Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
m68k.elf

Overview

General Information

Sample name:m68k.elf
Analysis ID:1576205
MD5:a2ddb11fd9904198e690f4be25b24460
SHA1:8a8a2ebfd6694a93f7f29418bbf84785dcbfbc14
SHA256:521afcfb4ab208da2ed3d5316f22d1ceb32af5ee7f0aa63eb10d54c70a7b778f
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1576205
Start date and time:2024-12-16 16:33:05 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 6s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:m68k.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@0/0
  • VT rate limit hit for: m68k.elf
Command:/tmp/m68k.elf
PID:6227
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:
  • system is lnxubuntu20
  • m68k.elf (PID: 6227, Parent: 6139, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/m68k.elf
    • m68k.elf New Fork (PID: 6229, Parent: 6227)
      • m68k.elf New Fork (PID: 6231, Parent: 6229)
        • m68k.elf New Fork (PID: 6233, Parent: 6231)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
m68k.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    6229.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6231.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        6227.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          No Suricata rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: m68k.elfReversingLabs: Detection: 39%
          Source: global trafficTCP traffic: 192.168.2.23:40260 -> 85.239.34.134:6666
          Source: /tmp/m68k.elf (PID: 6227)Socket: 0.0.0.0:1210Jump to behavior
          Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
          Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
          Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: m68k.elfString found in binary or memory: http://fast.no/support/crawler.asp)
          Source: m68k.elfString found in binary or memory: http://feedback.redkolibri.com/
          Source: m68k.elfString found in binary or memory: http://www.baidu.com/search/spider.htm)
          Source: m68k.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
          Source: m68k.elfString found in binary or memory: http://www.billybobbot.com/crawler/)
          Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
          Source: ELF static info symbol of initial sample.symtab present: no
          Source: classification engineClassification label: mal56.troj.linELF@0/0@0/0
          Source: /tmp/m68k.elf (PID: 6227)Queries kernel information via 'uname': Jump to behavior
          Source: m68k.elf, 6227.1.000055d35e089000.000055d35e10e000.rw-.sdmp, m68k.elf, 6229.1.000055d35e089000.000055d35e10e000.rw-.sdmp, m68k.elf, 6231.1.000055d35e089000.000055d35e10e000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/m68k
          Source: m68k.elf, 6227.1.00007fff2db98000.00007fff2dbb9000.rw-.sdmp, m68k.elf, 6229.1.00007fff2db98000.00007fff2dbb9000.rw-.sdmp, m68k.elf, 6231.1.00007fff2db98000.00007fff2dbb9000.rw-.sdmpBinary or memory string: Ox86_64/usr/bin/qemu-m68k/tmp/m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m68k.elf
          Source: m68k.elf, 6227.1.00007fff2db98000.00007fff2dbb9000.rw-.sdmp, m68k.elf, 6229.1.00007fff2db98000.00007fff2dbb9000.rw-.sdmp, m68k.elf, 6231.1.00007fff2db98000.00007fff2dbb9000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
          Source: m68k.elf, 6227.1.000055d35e089000.000055d35e10e000.rw-.sdmp, m68k.elf, 6229.1.000055d35e089000.000055d35e10e000.rw-.sdmp, m68k.elf, 6231.1.000055d35e089000.000055d35e10e000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: m68k.elf, type: SAMPLE
          Source: Yara matchFile source: 6229.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6231.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6227.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmp, type: MEMORY
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
          Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
          Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
          Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
          Source: Initial sampleUser agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
          Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: m68k.elf, type: SAMPLE
          Source: Yara matchFile source: 6229.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6231.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6227.1.00007f0fd0001000.00007f0fd0018000.r-x.sdmp, type: MEMORY
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
          Security Software Discovery
          Remote ServicesData from Local System1
          Data Obfuscation
          Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
          Encrypted Channel
          Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
          Non-Standard Port
          Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
          Application Layer Protocol
          Traffic DuplicationData Destruction
          No configs have been found
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1576205 Sample: m68k.elf Startdate: 16/12/2024 Architecture: LINUX Score: 56 17 85.239.34.134, 40260, 6666 RAINBOW-HKRainbownetworklimitedHK Russian Federation 2->17 19 109.202.202.202, 80 INIT7CH Switzerland 2->19 21 2 other IPs or domains 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 Yara detected Mirai 2->25 9 m68k.elf 2->9         started        signatures3 process4 process5 11 m68k.elf 9->11         started        process6 13 m68k.elf 11->13         started        process7 15 m68k.elf 13->15         started       
          SourceDetectionScannerLabelLink
          m68k.elf39%ReversingLabsLinux.Trojan.Mirai
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          No contacted domains info
          NameSourceMaliciousAntivirus DetectionReputation
          http://www.baidu.com/search/spider.html)m68k.elffalse
            high
            http://www.billybobbot.com/crawler/)m68k.elffalse
              high
              http://fast.no/support/crawler.asp)m68k.elffalse
                high
                http://feedback.redkolibri.com/m68k.elffalse
                  high
                  http://www.baidu.com/search/spider.htm)m68k.elffalse
                    high
                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs
                    IPDomainCountryFlagASNASN NameMalicious
                    85.239.34.134
                    unknownRussian Federation
                    134121RAINBOW-HKRainbownetworklimitedHKfalse
                    109.202.202.202
                    unknownSwitzerland
                    13030INIT7CHfalse
                    91.189.91.43
                    unknownUnited Kingdom
                    41231CANONICAL-ASGBfalse
                    91.189.91.42
                    unknownUnited Kingdom
                    41231CANONICAL-ASGBfalse
