Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
zermips.elf

Overview

General Information

Sample name:zermips.elf
Analysis ID:1580192
MD5:d89ed8f31dd5942c33be023f7eb61b93
SHA1:e1fc999950eb17af3e3920aa4d5132c132699cbb
SHA256:2973b1298593b9876c0f5d78c45c134e9b7a13d7c362b26e72e72c072afa6629
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1580192
Start date and time:2024-12-24 04:04:49 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 38s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zermips.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@6/0
Command:/tmp/zermips.elf
PID:5525
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
The Peoples Bank of China.
Standard Error:
  • system is lnxubuntu20
  • zermips.elf (PID: 5525, Parent: 5443, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/zermips.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: zermips.elfVirustotal: Detection: 30%Perma Link
Source: zermips.elfReversingLabs: Detection: 31%

Networking

barindex
Source: global trafficTCP traffic: 209.38.192.73 ports 38241,1,2,3,4,8
Source: global trafficDNS traffic detected: malformed DNS query: serisbot.geek. [malformed]
Source: global trafficTCP traffic: 192.168.2.14:37080 -> 209.38.192.73:38241
Source: /tmp/zermips.elf (PID: 5525)Socket: 127.0.0.1:39148Jump to behavior
Source: global trafficTCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: global trafficDNS traffic detected: DNS query: serisbot.geek
Source: global trafficDNS traffic detected: DNS query: serisontop.dyn
Source: global trafficDNS traffic detected: DNS query: serisbot.geek. [malformed]
Source: unknownNetwork traffic detected: HTTP traffic on port 46540 -> 443
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.troj.linELF@0/0@6/0
Source: /tmp/zermips.elf (PID: 5525)Queries kernel information via 'uname': Jump to behavior
Source: zermips.elf, 5525.1.00005602e8444000.00005602e84cb000.rw-.sdmpBinary or memory string: V!/etc/qemu-binfmt/mips
Source: zermips.elf, 5525.1.00005602e8444000.00005602e84cb000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
Source: zermips.elf, 5525.1.00007ffef75d6000.00007ffef75f7000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
Source: zermips.elf, 5525.1.00007ffef75d6000.00007ffef75f7000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mips/tmp/zermips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zermips.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
zermips.elf31%VirustotalBrowse
zermips.elf32%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
serisbot.geek
209.38.192.73
truefalse
    high
    serisontop.dyn
    unknown
    unknownfalse
      high
      serisbot.geek. [malformed]
      unknown
      unknownfalse
        high
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        185.125.190.26
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        209.38.192.73
        serisbot.geekUnited States
        7018ATT-INTERNET4USfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        185.125.190.26bot.arm.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
          sh4.nn.elfGet hashmaliciousOkiruBrowse
            jackmymips64.elfGet hashmaliciousGafgyt, MiraiBrowse
              arm5.nn.elfGet hashmaliciousOkiruBrowse
                arm.nn-20241223-1416.elfGet hashmaliciousOkiruBrowse
                  hidakibest.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                    vlxx.mpsl.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                      la.bot.m68k.elfGet hashmaliciousMiraiBrowse
                        nsharm6.elfGet hashmaliciousMiraiBrowse
                          boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                            209.38.192.73zersh4.elfGet hashmaliciousUnknownBrowse
                              zerspc.elfGet hashmaliciousUnknownBrowse
                                zerm68k.elfGet hashmaliciousUnknownBrowse
                                  zermpsl.elfGet hashmaliciousUnknownBrowse
                                    zerarm.elfGet hashmaliciousUnknownBrowse
                                      zerx86.elfGet hashmaliciousUnknownBrowse
                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        serisbot.geeksplmpsl.elfGet hashmaliciousUnknownBrowse
                                        • 209.38.192.73
                                        splppc.elfGet hashmaliciousUnknownBrowse
                                        • 209.38.192.73
