Edit tour

Linux Analysis Report
10000.elf

Overview

General Information

Sample name:	10000.elf
Analysis ID:	1581934
MD5:	5beba5cbe11be5fe0c7e8181d5fad806
SHA1:	d228d90fba5f339e1f407f4d56e16da312e87aac
SHA256:	650321cba0bc8b8964b45f3a787a984cdce473f5203d213c2a7a92d049e9bc1a
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Opens /sys/class/net/* files useful for querying network interface information

Sample is packed with UPX

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Reads CPU information from /proc indicative of miner or evasive malware

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains only a LOAD segment without any section mappings

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581934
Start date and time:	2024-12-29 13:27:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	10000.elf
Detection:	MAL
Classification:	mal48.spyw.evad.linELF@0/1@1/0

Runtime Messages

Command:	/tmp/10000.elf
PID:	6259
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6222, Parent: 4331)

rm (PID: 6222, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ujUhilwG3K /tmp/tmp.qYHYRyyPnV /tmp/tmp.rXwLrW9RNO

dash New Fork (PID: 6223, Parent: 4331)

cat (PID: 6223, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.ujUhilwG3K

dash New Fork (PID: 6224, Parent: 4331)

head (PID: 6224, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6225, Parent: 4331)

tr (PID: 6225, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6226, Parent: 4331)

cut (PID: 6226, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6227, Parent: 4331)

cat (PID: 6227, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.ujUhilwG3K

dash New Fork (PID: 6228, Parent: 4331)

head (PID: 6228, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6229, Parent: 4331)

tr (PID: 6229, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6230, Parent: 4331)

cut (PID: 6230, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6231, Parent: 4331)

rm (PID: 6231, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ujUhilwG3K /tmp/tmp.qYHYRyyPnV /tmp/tmp.rXwLrW9RNO

10000.elf (PID: 6259, Parent: 6151, MD5: 5beba5cbe11be5fe0c7e8181d5fad806) Arguments: /tmp/10000.elf

10000.elf New Fork (PID: 6260, Parent: 6259)

10000.elf New Fork (PID: 6261, Parent: 6260)

10000.elf New Fork (PID: 6295, Parent: 6261)

sh (PID: 6295, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6296, Parent: 6295)

ip (PID: 6296, Parent: 6295, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6300, Parent: 6261)

sh (PID: 6300, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6301, Parent: 6300)

ip (PID: 6301, Parent: 6300, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6302, Parent: 6261)

sh (PID: 6302, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6303, Parent: 6302)

ip (PID: 6303, Parent: 6302, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6306, Parent: 6261)

sh (PID: 6306, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6307, Parent: 6306)

ip (PID: 6307, Parent: 6306, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6308, Parent: 6261)

sh (PID: 6308, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6309, Parent: 6308)

ip (PID: 6309, Parent: 6308, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6311, Parent: 6261)

sh (PID: 6311, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6312, Parent: 6311)

ip (PID: 6312, Parent: 6311, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6315, Parent: 6261)

sh (PID: 6315, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6316, Parent: 6315)

ip (PID: 6316, Parent: 6315, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6317, Parent: 6261)

sh (PID: 6317, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6318, Parent: 6317)

ip (PID: 6318, Parent: 6317, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6321, Parent: 6261)

sh (PID: 6321, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6322, Parent: 6321)

ip (PID: 6322, Parent: 6321, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6336, Parent: 6261)

sh (PID: 6336, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6337, Parent: 6336)

ip (PID: 6337, Parent: 6336, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6338, Parent: 6261)

sh (PID: 6338, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6339, Parent: 6338)

ip (PID: 6339, Parent: 6338, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6342, Parent: 6261)

sh (PID: 6342, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6343, Parent: 6342)

ip (PID: 6343, Parent: 6342, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6344, Parent: 6261)

sh (PID: 6344, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6345, Parent: 6344)

ip (PID: 6345, Parent: 6344, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6348, Parent: 6261)

sh (PID: 6348, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6349, Parent: 6348)

ip (PID: 6349, Parent: 6348, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6350, Parent: 6261)

sh (PID: 6350, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6351, Parent: 6350)

ip (PID: 6351, Parent: 6350, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6352, Parent: 6261)

sh (PID: 6352, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6353, Parent: 6352)

ip (PID: 6353, Parent: 6352, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6356, Parent: 6261)

