Edit tour

Linux Analysis Report
10000.elf

Overview

General Information

Sample name:	10000.elf
Analysis ID:	1578690
MD5:	d42190dd0b6ba9a0d29c21a90cb9b6a5
SHA1:	edbd710cf7f3d3b80ab4f65e4128e34d56a61893
SHA256:	cfd87d44b5b4fc2a8f4a7d73ee90f1884c72a9482ef421543b0d7a777bb65f65
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Opens /sys/class/net/* files useful for querying network interface information

Sample is packed with UPX

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Reads CPU information from /proc indicative of miner or evasive malware

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578690
Start date and time:	2024-12-20 05:02:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	10000.elf
Detection:	MAL
Classification:	mal48.spyw.evad.linELF@0/2@1/0

Runtime Messages

Command:	/tmp/10000.elf
PID:	6236
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6215, Parent: 4331)

rm (PID: 6215, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.bHGyPAn7wb /tmp/tmp.QSvibAGfTW /tmp/tmp.tNorlxTd7m

dash New Fork (PID: 6216, Parent: 4331)

cat (PID: 6216, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.bHGyPAn7wb

dash New Fork (PID: 6217, Parent: 4331)

head (PID: 6217, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6218, Parent: 4331)

tr (PID: 6218, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6219, Parent: 4331)

cut (PID: 6219, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6220, Parent: 4331)

cat (PID: 6220, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.bHGyPAn7wb

dash New Fork (PID: 6221, Parent: 4331)

head (PID: 6221, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6222, Parent: 4331)

tr (PID: 6222, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6223, Parent: 4331)

cut (PID: 6223, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6224, Parent: 4331)

rm (PID: 6224, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.bHGyPAn7wb /tmp/tmp.QSvibAGfTW /tmp/tmp.tNorlxTd7m

10000.elf (PID: 6236, Parent: 6149, MD5: d42190dd0b6ba9a0d29c21a90cb9b6a5) Arguments: /tmp/10000.elf

10000.elf New Fork (PID: 6237, Parent: 6236)

10000.elf New Fork (PID: 6238, Parent: 6237)

10000.elf New Fork (PID: 6273, Parent: 6238)

sh (PID: 6273, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6274, Parent: 6273)

ip (PID: 6274, Parent: 6273, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6276, Parent: 6238)

sh (PID: 6276, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6277, Parent: 6276)

ip (PID: 6277, Parent: 6276, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6278, Parent: 6238)

sh (PID: 6278, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6279, Parent: 6278)

ip (PID: 6279, Parent: 6278, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6282, Parent: 6238)

sh (PID: 6282, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6283, Parent: 6282)

ip (PID: 6283, Parent: 6282, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6285, Parent: 6238)

sh (PID: 6285, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6286, Parent: 6285)

ip (PID: 6286, Parent: 6285, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6289, Parent: 6238)

sh (PID: 6289, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6290, Parent: 6289)

ip (PID: 6290, Parent: 6289, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6291, Parent: 6238)

sh (PID: 6291, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6292, Parent: 6291)

ip (PID: 6292, Parent: 6291, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6293, Parent: 6238)

sh (PID: 6293, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6294, Parent: 6293)

ip (PID: 6294, Parent: 6293, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6310, Parent: 6238)

sh (PID: 6310, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6311, Parent: 6310)

ip (PID: 6311, Parent: 6310, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6312, Parent: 6238)

sh (PID: 6312, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6313, Parent: 6312)

ip (PID: 6313, Parent: 6312, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6316, Parent: 6238)

sh (PID: 6316, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6317, Parent: 6316)

ip (PID: 6317, Parent: 6316, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6318, Parent: 6238)

sh (PID: 6318, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6319, Parent: 6318)

ip (PID: 6319, Parent: 6318, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6320, Parent: 6238)

sh (PID: 6320, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6321, Parent: 6320)

ip (PID: 6321, Parent: 6320, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6324, Parent: 6238)

sh (PID: 6324, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6325, Parent: 6324)

ip (PID: 6325, Parent: 6324, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6326, Parent: 6238)

sh (PID: 6326, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6327, Parent: 6326)

ip (PID: 6327, Parent: 6326, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6330, Parent: 6238)

sh (PID: 6330, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6331, Parent: 6330)

ip (PID: 6331, Parent: 6330, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6332, Parent: 6238)

sh (PID: 6332, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6333, Parent: 6332)

ip (PID: 6333, Parent: 6332, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6336, Parent: 6238)

sh (PID: 6336, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6337, Parent: 6336)

ip (PID: 6337, Parent: 6336, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6338, Parent: 6238)

sh (PID: 6338, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6339, Parent: 6338)

ip (PID: 6339, Parent: 6338, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6343, Parent: 6238)

sh (PID: 6343, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6344, Parent: 6343)

ip (PID: 6344, Parent: 6343, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6346, Parent: 6238)

sh (PID: 6346, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6347, Parent: 6346)

ip (PID: 6347, Parent: 6346, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6350, Parent: 6238)

sh (PID: 6350, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6351, Parent: 6350)

ip (PID: 6351, Parent: 6350, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6352, Parent: 6238)

sh (PID: 6352, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6353, Parent: 6352)

ip (PID: 6353, Parent: 6352, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6354, Parent: 6238)

sh (PID: 6354, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6355, Parent: 6354)

ip (PID: 6355, Parent: 6354, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6358, Parent: 6238)

sh (PID: 6358, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6359, Parent: 6358)

ip (PID: 6359, Parent: 6358, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6360, Parent: 6238)