                                        arm7.elfGet hashmaliciousUnknownBrowse
                                        • 154.216.16.244
                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        CANONICAL-ASGBzerm68k.elfGet hashmaliciousUnknownBrowse
                                        • 91.189.91.42
                                        zerarm6.elfGet hashmaliciousUnknownBrowse
                                        • 91.189.91.42
                                        armv4eb.elfGet hashmaliciousUnknownBrowse
                                        • 91.189.91.42
                                        x86_32.nn.elfGet hashmaliciousOkiruBrowse
                                        • 91.189.91.42
                                        tftp.elfGet hashmaliciousUnknownBrowse
                                        • 91.189.91.42
                                        arm5.nn-20241224-0050.elfGet hashmaliciousOkiruBrowse
                                        • 91.189.91.42
                                        bot.sh4.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                        • 91.189.91.42
                                        mipsel.nn.elfGet hashmaliciousOkiruBrowse
                                        • 91.189.91.42
                                        powerpc.nn.elfGet hashmaliciousOkiruBrowse
                                        • 91.189.91.42
                                        arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                        • 91.189.91.42
                                        ATT-INTERNET4USnabppc.elfGet hashmaliciousUnknownBrowse
                                        • 70.137.219.150
                                        nabsh4.elfGet hashmaliciousUnknownBrowse
                                        • 162.207.61.13
                                        zersh4.elfGet hashmaliciousUnknownBrowse
                                        • 209.38.192.73
                                        nklm68k.elfGet hashmaliciousUnknownBrowse
                                        • 70.254.163.117
                                        nabmpsl.elfGet hashmaliciousUnknownBrowse
                                        • 12.178.23.37
                                        splmpsl.elfGet hashmaliciousUnknownBrowse
                                        • 76.240.173.144
                                        nabmips.elfGet hashmaliciousUnknownBrowse
                                        • 13.141.6.166
                                        arm7.elfGet hashmaliciousUnknownBrowse
                                        • 99.185.12.79
                                        jklx86.elfGet hashmaliciousUnknownBrowse
                                        • 12.140.118.169
                                        nklmpsl.elfGet hashmaliciousUnknownBrowse
                                        • 63.196.53.0
                                        No context
                                        No context
                                        No created / dropped files found
                                        File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                                        Entropy (8bit):5.4164631991109475
                                        TrID:
                                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                        File name:zermips.elf
                                        File size:60'788 bytes
                                        MD5:d89ed8f31dd5942c33be023f7eb61b93
                                        SHA1:e1fc999950eb17af3e3920aa4d5132c132699cbb
                                        SHA256:2973b1298593b9876c0f5d78c45c134e9b7a13d7c362b26e72e72c072afa6629
                                        SHA512:097a49f503745ad4e07f98daf0873a6245ad26b42fb2f5afe85abe5599d367b0dc666af43a6812d248f17d98aa3ed53cdfa7822869731493aa874deaaf95eec7
                                        SSDEEP:1536:K/LrvCNzyOqHGWYdlVUzbPknPihnPPwGmumK+KTd:ybgzyNGWYdlVU9/mrKTd
                                        TLSH:A953B41A2E258FACF7AD833557B38E31969833D226A0C646D15CE9011FB074E645FFAC
                                        File Content Preview:.ELF.....................@.`...4.........4. ...(.............@...@.....@...@...............D.D.D.D.D...l...$........dt.Q............................<...'.fL...!'.......................<...'.f(...!... ....'9... ......................<...'.e....!........'9.

