Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm6.elf

Overview

General Information

Sample name:arm6.elf
Analysis ID:1576218
MD5:7431309b1d1cef87541d0fec61f9bbe2
SHA1:ccc994e0a6a1b52138c8dc0ba6bd30f52f7c83f7
SHA256:0ebb7dfbeb9a5b177cb170318b4a05f72eb4b89830c9fd2b96fdf06cf2ad9f74
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1576218
Start date and time:2024-12-16 16:48:06 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 6s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm6.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@0/0
  • VT rate limit hit for: arm6.elf
Command:/tmp/arm6.elf
PID:6224
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:
  • system is lnxubuntu20
  • arm6.elf (PID: 6224, Parent: 6131, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm6.elf
    • arm6.elf New Fork (PID: 6226, Parent: 6224)
      • arm6.elf New Fork (PID: 6233, Parent: 6226)
        • arm6.elf New Fork (PID: 6235, Parent: 6233)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
arm6.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    6226.1.00007f7d70017000.00007f7d7002b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6224.1.00007f7d70017000.00007f7d7002b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        6233.1.00007f7d70017000.00007f7d7002b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          No Suricata rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: arm6.elfReversingLabs: Detection: 44%
          Source: global trafficTCP traffic: 192.168.2.23:40260 -> 85.239.34.134:6666
          Source: /tmp/arm6.elf (PID: 6224)Socket: 0.0.0.0:1210Jump to behavior
          Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
          Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
          Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: unknownTCP traffic detected without corresponding DNS query: 85.239.34.134
          Source: arm6.elfString found in binary or memory: http://fast.no/support/crawler.asp)
          Source: arm6.elfString found in binary or memory: http://feedback.redkolibri.com/
          Source: arm6.elfString found in binary or memory: http://www.baidu.com/search/spider.htm)
          Source: arm6.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
          Source: arm6.elfString found in binary or memory: http://www.billybobbot.com/crawler/)
          Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
          Source: ELF static info symbol of initial sample.symtab present: no
          Source: classification engineClassification label: mal56.troj.linELF@0/0@0/0
          Source: /tmp/arm6.elf (PID: 6224)Queries kernel information via 'uname': Jump to behavior
          Source: arm6.elf, 6224.1.0000564391b6b000.0000564391c99000.rw-.sdmp, arm6.elf, 6226.1.0000564391b6b000.0000564391c99000.rw-.sdmp, arm6.elf, 6233.1.0000564391b6b000.0000564391c99000.rw-.sdmpBinary or memory string: CV!/etc/qemu-binfmt/arm
          Source: arm6.elf, 6224.1.0000564391b6b000.0000564391c99000.rw-.sdmp, arm6.elf, 6226.1.0000564391b6b000.0000564391c99000.rw-.sdmp, arm6.elf, 6233.1.0000564391b6b000.0000564391c99000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
          Source: arm6.elf, 6224.1.00007ffdcf48f000.00007ffdcf4b0000.rw-.sdmp, arm6.elf, 6226.1.00007ffdcf48f000.00007ffdcf4b0000.rw-.sdmp, arm6.elf, 6233.1.00007ffdcf48f000.00007ffdcf4b0000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
          Source: arm6.elf, 6224.1.00007ffdcf48f000.00007ffdcf4b0000.rw-.sdmp, arm6.elf, 6226.1.00007ffdcf48f000.00007ffdcf4b0000.rw-.sdmp, arm6.elf, 6233.1.00007ffdcf48f000.00007ffdcf4b0000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6.elf

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: arm6.elf, type: SAMPLE
          Source: Yara matchFile source: 6226.1.00007f7d70017000.00007f7d7002b000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6224.1.00007f7d70017000.00007f7d7002b000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6233.1.00007f7d70017000.00007f7d7002b000.r-x.sdmp, type: MEMORY
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
          Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
          Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
          Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
          Source: Initial sampleUser agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
          Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: arm6.elf, type: SAMPLE
          Source: Yara matchFile source: 6226.1.00007f7d70017000.00007f7d7002b000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6224.1.00007f7d70017000.00007f7d7002b000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 6233.1.00007f7d70017000.00007f7d7002b000.r-x.sdmp, type: MEMORY
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
          Security Software Discovery
          Remote ServicesData from Local System1
          Data Obfuscation
          Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
          Encrypted Channel
          Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
          Non-Standard Port
          Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
          Application Layer Protocol
          Traffic DuplicationData Destruction
          No configs have been found
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1576218 Sample: arm6.elf Startdate: 16/12/2024 Architecture: LINUX Score: 56 17 85.239.34.134, 40260, 40262, 40264 RAINBOW-HKRainbownetworklimitedHK Russian Federation 2->17 19 109.202.202.202, 80 INIT7CH Switzerland 2->19 21 2 other IPs or domains 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 Yara detected Mirai 2->25 9 arm6.elf 2->9         started        signatures3 process4 process5 11 arm6.elf 9->11         started        process6 13 arm6.elf 11->13         started        process7 15 arm6.elf 13->15         started       
          SourceDetectionScannerLabelLink
          arm6.elf45%ReversingLabsLinux.Trojan.Mirai
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          No contacted domains info
          NameSourceMaliciousAntivirus DetectionReputation
          http://www.baidu.com/search/spider.html)arm6.elffalse
            high
            http://www.billybobbot.com/crawler/)arm6.elffalse
              high
              http://fast.no/support/crawler.asp)arm6.elffalse
                high
                http://feedback.redkolibri.com/arm6.elffalse
                  high
                  http://www.baidu.com/search/spider.htm)arm6.elffalse
                    high
                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs
                    IPDomainCountryFlagASNASN NameMalicious
                    85.239.34.134
                    unknownRussian Federation
                    134121RAINBOW-HKRainbownetworklimitedHKfalse
                    109.202.202.202
                    unknownSwitzerland
                    13030INIT7CHfalse
                    91.189.91.43
                    unknownUnited Kingdom
                    41231CANONICAL-ASGBfalse
                    91.189.91.42
                    unknownUnited Kingdom
                    41231CANONICAL-ASGBfalse
                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    85.239.34.134arm.elfGet hashmaliciousMiraiBrowse
                      m68k.elfGet hashmaliciousMiraiBrowse
                        arm7.elfGet hashmaliciousMiraiBrowse
                          x86.elfGet hashmaliciousMiraiBrowse