sh (PID: 6360, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6361, Parent: 6360)

ip (PID: 6361, Parent: 6360, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6364, Parent: 6238)

sh (PID: 6364, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6365, Parent: 6364)

ip (PID: 6365, Parent: 6364, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6368, Parent: 6238)

sh (PID: 6368, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6369, Parent: 6368)

ip (PID: 6369, Parent: 6368, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6370, Parent: 6238)

sh (PID: 6370, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6371, Parent: 6370)

ip (PID: 6371, Parent: 6370, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6374, Parent: 6238)

sh (PID: 6374, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6375, Parent: 6374)

ip (PID: 6375, Parent: 6374, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6376, Parent: 6238)

sh (PID: 6376, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6377, Parent: 6376)

ip (PID: 6377, Parent: 6376, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6380, Parent: 6238)

sh (PID: 6380, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6381, Parent: 6380)

ip (PID: 6381, Parent: 6380, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6383, Parent: 6238)

sh (PID: 6383, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6384, Parent: 6383)

ip (PID: 6384, Parent: 6383, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6387, Parent: 6238)

sh (PID: 6387, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6388, Parent: 6387)

ip (PID: 6388, Parent: 6387, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6389, Parent: 6238)

sh (PID: 6389, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6390, Parent: 6389)

ip (PID: 6390, Parent: 6389, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6391, Parent: 6238)

sh (PID: 6391, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6392, Parent: 6391)

ip (PID: 6392, Parent: 6391, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6395, Parent: 6238)

sh (PID: 6395, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6396, Parent: 6395)

ip (PID: 6396, Parent: 6395, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6397, Parent: 6238)

sh (PID: 6397, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6398, Parent: 6397)

ip (PID: 6398, Parent: 6397, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6401, Parent: 6238)

sh (PID: 6401, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6402, Parent: 6401)

ip (PID: 6402, Parent: 6401, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6403, Parent: 6238)

sh (PID: 6403, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6404, Parent: 6403)

ip (PID: 6404, Parent: 6403, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6405, Parent: 6238)

sh (PID: 6405, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6406, Parent: 6405)

ip (PID: 6406, Parent: 6405, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6409, Parent: 6238)

sh (PID: 6409, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6410, Parent: 6409)

ip (PID: 6410, Parent: 6409, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6411, Parent: 6238)

sh (PID: 6411, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6412, Parent: 6411)

ip (PID: 6412, Parent: 6411, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6415, Parent: 6238)

sh (PID: 6415, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6416, Parent: 6415)

ip (PID: 6416, Parent: 6415, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6418, Parent: 6238)

sh (PID: 6418, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6419, Parent: 6418)

ip (PID: 6419, Parent: 6418, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6420, Parent: 6238)

sh (PID: 6420, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6421, Parent: 6420)

ip (PID: 6421, Parent: 6420, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6424, Parent: 6238)

sh (PID: 6424, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6425, Parent: 6424)

ip (PID: 6425, Parent: 6424, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6427, Parent: 6238)

sh (PID: 6427, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6428, Parent: 6427)

ip (PID: 6428, Parent: 6427, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6431, Parent: 6238)

sh (PID: 6431, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6432, Parent: 6431)

ip (PID: 6432, Parent: 6431, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6433, Parent: 6238)

sh (PID: 6433, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6434, Parent: 6433)

ip (PID: 6434, Parent: 6433, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6437, Parent: 6238)

sh (PID: 6437, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6438, Parent: 6437)

ip (PID: 6438, Parent: 6437, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6439, Parent: 6238)

sh (PID: 6439, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6440, Parent: 6439)

ip (PID: 6440, Parent: 6439, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6441, Parent: 6238)

sh (PID: 6441, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6442, Parent: 6441)

ip (PID: 6442, Parent: 6441, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6445, Parent: 6238)

sh (PID: 6445, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6446, Parent: 6445)

ip (PID: 6446, Parent: 6445, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6447, Parent: 6238)

sh (PID: 6447, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6448, Parent: 6447)

ip (PID: 6448, Parent: 6447, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6451, Parent: 6238)

sh (PID: 6451, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6452, Parent: 6451)

ip (PID: 6452, Parent: 6451, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6455, Parent: 6238)

sh (PID: 6455, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6456, Parent: 6455)

ip (PID: 6456, Parent: 6455, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6457, Parent: 6238)

sh (PID: 6457, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6458, Parent: 6457)

ip (PID: 6458, Parent: 6457, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

udisksd New Fork (PID: 6248, Parent: 799)

dumpe2fs (PID: 6248, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: /tmp/10000.elf (PID: 6238)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Networking

Opens /sys/class/net/* files useful for querying network interface information

Source: /tmp/10000.elf (PID: 6238)	Opens: /sys/class/net/ens160/statistics/tx_bytes	Jump to behavior
Source: /tmp/10000.elf (PID: 6238)	Opens: /sys/class/net/ens160/statistics/tx_bytes	Jump to behavior
Source: /tmp/10000.elf (PID: 6238)	Opens: /sys/class/net/ens160/statistics/tx_bytes	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.23:55562 -> 213.139.233.9:10000

Source: /tmp/10000.elf (PID: 6238)

Reads hosts file: /etc/hosts

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: svip-1.0889.org

Source: 10000.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: LOAD without section mappings

Program segment: 0x400000

Source: classification engine

Classification label: mal48.spyw.evad.linELF@0/2@1/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 4.30 Copyright (C) 1996-2024 the UPX Team. All Rights Reserved. $