                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    85.239.34.134arm7.elfGet hashmaliciousMiraiBrowse
                      x86.elfGet hashmaliciousMiraiBrowse
                        mpsl.elfGet hashmaliciousMiraiBrowse
                          arm5.elfGet hashmaliciousMiraiBrowse
                            arm5.elfGet hashmaliciousMiraiBrowse
                              m68k.elfGet hashmaliciousUnknownBrowse
                                x86.elfGet hashmaliciousUnknownBrowse
                                  arm.elfGet hashmaliciousUnknownBrowse
                                    mpsl.elfGet hashmaliciousUnknownBrowse
                                      spc.elfGet hashmaliciousUnknownBrowse
                                        109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                                        • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                                        91.189.91.43x86.elfGet hashmaliciousMiraiBrowse
                                          mpsl.elfGet hashmaliciousMiraiBrowse
                                            arm5.elfGet hashmaliciousMiraiBrowse
                                              arm5.elfGet hashmaliciousMiraiBrowse
                                                zmap.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                  skid.mips.elfGet hashmaliciousUnknownBrowse
                                                    arm.elfGet hashmaliciousUnknownBrowse
                                                      zmap.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                        zmap.arm5.elfGet hashmaliciousOkiruBrowse
                                                          zmap.spc.elfGet hashmaliciousMirai, OkiruBrowse
                                                            No context
                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            RAINBOW-HKRainbownetworklimitedHKarm7.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            x86.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            m68k.elfGet hashmaliciousUnknownBrowse
                                                            • 85.239.34.134
                                                            x86.elfGet hashmaliciousUnknownBrowse
                                                            • 85.239.34.134
                                                            arm.elfGet hashmaliciousUnknownBrowse
                                                            • 85.239.34.134
                                                            mpsl.elfGet hashmaliciousUnknownBrowse
                                                            • 85.239.34.134
                                                            spc.elfGet hashmaliciousUnknownBrowse
                                                            • 85.239.34.134
                                                            CANONICAL-ASGBx86.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            zmap.x86.elfGet hashmaliciousOkiruBrowse
                                                            • 185.125.190.26
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            zmap.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 91.189.91.42
                                                            skid.mips.elfGet hashmaliciousUnknownBrowse
                                                            • 91.189.91.42
                                                            arm.elfGet hashmaliciousUnknownBrowse
                                                            • 91.189.91.42
                                                            zmap.arm6.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 185.125.190.26
                                                            zmap.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 91.189.91.42
                                                            INIT7CHx86.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            zmap.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 109.202.202.202
                                                            skid.mips.elfGet hashmaliciousUnknownBrowse
                                                            • 109.202.202.202
                                                            arm.elfGet hashmaliciousUnknownBrowse
                                                            • 109.202.202.202
                                                            zmap.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 109.202.202.202
                                                            zmap.arm5.elfGet hashmaliciousOkiruBrowse
                                                            • 109.202.202.202
                                                            zmap.spc.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 109.202.202.202
                                                            No context
                                                            No context
                                                            No created / dropped files found
                                                            File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
                                                            Entropy (8bit):6.284020740286846
                                                            TrID:
                                                            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                            File name:m68k.elf
                                                            File size:95'068 bytes
                                                            MD5:a2ddb11fd9904198e690f4be25b24460
                                                            SHA1:8a8a2ebfd6694a93f7f29418bbf84785dcbfbc14
                                                            SHA256:521afcfb4ab208da2ed3d5316f22d1ceb32af5ee7f0aa63eb10d54c70a7b778f
                                                            SHA512:0e2ceca062095bfea926ed97e0f1fb02d9582526da09843effa5038e827679afad1665c658397c5338d4663dcd40f9091191c83cf077d8c421692719b931fdf4
                                                            SSDEEP:1536:5NvRYhpj8nqyR8rrnAaT/QeqacWucW0JcWcBeXC3X99QqVquIXLy9c7+dWe9mswB:dY0qyR8rrnAu/QeqacWucW0JcWcBYG98
                                                            TLSH:E29328D3FC00D9BAF418DB370C534A09B271F2B14D931A72A7173A6AED79199152BEC2
                                                            File Content Preview:.ELF.......................D...4..q|.....4. ...(......................n...n...............n...~...~.......i.........dt.Q............................NV..a....da...>.N^NuNV..J9...,f>"y..~. QJ.g.X.#...~.N."y..~. QJ.f.A.....J.g.Hy..~.N.X........,N^NuNV..N^NuN