                            mpsl.elfGet hashmaliciousMiraiBrowse
                              arm5.elfGet hashmaliciousMiraiBrowse
                                arm5.elfGet hashmaliciousMiraiBrowse
                                  m68k.elfGet hashmaliciousUnknownBrowse
                                    x86.elfGet hashmaliciousUnknownBrowse
                                      arm.elfGet hashmaliciousUnknownBrowse
                                        109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                                        • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                                        91.189.91.43arm.elfGet hashmaliciousMiraiBrowse
                                          m68k.elfGet hashmaliciousMiraiBrowse
                                            x86.elfGet hashmaliciousMiraiBrowse
                                              mpsl.elfGet hashmaliciousMiraiBrowse
                                                arm5.elfGet hashmaliciousMiraiBrowse
                                                  arm5.elfGet hashmaliciousMiraiBrowse
                                                    zmap.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                      skid.mips.elfGet hashmaliciousUnknownBrowse
                                                        arm.elfGet hashmaliciousUnknownBrowse
                                                          zmap.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                            No context
                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            RAINBOW-HKRainbownetworklimitedHKarm.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            m68k.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            arm7.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            x86.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 85.239.34.134
                                                            m68k.elfGet hashmaliciousUnknownBrowse
                                                            • 85.239.34.134
                                                            x86.elfGet hashmaliciousUnknownBrowse
                                                            • 85.239.34.134
                                                            arm.elfGet hashmaliciousUnknownBrowse
                                                            • 85.239.34.134
                                                            CANONICAL-ASGBarm.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            m68k.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            x86.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            zmap.x86.elfGet hashmaliciousOkiruBrowse
                                                            • 185.125.190.26
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 91.189.91.42
                                                            zmap.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 91.189.91.42
                                                            skid.mips.elfGet hashmaliciousUnknownBrowse
                                                            • 91.189.91.42
                                                            arm.elfGet hashmaliciousUnknownBrowse
                                                            • 91.189.91.42
                                                            INIT7CHarm.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            m68k.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            x86.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            arm5.elfGet hashmaliciousMiraiBrowse
                                                            • 109.202.202.202
                                                            zmap.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 109.202.202.202
                                                            skid.mips.elfGet hashmaliciousUnknownBrowse
                                                            • 109.202.202.202
                                                            arm.elfGet hashmaliciousUnknownBrowse
                                                            • 109.202.202.202
                                                            zmap.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                            • 109.202.202.202
                                                            No context
                                                            No context
                                                            No created / dropped files found
                                                            File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                                                            Entropy (8bit):6.171421701354587
                                                            TrID:
                                                            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                            File name:arm6.elf
                                                            File size:83'384 bytes
                                                            MD5:7431309b1d1cef87541d0fec61f9bbe2
                                                            SHA1:ccc994e0a6a1b52138c8dc0ba6bd30f52f7c83f7
                                                            SHA256:0ebb7dfbeb9a5b177cb170318b4a05f72eb4b89830c9fd2b96fdf06cf2ad9f74
                                                            SHA512:2b6c7c4f88dc3285f1c936941fd91b3def3915bd3a96565609222f562bcdc1e29ec2729666c6102d170afb268bcb3f416e246835cf370b46d7365238d4d23364
                                                            SSDEEP:1536:94na2KJZ6IYfRbvagsHIbYjMHxi6/zxcVmX8068a5HYq5hpT:GK36ZaGzxcVo80haBb5hpT
                                                            TLSH:0E832A96F8808B12D5D1157AFA1E628E7313077CE3DE32169E249F207B879670F3B985
                                                            File Content Preview:.ELF..............(.....T...4....C......4. ...(......................6...6...............@...@...@.......j..........Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../..C.......@....-.@0....S

                                                            ELF header

                                                            Class:ELF32
                                                            Data:2's complement, little endian
                                                            Version:1 (current)
                                                            Machine:ARM
                                                            Version Number:0x1
                                                            Type:EXEC (Executable file)
                                                            OS/ABI:UNIX - System V
                                                            ABI Version:0
                                                            Entry Point Address:0x8154
                                                            Flags:0x4000002
                                                            ELF Header Size:52
                                                            Program Header Offset:52
                                                            Program Header Size:32
