Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
zerarm.elf

Overview

General Information

Sample name:zerarm.elf
Analysis ID:1580170
MD5:16293ddd1603db26cde04d30de5867e7
SHA1:5c8196dc14b1cb98ab601d6f3dd1c9eb8b6ab317
SHA256:e408748eb1a7a5e5c8fc96e514a95099cceaaa73a9355b90990bf59a05f4c115
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1580170
Start date and time:2024-12-24 03:39:13 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 44s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zerarm.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@11/0
  • VT rate limit hit for: serisbot.geek. [malformed]
Command:/tmp/zerarm.elf
PID:5451
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
The Peoples Bank of China.
Standard Error:
  • system is lnxubuntu20
  • zerarm.elf (PID: 5451, Parent: 5371, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/zerarm.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: zerarm.elfReversingLabs: Detection: 44%

Networking

barindex
Source: global trafficTCP traffic: 154.216.16.244 ports 38241,1,2,3,4,8
Source: global trafficTCP traffic: 154.216.16.250 ports 38241,1,2,3,4,8
Source: global trafficTCP traffic: 209.38.192.73 ports 38241,1,2,3,4,8
Source: global trafficDNS traffic detected: malformed DNS query: serisbot.geek. [malformed]
Source: global trafficTCP traffic: 192.168.2.13:48456 -> 209.38.192.73:38241
Source: global trafficTCP traffic: 192.168.2.13:44660 -> 154.216.16.244:38241
Source: global trafficTCP traffic: 192.168.2.13:58398 -> 154.216.16.250:38241
Source: /tmp/zerarm.elf (PID: 5451)Socket: 127.0.0.1:39148Jump to behavior
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: global trafficDNS traffic detected: DNS query: serisbot.geek
Source: global trafficDNS traffic detected: DNS query: serisontop.dyn
Source: global trafficDNS traffic detected: DNS query: serisbot.geek. [malformed]
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.troj.linELF@0/0@11/0
Source: /tmp/zerarm.elf (PID: 5451)Queries kernel information via 'uname': Jump to behavior
Source: zerarm.elf, 5451.1.000055f4e2458000.000055f4e2586000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: zerarm.elf, 5451.1.000055f4e2458000.000055f4e2586000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: zerarm.elf, 5451.1.00007ffd16549000.00007ffd1656a000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: zerarm.elf, 5451.1.00007ffd16549000.00007ffd1656a000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/zerarm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zerarm.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
zerarm.elf45%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
serisontop.dyn
209.38.192.73
truefalse
    high
    serisbot.geek
    209.38.192.73
    truefalse
      high
      serisbot.geek. [malformed]
      unknown
      unknowntrue
        unknown
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        154.216.16.244
        unknownSeychelles
        135357SKHT-ASShenzhenKatherineHengTechnologyInformationCotrue
        154.216.16.250
        unknownSeychelles
        135357SKHT-ASShenzhenKatherineHengTechnologyInformationCotrue
        209.38.192.73
        serisontop.dynUnited States
        7018ATT-INTERNET4USfalse
        No context
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        serisontop.dynjklmpsl.elfGet hashmaliciousUnknownBrowse
        • 209.38.192.73
        arm5.elfGet hashmaliciousUnknownBrowse
        • 209.38.192.73
        nabarm5.elfGet hashmaliciousUnknownBrowse
        • 154.216.16.244
        nklx86.elfGet hashmaliciousUnknownBrowse
        • 154.216.16.250
        sh4.elfGet hashmaliciousUnknownBrowse
        • 209.38.192.73