Source: /tmp/10000.elf (PID: 6236)	Directory: /var/tmp/.loc	Jump to behavior
Source: /tmp/10000.elf (PID: 6238)	File: /var/tmp/.loc	Jump to behavior
Source: /tmp/10000.elf (PID: 6238)	Directory: /var/tmp/.rnd	Jump to behavior
Source: /tmp/10000.elf (PID: 6238)	Directory: /var/tmp/.u	Jump to behavior

Source: /tmp/10000.elf (PID: 6273)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6276)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6278)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6282)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6285)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6289)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6291)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6293)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6310)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6312)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6316)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6318)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6320)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6324)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6326)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6330)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6332)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6336)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6338)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6343)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6346)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6350)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6352)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6354)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6358)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6360)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6364)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6368)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6370)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6374)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6376)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6380)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6383)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6387)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6389)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6391)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6395)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6397)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6401)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6403)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6405)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6409)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6411)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6415)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6418)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6420)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6424)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6427)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6431)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6433)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6437)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6439)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6441)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6445)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6447)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6451)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6455)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6457)	Shell command executed: sh -c "ip route show default"	Jump to behavior

Source: /usr/bin/dash (PID: 6215)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.bHGyPAn7wb /tmp/tmp.QSvibAGfTW /tmp/tmp.tNorlxTd7m			Jump to behavior
Source: /usr/bin/dash (PID: 6224)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.bHGyPAn7wb /tmp/tmp.QSvibAGfTW /tmp/tmp.tNorlxTd7m			Jump to behavior

Source: /tmp/10000.elf (PID: 6238)	Reads from proc file: /proc/cpuinfo			Jump to behavior
Source: /tmp/10000.elf (PID: 6238)	Reads from proc file: /proc/stat			Jump to behavior

Source: 10000.elf	Submission file: segment LOAD with 7.7272 entropy (max. 8.0)
Source: 10000.elf	Submission file: segment LOAD with 7.9997 entropy (max. 8.0)

Source: /tmp/10000.elf (PID: 6238)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: /tmp/10000.elf (PID: 6238)

Queries kernel information via 'uname':

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Obfuscated Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
10000.elf	3%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
svip-1.0889.org	213.139.233.9	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	10000.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
213.139.233.9	svip-1.0889.org	Russian Federation	136782	PINGTAN-AS-APKirinNetworksCN	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
213.139.233.9	10000.elf	Get hash	malicious	BillGates	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	copy_netaddr.elf	Get hash	malicious	Xmrig	Browse
	wiewa64.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	woega6.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	copy_netaddr.elf	Get hash	malicious	Xmrig	Browse
	wiewa64.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	woega6.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	copy_netaddr.elf	Get hash	malicious	Xmrig	Browse	91.189.91.42
	wiewa64.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wkb86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	njvwa4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	copy_netaddr.elf	Get hash	malicious	Xmrig	Browse	109.202.202.202
	wiewa64.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	njvwa4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	woega6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
PINGTAN-AS-APKirinNetworksCN	10000.elf	Get hash	malicious	BillGates	Browse	213.139.233.9
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	103.96.197.3
	1FOZSuwbGF.elf	Get hash	malicious	Mirai	Browse	103.96.197.9
	1ik5K4HEZO	Get hash	malicious	Unknown	Browse	103.96.197.9
	TT copy.exe	Get hash	malicious	FormBook	Browse	185.254.241.173
	RxD0XMDsWp	Get hash	malicious	Mirai	Browse	103.96.153.100
	ywvz5i8kT9.exe	Get hash	malicious	Unknown	Browse	45.135.48.153
	28z8ooA3oC	Get hash	malicious	Mirai	Browse	196.19.196.209
	y8uLBHoe4J.exe	Get hash	malicious	BitRAT	Browse	62.133.35.244
	4RjVkoQ93E	Get hash	malicious	Unknown	Browse	103.96.171.168

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/memfd:upX (deleted)

Download File

Process:	/tmp/10000.elf
File Type:	data
Category:	dropped
Size (bytes):	5665
Entropy (8bit):	6.434675153350928
Encrypted:	false
SSDEEP:	96:e5wnbxFCCEcHqCG3jusysTjClY55kyUx7P2EbfOlDhS+dY64At7S1TBIa+tej72J:eGnF9G3jusyoClq5kyUxaVXFaLA
MD5:	CB3098FC325440FBAB94051EA9616C2E
SHA1:	EA93644532455049B06893567F8A49A1303A4B1C
SHA-256:	058DF20A5137C9E87D4AC82827ED2E071D50B55C39ED6F3C58EE6956370926F2
SHA-512:	B9EEBF06BEBB4D5D2F7C413754842726A39E2EE9708501E2AF9E0F17F48E71CAB121FD023765F76295689AC6E0F632E53C234511DCF8BCB4F2508DA49CCE6D8B
Malicious:	false
Reputation:	low
Preview:	............L.m0L.....E.H...E0.u.H......H..j.Y.H.H.>.H.u.I...E0.u.H.H.>.H.u.I..H..H.>.H.H.u.I..I..I)..E0.t....I...rWH.=....)..u.....^.....jYX....y.W^j.X..I.}....H.t...H..... =I.>H...L..H).H...I.w...1....H).I..H....H.H.g..K.L&._^H...AXD.....H..I).M..H......H...q...H........H.D$.I......L.......L........x.M).A..j.Yj.Z.....)..>........._^j.XA.&H.......QH9.L.G.H.J.s.......l...H...t.A...H..I....H....H.W.H).X.UH..SH..H..(H.>.......H.t$......H.......T$..D$...u.=UPX!u.H.;.t\|....u...........9.w..H;M.w.9.H.u.s3H.{.H.T$.H.L$.H.........u.D$.H9D$.u..D$.H.C.H).....H...&....T$.H.E.H.U.H).H..H.E..S...H..([].H..APtP@...uJE1.1.H..A..L9.u...H.W...H...u.I...!H..u...u.M..t.M..I.P.........7...H....^.ATA..I...S..E1.H......H......H...D..L..A....2....H..L..H....H......[A\.AWAVI..AUATUSH.....L.w H...T$TH.\|$`H.t$XH.L$HL.D$@H.D$h....H.D$8......W.t3I.8H.G@H+xHf...u.H.x...H.\|$8H.p(H..>H.D$h.g....,...f...H.T$`.....A.....H.D$0....L..D.D.I...E1...j8D.T$.....D.T$.H....x@.;.u3H.S(H..t*H.C.L9.L.B.H...I9.L