                                                            Number of Program Headers:3
                                                            Section Header Offset:82824
                                                            Section Header Size:40
                                                            Number of Section Headers:14
                                                            Header String Table Index:13
                                                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                            NULL0x00x00x00x00x0000
                                                            .initPROGBITS0x80940x940x100x00x6AX004
                                                            .textPROGBITS0x80b00xb00x105a80x00x6AX0016
                                                            .finiPROGBITS0x186580x106580x100x00x6AX004
                                                            .rodataPROGBITS0x186680x106680x2fa40x00x2A008
                                                            .eh_framePROGBITS0x240000x140000x40x00x3WA004
                                                            .init_arrayINIT_ARRAY0x240040x140040x40x00x3WA004
                                                            .fini_arrayFINI_ARRAY0x240080x140080x40x00x3WA004
                                                            .jcrPROGBITS0x2400c0x1400c0x40x00x3WA004
                                                            .gotPROGBITS0x240100x140100x780x40x3WA004
                                                            .dataPROGBITS0x240880x140880x2840x00x3WA004
                                                            .bssNOBITS0x243100x1430c0x67940x00x3WA008
                                                            .ARM.attributesARM_ATTRIBUTES0x00x1430c0x100x00x0001
                                                            .shstrtabSTRTAB0x00x1431c0x6c0x00x0001
                                                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                            LOAD0x00x80000x80000x1360c0x1360c6.31140x5R E0x8000.init .text .fini .rodata
                                                            LOAD0x140000x240000x240000x30c0x6aa43.77240x6RW 0x8000.eh_frame .init_array .fini_array .jcr .got .data .bss
                                                            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Dec 16, 2024 16:48:46.458879948 CET43928443192.168.2.2391.189.91.42
                                                            Dec 16, 2024 16:48:47.512489080 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:47.633065939 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:47.633147955 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:47.633474112 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:47.753757954 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:48.773442984 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:48.773469925 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:48.773869991 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:48.773978949 CET402606666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:48.893727064 CET66664026085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:51.834076881 CET42836443192.168.2.2391.189.91.43
                                                            Dec 16, 2024 16:48:53.114015102 CET4251680192.168.2.23109.202.202.202
                                                            Dec 16, 2024 16:48:57.780693054 CET402626666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:57.900696993 CET66664026285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:57.900854111 CET402626666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:57.901065111 CET402626666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:58.022373915 CET66664026285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:59.089829922 CET66664026285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:59.089951038 CET402626666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:59.090174913 CET66664026285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:48:59.090234995 CET402626666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:48:59.210268021 CET66664026285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:06.424129963 CET43928443192.168.2.2391.189.91.42
                                                            Dec 16, 2024 16:49:08.110060930 CET402646666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:08.229940891 CET66664026485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:08.230170012 CET402646666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:08.230278969 CET402646666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:08.350410938 CET66664026485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:09.378678083 CET66664026485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:09.378848076 CET402646666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:09.378968954 CET66664026485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:09.379112959 CET402646666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:09.500788927 CET66664026485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:18.390852928 CET402666666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:18.511286020 CET66664026685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:18.511468887 CET402666666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:18.511537075 CET402666666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:18.631392002 CET66664026685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:18.710403919 CET42836443192.168.2.2391.189.91.43
                                                            Dec 16, 2024 16:49:19.668586016 CET66664026685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:19.668807030 CET402666666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:19.669540882 CET66664026685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:19.669615984 CET402666666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:19.789376974 CET66664026685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:22.805810928 CET4251680192.168.2.23109.202.202.202
                                                            Dec 16, 2024 16:49:28.678461075 CET402686666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:28.798528910 CET66664026885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:28.798716068 CET402686666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:28.798857927 CET402686666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:28.919584036 CET66664026885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:29.964030027 CET66664026885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:29.964176893 CET402686666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:29.964210987 CET66664026885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:29.964390993 CET402686666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:30.085089922 CET66664026885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:38.971863031 CET402706666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:39.095674992 CET66664027085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:39.095830917 CET402706666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:39.095957994 CET402706666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:39.215893030 CET66664027085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:40.263983965 CET66664027085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:40.264019966 CET66664027085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:40.264158010 CET402706666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:40.264286041 CET402706666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:40.384763956 CET66664027085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:47.378648996 CET43928443192.168.2.2391.189.91.42
