6263)Socket: 127.0.0.1:39148Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: global trafficDNS traffic detected: DNS query: yellowchink.pirate
Source: global trafficDNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global trafficDNS traffic detected: DNS query: yellowchink.pirate. [malformed]
Source: global trafficDNS traffic detected: DNS query: burnthe.libre. [malformed]
Source: global trafficDNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global trafficDNS traffic detected: DNS query: burnthe.libre
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.troj.linELF@0/0@11/0
Source: /tmp/zerarm.elf (PID: 6263)Queries kernel information via 'uname': Jump to behavior
Source: zerarm.elf, 6263.1.000055bc1dbbf000.000055bc1dced000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: zerarm.elf, 6263.1.000055bc1dbbf000.000055bc1dced000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: zerarm.elf, 6263.1.00007ffd65f35000.00007ffd65f56000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: zerarm.elf, 6263.1.00007ffd65f35000.00007ffd65f56000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/zerarm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zerarm.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1543153 Sample: zerarm.elf Startdate: 27/10/2024 Architecture: LINUX Score: 56 14 yellowchink.pirate. [malformed] 2->14 16 netfags.geek. [malformed] 2->16 18 7 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Connects to many ports of the same IP (likely port scanning) 2->22 8 zerarm.elf 2->8         started        signatures3 24 Sends malformed DNS queries 16->24 process4 process5 10 zerarm.elf 8->10         started        process6 12 zerarm.elf 10->12         started       
SourceDetectionScannerLabelLink
zerarm.elf50%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
yellowchink.pirate
45.156.86.24
truetrue
    unknown
    burnthe.libre
    45.156.86.24
    truetrue
      unknown
      chinklabs.dyn. [malformed]
      unknown
      unknowntrue
        unknown
        burnthe.libre. [malformed]
        unknown
        unknowntrue
          unknown
          netfags.geek. [malformed]
          unknown
          unknowntrue
            unknown
            yellowchink.pirate. [malformed]
            unknown
            unknowntrue
              unknown
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              109.202.202.202
              unknownSwitzerland
              13030INIT7CHfalse
              91.189.91.43
              unknownUnited Kingdom
              41231CANONICAL-ASGBfalse
              91.189.91.42
              unknownUnited Kingdom
              41231CANONICAL-ASGBfalse
              45.156.86.24
              yellowchink.pirateGermany
              44592SKYLINKNLtrue
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
              • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
              91.189.91.43zerarm6.elfGet hashmaliciousUnknownBrowse
                nabarm6.elfGet hashmaliciousUnknownBrowse
                  mips.elfGet hashmaliciousUnknownBrowse
                    arm.elfGet hashmaliciousUnknownBrowse
                      boatnet.arc.elfGet hashmaliciousMiraiBrowse
                        x86.elfGet hashmaliciousMiraiBrowse
                          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                            oovw68w2UV.elfGet hashmaliciousBlackBastaBrowse
                              sshd.elfGet hashmaliciousUnknownBrowse
                                la.bot.arc.elfGet hashmaliciousMiraiBrowse
                                  91.189.91.42zerarm6.elfGet hashmaliciousUnknownBrowse
                                    nabarm6.elfGet hashmaliciousUnknownBrowse
                                      mips.elfGet hashmaliciousUnknownBrowse
                                        arm.elfGet hashmaliciousUnknownBrowse
                                          nklarm6.elfGet hashmaliciousUnknownBrowse
                                            boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                              x86.elfGet hashmaliciousMiraiBrowse
                                                boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                  oovw68w2UV.elfGet hashmaliciousBlackBastaBrowse
                                                    sshd.elfGet hashmaliciousUnknownBrowse
                                                      45.156.86.24zerarm5.elfGet hashmaliciousUnknownBrowse
                                                        nabspc.elfGet hashmaliciousUnknownBrowse
                                                          zerx86.elfGet hashmaliciousUnknownBrowse
                                                            nabppc.elfGet hashmaliciousUnknownBrowse
                                                              nabmips.elfGet hashmaliciousUnknownBrowse
                                                                zermips.elfGet hashmaliciousUnknownBrowse
                                                                  nabarm.elfGet hashmaliciousUnknownBrowse
                                                                    nabx86.elfGet hashmaliciousUnknownBrowse
                                                                      nabarm5.elfGet hashmaliciousUnknownBrowse
                                                                        splsh4.elfGet hashmaliciousUnknownBrowse
                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          burnthe.librenklsh4.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nklm68k.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabmips.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          zermips.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          yellowchink.piratezerarm5.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabspc.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          zerx86.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabmips.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          splm68k.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          zermips.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          CANONICAL-ASGBzerarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          mips.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          arm.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          nklarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          x86.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          oovw68w2UV.elfGet hashmaliciousBlackBastaBrowse
