Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
linux_mips64.elf

Overview

General Information

Sample name:linux_mips64.elf
Analysis ID:1546459
MD5:df2cd2d882733d3792df85114837c5a1
SHA1:3f010e003f05650d21d3ffd8ae9098b8d0e31673
SHA256:7e3323c14e8c2af080276aa92fffd282f5f276242e67f607c021666fcb1fa80e
Tags:elfuser-abuse_ch
Infos:

Detection

Chaos
Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Chaos
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1546459
Start date and time:2024-10-31 23:26:04 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 25s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:linux_mips64.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@0/0
  • VT rate limit hit for: linux_mips64.elf
Command:/tmp/linux_mips64.elf
PID:6222
Exit Code:2
Exit Code Info:
Killed:False
Standard Output:

Standard Error:fatal error: sigaction failed

runtime stack:
runtime.throw({0x39ae60, 0x10})
/usr/lib/go-1.18/src/runtime/panic.go:992 +0x6c
runtime.sysSigaction.func1()
/usr/lib/go-1.18/src/runtime/os_linux.go:529 +0x4c
runtime.sysSigaction(0x41, 0x4000800bc0, 0x0)
/usr/lib/go-1.18/src/runtime/os_linux.go:528 +0x88
runtime.sigaction(0x41, 0x4000800bc0, 0x0)
/usr/lib/go-1.18/src/runtime/sigaction.go:15 +0x28
runtime.setsig(0x41, 0x6ed10)
/usr/lib/go-1.18/src/runtime/os_linux.go:478 +0xb0
runtime.initsig(0x0)
/usr/lib/go-1.18/src/runtime/signal_unix.go:147 +0x348
runtime.mstartm0()
/usr/lib/go-1.18/src/runtime/proc.go:1442 +0x78
runtime.mstart1()
/usr/lib/go-1.18/src/runtime/proc.go:1414 +0x94
runtime.mstart0()
/usr/lib/go-1.18/src/runtime/proc.go:1376 +0x74
runtime.mstart()
/usr/lib/go-1.18/src/runtime/asm_mips64x.s:88 +0x10