                                                            Dec 16, 2024 16:49:49.270814896 CET402726666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:49.391562939 CET66664027285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:49.391901016 CET402726666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:49.392015934 CET402726666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:49.512479067 CET66664027285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:50.537348986 CET66664027285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:50.537424088 CET66664027285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:50.537538052 CET402726666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:50.537656069 CET402726666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:50.659874916 CET66664027285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:59.543013096 CET402746666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:59.663347960 CET66664027485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:49:59.663655996 CET402746666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:59.663731098 CET402746666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:49:59.784246922 CET66664027485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:00.804219961 CET66664027485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:00.804296017 CET66664027485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:00.804455996 CET402746666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:00.804553032 CET402746666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:00.926846981 CET66664027485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:09.813333988 CET402766666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:09.933932066 CET66664027685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:09.934276104 CET402766666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:09.934489965 CET402766666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:10.054348946 CET66664027685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:11.086139917 CET66664027685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:11.086282969 CET66664027685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:11.086400032 CET402766666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:11.086546898 CET402766666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:11.206346035 CET66664027685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:20.098258972 CET402786666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:20.218929052 CET66664027885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:20.219100952 CET402786666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:20.219216108 CET402786666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:20.339248896 CET66664027885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:21.369091034 CET66664027885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:21.369170904 CET66664027885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:21.369345903 CET402786666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:21.369502068 CET402786666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:21.489303112 CET66664027885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:30.378020048 CET402806666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:30.498183012 CET66664028085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:30.498409033 CET402806666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:30.498452902 CET402806666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:30.619672060 CET66664028085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:31.663866043 CET66664028085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:31.663932085 CET66664028085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:31.664153099 CET402806666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:31.664271116 CET402806666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:31.784480095 CET66664028085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:40.673074961 CET402826666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:40.793401957 CET66664028285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:40.793606043 CET402826666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:40.793706894 CET402826666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:40.915905952 CET66664028285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:41.965399027 CET66664028285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:41.965502977 CET66664028285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:41.965776920 CET402826666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:41.965863943 CET402826666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:42.085997105 CET66664028285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:50.973910093 CET402846666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:51.095067978 CET66664028485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:51.095546007 CET402846666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:51.977580070 CET402846666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:52.098771095 CET66664028485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:52.099122047 CET402846666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:52.099231958 CET402846666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:52.220582008 CET66664028485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:53.264806986 CET66664028485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:53.264873981 CET66664028485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:50:53.265031099 CET402846666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:53.265131950 CET402846666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:50:53.385317087 CET66664028485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:02.274573088 CET402866666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:02.396595001 CET66664028685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:02.396852016 CET402866666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:02.396893024 CET402866666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:02.516932011 CET66664028685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:03.563165903 CET66664028685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:03.563252926 CET66664028685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:03.563498974 CET402866666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:03.563596010 CET402866666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:03.683465958 CET66664028685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:12.577178955 CET402886666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:12.697747946 CET66664028885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:12.697854996 CET402886666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:12.697900057 