        nklppc.elfGet hashmaliciousUnknownBrowse
        • 154.216.16.244
        nklmips.elfGet hashmaliciousUnknownBrowse
        • 154.216.16.244
        serisbot.geeknklppc.elfGet hashmaliciousUnknownBrowse
        • 209.38.192.73
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        ATT-INTERNET4USjklmpsl.elfGet hashmaliciousUnknownBrowse
        • 12.242.244.195
        arm5.elfGet hashmaliciousUnknownBrowse
        • 104.55.155.192
        nabarm5.elfGet hashmaliciousUnknownBrowse
        • 32.96.179.169
        nklx86.elfGet hashmaliciousUnknownBrowse
        • 67.127.218.45
        sh4.elfGet hashmaliciousUnknownBrowse
        • 108.255.169.52
        nklppc.elfGet hashmaliciousUnknownBrowse
        • 99.116.76.29
        armv4l.elfGet hashmaliciousUnknownBrowse
        • 12.29.53.204
        nklmips.elfGet hashmaliciousUnknownBrowse
        • 70.133.32.51
        armv7l.elfGet hashmaliciousUnknownBrowse
        • 69.235.165.131
        armv5l.elfGet hashmaliciousUnknownBrowse
        • 65.81.221.130
        SKHT-ASShenzhenKatherineHengTechnologyInformationCox86_32.nn.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        arm7.nn-20241224-0051.elfGet hashmaliciousMirai, OkiruBrowse
        • 154.216.19.139
        sparc.nn.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        arm5.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        arm.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        mipsel.nn.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        powerpc.nn.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        Iuv2tI4JHh.exeGet hashmaliciousRHADAMANTHYSBrowse
        • 154.216.18.146
        byte.x86.elfGet hashmaliciousMirai, OkiruBrowse
        • 154.216.19.138
        Brooming.vbsGet hashmaliciousRemcos, GuLoaderBrowse
        • 154.216.20.209
        SKHT-ASShenzhenKatherineHengTechnologyInformationCox86_32.nn.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        arm7.nn-20241224-0051.elfGet hashmaliciousMirai, OkiruBrowse
        • 154.216.19.139
        sparc.nn.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        arm5.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        arm.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        mipsel.nn.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        powerpc.nn.elfGet hashmaliciousOkiruBrowse
        • 154.216.19.139
        Iuv2tI4JHh.exeGet hashmaliciousRHADAMANTHYSBrowse
        • 154.216.18.146
        byte.x86.elfGet hashmaliciousMirai, OkiruBrowse
        • 154.216.19.138
        Brooming.vbsGet hashmaliciousRemcos, GuLoaderBrowse
        • 154.216.20.209
        No context
        No context
        No created / dropped files found
        File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
        Entropy (8bit):5.956593508374874
        TrID:
        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
        File name:zerarm.elf
        File size:47'688 bytes
        MD5:16293ddd1603db26cde04d30de5867e7
        SHA1:5c8196dc14b1cb98ab601d6f3dd1c9eb8b6ab317
        SHA256:e408748eb1a7a5e5c8fc96e514a95099cceaaa73a9355b90990bf59a05f4c115
        SHA512:9423d0c425096e4cf650add2e3c77596bcfc956e97e496331deb130ddcfb8d267870abc94cc01b9b05fe45fddf7c463050ceaeaa0afef80351f2984329932684
        SSDEEP:768:D6GQFher0NQHBpHM1fXGc2VdoAPtbPaEhyQ7Qot3jQsMxeNqWCyV1ZST:mlhq0VXGdVdoA1bDAQfMxomT
        TLSH:28230841BC818A13C5D413BEFA5E429D372523B8E1EB7217DC226F15778A82F0DB7646
        File Content Preview:.ELF...a..........(.........4...........4. ...(.....................................................................Q.td..................................-...L."....+..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