sh (PID: 6356, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6357, Parent: 6356)

ip (PID: 6357, Parent: 6356, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6358, Parent: 6261)

sh (PID: 6358, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6359, Parent: 6358)

ip (PID: 6359, Parent: 6358, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6362, Parent: 6261)

sh (PID: 6362, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6363, Parent: 6362)

ip (PID: 6363, Parent: 6362, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6365, Parent: 6261)

sh (PID: 6365, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6366, Parent: 6365)

ip (PID: 6366, Parent: 6365, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6369, Parent: 6261)

sh (PID: 6369, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6370, Parent: 6369)

ip (PID: 6370, Parent: 6369, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6371, Parent: 6261)

sh (PID: 6371, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6372, Parent: 6371)

ip (PID: 6372, Parent: 6371, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6373, Parent: 6261)

sh (PID: 6373, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6374, Parent: 6373)

ip (PID: 6374, Parent: 6373, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6377, Parent: 6261)

sh (PID: 6377, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6378, Parent: 6377)

ip (PID: 6378, Parent: 6377, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6379, Parent: 6261)

sh (PID: 6379, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6380, Parent: 6379)

ip (PID: 6380, Parent: 6379, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6383, Parent: 6261)

sh (PID: 6383, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6384, Parent: 6383)

ip (PID: 6384, Parent: 6383, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6385, Parent: 6261)

sh (PID: 6385, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6386, Parent: 6385)

ip (PID: 6386, Parent: 6385, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6387, Parent: 6261)

sh (PID: 6387, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6388, Parent: 6387)

ip (PID: 6388, Parent: 6387, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6393, Parent: 6261)

sh (PID: 6393, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6394, Parent: 6393)

ip (PID: 6394, Parent: 6393, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6395, Parent: 6261)

sh (PID: 6395, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6396, Parent: 6395)

ip (PID: 6396, Parent: 6395, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6399, Parent: 6261)

sh (PID: 6399, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6400, Parent: 6399)

ip (PID: 6400, Parent: 6399, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6401, Parent: 6261)

sh (PID: 6401, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6402, Parent: 6401)

ip (PID: 6402, Parent: 6401, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6403, Parent: 6261)

sh (PID: 6403, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6404, Parent: 6403)

ip (PID: 6404, Parent: 6403, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6407, Parent: 6261)

sh (PID: 6407, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6408, Parent: 6407)

ip (PID: 6408, Parent: 6407, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6410, Parent: 6261)

sh (PID: 6410, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6411, Parent: 6410)

ip (PID: 6411, Parent: 6410, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6414, Parent: 6261)

sh (PID: 6414, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6415, Parent: 6414)

ip (PID: 6415, Parent: 6414, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6416, Parent: 6261)

sh (PID: 6416, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6417, Parent: 6416)

ip (PID: 6417, Parent: 6416, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6420, Parent: 6261)

sh (PID: 6420, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6421, Parent: 6420)

ip (PID: 6421, Parent: 6420, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6422, Parent: 6261)

sh (PID: 6422, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6423, Parent: 6422)

ip (PID: 6423, Parent: 6422, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6424, Parent: 6261)

sh (PID: 6424, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6425, Parent: 6424)

ip (PID: 6425, Parent: 6424, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6428, Parent: 6261)

sh (PID: 6428, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6429, Parent: 6428)

ip (PID: 6429, Parent: 6428, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6430, Parent: 6261)

sh (PID: 6430, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6431, Parent: 6430)

ip (PID: 6431, Parent: 6430, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6434, Parent: 6261)

sh (PID: 6434, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6435, Parent: 6434)

ip (PID: 6435, Parent: 6434, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6436, Parent: 6261)

sh (PID: 6436, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6437, Parent: 6436)

ip (PID: 6437, Parent: 6436, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6438, Parent: 6261)

sh (PID: 6438, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6439, Parent: 6438)

ip (PID: 6439, Parent: 6438, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6442, Parent: 6261)

sh (PID: 6442, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6443, Parent: 6442)

ip (PID: 6443, Parent: 6442, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6445, Parent: 6261)

sh (PID: 6445, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6446, Parent: 6445)

ip (PID: 6446, Parent: 6445, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6449, Parent: 6261)

sh (PID: 6449, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6450, Parent: 6449)

ip (PID: 6450, Parent: 6449, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6451, Parent: 6261)