                                                                          • 91.189.91.42
                                                                          sshd.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          CANONICAL-ASGBzerarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          mips.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          arm.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          nklarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          x86.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          oovw68w2UV.elfGet hashmaliciousBlackBastaBrowse
                                                                          • 91.189.91.42
                                                                          sshd.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          SKYLINKNLzerarm5.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabspc.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          zerx86.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabppc.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabmips.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          zermips.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabx86.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          nabarm5.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          splsh4.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.156.86.24
                                                                          INIT7CHzerarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          mips.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          mpsl.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          arm.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          nklarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                                          • 109.202.202.202
                                                                          x86.elfGet hashmaliciousMiraiBrowse
                                                                          • 109.202.202.202
                                                                          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                          • 109.202.202.202
                                                                          oovw68w2UV.elfGet hashmaliciousBlackBastaBrowse
                                                                          • 109.202.202.202
                                                                          No context
                                                                          No context
                                                                          No created / dropped files found
                                                                          File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                                                                          Entropy (8bit):5.978026723918992
                                                                          TrID:
                                                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                          File name:zerarm.elf
                                                                          File size:48'168 bytes
                                                                          MD5:df8ac01308ab6015e8ab997165338246
                                                                          SHA1:14c6d9231087b174c621570e674bed0a7a681633
                                                                          SHA256:1dd6b91e5c01b531acda095c662f649638e1a03ec141213504b1193834e89345
                                                                          SHA512:03edc6d6ed8e10d5f53b91f77783340b07dba253f65e49e901892fcf5320cbccf00a5f51cb71aa5d9a9f64f4078573cf547852d00620af2694510547137a43fa
                                                                          SSDEEP:768:vic2x0lAcmc4mkM50az5xehsXdT6tQ0tHloK5kcIRBXNq5fvqU1Q6wn:aDxGAdazKhsXdetQ0tdkVBUSn
                                                                          TLSH:75232881B8819A17C5E4137FF62F428D372523A8E2DF7217DD226F057B8A92F0DA7641
                                                                          File Content Preview:.ELF...a..........(.........4...p.......4. ...(.....................................................................Q.td..................................-...L."....+..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                                                                          ELF header

                                                                          Class:ELF32
                                                                          Data:2's complement, little endian
                                                                          Version:1 (current)
                                                                          Machine:ARM
                                                                          Version Number:0x1
                                                                          Type:EXEC (Executable file)
                                                                          OS/ABI:ARM - ABI
                                                                          ABI Version:0
                                                                          Entry Point Address:0x8190
                                                                          Flags:0x202
                                                                          ELF Header Size:52
                                                                          Program Header Offset:52
                                                                          Program Header Size:32
                                                                          Number of Program Headers:3
                                                                          Section Header Offset:47728
                                                                          Section Header Size:40
                                                                          Number of Section Headers:11
                                                                          Header String Table Index:10
                                                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                          NULL0x00x00x00x00x0000