        ELF header

        Class:ELF32
        Data:2's complement, little endian
        Version:1 (current)
        Machine:ARM
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:ARM - ABI
        ABI Version:0
        Entry Point Address:0x8190
        Flags:0x202
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:3
        Section Header Offset:47248
        Section Header Size:40
        Number of Section Headers:11
        Header String Table Index:10
        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
        NULL0x00x00x00x00x0000
        .initPROGBITS0x80940x940x180x00x6AX004
        .textPROGBITS0x80b00xb00xae600x00x6AX0016
        .finiPROGBITS0x12f100xaf100x140x00x6AX004
        .rodataPROGBITS0x12f240xaf240x7a40x00x2A004
        .ctorsPROGBITS0x1b6cc0xb6cc0x80x00x3WA004
        .dtorsPROGBITS0x1b6d40xb6d40x80x00x3WA004
        .jcrPROGBITS0x1b6dc0xb6dc0x40x00x3WA004
        .dataPROGBITS0x1b6e00xb6e00x16c0x00x3WA004
        .bssNOBITS0x1b84c0xb84c0x1780x00x3WA004
        .shstrtabSTRTAB0x00xb84c0x430x00x0001
        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        LOAD0x00x80000x80000xb6c80xb6c85.99510x5R E0x8000.init .text .fini .rodata
        LOAD0xb6cc0x1b6cc0x1b6cc0x1800x2f80.84990x6RW 0x8000.ctors .dtors .jcr .data .bss
        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
        TimestampSource PortDest PortSource IPDest IP
        Dec 24, 2024 03:40:11.017941952 CET4845638241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:11.137706995 CET3824148456209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:11.137862921 CET4845638241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:11.138854027 CET4845638241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:11.258908987 CET3824148456209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:11.259274006 CET4845638241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:11.378822088 CET3824148456209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:21.149379015 CET4845638241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:21.269079924 CET3824148456209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:21.574572086 CET3824148456209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:21.574908972 CET4845638241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:21.694547892 CET3824148456209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:22.817811966 CET4845838241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:22.937378883 CET3824148458209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:22.937582016 CET4845838241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:22.938786983 CET4845838241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:23.058300972 CET3824148458209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:23.058482885 CET4845838241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:23.178144932 CET3824148458209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:34.061614990 CET3824148458209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:34.061980009 CET4845838241192.168.2.13209.38.192.73
        Dec 24, 2024 03:40:34.181534052 CET3824148458209.38.192.73192.168.2.13
        Dec 24, 2024 03:40:35.310642958 CET4466038241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:35.430386066 CET3824144660154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:35.430507898 CET4466038241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:35.432096958 CET4466038241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:35.551616907 CET3824144660154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:35.551754951 CET4466038241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:35.671322107 CET3824144660154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:46.539130926 CET3824144660154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:46.539460897 CET4466038241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:46.659255028 CET3824144660154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:47.788395882 CET4466238241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:47.908611059 CET3824144662154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:47.908783913 CET4466238241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:47.910614014 CET4466238241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:48.031675100 CET3824144662154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:48.031810045 CET4466238241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:48.151359081 CET3824144662154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:59.015466928 CET3824144662154.216.16.244192.168.2.13
        Dec 24, 2024 03:40:59.015620947 CET4466238241192.168.2.13154.216.16.244
        Dec 24, 2024 03:40:59.135320902 CET3824144662154.216.16.244192.168.2.13