CET402886666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:12.817750931 CET66664028885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:13.865936041 CET66664028885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:13.866199970 CET66664028885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:13.866238117 CET402886666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:13.866329908 CET402886666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:13.987245083 CET66664028885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:22.878499985 CET402906666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:22.999012947 CET66664029085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:22.999327898 CET402906666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:22.999423027 CET402906666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:23.119415998 CET66664029085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:24.164680004 CET66664029085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:24.164827108 CET66664029085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:24.165103912 CET402906666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:24.165204048 CET402906666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:24.285300970 CET66664029085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:33.177651882 CET402926666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:33.297612906 CET66664029285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:33.297765970 CET402926666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:33.297847033 CET402926666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:33.418852091 CET66664029285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:34.465197086 CET66664029285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:34.465245962 CET66664029285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:34.465553045 CET402926666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:34.465553045 CET402926666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:34.585922003 CET66664029285.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:43.472069979 CET402946666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:43.592183113 CET66664029485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:43.592498064 CET402946666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:43.592695951 CET402946666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:43.712513924 CET66664029485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:44.759337902 CET66664029485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:44.759409904 CET66664029485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:44.759804964 CET402946666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:44.759907961 CET402946666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:44.879865885 CET66664029485.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:53.770972967 CET402966666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:53.891490936 CET66664029685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:53.891832113 CET402966666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:53.892246962 CET402966666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:54.012320042 CET66664029685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:55.067909956 CET66664029685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:55.068016052 CET66664029685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:51:55.068236113 CET402966666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:55.068329096 CET402966666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:51:55.188535929 CET66664029685.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:04.084865093 CET402986666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:04.205118895 CET66664029885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:04.205367088 CET402986666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:04.205588102 CET402986666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:04.327862024 CET66664029885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:05.365159035 CET66664029885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:05.365297079 CET66664029885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:05.365488052 CET402986666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:05.365583897 CET402986666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:05.487039089 CET66664029885.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:14.378093958 CET403006666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:14.498060942 CET66664030085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:14.498348951 CET403006666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:14.498387098 CET403006666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:14.618227959 CET66664030085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:15.659024954 CET66664030085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:15.659079075 CET66664030085.239.34.134192.168.2.23
                                                            Dec 16, 2024 16:52:15.659404993 CET403006666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:15.659496069 CET403006666192.168.2.2385.239.34.134
                                                            Dec 16, 2024 16:52:15.779877901 CET66664030085.239.34.134192.168.2.23

                                                            System Behavior

                                                            Start time (UTC):15:48:46
                                                            Start date (UTC):16/12/2024
                                                            Path:/tmp/arm6.elf
                                                            Arguments:/tmp/arm6.elf
                                                            File size:4956856 bytes
                                                            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                            Start time (UTC):15:48:46
                                                            Start date (UTC):16/12/2024
                                                            Path:/tmp/arm6.elf
                                                            Arguments:-
                                                            File size:4956856 bytes
                                                            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                            Start time (UTC):15:48:46
                                                            Start date (UTC):16/12/2024
                                                            Path:/tmp/arm6.elf
                                                            Arguments:-
                                                            File size:4956856 bytes
                                                            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                            Start time (UTC):15:48:47
                                                            Start date (UTC):16/12/2024
                                                            Path:/tmp/arm6.elf
                                                            Arguments:-
                                                            File size:4956856 bytes
                                                            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1