sh (PID: 6451, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6452, Parent: 6451)

ip (PID: 6452, Parent: 6451, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6454, Parent: 6261)

sh (PID: 6454, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6455, Parent: 6454)

ip (PID: 6455, Parent: 6454, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6458, Parent: 6261)

sh (PID: 6458, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6459, Parent: 6458)

ip (PID: 6459, Parent: 6458, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6460, Parent: 6261)

sh (PID: 6460, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6461, Parent: 6460)

ip (PID: 6461, Parent: 6460, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6464, Parent: 6261)

sh (PID: 6464, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6465, Parent: 6464)

ip (PID: 6465, Parent: 6464, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6466, Parent: 6261)

sh (PID: 6466, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6467, Parent: 6466)

ip (PID: 6467, Parent: 6466, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6468, Parent: 6261)

sh (PID: 6468, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6469, Parent: 6468)

ip (PID: 6469, Parent: 6468, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6472, Parent: 6261)

sh (PID: 6472, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6473, Parent: 6472)

ip (PID: 6473, Parent: 6472, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6474, Parent: 6261)

sh (PID: 6474, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6475, Parent: 6474)

ip (PID: 6475, Parent: 6474, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6480, Parent: 6261)

sh (PID: 6480, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6481, Parent: 6480)

ip (PID: 6481, Parent: 6480, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6482, Parent: 6261)

sh (PID: 6482, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6483, Parent: 6482)

ip (PID: 6483, Parent: 6482, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

10000.elf New Fork (PID: 6491, Parent: 6261)

sh (PID: 6491, Parent: 6261, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip route show default"

sh New Fork (PID: 6492, Parent: 6491)

ip (PID: 6492, Parent: 6491, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip route show default

udisksd New Fork (PID: 6273, Parent: 799)

dumpe2fs (PID: 6273, Parent: 799, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: /tmp/10000.elf (PID: 6261)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Networking

Opens /sys/class/net/* files useful for querying network interface information

Source: /tmp/10000.elf (PID: 6261)

Opens: /sys/class/net/ens160/statistics/tx_bytes

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.23:55560 -> 213.139.233.9:10000

Source: /tmp/10000.elf (PID: 6261)

Reads hosts file: /etc/hosts

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: svip-1.0889.org

Source: 10000.elf	String found in binary or memory: http://upx.sf.net
Source: 10000.elf, 6259.1.0000000000400000.00000000005f3000.r-x.sdmp, 10000.elf, 6260.1.0000000000400000.00000000005f3000.r-x.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 10000.elf, 6259.1.0000000000400000.00000000005f3000.r-x.sdmp, 10000.elf, 6260.1.0000000000400000.00000000005f3000.r-x.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: LOAD without section mappings

Program segment: 0x400000

Source: classification engine

Classification label: mal48.spyw.evad.linELF@0/1@1/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 4.24 Copyright (C) 1996-2024 the UPX Team. All Rights Reserved. $

Source: /tmp/10000.elf (PID: 6259)	Directory: /var/tmp/.loc	Jump to behavior
Source: /tmp/10000.elf (PID: 6261)	File: /var/tmp/.loc	Jump to behavior
Source: /tmp/10000.elf (PID: 6261)	Directory: /var/tmp/.rnd	Jump to behavior
Source: /tmp/10000.elf (PID: 6261)	Directory: /var/tmp/.u	Jump to behavior

Source: /tmp/10000.elf (PID: 6295)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6300)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6302)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6306)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6308)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6311)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6315)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6317)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6321)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6336)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6338)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6342)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6344)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6348)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6350)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6352)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6356)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6358)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6362)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6365)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6369)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6371)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6373)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6377)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6379)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6383)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6385)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6387)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6393)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6395)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6399)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6401)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6403)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6407)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6410)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6414)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6416)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6420)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6422)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6424)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6428)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6430)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6434)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6436)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6438)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6442)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6445)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6449)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6451)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6454)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6458)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6460)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6464)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6466)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6468)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6472)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6474)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6480)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6482)	Shell command executed: sh -c "ip route show default"	Jump to behavior
Source: /tmp/10000.elf (PID: 6491)	Shell command executed: sh -c "ip route show default"	Jump to behavior