                                                                          .initPROGBITS0x80940x940x180x00x6AX004
                                                                          .textPROGBITS0x80b00xb00xaea00x00x6AX0016
                                                                          .finiPROGBITS0x12f500xaf500x140x00x6AX004
                                                                          .rodataPROGBITS0x12f640xaf640x9440x00x2A004
                                                                          .ctorsPROGBITS0x1b8ac0xb8ac0x80x00x3WA004
                                                                          .dtorsPROGBITS0x1b8b40xb8b40x80x00x3WA004
                                                                          .jcrPROGBITS0x1b8bc0xb8bc0x40x00x3WA004
                                                                          .dataPROGBITS0x1b8c00xb8c00x16c0x00x3WA004
                                                                          .bssNOBITS0x1ba2c0xba2c0x1780x00x3WA004
                                                                          .shstrtabSTRTAB0x00xba2c0x430x00x0001
                                                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                          LOAD0x00x80000x80000xb8a80xb8a86.01610x5R E0x8000.init .text .fini .rodata
                                                                          LOAD0xb8ac0x1b8ac0x1b8ac0x1800x2f80.84470x6RW 0x8000.ctors .dtors .jcr .data .bss
                                                                          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Oct 27, 2024 09:57:33.776602030 CET43928443192.168.2.2391.189.91.42
                                                                          Oct 27, 2024 09:57:34.599361897 CET4944838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:34.605216980 CET382414944845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:34.605282068 CET4944838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:34.621675014 CET4944838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:34.627259970 CET382414944845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:34.627317905 CET4944838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:34.632747889 CET382414944845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:39.151757956 CET42836443192.168.2.2391.189.91.43
                                                                          Oct 27, 2024 09:57:44.630971909 CET4944838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:44.636375904 CET382414944845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:44.984613895 CET382414944845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:44.985070944 CET4944838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:44.990426064 CET382414944845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:46.000602007 CET4945038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:46.006968021 CET382414945045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:46.007025957 CET4945038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:46.007973909 CET4945038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:46.013516903 CET382414945045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:46.013639927 CET4945038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:46.018994093 CET382414945045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:55.277488947 CET43928443192.168.2.2391.189.91.42
                                                                          Oct 27, 2024 09:57:56.845746040 CET382414945045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:56.846035957 CET4945038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:56.851710081 CET382414945045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:57.863615990 CET4945238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:57.870126963 CET382414945245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:57.870300055 CET4945238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:57.871459007 CET4945238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:57.879492998 CET382414945245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:57:57.881421089 CET4945238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:57:57.887810946 CET382414945245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:01.420604944 CET4251680192.168.2.23109.202.202.202
                                                                          Oct 27, 2024 09:58:05.516077995 CET42836443192.168.2.2391.189.91.43
                                                                          Oct 27, 2024 09:58:08.710865974 CET382414945245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:08.711271048 CET4945238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:08.716787100 CET382414945245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:09.726670980 CET4945438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:09.732090950 CET382414945445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:09.732173920 CET4945438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:09.733624935 CET4945438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:09.739211082 CET382414945445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:09.739367962 CET4945438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:09.744724035 CET382414945445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:20.561188936 CET382414945445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:20.561508894 CET4945438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:20.567018032 CET382414945445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:21.661689997 CET4945638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:21.667398930 CET382414945645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:21.667638063 CET4945638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:21.669260979 CET4945638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:21.674807072 CET382414945645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:21.674875021 CET4945638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:21.680335045 CET382414945645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:32.475346088 CET382414945645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:32.475856066 CET4945638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:32.481462002 CET382414945645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:33.518243074 CET4945838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:33.523847103 CET382414945845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:33.523968935 CET4945838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:33.525620937 CET4945838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:33.531197071 CET382414945845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:33.531348944 CET4945838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:33.537398100 CET382414945845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:36.231919050 CET43928443192.168.2.2391.189.91.42