goroutine 1 [runnable]:
runtime.main()
/usr/lib/go-1.18/src/runtime/proc.go:145
runtime.goexit()
/usr/lib/go-1.18/src/runtime/asm_mips64x.s:617 +0x4
  • system is lnxubuntu20
  • linux_mips64.elf (PID: 6222, Parent: 6139, MD5: 801a06b4e0ed2dca89cbfa1f900a483d) Arguments: /tmp/linux_mips64.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
ChaosMulti-functional malware written in Go, targeting both Linux and Windows, evolved from elf.kaiji.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.chaos
SourceRuleDescriptionAuthorStrings
linux_mips64.elfJoeSecurity_ChaosGoYara detected ChaosJoe Security
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: linux_mips64.elfReversingLabs: Detection: 39%
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: linux_mips64.elfString found in binary or memory: http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing connectionhttp: message cannot contain multiple Content-Length headers; got %qpadding bytes must all be zeros unless AllowIllegalWrites is enabledreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)tls: handshake message of length %d bytes exceeds maximum of %d bytestls: peer doesn't support the certificate custom signature algorithmsbytes.Buffer: UnreadByte: previous operation was not a successful readcannot convert slice with length %y to pointer to array with length %xgot %s for stream %d; expected CONTINUATION following %s for stream %dx509: PKCS#8 wrapping contained private key with unknown algorithm: %vx509: certificate relies on legacy Common Name field, use SANs insteadMozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)Sogou Pic Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)dynamic table size update MUST occur at the beginning of a header blockssh: no common algorithm for %s; client offered: %v, server offered: %vtls: peer doesn't support any of the certificate's signature algorithmstoo many concurrent operations on a single file or socket (max 1048575)x509: issuer has name constraints but leaf doesn't have a SAN extensionMozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)tls: server's certificate contains an unsupported type of public key: %Ttls: received unexpected handshake message of type %T when waiting for %T91289437fa036b34da55d57af6192768c27bd433fa012169d626d934e0051b24dd67dd3cf49d7cc827bc012d259d7ac226e70829239d7ac226e7082968de60d520eb433722c07fd236f6crypto/elliptic: internal error: Unmarshal rejected a valid point encodingmalformed response from server: malformed non-numeric status pseudo headernet/http: server replied with more than declared Content-Length; truncatedtls: certificate RSA key size too small for supported signature algorithmsUnsolicited response received on idle HTTP channel starting with %q; err=%vtls: internal error: attempted to read record with pending application datatls: failed to send closeNotify alert (but connection was closed anyway): %wtls: server certificate contains incorrect key type for selected ciphersuite((2(5[0-5]|[0-4]\d))|[0-1]?\d{1,2})(\.((2(5[0-5]|[0-4]\d))|[0-1]?\d{1,2})){3}MapIter.Next called on an iterator that does not have an associated map Valuecrypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabled115792089210356248762697446949407573529996955224135760342422259061068512044369115792089210356248762697446949407573530086143415290314195533631308867097853951ssh: internal error: algorithmSignerWrapper invoked with non-default algorithmssh: unable to authenticate, attempted methods %v, no supported methods remainx509: signature check attempt
    Source: linux_mips64.elfString found in binary or memory: http: RoundTripper implementation (%T) returned a nil *Response with a nil errortls: either ServerName or InsecureSkipVerify must be specified in the tls.Configx509: invalid signature: parent certificate cannot sign this kind of certificaterefusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxyx509: a root or intermediate certificate is not authorized to sign for this name: (possibly because of %q while trying to verify candidate authority certificate %q)Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)x509: issuer has name constraints but leaf contains unknown or