Source: /usr/bin/dash (PID: 6222)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ujUhilwG3K /tmp/tmp.qYHYRyyPnV /tmp/tmp.rXwLrW9RNO			Jump to behavior
Source: /usr/bin/dash (PID: 6231)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ujUhilwG3K /tmp/tmp.qYHYRyyPnV /tmp/tmp.rXwLrW9RNO			Jump to behavior

Source: /tmp/10000.elf (PID: 6261)	Reads from proc file: /proc/cpuinfo			Jump to behavior
Source: /tmp/10000.elf (PID: 6261)	Reads from proc file: /proc/stat			Jump to behavior

Source: 10000.elf	Submission file: segment LOAD with 7.8152 entropy (max. 8.0)
Source: 10000.elf	Submission file: segment LOAD with 7.9996 entropy (max. 8.0)

Source: /tmp/10000.elf (PID: 6261)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: /tmp/10000.elf (PID: 6261)

Queries kernel information via 'uname':

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Obfuscated Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
10000.elf	3%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
svip-1.0889.org	213.139.233.9	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://upx.sf.net	10000.elf	false	high
http://www.openssl.org/support/faq.htmlRAND	10000.elf, 6259.1.0000000000400000.00000000005f3000.r-x.sdmp, 10000.elf, 6260.1.0000000000400000.00000000005f3000.r-x.sdmp	false	high
http://www.openssl.org/support/faq.html	10000.elf, 6259.1.0000000000400000.00000000005f3000.r-x.sdmp, 10000.elf, 6260.1.0000000000400000.00000000005f3000.r-x.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
213.139.233.9	svip-1.0889.org	Russian Federation	136782	PINGTAN-AS-APKirinNetworksCN	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
213.139.233.9	10000.elf	Get hash	malicious	Unknown	Browse
213.139.233.9	10000.elf	Get hash	malicious	BillGates	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	tftp.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	72.14.155.77-boatnet.mpsl-2024-12-29T04_49_11.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	db0fa4b8db0333367e9bda3ab68b8042.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	tftp.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	72.14.155.77-boatnet.mpsl-2024-12-29T04_49_11.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	bin.sh.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	db0fa4b8db0333367e9bda3ab68b8042.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
svip-1.0889.org	10000.elf	Get hash	malicious	Unknown	Browse	213.139.233.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	72.14.155.77-boatnet.mpsl-2024-12-29T04_49_11.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	72.14.155.77-boatnet.mpsl-2024-12-29T04_49_11.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	tftp.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	72.14.155.77-boatnet.mpsl-2024-12-29T04_49_11.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bin.sh.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	db0fa4b8db0333367e9bda3ab68b8042.ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
PINGTAN-AS-APKirinNetworksCN	10000.elf	Get hash	malicious	Unknown	Browse	213.139.233.9
	10000.elf	Get hash	malicious	BillGates	Browse	213.139.233.9
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	103.96.197.3
	1FOZSuwbGF.elf	Get hash	malicious	Mirai	Browse	103.96.197.9
	1ik5K4HEZO	Get hash	malicious	Unknown	Browse	103.96.197.9
	TT copy.exe	Get hash	malicious	FormBook	Browse	185.254.241.173
	RxD0XMDsWp	Get hash	malicious	Mirai	Browse	103.96.153.100
	ywvz5i8kT9.exe	Get hash	malicious	Unknown	Browse	45.135.48.153
	28z8ooA3oC	Get hash	malicious	Mirai	Browse	196.19.196.209
	y8uLBHoe4J.exe	Get hash	malicious	BitRAT	Browse	62.133.35.244

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/tmp/.loc

Download File

Process:	/tmp/10000.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:kvn:kvn
MD5:	6FC7277C23DB109AE333AEDEB82F3A1D
SHA1:	218E57509998197D570E2C98512D0105985DFFC9
SHA-256:	CCD7A3522BA234A9E1D9FCE5FD57212D27C1CF346FE7F8C970B861693A9F151B
SHA-512:	AA45BAE538F2C66418ADB983BE121375557B058C53527F8D0C36CACE075AD6FC43B812444105779161BC5690BA9C6CDE4490B04B6B680AA2FA3C8921FF585E6D
Malicious:	false
Reputation:	low
Preview:	6261.