        Dec 24, 2024 03:41:00.262562990 CET4846438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:00.382102013 CET3824148464209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:00.382234097 CET4846438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:00.383583069 CET4846438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:00.503086090 CET3824148464209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:00.503321886 CET4846438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:00.622781038 CET3824148464209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:11.494872093 CET3824148464209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:11.495207071 CET4846438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:11.615413904 CET3824148464209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:12.742209911 CET5839838241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:12.861886978 CET3824158398154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:12.862159967 CET5839838241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:12.863641024 CET5839838241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:12.983270884 CET3824158398154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:12.983618975 CET5839838241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:13.103562117 CET3824158398154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:23.969927073 CET3824158398154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:23.970304012 CET5839838241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:24.089854002 CET3824158398154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:25.218789101 CET5840038241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:25.338557005 CET3824158400154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:25.338943005 CET5840038241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:25.340776920 CET5840038241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:25.460465908 CET3824158400154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:25.460892916 CET5840038241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:25.580565929 CET3824158400154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:35.350867033 CET5840038241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:35.470654011 CET3824158400154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:35.771697998 CET3824158400154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:35.771879911 CET5840038241192.168.2.13154.216.16.250
        Dec 24, 2024 03:41:35.891450882 CET3824158400154.216.16.250192.168.2.13
        Dec 24, 2024 03:41:37.016076088 CET4847038241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:37.136084080 CET3824148470209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:37.136221886 CET4847038241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:37.137865067 CET4847038241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:37.257879019 CET3824148470209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:37.257987976 CET4847038241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:37.377872944 CET3824148470209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:48.246217012 CET3824148470209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:48.246539116 CET4847038241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:48.366621017 CET3824148470209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:49.500897884 CET4847238241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:49.620660067 CET3824148472209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:49.621005058 CET4847238241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:49.622648954 CET4847238241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:49.742188931 CET3824148472209.38.192.73192.168.2.13
        Dec 24, 2024 03:41:49.742503881 CET4847238241192.168.2.13209.38.192.73
        Dec 24, 2024 03:41:49.862112045 CET3824148472209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:00.741890907 CET3824148472209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:00.742048025 CET4847238241192.168.2.13209.38.192.73
        Dec 24, 2024 03:42:00.861901045 CET3824148472209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:01.987207890 CET4847438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:42:02.106972933 CET3824148474209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:02.107215881 CET4847438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:42:02.108792067 CET4847438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:42:02.228528976 CET3824148474209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:02.228769064 CET4847438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:42:02.348566055 CET3824148474209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:13.225831032 CET3824148474209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:13.226049900 CET4847438241192.168.2.13209.38.192.73
        Dec 24, 2024 03:42:13.345664024 CET3824148474209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:14.492211103 CET4847638241192.168.2.13209.38.192.73
        Dec 24, 2024 03:42:14.611725092 CET3824148476209.38.192.73192.168.2.13
        Dec 24, 2024 03:42:14.611900091 CET4847638241192.168.2.13209.38.192.73
        TimestampSource PortDest PortSource IPDest IP
        Dec 24, 2024 03:40:10.769474983 CET5401853192.168.2.13202.61.197.122
        Dec 24, 2024 03:40:11.016671896 CET5354018202.61.197.122192.168.2.13
        Dec 24, 2024 03:40:22.578386068 CET4851453192.168.2.1351.158.108.203
        Dec 24, 2024 03:40:22.816915989 CET534851451.158.108.203192.168.2.13
        Dec 24, 2024 03:40:35.065766096 CET3665653192.168.2.13152.53.15.127
        Dec 24, 2024 03:40:35.309523106 CET5336656152.53.15.127192.168.2.13
        Dec 24, 2024 03:40:47.543143034 CET5107753192.168.2.13152.53.15.127