unconstrained name: tls: downgrade attempt detected, possibly due to a MitM attack or a broken middleboxx509: signature algorithm specifies an %s public key, but have public key of type %Treflect.Value.Interface: cannot return value obtained from unexported field or methodx509: failed to parse private key (use ParseECPrivateKey instead for this key format)Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/;)reflect: New of type that may not be allocated in heap (possibly undefined cgo C type)x509: a root or intermediate certificate is not authorized for an extended key usage: fxfzUc6gtMGc/i26ld3KydGKy1k7QqyMMyxjbU1Rlk+F9LQxnaTeCHGHsDUpaBeOWDeY6l+2kHlB7EWTLcGwfg==whv+Kf1cEtOXzr+zuvmef2as0WfbUDm8l2LMWBMel10NDnbShg9CsMUt327VJhOTbXLoPYJVTKy8MBPCVwoT8A==x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)x509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format)Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)http2: server sent GOAWAY and closed the connection; LastStreamID=%v, ErrCode=%v, debug=%qapplication/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5tls: handshake hash for a client certificate requested after discarding the handshake buffertls: unsupported certificate: private key is *ed25519.PrivateKey, expected ed25519.PrivateKey3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5faa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefhttp: RoundTripper implementation (%T) returned a *Response with content length %d but a nil BodyNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertcipher: the nonce can't have zero length, or the security of the key will be immediately compromised1.0.3<<RMS>> equals www.yahoo.com (Yahoo)
    Source: linux_mips64.elfString found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)x509:
    Source: linux_mips64.elfString found in binary or memory: http://search.msn.com/msnbot.htm
    Source: linux_mips64.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
    Source: linux_mips64.elfString found in binary or memory: http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829
    Source: linux_mips64.elfString found in binary or memory: http://www.baidu.com/search/spider.html)Mozilla/5.0
    Source: linux_mips64.elfString found in binary or memory: http://www.baidu.com/search/spider.html)http2:
    Source: linux_mips64.elfString found in binary or memory: http://www.entireweb.com/about/search_tech/speedy_spider/)text/html
    Source: linux_mips64.elfString found in binary or memory: http://www.google.com/mobile/adsbot.html)
    Source: linux_mips64.elfString found in binary or memory: http://www.haosou.com/help/help_3_2.htmlMozilla/5.0
    Source: linux_mips64.elfString found in binary or memory: http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0
    Source: linux_mips64.elfString found in binary or memory: http://www.youdao.com/help/webmaster/spider/;)reflect:
    Source: linux_mips64.elfString found in binary or memory: http://yandex.com/bots)http:
    Source: linux_mips64.elfString found in binary or memory: https://search.yahoo.com/search?p=illegal
    Source: linux_mips64.elfString found in binary or memory: https://www.baidu.com/s?wd=insufficient
    Source: linux_mips64.elfString found in binary or memory: https://www.so.com/s?q=index
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: classification engineClassification label: mal56.troj.linELF@0/0@0/0
    Source: ELF file sectionSubmission: linux_mips64.elf
    Source: /tmp/linux_mips64.elf (PID: 6222)Queries kernel information via 'uname': Jump to behavior
    Source: linux_mips64.elf, 6222.1.00007ffe549be000.00007ffe549df000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips64
    Source: linux_mips64.elf, 6222.1.0000559e7a83f000.0000559e7abb3000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mips641RelativeDistinguishedName
    Source: linux_mips64.elf, 6222.1.00007ffe549be000.00007ffe549df000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mips64/tmp/linux_mips64.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/linux_mips64.elf
    Source: linux_mips64.elf, 6222.1.0000559e7a83f000.0000559e7abb3000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips64