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.999656141422145
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	10000.elf
File size:	896'872 bytes
MD5:	5beba5cbe11be5fe0c7e8181d5fad806
SHA1:	d228d90fba5f339e1f407f4d56e16da312e87aac
SHA256:	650321cba0bc8b8964b45f3a787a984cdce473f5203d213c2a7a92d049e9bc1a
SHA512:	7342471fa2f1c1e575a80a310e5ace1cefaf30d8e180c7dd7cefc290439a1b5c26f16899acd8e987643f885b7a5bc9120f94c89e611212d4afa11e2b11d3bceb
SSDEEP:	24576:Y6jwScDJK4+mg0XPwjeTcLeZKfaIyITe9lmZRQQnLOAU1imUyHZhPiegmf:Xjb8UmL6eTcLokaRoe9IHaAU1idyi/mf
TLSH:	B5153316E74AC2E9F7D79CF46492480C2F06F46C065C2EB682DBC62C9B4487877EE51B
File Content Preview:	.ELF..............>.....`.......@...................@.8...........................@.......@............. .@....... .....................................n.......n......... .....Q.td....................................................!.jzUPX!........-.$....

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0xac9360
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	0
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x400000	0x400000	0x1000	0x408b20	7.8152	0x6	RW	0x200000
LOAD	0x0	0xa00000	0xa00000	0xca76e	0xca76e	7.9996	0x5	R E	0x200000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 13:27:54.495497942 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 13:27:54.720293999 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:54.841429949 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:54.841685057 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:54.842878103 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:54.963799953 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.354465961 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.354515076 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.354553938 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.354581118 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:56.354582071 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:56.354595900 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.354615927 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:56.354633093 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:56.372683048 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:56.372683048 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:56.493726015 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.493746042 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.493753910 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.879137039 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.879169941 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:56.879254103 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:56.879293919 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:58.939600945 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:27:59.060870886 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:27:59.870899916 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 13:28:00.987005949 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:01.108181000 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:01.150666952 CET	42516	80	192.168.2.23	109.202.202.202
Dec 29, 2024 13:28:03.032402992 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:03.153867960 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:05.074686050 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:05.195827007 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:07.124835968 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:07.246315002 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:09.167356968 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:09.288752079 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:11.216057062 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:11.338697910 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:13.263770103 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:13.385113001 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:14.464709997 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 13:28:15.315953970 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:15.438173056 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:17.367671967 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:17.488805056 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:19.419708967 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:19.540914059 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:21.475090981 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:21.596503019 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:23.520559072 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:23.641855001 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:25.570389986 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:25.691919088 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:26.747107029 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 13:28:27.622292042 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:27.743520021 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:29.672610044 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:29.793824911 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:30.842591047 CET	42516	80	192.168.2.23	109.202.202.202
Dec 29, 2024 13:28:31.715481043 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:31.837044954 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:33.771442890 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:33.892805099 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:35.822333097 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:35.943397999 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:37.896986008 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:38.018340111 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:39.953605890 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:40.074686050 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:42.005678892 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:42.126916885 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:44.054460049 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:44.175832033 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:46.096841097 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:46.218327999 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:48.141036987 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:48.262386084 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:50.187988997 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:50.309355021 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:52.242928982 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:52.364130020 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:54.292814016 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:54.414266109 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:55.415026903 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 13:28:56.341829062 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:56.463062048 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:28:58.391371965 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:28:58.513320923 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:00.440817118 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:00.562179089 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:02.496931076 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:02.618262053 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:04.548712969 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:04.669790983 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:06.599436045 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:06.720524073 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:08.650259018 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:08.771528006 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:10.698086977 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:10.819485903 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:12.739671946 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:12.860888958 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:14.787029982 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:14.909208059 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:16.831671000 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:16.953176975 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:18.874505997 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:18.995691061 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:20.917099953 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:21.038161039 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:22.959913015 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:23.081007957 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:25.006907940 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:25.128999949 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:27.059573889 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:27.180856943 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:29.115370035 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:29.236592054 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:31.166889906 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:31.288836956 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:33.218569040 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:33.339797974 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:35.265404940 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:35.386584997 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:37.325110912 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:37.446562052 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:39.377685070 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:39.499255896 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:41.433914900 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:41.555154085 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:43.486995935 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:43.608264923 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:45.544002056 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:45.665188074 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:47.581938028 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:47.703298092 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:49.624526978 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:49.745776892 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:51.665632010 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:51.786848068 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:53.712990046 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:53.834229946 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:55.751342058 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:55.872361898 CET	10000	55560	213.139.233.9	192.168.2.23
Dec 29, 2024 13:29:57.798671961 CET	55560	10000	192.168.2.23	213.139.233.9
Dec 29, 2024 13:29:57.919852972 CET	10000	55560	213.139.233.9	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 13:27:54.387742043 CET	46865	53	192.168.2.23	1.1.1.1
Dec 29, 2024 13:27:54.719203949 CET	53	46865	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 13:27:54.387742043 CET	192.168.2.23	1.1.1.1	0x5b86	Standard query (0)	svip-1.0889.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 13:27:54.719203949 CET	1.1.1.1	192.168.2.23	0x5b86	No error (0)	svip-1.0889.org		213.139.233.9	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 6222, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6222, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.ujUhilwG3K /tmp/tmp.qYHYRyyPnV /tmp/tmp.rXwLrW9RNO
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6223, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6223, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.ujUhilwG3K
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6224, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6224, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6225, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6225, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6226, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6226, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6227, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6227, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.ujUhilwG3K
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6228, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6228, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6229, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6229, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6230, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6230, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6231, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6231, Parent PID: 4331