                                                            ELF header

                                                            Class:ELF32
                                                            Data:2's complement, big endian
                                                            Version:1 (current)
                                                            Machine:MC68000
                                                            Version Number:0x1
                                                            Type:EXEC (Executable file)
                                                            OS/ABI:UNIX - System V
                                                            ABI Version:0
                                                            Entry Point Address:0x80000144
                                                            Flags:0x0
                                                            ELF Header Size:52
                                                            Program Header Offset:52
                                                            Program Header Size:32
                                                            Number of Program Headers:3
                                                            Section Header Offset:94588
                                                            Section Header Size:40
                                                            Number of Section Headers:12
                                                            Header String Table Index:11
                                                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                            NULL0x00x00x00x00x0000
                                                            .initPROGBITS0x800000940x940x140x00x6AX002
                                                            .textPROGBITS0x800000a80xa80x13efa0x00x6AX004
                                                            .finiPROGBITS0x80013fa20x13fa20xe0x00x6AX002
                                                            .rodataPROGBITS0x80013fb00x13fb00x2ed40x00x2A002
                                                            .eh_framePROGBITS0x80017e840x16e840x40x00x3WA004
                                                            .ctorsPROGBITS0x80017e880x16e880x80x00x3WA004
                                                            .dtorsPROGBITS0x80017e900x16e900x80x00x3WA004
                                                            .jcrPROGBITS0x80017e980x16e980x40x00x3WA004
                                                            .dataPROGBITS0x80017e9c0x16e9c0x2900x00x3WA004
                                                            .bssNOBITS0x8001812c0x1712c0x67480x00x3WA004
                                                            .shstrtabSTRTAB0x00x1712c0x4d0x00x0001
                                                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                            LOAD0x00x800000000x800000000x16e840x16e846.30000x5R E0x1000.init .text .fini .rodata
                                                            LOAD0x16e840x80017e840x80017e840x2a80x69f03.68940x6RW 0x1000.eh_frame .ctors .dtors .jcr .data .bss
                                                            GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Dec 16, 2024 16:33:46.753129005 CET43928443192.168.2.2391.189.91.42
                                                            Dec 16, 2024 16:33:47.381464005 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:33:47.501434088 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:33:47.501513004 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:33:47.502600908 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:33:47.622724056 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:33:52.384618044 CET42836443192.168.2.2391.189.91.43
                                                            Dec 16, 2024 16:33:53.152465105 CET4251680192.168.2.23109.202.202.202
                                                            Dec 16, 2024 16:34:07.742348909 CET43928443192.168.2.2391.189.91.42
                                                            Dec 16, 2024 16:34:17.980890036 CET42836443192.168.2.2391.189.91.43
                                                            Dec 16, 2024 16:34:24.123939037 CET4251680192.168.2.23109.202.202.202
                                                            Dec 16, 2024 16:34:48.696733952 CET43928443192.168.2.2391.189.91.42
                                                            Dec 16, 2024 16:35:09.173861027 CET42836443192.168.2.2391.189.91.43
                                                            Dec 16, 2024 16:36:39.155766010 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:36:39.156126976 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:36:39.389588118 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:36:39.389767885 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:36:42.241453886 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:36:42.241759062 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:36:42.453192949 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:36:42.453509092 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:36:45.554723978 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:36:45.555037022 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:36:45.746078968 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:36:45.746413946 CET402606666192.168.2.2385.239.34.134

                                                            System Behavior

                                                            Start time (UTC):15:33:46
                                                            Start date (UTC):16/12/2024
                                                            Path:/tmp/m68k.elf
                                                            Arguments:/tmp/m68k.elf
                                                            File size:4463432 bytes
                                                            MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                            Start time (UTC):15:33:46
                                                            Start date (UTC):16/12/2024
                                                            Path:/tmp/m68k.elf
                                                            Arguments:-
                                                            File size:4463432 bytes
                                                            MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                            Start time (UTC):15:33:46
                                                            Start date (UTC):16/12/2024
                                                            Path:/tmp/m68k.elf
                                                            Arguments:-
                                                            File size:4463432 bytes
                                                            MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                            Start time (UTC):15:33:46
                                                            Start date (UTC):16/12/2024
                                                            Path:/tmp/m68k.elf
                                                            Arguments:-
                                                            File size:4463432 bytes
                                                            MD5 hash:cd177594338c77b895ae27c33f8f86cc