                                                                          Oct 27, 2024 09:58:44.371529102 CET382414945845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:44.372092009 CET4945838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:44.378081083 CET382414945845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:45.474652052 CET4946038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:45.480679035 CET382414946045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:45.480917931 CET4946038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:45.483294964 CET4946038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:45.490197897 CET382414946045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:45.490562916 CET4946038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:45.497330904 CET382414946045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:55.492248058 CET4946038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:55.497750998 CET382414946045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:55.853400946 CET382414946045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:55.853784084 CET4946038241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:55.859301090 CET382414946045.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:56.948702097 CET4946238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:56.957161903 CET382414946245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:56.957297087 CET4946238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:56.959075928 CET4946238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:56.968121052 CET382414946245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:58:56.968269110 CET4946238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:58:56.974102020 CET382414946245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:07.802411079 CET382414946245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:07.802861929 CET4946238241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:07.808440924 CET382414946245.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:08.898263931 CET4946438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:08.904098034 CET382414946445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:08.904208899 CET4946438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:08.905034065 CET4946438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:08.910496950 CET382414946445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:08.910583973 CET4946438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:08.916533947 CET382414946445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:19.729167938 CET382414946445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:19.729999065 CET4946438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:19.729999065 CET4946438241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:19.735637903 CET382414946445.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:20.754595995 CET4946638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:20.760284901 CET382414946645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:20.760672092 CET4946638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:20.762777090 CET4946638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:20.768270969 CET382414946645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:20.768362045 CET4946638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:20.773765087 CET382414946645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:31.605448008 CET382414946645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:31.605968952 CET4946638241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:31.611423016 CET382414946645.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:32.861500978 CET4946838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:32.867511988 CET382414946845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:32.867811918 CET4946838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:32.869584084 CET4946838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:32.875449896 CET382414946845.156.86.24192.168.2.23
                                                                          Oct 27, 2024 09:59:32.875726938 CET4946838241192.168.2.2345.156.86.24
                                                                          Oct 27, 2024 09:59:32.881704092 CET382414946845.156.86.24192.168.2.23
                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Oct 27, 2024 09:57:34.579862118 CET4063953192.168.2.23152.53.15.127
                                                                          Oct 27, 2024 09:57:34.591521978 CET5340639152.53.15.127192.168.2.23
                                                                          Oct 27, 2024 09:57:45.988702059 CET5505453192.168.2.23194.36.144.87
                                                                          Oct 27, 2024 09:57:45.999748945 CET5355054194.36.144.87192.168.2.23
                                                                          Oct 27, 2024 09:57:57.851491928 CET4698853192.168.2.23152.53.15.127
                                                                          Oct 27, 2024 09:57:57.862409115 CET5346988152.53.15.127192.168.2.23
                                                                          Oct 27, 2024 09:58:09.714509964 CET4123353192.168.2.23194.36.144.87
                                                                          Oct 27, 2024 09:58:09.725817919 CET5341233194.36.144.87192.168.2.23
                                                                          Oct 27, 2024 09:58:21.565557957 CET5227553192.168.2.23168.235.111.72
                                                                          Oct 27, 2024 09:58:21.659780025 CET5352275168.235.111.72192.168.2.23
                                                                          Oct 27, 2024 09:58:33.481779099 CET4058753192.168.2.23185.181.61.24
                                                                          Oct 27, 2024 09:58:33.515949965 CET5340587185.181.61.24192.168.2.23