                                        ELF header

                                        Class:ELF32
                                        Data:2's complement, big endian
                                        Version:1 (current)
                                        Machine:MIPS R3000
                                        Version Number:0x1
                                        Type:EXEC (Executable file)
                                        OS/ABI:UNIX - System V
                                        ABI Version:0
                                        Entry Point Address:0x400260
                                        Flags:0x1007
                                        ELF Header Size:52
                                        Program Header Offset:52
                                        Program Header Size:32
                                        Number of Program Headers:3
                                        Section Header Offset:60188
                                        Section Header Size:40
                                        Number of Section Headers:15
                                        Header String Table Index:14
                                        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                        NULL0x00x00x00x00x0000
                                        .initPROGBITS0x4000940x940x8c0x00x6AX004
                                        .textPROGBITS0x4001200x1200xdbd00x00x6AX0016
                                        .finiPROGBITS0x40dcf00xdcf00x5c0x00x6AX004
                                        .rodataPROGBITS0x40dd500xdd500x7f00x00x2A0016
                                        .ctorsPROGBITS0x44e5440xe5440x80x00x3WA004
                                        .dtorsPROGBITS0x44e54c0xe54c0x80x00x3WA004
                                        .jcrPROGBITS0x44e5540xe5540x40x00x3WA004
                                        .data.rel.roPROGBITS0x44e5580xe5580x80x00x3WA004
                                        .dataPROGBITS0x44e5600xe5600x1900x00x3WA0016
                                        .gotPROGBITS0x44e6f00xe6f00x3c00x40x10000003WAp0016
                                        .sbssNOBITS0x44eab00xeab00x180x00x10000003WAp004
                                        .bssNOBITS0x44ead00xeab00x1980x00x3WA0016
                                        .mdebug.abi32PROGBITS0x73e0xeab00x00x00x0001
                                        .shstrtabSTRTAB0x00xeab00x690x00x0001
                                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                        LOAD0x00x4000000x4000000xe5400xe5405.45440x5R E0x10000.init .text .fini .rodata
                                        LOAD0xe5440x44e5440x44e5440x56c0x7243.18460x6RW 0x10000.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
                                        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                        TimestampSource PortDest PortSource IPDest IP
                                        Dec 24, 2024 04:05:42.235043049 CET3708038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:42.354732037 CET3824137080209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:05:42.354903936 CET3708038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:42.355999947 CET3708038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:42.479134083 CET3824137080209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:05:42.479269028 CET3708038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:42.601207018 CET3824137080209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:05:52.191860914 CET46540443192.168.2.14185.125.190.26
                                        Dec 24, 2024 04:05:52.365885019 CET3708038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:52.485505104 CET3824137080209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:05:52.789899111 CET3824137080209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:05:52.790497065 CET3708038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:52.910200119 CET3824137080209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:05:54.033711910 CET3708238241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:54.153388977 CET3824137082209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:05:54.153543949 CET3708238241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:54.154784918 CET3708238241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:54.274293900 CET3824137082209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:05:54.274594069 CET3708238241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:05:54.394129992 CET3824137082209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:05.272646904 CET3824137082209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:05.273086071 CET3708238241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:05.392661095 CET3824137082209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:06.516614914 CET3708438241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:06.636156082 CET3824137084209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:06.636336088 CET3708438241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:07.519340992 CET3708438241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:07.638957977 CET3824137084209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:07.639184952 CET3708438241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:07.641041040 CET3708438241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:07.760752916 CET3824137084209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:07.761056900 CET3708438241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:07.880589008 CET3824137084209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:18.761419058 CET3824137084209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:18.761658907 CET3708438241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:18.881284952 CET3824137084209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:20.010428905 CET3708638241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:20.130120993 CET3824137086209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:20.130398989 CET3708638241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:20.132065058 CET3708638241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:20.251517057 CET3824137086209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:20.251728058 CET3708638241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:20.371218920 CET3824137086209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:23.678714991 CET46540443192.168.2.14185.125.190.26