/var/tmp/.loc

Download File

Process:	/tmp/10000.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:A:A
MD5:	D8D6781940EB8C057D6D6D5C888D7621
SHA1:	7ACE02605F06C8A76D4DE85467B2F719E28F45C1
SHA-256:	3A5F9D59438CB75C07D92526D23FEDA607FDD310E9086B348003A826BFFE2B6E
SHA-512:	536A1D4B7E5901A40F978EAC6EE77A7D7936B8DCFFAA33C7DEF1038522A3FDC92B456B8EF8FB3D001148D03CB1DA874556B9AC15FAFC5B79D512099C5C941525
Malicious:	false
Reputation:	low
Preview:	6238.

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), for GNU/Linux 2.6.18, BuildID[sha1]=5fb05bfd9b968e989731f3d702b8c704afea3108, statically linked, no section header
Entropy (8bit):	7.9997255003088075
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	10000.elf
File size:	896'828 bytes
MD5:	d42190dd0b6ba9a0d29c21a90cb9b6a5
SHA1:	edbd710cf7f3d3b80ab4f65e4128e34d56a61893
SHA256:	cfd87d44b5b4fc2a8f4a7d73ee90f1884c72a9482ef421543b0d7a777bb65f65
SHA512:	002b23a9970ad1d0c35370f25b9da708382a37361ed33a99b6709c358aa80785458649274d8b7026c5f230e69165770836996620c154f03e3019879acaeb8194
SSDEEP:	24576:WQB3I3PHxfwxrpDFE5zZtZN3UhBT4kDy9b:3YPxfwxdDi5tvN3UhBTvDyJ
TLSH:	55153359FCD6CD71CAD35253D2623C88743BD82A5D1A74D3CC8386B764998A2863ECF8
File Content Preview:	.ELF..............>.....8.......@...................@.8...........................@.......@............. .@....... ....................................................... ............. ....... .@..... .@.....D.......D...............Q.td...................

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0xac9138
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	4
Section Header Offset:	0
Section Header Size:	0
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x400000	0x400000	0x1000	0x408b20	7.7272	0x6	RW	0x200000
LOAD	0x0	0xa00000	0xa00000	0xca207	0xca207	7.9997	0x5	R E	0x200000
NOTE	0x120	0x400120	0x400120	0x44	0x44	3.4225	0x4	R	0x4
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 05:02:50.750845909 CET	43928	443	192.168.2.23	91.189.91.42
Dec 20, 2024 05:02:51.703869104 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:51.823579073 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:51.824003935 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:51.825789928 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:51.945329905 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.245517015 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.245565891 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.245621920 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.245659113 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.245982885 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:53.246079922 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:53.246079922 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:53.246079922 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:53.269002914 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:53.269004107 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:53.388744116 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.388777971 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.388796091 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.774631977 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.774678946 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:53.774987936 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:53.775300026 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:55.854084015 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:55.974111080 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:56.382025003 CET	42836	443	192.168.2.23	91.189.91.43
Dec 20, 2024 05:02:57.406104088 CET	42516	80	192.168.2.23	109.202.202.202
Dec 20, 2024 05:02:57.909816980 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:02:58.029493093 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:02:59.965872049 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:00.085825920 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:02.024610043 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:02.144530058 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:04.075886011 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:04.195763111 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:06.130280972 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:06.250065088 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:08.185729027 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:08.305743933 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:10.242289066 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:10.362118006 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:12.303420067 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:12.423249960 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:12.507967949 CET	43928	443	192.168.2.23	91.189.91.42
Dec 20, 2024 05:03:14.361933947 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:14.482037067 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:16.420474052 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:16.541187048 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:18.474292994 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:18.594041109 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:20.529445887 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:20.649815083 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:22.583453894 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:22.703428984 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:22.746540070 CET	42836	443	192.168.2.23	91.189.91.43
Dec 20, 2024 05:03:24.641590118 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:24.761696100 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:26.700463057 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:26.820911884 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:26.842219114 CET	42516	80	192.168.2.23	109.202.202.202
Dec 20, 2024 05:03:28.755825996 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:28.875653028 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:30.811649084 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:30.931608915 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:31.868444920 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:31.988554001 CET	10000	55562	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:31.988987923 CET	55562	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:32.878221989 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:32.997934103 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:32.998279095 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:33.000349045 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:33.119940042 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.445255995 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.445379972 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.445434093 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.445552111 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:34.445552111 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:34.445581913 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:34.473912954 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:34.473912954 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:34.593590975 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.593626022 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.593638897 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.958132982 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.958173037 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:34.958587885 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:34.958587885 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:37.043231964 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:37.163271904 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:39.116657972 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:39.236674070 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:41.178193092 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:41.298105001 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:43.236323118 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:43.356306076 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:45.300224066 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:45.419821024 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:47.358114958 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:47.477982044 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:49.421271086 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:49.541105986 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:51.482690096 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:51.602394104 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:53.462210894 CET	43928	443	192.168.2.23	91.189.91.42
Dec 20, 2024 05:03:53.542114973 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:53.661711931 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:55.599605083 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:55.719631910 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:57.657732964 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:57.777940035 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:03:59.715765953 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:03:59.835644960 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:01.780742884 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:01.900572062 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:03.836518049 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:03.956459045 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:05.893129110 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:06.012741089 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:07.956243992 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:08.076967001 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:10.022993088 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:10.142940998 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:12.084124088 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:12.203907013 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:14.135973930 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:14.255877018 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:16.204109907 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:16.324764013 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:18.264595985 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:18.385118961 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:20.325210094 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:20.444817066 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:22.389607906 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:22.509443045 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:24.442011118 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:24.563158989 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:26.497426987 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:26.617207050 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:28.550642014 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:28.671148062 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:30.607898951 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:30.727715015 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:32.661807060 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:32.783555031 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:34.723287106 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:34.843010902 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:36.793771029 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:36.913525105 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:38.865163088 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:38.985061884 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:40.943780899 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:41.063575029 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:43.023222923 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:43.143131971 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:45.086625099 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:45.206475019 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:47.155205011 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:47.275101900 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:49.215054035 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:49.334903002 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:51.279556990 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:51.399383068 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:53.360038996 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:53.480706930 CET	10000	55564	213.139.233.9	192.168.2.23
Dec 20, 2024 05:04:55.435945988 CET	55564	10000	192.168.2.23	213.139.233.9
Dec 20, 2024 05:04:55.556377888 CET	10000	55564	213.139.233.9	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 05:02:51.233858109 CET	37735	53	192.168.2.23	1.1.1.1
Dec 20, 2024 05:02:51.701788902 CET	53	37735	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 05:02:51.233858109 CET	192.168.2.23	1.1.1.1	0x5c6d	Standard query (0)	svip-1.0889.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 05:02:51.701788902 CET	1.1.1.1	192.168.2.23	0x5c6d	No error (0)	svip-1.0889.org		213.139.233.9	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 6215, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6215, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.bHGyPAn7wb /tmp/tmp.QSvibAGfTW /tmp/tmp.tNorlxTd7m
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6216, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6216, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.bHGyPAn7wb
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6217, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6217, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6218, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6218, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6219, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6219, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6220, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6220, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.bHGyPAn7wb
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6221, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6221, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6222, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6222, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6223, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6223, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6224, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6224, Parent PID: 4331