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: linux_mips64.elf, type: SAMPLE

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: linux_mips64.elf, type: SAMPLE
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
    Security Software Discovery
    Remote ServicesData from Local System1
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    linux_mips64.elf39%ReversingLabsLinux.Trojan.Multiverze
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No contacted domains info
    NameSourceMaliciousAntivirus DetectionReputation
    http://www.baidu.com/search/spider.html)linux_mips64.elffalse
      unknown
      http://search.msn.com/msnbot.htmlinux_mips64.elffalse
        unknown
        http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829linux_mips64.elffalse
          unknown
          https://www.so.com/s?q=indexlinux_mips64.elffalse
            unknown
            http://help.yahoo.com/help/us/ysearch/slurp)x509:linux_mips64.elffalse
              unknown
              http://www.google.com/mobile/adsbot.html)linux_mips64.elffalse
                unknown
                http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0linux_mips64.elffalse
                  unknown
                  http://www.baidu.com/search/spider.html)http2:linux_mips64.elffalse
                    unknown
                    http://yandex.com/bots)http:linux_mips64.elffalse
                      unknown
                      http://www.baidu.com/search/spider.html)Mozilla/5.0linux_mips64.elffalse
                        unknown
                        http://www.entireweb.com/about/search_tech/speedy_spider/)text/htmllinux_mips64.elffalse
                          unknown
                          http://www.haosou.com/help/help_3_2.htmlMozilla/5.0linux_mips64.elffalse
                            unknown
                            https://www.baidu.com/s?wd=insufficientlinux_mips64.elffalse
                              unknown
                              http://www.youdao.com/help/webmaster/spider/;)reflect:linux_mips64.elffalse
                                unknown
                                https://search.yahoo.com/search?p=illegallinux_mips64.elffalse
                                  unknown
                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs
                                  IPDomainCountryFlagASNASN NameMalicious
                                  109.202.202.202
                                  unknownSwitzerland
                                  13030INIT7CHfalse
                                  91.189.91.43
                                  unknownUnited Kingdom
                                  41231CANONICAL-ASGBfalse
                                  91.189.91.42
                                  unknownUnited Kingdom
                                  41231CANONICAL-ASGBfalse
                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                                  • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                                  91.189.91.43linux_arm5.elfGet hashmaliciousChaosBrowse
                                    Mozi.m.elfGet hashmaliciousUnknownBrowse
                                      x.rar.elfGet hashmaliciousXmrigBrowse
                                        boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                          boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                            boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                              tftp.elfGet hashmaliciousUnknownBrowse
                                                .i.elfGet hashmaliciousUnknownBrowse
                                                  .i.elfGet hashmaliciousUnknownBrowse
                                                    .i.elfGet hashmaliciousUnknownBrowse
                                                      91.189.91.42linux_arm5.elfGet hashmaliciousChaosBrowse
                                                        Mozi.m.elfGet hashmaliciousUnknownBrowse
                                                          x.rar.elfGet hashmaliciousXmrigBrowse
                                                            boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                              boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                                                boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                  tftp.elfGet hashmaliciousUnknownBrowse
                                                                    .i.elfGet hashmaliciousUnknownBrowse
                                                                      .i.elfGet hashmaliciousUnknownBrowse
                                                                        .i.elfGet hashmaliciousUnknownBrowse
                                                                          No context
                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          CANONICAL-ASGBlinux_arm5.elfGet hashmaliciousChaosBrowse
                                                                          • 91.189.91.42
                                                                          Mozi.m.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          x.rar.elfGet hashmaliciousXmrigBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                                                          • 185.125.190.26
                                                                          boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                          • 185.125.190.26
                                                                          boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                                          • 185.125.190.26
                                                                          boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          tftp.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          CANONICAL-ASGBlinux_arm5.elfGet hashmaliciousChaosBrowse
                                                                          • 91.189.91.42
                                                                          Mozi.m.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          x.rar.elfGet hashmaliciousXmrigBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                                                          • 185.125.190.26
                                                                          boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                          • 185.125.190.26
                                                                          boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                                          • 185.125.190.26
                                                                          boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          tftp.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          INIT7CHlinux_arm5.elfGet hashmaliciousChaosBrowse
                                                                          • 109.202.202.202
                                                                          Mozi.m.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          x.rar.elfGet hashmaliciousXmrigBrowse
                                                                          • 109.202.202.202
                                                                          boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                                          • 109.202.202.202
                                                                          boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                                                          • 109.202.202.202
                                                                          boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                          • 109.202.202.202
                                                                          tftp.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          .i.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          .i.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          .i.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          No context
                                                                          No context
                                                                          No created / dropped files found
                                                                          File type:ELF 64-bit MSB executable, MIPS, MIPS-III version 1 (SYSV), statically linked, Go BuildID=531EpRgthPZPt3knqoKK/ayf51kNy_prNzbkXr_MN/zxjogFIOCYVVIxufPI04/tQgJURn6GO8NPfNwspcu, stripped
                                                                          Entropy (8bit):5.376057334583103
                                                                          TrID:
                                                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                          File name:linux_mips64.elf
                                                                          File size:5'963'776 bytes
                                                                          MD5:df2cd2d882733d3792df85114837c5a1
                                                                          SHA1:3f010e003f05650d21d3ffd8ae9098b8d0e31673
                                                                          SHA256:7e3323c14e8c2af080276aa92fffd282f5f276242e67f607c021666fcb1fa80e
                                                                          SHA512:83852a17da3927c98063cca789ad1e3916c9c42556d61530a1561f0d327196d61dbe0bf90a5e23223f09483d81639a09afba5d5c6afe99352c8543e1cfb8093d
                                                                          SSDEEP:49152:XralYsYZ/MjJ7fhl2pCQLg1xbnZdY3MniUj0E/GiV:Xr9lMjJ7fWjWjV/P
                                                                          TLSH:5F560912BF58ED2FD25421308BB7C23433D53D1482E16533AA56F71E2EBA2B5991BDC8
                                                                          File Content Preview:.ELF...................................@........ ....@.8...@...................@.......@.......@...............................................................d.......d.............................................0.......0.......................1.......2.