                                        Dec 24, 2024 04:06:31.248929977 CET3824137086209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:31.249356031 CET3708638241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:31.368851900 CET3824137086209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:32.506401062 CET3708838241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:32.625977039 CET3824137088209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:32.626256943 CET3708838241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:32.628026009 CET3708838241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:32.747509003 CET3824137088209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:32.747649908 CET3708838241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:32.867096901 CET3824137088209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:43.737855911 CET3824137088209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:43.738179922 CET3708838241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:43.857877016 CET3824137088209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:44.989706993 CET3709038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:45.109397888 CET3824137090209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:45.109492064 CET3709038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:45.111069918 CET3709038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:45.232214928 CET3824137090209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:06:45.232321024 CET3709038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:06:45.351834059 CET3824137090209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:07:05.127510071 CET3709038241192.168.2.14209.38.192.73
                                        Dec 24, 2024 04:07:05.247150898 CET3824137090209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:07:05.570954084 CET3824137090209.38.192.73192.168.2.14
                                        Dec 24, 2024 04:07:05.571446896 CET3709038241192.168.2.14209.38.192.73
                                        TimestampSource PortDest PortSource IPDest IP
                                        Dec 24, 2024 04:05:41.994105101 CET5536653192.168.2.1451.158.108.203
                                        Dec 24, 2024 04:05:42.233721018 CET535536651.158.108.203192.168.2.14
                                        Dec 24, 2024 04:05:53.793740988 CET3756253192.168.2.1451.158.108.203
                                        Dec 24, 2024 04:05:54.032880068 CET533756251.158.108.203192.168.2.14
                                        Dec 24, 2024 04:06:06.276279926 CET3752053192.168.2.1481.169.136.222
                                        Dec 24, 2024 04:06:06.515010118 CET533752081.169.136.222192.168.2.14
                                        Dec 24, 2024 04:06:19.765614033 CET3899453192.168.2.14194.36.144.87
                                        Dec 24, 2024 04:06:20.009068966 CET5338994194.36.144.87192.168.2.14
                                        Dec 24, 2024 04:06:32.252928972 CET5515353192.168.2.14152.53.15.127
                                        Dec 24, 2024 04:06:32.505162001 CET5355153152.53.15.127192.168.2.14
                                        Dec 24, 2024 04:06:44.741729021 CET3598953192.168.2.14202.61.197.122
                                        Dec 24, 2024 04:06:44.988253117 CET5335989202.61.197.122192.168.2.14
                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Dec 24, 2024 04:05:41.994105101 CET192.168.2.1451.158.108.2030xefd1Standard query (0)serisbot.geekA (IP address)IN (0x0001)false
                                        Dec 24, 2024 04:05:53.793740988 CET192.168.2.1451.158.108.2030x72bcStandard query (0)serisbot.geekA (IP address)IN (0x0001)false
                                        Dec 24, 2024 04:06:06.276279926 CET192.168.2.1481.169.136.2220xe659Standard query (0)serisontop.dynA (IP address)IN (0x0001)false
                                        Dec 24, 2024 04:06:19.765614033 CET192.168.2.14194.36.144.870x8c4bStandard query (0)serisbot.geek. [malformed]256300false
                                        Dec 24, 2024 04:06:32.252928972 CET192.168.2.14152.53.15.1270xca86Standard query (0)serisbot.geek. [malformed]256312false
                                        Dec 24, 2024 04:06:44.741729021 CET192.168.2.14202.61.197.1220xa973Standard query (0)serisbot.geek. [malformed]256324false
                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Dec 24, 2024 04:05:42.233721018 CET51.158.108.203192.168.2.140xefd1No error (0)serisbot.geek209.38.192.73A (IP address)IN (0x0001)false
                                        Dec 24, 2024 04:05:54.032880068 CET51.158.108.203192.168.2.140x72bcNo error (0)serisbot.geek209.38.192.73A (IP address)IN (0x0001)false
                                        Dec 24, 2024 04:06:06.515010118 CET81.169.136.222192.168.2.140xe659Refused (5)serisontop.dynnonenoneA (IP address)IN (0x0001)false
                                        Dec 24, 2024 04:06:20.009068966 CET194.36.144.87192.168.2.140x8c4bFormat error (1)serisbot.geek. [malformed]nonenone256300false
                                        Dec 24, 2024 04:06:32.505162001 CET152.53.15.127192.168.2.140xca86Format error (1)serisbot.geek. [malformed]nonenone256312false

                                        System Behavior

                                        Start time (UTC):03:05:40
                                        Start date (UTC):24/12/2024
                                        Path:/tmp/zermips.elf
                                        Arguments:/tmp/zermips.elf
                                        File size:5777432 bytes
                                        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                        Start time (UTC):03:05:40
                                        Start date (UTC):24/12/2024
                                        Path:/tmp/zermips.elf
                                        Arguments:-
                                        File size:5777432 bytes
                                        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                        Start time (UTC):03:05:40
                                        Start date (UTC):24/12/2024
                                        Path:/tmp/zermips.elf
                                        Arguments:-
                                        File size:5777432 bytes
                                        MD5 hash:0083f1f0e77be34ad27f849842bbb00c