General

Start time (UTC):	04:02:40
Start date (UTC):	20/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.bHGyPAn7wb /tmp/tmp.QSvibAGfTW /tmp/tmp.tNorlxTd7m
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: 10000.elf PID: 6236, Parent PID: 6149

General

Start time (UTC):	04:02:50
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	/tmp/10000.elf
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: 10000.elf PID: 6237, Parent PID: 6236

General

Start time (UTC):	04:02:50
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: 10000.elf PID: 6238, Parent PID: 6237

General

Start time (UTC):	04:02:50
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: 10000.elf PID: 6273, Parent PID: 6238

General

Start time (UTC):	04:02:54
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6273, Parent PID: 6238

General

Start time (UTC):	04:02:54
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6274, Parent PID: 6273

General

Start time (UTC):	04:02:54
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6274, Parent PID: 6273

General

Start time (UTC):	04:02:54
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6276, Parent PID: 6238

General

Start time (UTC):	04:02:56
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6276, Parent PID: 6238

General

Start time (UTC):	04:02:56
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6277, Parent PID: 6276

General

Start time (UTC):	04:02:56
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6277, Parent PID: 6276

General

Start time (UTC):	04:02:56
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6278, Parent PID: 6238

General

Start time (UTC):	04:02:58
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6278, Parent PID: 6238

General

Start time (UTC):	04:02:58
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6279, Parent PID: 6278

General

Start time (UTC):	04:02:58
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6279, Parent PID: 6278

General

Start time (UTC):	04:02:58
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6282, Parent PID: 6238

General

Start time (UTC):	04:03:00
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6282, Parent PID: 6238

General

Start time (UTC):	04:03:00
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6283, Parent PID: 6282

General

Start time (UTC):	04:03:00
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6283, Parent PID: 6282

General

Start time (UTC):	04:03:00
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6285, Parent PID: 6238

General

Start time (UTC):	04:03:02
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6285, Parent PID: 6238

General

Start time (UTC):	04:03:02
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6286, Parent PID: 6285

General

Start time (UTC):	04:03:02
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6286, Parent PID: 6285

General

Start time (UTC):	04:03:02
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6289, Parent PID: 6238

General

Start time (UTC):	04:03:04
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6289, Parent PID: 6238

General

Start time (UTC):	04:03:04
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6290, Parent PID: 6289

General

Start time (UTC):	04:03:04
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6290, Parent PID: 6289

General

Start time (UTC):	04:03:04
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6291, Parent PID: 6238

General

Start time (UTC):	04:03:06
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6291, Parent PID: 6238

General

Start time (UTC):	04:03:06
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6292, Parent PID: 6291

General

Start time (UTC):	04:03:06
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6292, Parent PID: 6291

General

Start time (UTC):	04:03:06
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6293, Parent PID: 6238

General

Start time (UTC):	04:03:08
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6293, Parent PID: 6238