General

Start time (UTC):	12:27:49
Start date (UTC):	29/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.ujUhilwG3K /tmp/tmp.qYHYRyyPnV /tmp/tmp.rXwLrW9RNO
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: 10000.elf PID: 6259, Parent PID: 6151

General

Start time (UTC):	12:27:53
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	/tmp/10000.elf
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: 10000.elf PID: 6260, Parent PID: 6259

General

Start time (UTC):	12:27:53
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: 10000.elf PID: 6261, Parent PID: 6260

General

Start time (UTC):	12:27:53
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: 10000.elf PID: 6295, Parent PID: 6261

General

Start time (UTC):	12:27:57
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6295, Parent PID: 6261

General

Start time (UTC):	12:27:57
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6296, Parent PID: 6295

General

Start time (UTC):	12:27:57
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6296, Parent PID: 6295

General

Start time (UTC):	12:27:57
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6300, Parent PID: 6261

General

Start time (UTC):	12:27:59
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6300, Parent PID: 6261

General

Start time (UTC):	12:27:59
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6301, Parent PID: 6300

General

Start time (UTC):	12:27:59
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6301, Parent PID: 6300

General

Start time (UTC):	12:27:59
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6302, Parent PID: 6261

General

Start time (UTC):	12:28:01
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6302, Parent PID: 6261

General

Start time (UTC):	12:28:01
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6303, Parent PID: 6302

General

Start time (UTC):	12:28:01
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6303, Parent PID: 6302

General

Start time (UTC):	12:28:01
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6306, Parent PID: 6261

General

Start time (UTC):	12:28:03
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6306, Parent PID: 6261

General

Start time (UTC):	12:28:03
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6307, Parent PID: 6306

General

Start time (UTC):	12:28:03
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6307, Parent PID: 6306

General

Start time (UTC):	12:28:03
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6308, Parent PID: 6261

General

Start time (UTC):	12:28:05
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6308, Parent PID: 6261

General

Start time (UTC):	12:28:05
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6309, Parent PID: 6308

General

Start time (UTC):	12:28:05
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6309, Parent PID: 6308

General

Start time (UTC):	12:28:05
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6311, Parent PID: 6261

General

Start time (UTC):	12:28:07
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6311, Parent PID: 6261

General

Start time (UTC):	12:28:07
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6312, Parent PID: 6311

General

Start time (UTC):	12:28:07
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6312, Parent PID: 6311

General

Start time (UTC):	12:28:07
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6315, Parent PID: 6261

General

Start time (UTC):	12:28:09
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6315, Parent PID: 6261

General

Start time (UTC):	12:28:09
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6316, Parent PID: 6315

General

Start time (UTC):	12:28:09
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6316, Parent PID: 6315

General

Start time (UTC):	12:28:09
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6317, Parent PID: 6261

General

Start time (UTC):	12:28:11
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6317, Parent PID: 6261

General

Start time (UTC):	12:28:11
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6318, Parent PID: 6317

General

Start time (UTC):	12:28:11
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6318, Parent PID: 6317

General

Start time (UTC):	12:28:11
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6321, Parent PID: 6261

General

Start time (UTC):	12:28:13
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6321, Parent PID: 6261