        Dec 24, 2024 03:40:47.787198067 CET5351077152.53.15.127192.168.2.13
        Dec 24, 2024 03:41:00.018793106 CET5166053192.168.2.13152.53.15.127
        Dec 24, 2024 03:41:00.261482954 CET5351660152.53.15.127192.168.2.13
        Dec 24, 2024 03:41:12.499222994 CET4305053192.168.2.13152.53.15.127
        Dec 24, 2024 03:41:12.739525080 CET5343050152.53.15.127192.168.2.13
        Dec 24, 2024 03:41:24.974488974 CET4086453192.168.2.13202.61.197.122
        Dec 24, 2024 03:41:25.217497110 CET5340864202.61.197.122192.168.2.13
        Dec 24, 2024 03:41:36.775094032 CET3937853192.168.2.1351.158.108.203
        Dec 24, 2024 03:41:37.014664888 CET533937851.158.108.203192.168.2.13
        Dec 24, 2024 03:41:49.250711918 CET5015353192.168.2.13152.53.15.127
        Dec 24, 2024 03:41:49.498920918 CET5350153152.53.15.127192.168.2.13
        Dec 24, 2024 03:42:01.745203972 CET6042153192.168.2.13202.61.197.122
        Dec 24, 2024 03:42:01.985901117 CET5360421202.61.197.122192.168.2.13
        Dec 24, 2024 03:42:14.229053974 CET3838753192.168.2.13185.181.61.24
        Dec 24, 2024 03:42:14.491266966 CET5338387185.181.61.24192.168.2.13
        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Dec 24, 2024 03:40:10.769474983 CET192.168.2.13202.61.197.1220xb84fStandard query (0)serisbot.geekA (IP address)IN (0x0001)false
        Dec 24, 2024 03:40:22.578386068 CET192.168.2.1351.158.108.2030xffc9Standard query (0)serisontop.dynA (IP address)IN (0x0001)false
        Dec 24, 2024 03:40:35.065766096 CET192.168.2.13152.53.15.1270x48daStandard query (0)serisontop.dynA (IP address)IN (0x0001)false
        Dec 24, 2024 03:40:47.543143034 CET192.168.2.13152.53.15.1270x9853Standard query (0)serisbot.geek. [malformed]256303false
        Dec 24, 2024 03:41:00.018793106 CET192.168.2.13152.53.15.1270xbee9Standard query (0)serisontop.dynA (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:12.499222994 CET192.168.2.13152.53.15.1270xba2eStandard query (0)serisontop.dynA (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:24.974488974 CET192.168.2.13202.61.197.1220xe81cStandard query (0)serisbot.geek. [malformed]256341false
        Dec 24, 2024 03:41:36.775094032 CET192.168.2.1351.158.108.2030x1cbeStandard query (0)serisontop.dynA (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:49.250711918 CET192.168.2.13152.53.15.1270x2ad3Standard query (0)serisbot.geek. [malformed]256365false
        Dec 24, 2024 03:42:01.745203972 CET192.168.2.13202.61.197.1220x87ebStandard query (0)serisbot.geek. [malformed]256377false
        Dec 24, 2024 03:42:14.229053974 CET192.168.2.13185.181.61.240x40f5Standard query (0)serisbot.geek. [malformed]256390false
        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Dec 24, 2024 03:40:11.016671896 CET202.61.197.122192.168.2.130xb84fNo error (0)serisbot.geek209.38.192.73A (IP address)IN (0x0001)false
        Dec 24, 2024 03:40:22.816915989 CET51.158.108.203192.168.2.130xffc9No error (0)serisontop.dyn209.38.192.73A (IP address)IN (0x0001)false
        Dec 24, 2024 03:40:35.309523106 CET152.53.15.127192.168.2.130x48daNo error (0)serisontop.dyn154.216.16.250A (IP address)IN (0x0001)false
        Dec 24, 2024 03:40:35.309523106 CET152.53.15.127192.168.2.130x48daNo error (0)serisontop.dyn209.38.192.73A (IP address)IN (0x0001)false
        Dec 24, 2024 03:40:35.309523106 CET152.53.15.127192.168.2.130x48daNo error (0)serisontop.dyn154.216.16.244A (IP address)IN (0x0001)false
        Dec 24, 2024 03:40:47.787198067 CET152.53.15.127192.168.2.130x9853Format error (1)serisbot.geek. [malformed]nonenone256303false
        Dec 24, 2024 03:41:00.261482954 CET152.53.15.127192.168.2.130xbee9No error (0)serisontop.dyn154.216.16.244A (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:00.261482954 CET152.53.15.127192.168.2.130xbee9No error (0)serisontop.dyn154.216.16.250A (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:00.261482954 CET152.53.15.127192.168.2.130xbee9No error (0)serisontop.dyn209.38.192.73A (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:12.739525080 CET152.53.15.127192.168.2.130xba2eNo error (0)serisontop.dyn154.216.16.250A (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:12.739525080 CET152.53.15.127192.168.2.130xba2eNo error (0)serisontop.dyn209.38.192.73A (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:12.739525080 CET152.53.15.127192.168.2.130xba2eNo error (0)serisontop.dyn154.216.16.244A (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:37.014664888 CET51.158.108.203192.168.2.130x1cbeNo error (0)serisontop.dyn209.38.192.73A (IP address)IN (0x0001)false
        Dec 24, 2024 03:41:49.498920918 CET152.53.15.127192.168.2.130x2ad3Format error (1)serisbot.geek. [malformed]nonenone256365false

        System Behavior

        Start time (UTC):02:40:10
        Start date (UTC):24/12/2024
        Path:/tmp/zerarm.elf
        Arguments:/tmp/zerarm.elf
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        Start time (UTC):02:40:10
        Start date (UTC):24/12/2024
        Path:/tmp/zerarm.elf
        Arguments:-
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        Start time (UTC):02:40:10
        Start date (UTC):24/12/2024
        Path:/tmp/zerarm.elf
        Arguments:-
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1