General

Start time (UTC):	04:03:08
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6294, Parent PID: 6293

General

Start time (UTC):	04:03:08
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6294, Parent PID: 6293

General

Start time (UTC):	04:03:08
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6310, Parent PID: 6238

General

Start time (UTC):	04:03:10
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6310, Parent PID: 6238

General

Start time (UTC):	04:03:10
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6311, Parent PID: 6310

General

Start time (UTC):	04:03:10
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6311, Parent PID: 6310

General

Start time (UTC):	04:03:10
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6312, Parent PID: 6238

General

Start time (UTC):	04:03:12
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6312, Parent PID: 6238

General

Start time (UTC):	04:03:12
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6313, Parent PID: 6312

General

Start time (UTC):	04:03:12
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6313, Parent PID: 6312

General

Start time (UTC):	04:03:12
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6316, Parent PID: 6238

General

Start time (UTC):	04:03:14
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6316, Parent PID: 6238

General

Start time (UTC):	04:03:14
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6317, Parent PID: 6316

General

Start time (UTC):	04:03:14
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6317, Parent PID: 6316

General

Start time (UTC):	04:03:14
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6318, Parent PID: 6238

General

Start time (UTC):	04:03:16
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6318, Parent PID: 6238

General

Start time (UTC):	04:03:16
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6319, Parent PID: 6318

General

Start time (UTC):	04:03:16
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6319, Parent PID: 6318

General

Start time (UTC):	04:03:16
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6320, Parent PID: 6238

General

Start time (UTC):	04:03:18
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6320, Parent PID: 6238

General

Start time (UTC):	04:03:18
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6321, Parent PID: 6320

General

Start time (UTC):	04:03:18
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6321, Parent PID: 6320

General

Start time (UTC):	04:03:18
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6324, Parent PID: 6238

General

Start time (UTC):	04:03:20
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6324, Parent PID: 6238

General

Start time (UTC):	04:03:20
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6325, Parent PID: 6324

General

Start time (UTC):	04:03:20
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6325, Parent PID: 6324

General

Start time (UTC):	04:03:20
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6326, Parent PID: 6238

General

Start time (UTC):	04:03:22
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6326, Parent PID: 6238

General

Start time (UTC):	04:03:22
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6327, Parent PID: 6326

General

Start time (UTC):	04:03:22
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6327, Parent PID: 6326

General

Start time (UTC):	04:03:22
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6330, Parent PID: 6238

General

Start time (UTC):	04:03:24
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6330, Parent PID: 6238

General

Start time (UTC):	04:03:24
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6331, Parent PID: 6330

General

Start time (UTC):	04:03:25
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6331, Parent PID: 6330

General

Start time (UTC):	04:03:25
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6332, Parent PID: 6238

General

Start time (UTC):	04:03:27
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6332, Parent PID: 6238

General

Start time (UTC):	04:03:27
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6333, Parent PID: 6332

General

Start time (UTC):	04:03:27
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6333, Parent PID: 6332

General

Start time (UTC):	04:03:27
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6336, Parent PID: 6238

General

Start time (UTC):	04:03:29
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6336, Parent PID: 6238

General

Start time (UTC):	04:03:29
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6337, Parent PID: 6336

General

Start time (UTC):	04:03:29
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6337, Parent PID: 6336

General

Start time (UTC):	04:03:29
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6338, Parent PID: 6238

General

Start time (UTC):	04:03:31
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6338, Parent PID: 6238

General

Start time (UTC):	04:03:31
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6339, Parent PID: 6338

General

Start time (UTC):	04:03:31
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6339, Parent PID: 6338

General

Start time (UTC):	04:03:31
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6343, Parent PID: 6238

General

Start time (UTC):	04:03:35
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6343, Parent PID: 6238

General

Start time (UTC):	04:03:35
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6344, Parent PID: 6343

General

Start time (UTC):	04:03:35
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6344, Parent PID: 6343

General

Start time (UTC):	04:03:35
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6346, Parent PID: 6238

General

Start time (UTC):	04:03:37
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6346, Parent PID: 6238

General

Start time (UTC):	04:03:37
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6347, Parent PID: 6346

General

Start time (UTC):	04:03:37
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6347, Parent PID: 6346

General

Start time (UTC):	04:03:37
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6350, Parent PID: 6238

General

Start time (UTC):	04:03:39
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6350, Parent PID: 6238

General

Start time (UTC):	04:03:39
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6351, Parent PID: 6350

General

Start time (UTC):	04:03:39
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6351, Parent PID: 6350

General

Start time (UTC):	04:03:39
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6352, Parent PID: 6238

General

Start time (UTC):	04:03:41
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6352, Parent PID: 6238

General

Start time (UTC):	04:03:41
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6353, Parent PID: 6352

General

Start time (UTC):	04:03:41
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6353, Parent PID: 6352

General

Start time (UTC):	04:03:41
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6354, Parent PID: 6238

General

Start time (UTC):	04:03:43
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6354, Parent PID: 6238

General

Start time (UTC):	04:03:43
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6355, Parent PID: 6354

General

Start time (UTC):	04:03:43
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6355, Parent PID: 6354

General

Start time (UTC):	04:03:43
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6358, Parent PID: 6238

General

Start time (UTC):	04:03:45
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6358, Parent PID: 6238

General

Start time (UTC):	04:03:45
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6359, Parent PID: 6358

General

Start time (UTC):	04:03:45
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6359, Parent PID: 6358

General

Start time (UTC):	04:03:45
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6360, Parent PID: 6238