                                                                          ELF header

                                                                          Class:ELF64
                                                                          Data:2's complement, big endian
                                                                          Version:1 (current)
                                                                          Machine:MIPS R3000
                                                                          Version Number:0x1
                                                                          Type:EXEC (Executable file)
                                                                          OS/ABI:UNIX - System V
                                                                          ABI Version:0
                                                                          Entry Point Address:0x90000
                                                                          Flags:0x20000004
                                                                          ELF Header Size:64
                                                                          Program Header Offset:64
                                                                          Program Header Size:56
                                                                          Number of Program Headers:7
                                                                          Section Header Offset:456
                                                                          Section Header Size:64
                                                                          Number of Section Headers:14
                                                                          Header String Table Index:3
                                                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                          NULL0x00x00x00x00x0000
                                                                          .textPROGBITS0x110000x10000x30dbf00x00x6AX008
                                                                          .rodataPROGBITS0x3200000x3100000xf91340x00x2A0032
                                                                          .shstrtabSTRTAB0x00x4091400xa50x00x0001
                                                                          .typelinkPROGBITS0x4192000x4092000x17c80x00x2A0032
                                                                          .itablinkPROGBITS0x41a9e00x40a9e00x9480x00x2A0032
                                                                          .gosymtabPROGBITS0x41b3280x40b3280x00x00x2A001
                                                                          .gopclntabPROGBITS0x41b3400x40b3400x14bcb80x00x2A0032
                                                                          .go.buildinfoPROGBITS0x5700000x5600000xf00x00x3WA0016
                                                                          .noptrdataPROGBITS0x5701000x5601000x31e180x00x3WA0032
                                                                          .dataPROGBITS0x5a1f200x591f200xfe800x00x3WA0032
                                                                          .bssNOBITS0x5b1da00x5a1da00x301000x00x3WA0032
                                                                          .noptrbssNOBITS0x5e1ea00x5d1ea00xf5700x00x3WA0032
                                                                          .note.go.buildidNOTE0x10f9c0xf9c0x640x00x2A004
                                                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                          PHDR0x400x100400x100400x1880x1881.50300x4R 0x10000
                                                                          NOTE0xf9c0x10f9c0x10f9c0x640x645.31720x4R 0x4.note.go.buildid
                                                                          LOAD0x00x100000x100000x30ebf00x30ebf05.13710x5R E0x10000.text .note.go.buildid
                                                                          LOAD0x3100000x3200000x3200000x246ff80x246ff85.40300x4R 0x10000.rodata .typelink .itablink .gosymtab .gopclntab
                                                                          LOAD0x5600000x5700000x5700000x41da00x814105.04930x6RW 0x10000.go.buildinfo .noptrdata .data .bss .noptrbss
                                                                          GNU_STACK0x00x00x00x00x00.00000x6RW 0x8
                                                                          LOOS+50415800x00x00x00x00x00.00000x2a00 0x8
                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Oct 31, 2024 23:26:42.402726889 CET43928443192.168.2.2391.189.91.42
                                                                          Oct 31, 2024 23:26:47.777985096 CET42836443192.168.2.2391.189.91.43
                                                                          Oct 31, 2024 23:26:49.313793898 CET4251680192.168.2.23109.202.202.202
                                                                          Oct 31, 2024 23:27:03.391901970 CET43928443192.168.2.2391.189.91.42
                                                                          Oct 31, 2024 23:27:13.630563021 CET42836443192.168.2.2391.189.91.43
                                                                          Oct 31, 2024 23:27:19.773617029 CET4251680192.168.2.23109.202.202.202
                                                                          Oct 31, 2024 23:27:44.346818924 CET43928443192.168.2.2391.189.91.42
                                                                          Oct 31, 2024 23:28:04.823426962 CET42836443192.168.2.2391.189.91.43

                                                                          System Behavior

                                                                          Start time (UTC):22:26:39
                                                                          Start date (UTC):31/10/2024
                                                                          Path:/tmp/linux_mips64.elf
                                                                          Arguments:/tmp/linux_mips64.elf
                                                                          File size:5830456 bytes
                                                                          MD5 hash:801a06b4e0ed2dca89cbfa1f900a483d