                                                                          Oct 27, 2024 09:58:45.377672911 CET4703653192.168.2.23168.235.111.72
                                                                          Oct 27, 2024 09:58:45.472460032 CET5347036168.235.111.72192.168.2.23
                                                                          Oct 27, 2024 09:58:56.857527018 CET4461753192.168.2.23168.235.111.72
                                                                          Oct 27, 2024 09:58:56.947201014 CET5344617168.235.111.72192.168.2.23
                                                                          Oct 27, 2024 09:59:08.806651115 CET3819453192.168.2.23168.235.111.72
                                                                          Oct 27, 2024 09:59:08.897258043 CET5338194168.235.111.72192.168.2.23
                                                                          Oct 27, 2024 09:59:20.736555099 CET3411353192.168.2.2351.158.108.203
                                                                          Oct 27, 2024 09:59:20.753082991 CET533411351.158.108.203192.168.2.23
                                                                          Oct 27, 2024 09:59:32.610234022 CET3506553192.168.2.23185.181.61.24
                                                                          Oct 27, 2024 09:59:32.860107899 CET5335065185.181.61.24192.168.2.23
                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                          Oct 27, 2024 09:57:34.579862118 CET192.168.2.23152.53.15.1270x5ca8Standard query (0)yellowchink.pirateA (IP address)IN (0x0001)false
                                                                          Oct 27, 2024 09:57:45.988702059 CET192.168.2.23194.36.144.870xbf14Standard query (0)yellowchink.pirateA (IP address)IN (0x0001)false
                                                                          Oct 27, 2024 09:57:57.851491928 CET192.168.2.23152.53.15.1270x960aStandard query (0)chinklabs.dyn. [malformed]256405false
                                                                          Oct 27, 2024 09:58:09.714509964 CET192.168.2.23194.36.144.870x88acStandard query (0)yellowchink.pirate. [malformed]256417false
                                                                          Oct 27, 2024 09:58:21.565557957 CET192.168.2.23168.235.111.720x427aStandard query (0)burnthe.libre. [malformed]256429false
                                                                          Oct 27, 2024 09:58:33.481779099 CET192.168.2.23185.181.61.240x71f3Standard query (0)yellowchink.pirate. [malformed]256441false
                                                                          Oct 27, 2024 09:58:45.377672911 CET192.168.2.23168.235.111.720x8030Standard query (0)yellowchink.pirate. [malformed]256453false
                                                                          Oct 27, 2024 09:58:56.857527018 CET192.168.2.23168.235.111.720xc26eStandard query (0)chinklabs.dyn. [malformed]256464false
                                                                          Oct 27, 2024 09:59:08.806651115 CET192.168.2.23168.235.111.720xfbc4Standard query (0)netfags.geek. [malformed]256476false
                                                                          Oct 27, 2024 09:59:20.736555099 CET192.168.2.2351.158.108.2030xbf0eStandard query (0)burnthe.libreA (IP address)IN (0x0001)false
                                                                          Oct 27, 2024 09:59:32.610234022 CET192.168.2.23185.181.61.240x87a4Standard query (0)burnthe.libreA (IP address)IN (0x0001)false
                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                          Oct 27, 2024 09:57:34.591521978 CET152.53.15.127192.168.2.230x5ca8No error (0)yellowchink.pirate45.156.86.24A (IP address)IN (0x0001)false
                                                                          Oct 27, 2024 09:57:45.999748945 CET194.36.144.87192.168.2.230xbf14No error (0)yellowchink.pirate45.156.86.24A (IP address)IN (0x0001)false
                                                                          Oct 27, 2024 09:57:57.862409115 CET152.53.15.127192.168.2.230x960aFormat error (1)chinklabs.dyn. [malformed]nonenone256405false
                                                                          Oct 27, 2024 09:58:09.725817919 CET194.36.144.87192.168.2.230x88acFormat error (1)yellowchink.pirate. [malformed]nonenone256417false
                                                                          Oct 27, 2024 09:59:20.753082991 CET51.158.108.203192.168.2.230xbf0eNo error (0)burnthe.libre45.156.86.24A (IP address)IN (0x0001)false
                                                                          Oct 27, 2024 09:59:32.860107899 CET185.181.61.24192.168.2.230x87a4No error (0)burnthe.libre45.156.86.24A (IP address)IN (0x0001)false

                                                                          System Behavior

                                                                          Start time (UTC):08:57:33
                                                                          Start date (UTC):27/10/2024
                                                                          Path:/tmp/zerarm.elf
                                                                          Arguments:/tmp/zerarm.elf
                                                                          File size:4956856 bytes
                                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                          Start time (UTC):08:57:33
                                                                          Start date (UTC):27/10/2024
                                                                          Path:/tmp/zerarm.elf
                                                                          Arguments:-
                                                                          File size:4956856 bytes
                                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                          Start time (UTC):08:57:33
                                                                          Start date (UTC):27/10/2024
                                                                          Path:/tmp/zerarm.elf
                                                                          Arguments:-
                                                                          File size:4956856 bytes
                                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1