General

Start time (UTC):	04:03:47
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6360, Parent PID: 6238

General

Start time (UTC):	04:03:47
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6361, Parent PID: 6360

General

Start time (UTC):	04:03:47
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6361, Parent PID: 6360

General

Start time (UTC):	04:03:47
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6364, Parent PID: 6238

General

Start time (UTC):	04:03:49
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6364, Parent PID: 6238

General

Start time (UTC):	04:03:49
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6365, Parent PID: 6364

General

Start time (UTC):	04:03:49
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6365, Parent PID: 6364

General

Start time (UTC):	04:03:49
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6368, Parent PID: 6238

General

Start time (UTC):	04:03:51
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6368, Parent PID: 6238

General

Start time (UTC):	04:03:51
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6369, Parent PID: 6368

General

Start time (UTC):	04:03:51
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6369, Parent PID: 6368

General

Start time (UTC):	04:03:51
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6370, Parent PID: 6238

General

Start time (UTC):	04:03:53
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6370, Parent PID: 6238

General

Start time (UTC):	04:03:53
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6371, Parent PID: 6370

General

Start time (UTC):	04:03:53
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6371, Parent PID: 6370

General

Start time (UTC):	04:03:53
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6374, Parent PID: 6238

General

Start time (UTC):	04:03:55
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6374, Parent PID: 6238

General

Start time (UTC):	04:03:55
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6375, Parent PID: 6374

General

Start time (UTC):	04:03:55
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6375, Parent PID: 6374

General

Start time (UTC):	04:03:55
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6376, Parent PID: 6238

General

Start time (UTC):	04:03:58
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6376, Parent PID: 6238

General

Start time (UTC):	04:03:58
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6377, Parent PID: 6376

General

Start time (UTC):	04:03:58
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6377, Parent PID: 6376

General

Start time (UTC):	04:03:58
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6380, Parent PID: 6238

General

Start time (UTC):	04:04:00
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6380, Parent PID: 6238

General

Start time (UTC):	04:04:00
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6381, Parent PID: 6380

General

Start time (UTC):	04:04:00
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6381, Parent PID: 6380

General

Start time (UTC):	04:04:00
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6383, Parent PID: 6238

General

Start time (UTC):	04:04:02
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6383, Parent PID: 6238

General

Start time (UTC):	04:04:02
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6384, Parent PID: 6383

General

Start time (UTC):	04:04:02
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6384, Parent PID: 6383

General

Start time (UTC):	04:04:02
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6387, Parent PID: 6238

General

Start time (UTC):	04:04:04
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6387, Parent PID: 6238

General

Start time (UTC):	04:04:04
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6388, Parent PID: 6387

General

Start time (UTC):	04:04:04
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6388, Parent PID: 6387

General

Start time (UTC):	04:04:04
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6389, Parent PID: 6238

General

Start time (UTC):	04:04:06
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6389, Parent PID: 6238

General

Start time (UTC):	04:04:06
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6390, Parent PID: 6389

General

Start time (UTC):	04:04:06
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6390, Parent PID: 6389

General

Start time (UTC):	04:04:06
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6391, Parent PID: 6238

General

Start time (UTC):	04:04:08
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6391, Parent PID: 6238

General

Start time (UTC):	04:04:08
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6392, Parent PID: 6391

General

Start time (UTC):	04:04:08
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6392, Parent PID: 6391

General

Start time (UTC):	04:04:08
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6395, Parent PID: 6238

General

Start time (UTC):	04:04:10
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6395, Parent PID: 6238

General

Start time (UTC):	04:04:10
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6396, Parent PID: 6395

General

Start time (UTC):	04:04:10
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6396, Parent PID: 6395

General

Start time (UTC):	04:04:10
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6397, Parent PID: 6238

General

Start time (UTC):	04:04:12
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6397, Parent PID: 6238

General

Start time (UTC):	04:04:12
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6398, Parent PID: 6397

General

Start time (UTC):	04:04:12
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6398, Parent PID: 6397

General

Start time (UTC):	04:04:12
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6401, Parent PID: 6238

General

Start time (UTC):	04:04:14
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6401, Parent PID: 6238

General

Start time (UTC):	04:04:14
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6402, Parent PID: 6401

General

Start time (UTC):	04:04:14
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6402, Parent PID: 6401

General

Start time (UTC):	04:04:14
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6403, Parent PID: 6238

General

Start time (UTC):	04:04:16
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6403, Parent PID: 6238

General

Start time (UTC):	04:04:16
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6404, Parent PID: 6403

General

Start time (UTC):	04:04:16
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6404, Parent PID: 6403

General

Start time (UTC):	04:04:16
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6405, Parent PID: 6238

General

Start time (UTC):	04:04:18
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6405, Parent PID: 6238

General

Start time (UTC):	04:04:18
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6406, Parent PID: 6405

General

Start time (UTC):	04:04:18
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6406, Parent PID: 6405

General

Start time (UTC):	04:04:18
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6409, Parent PID: 6238

General

Start time (UTC):	04:04:20
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6409, Parent PID: 6238

General

Start time (UTC):	04:04:20
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6410, Parent PID: 6409

General

Start time (UTC):	04:04:20
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6410, Parent PID: 6409

General

Start time (UTC):	04:04:20
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6411, Parent PID: 6238

General

Start time (UTC):	04:04:22
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6411, Parent PID: 6238

General

Start time (UTC):	04:04:22
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6412, Parent PID: 6411

General

Start time (UTC):	04:04:22
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6412, Parent PID: 6411

General

Start time (UTC):	04:04:22
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6415, Parent PID: 6238

General

Start time (UTC):	04:04:24
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6415, Parent PID: 6238

General

Start time (UTC):	04:04:24
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6416, Parent PID: 6415

General

Start time (UTC):	04:04:24
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6416, Parent PID: 6415

General

Start time (UTC):	04:04:24
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6418, Parent PID: 6238

General

Start time (UTC):	04:04:26
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6418, Parent PID: 6238

General

Start time (UTC):	04:04:26
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6419, Parent PID: 6418

General

Start time (UTC):	04:04:26
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6419, Parent PID: 6418

General

Start time (UTC):	04:04:26
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6420, Parent PID: 6238

General

Start time (UTC):	04:04:28
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6420, Parent PID: 6238

General

Start time (UTC):	04:04:28
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6421, Parent PID: 6420

General

Start time (UTC):	04:04:28
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6421, Parent PID: 6420

General

Start time (UTC):	04:04:28
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6424, Parent PID: 6238

General

Start time (UTC):	04:04:30
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6424, Parent PID: 6238

General

Start time (UTC):	04:04:30
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6425, Parent PID: 6424

General

Start time (UTC):	04:04:30
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6425, Parent PID: 6424

General

Start time (UTC):	04:04:30
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6427, Parent PID: 6238

General

Start time (UTC):	04:04:33
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6427, Parent PID: 6238

General

Start time (UTC):	04:04:33
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6428, Parent PID: 6427

General

Start time (UTC):	04:04:33
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6428, Parent PID: 6427

General

Start time (UTC):	04:04:33
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6431, Parent PID: 6238

General

Start time (UTC):	04:04:35
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6431, Parent PID: 6238

General

Start time (UTC):	04:04:35
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6432, Parent PID: 6431

General

Start time (UTC):	04:04:35
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6432, Parent PID: 6431

General

Start time (UTC):	04:04:35
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6433, Parent PID: 6238

General

Start time (UTC):	04:04:37
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6433, Parent PID: 6238

General

Start time (UTC):	04:04:37
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6434, Parent PID: 6433

General

Start time (UTC):	04:04:37
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6434, Parent PID: 6433

General

Start time (UTC):	04:04:37
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6437, Parent PID: 6238

General

Start time (UTC):	04:04:39
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6437, Parent PID: 6238

General

Start time (UTC):	04:04:39
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6438, Parent PID: 6437

General

Start time (UTC):	04:04:39
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6438, Parent PID: 6437

General

Start time (UTC):	04:04:39
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6439, Parent PID: 6238

General

Start time (UTC):	04:04:41
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6439, Parent PID: 6238

General

Start time (UTC):	04:04:41
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6440, Parent PID: 6439

General

Start time (UTC):	04:04:41
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6440, Parent PID: 6439

General

Start time (UTC):	04:04:41
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6441, Parent PID: 6238

General

Start time (UTC):	04:04:43
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6441, Parent PID: 6238

General

Start time (UTC):	04:04:43
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6442, Parent PID: 6441

General

Start time (UTC):	04:04:43
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6442, Parent PID: 6441

General

Start time (UTC):	04:04:43
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6445, Parent PID: 6238

General

Start time (UTC):	04:04:45
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6445, Parent PID: 6238

General

Start time (UTC):	04:04:45
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6446, Parent PID: 6445

General

Start time (UTC):	04:04:45
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6446, Parent PID: 6445

General

Start time (UTC):	04:04:45
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6447, Parent PID: 6238

General

Start time (UTC):	04:04:47
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6447, Parent PID: 6238

General

Start time (UTC):	04:04:47
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6448, Parent PID: 6447

General

Start time (UTC):	04:04:47
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6448, Parent PID: 6447

General

Start time (UTC):	04:04:47
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6451, Parent PID: 6238

General

Start time (UTC):	04:04:49
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6451, Parent PID: 6238

General

Start time (UTC):	04:04:49
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6452, Parent PID: 6451

General

Start time (UTC):	04:04:49
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6452, Parent PID: 6451

General

Start time (UTC):	04:04:49
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6455, Parent PID: 6238

General

Start time (UTC):	04:04:51
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6455, Parent PID: 6238

General

Start time (UTC):	04:04:51
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6456, Parent PID: 6455

General

Start time (UTC):	04:04:51
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6456, Parent PID: 6455

General

Start time (UTC):	04:04:51
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6457, Parent PID: 6238

General

Start time (UTC):	04:04:53
Start date (UTC):	20/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896828 bytes
MD5 hash:	d42190dd0b6ba9a0d29c21a90cb9b6a5

Chronological Activities

Analysis Process: sh PID: 6457, Parent PID: 6238

General

Start time (UTC):	04:04:53
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6458, Parent PID: 6457

General

Start time (UTC):	04:04:53
Start date (UTC):	20/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6458, Parent PID: 6457

General

Start time (UTC):	04:04:53
Start date (UTC):	20/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: udisksd PID: 6248, Parent PID: 799

General

Start time (UTC):	04:02:50
Start date (UTC):	20/12/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Chronological Activities

Analysis Process: dumpe2fs PID: 6248, Parent PID: 799

General

Start time (UTC):	04:02:50
Start date (UTC):	20/12/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 10000.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/memfd:upX (deleted)

/var/tmp/.loc

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 6215, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6215, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6216, Parent PID: 4331

General

Chronological Activities

Analysis Process: cat PID: 6216, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6217, Parent PID: 4331

General

Chronological Activities

Analysis Process: head PID: 6217, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6218, Parent PID: 4331

General

Linux Analysis Report
10000.elf