General

Start time (UTC):	12:28:13
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6322, Parent PID: 6321

General

Start time (UTC):	12:28:13
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6322, Parent PID: 6321

General

Start time (UTC):	12:28:13
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6336, Parent PID: 6261

General

Start time (UTC):	12:28:15
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6336, Parent PID: 6261

General

Start time (UTC):	12:28:15
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6337, Parent PID: 6336

General

Start time (UTC):	12:28:16
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6337, Parent PID: 6336

General

Start time (UTC):	12:28:16
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6338, Parent PID: 6261

General

Start time (UTC):	12:28:18
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6338, Parent PID: 6261

General

Start time (UTC):	12:28:18
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6339, Parent PID: 6338

General

Start time (UTC):	12:28:18
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6339, Parent PID: 6338

General

Start time (UTC):	12:28:18
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6342, Parent PID: 6261

General

Start time (UTC):	12:28:20
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6342, Parent PID: 6261

General

Start time (UTC):	12:28:20
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6343, Parent PID: 6342

General

Start time (UTC):	12:28:20
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6343, Parent PID: 6342

General

Start time (UTC):	12:28:20
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6344, Parent PID: 6261

General

Start time (UTC):	12:28:22
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6344, Parent PID: 6261

General

Start time (UTC):	12:28:22
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6345, Parent PID: 6344

General

Start time (UTC):	12:28:22
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6345, Parent PID: 6344

General

Start time (UTC):	12:28:22
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6348, Parent PID: 6261

General

Start time (UTC):	12:28:24
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6348, Parent PID: 6261

General

Start time (UTC):	12:28:24
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6349, Parent PID: 6348

General

Start time (UTC):	12:28:24
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6349, Parent PID: 6348

General

Start time (UTC):	12:28:24
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6350, Parent PID: 6261

General

Start time (UTC):	12:28:26
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6350, Parent PID: 6261

General

Start time (UTC):	12:28:26
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6351, Parent PID: 6350

General

Start time (UTC):	12:28:26
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6351, Parent PID: 6350

General

Start time (UTC):	12:28:26
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6352, Parent PID: 6261

General

Start time (UTC):	12:28:28
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6352, Parent PID: 6261

General

Start time (UTC):	12:28:28
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6353, Parent PID: 6352

General

Start time (UTC):	12:28:28
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6353, Parent PID: 6352

General

Start time (UTC):	12:28:28
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6356, Parent PID: 6261

General

Start time (UTC):	12:28:30
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6356, Parent PID: 6261

General

Start time (UTC):	12:28:30
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6357, Parent PID: 6356

General

Start time (UTC):	12:28:30
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6357, Parent PID: 6356

General

Start time (UTC):	12:28:30
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6358, Parent PID: 6261

General

Start time (UTC):	12:28:32
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6358, Parent PID: 6261

General

Start time (UTC):	12:28:32
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6359, Parent PID: 6358

General

Start time (UTC):	12:28:32
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6359, Parent PID: 6358

General

Start time (UTC):	12:28:32
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6362, Parent PID: 6261

General

Start time (UTC):	12:28:34
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6362, Parent PID: 6261

General

Start time (UTC):	12:28:34
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6363, Parent PID: 6362

General

Start time (UTC):	12:28:34
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6363, Parent PID: 6362

General

Start time (UTC):	12:28:34
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6365, Parent PID: 6261

General

Start time (UTC):	12:28:36
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6365, Parent PID: 6261

General

Start time (UTC):	12:28:36
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6366, Parent PID: 6365

General

Start time (UTC):	12:28:36
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6366, Parent PID: 6365

General

Start time (UTC):	12:28:36
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6369, Parent PID: 6261

General

Start time (UTC):	12:28:38
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6369, Parent PID: 6261

General

Start time (UTC):	12:28:38
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6370, Parent PID: 6369

General

Start time (UTC):	12:28:38
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6370, Parent PID: 6369

General

Start time (UTC):	12:28:38
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6371, Parent PID: 6261

General

Start time (UTC):	12:28:40
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6371, Parent PID: 6261

General

Start time (UTC):	12:28:40
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6372, Parent PID: 6371

General

Start time (UTC):	12:28:40
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6372, Parent PID: 6371

General

Start time (UTC):	12:28:40
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6373, Parent PID: 6261

General

Start time (UTC):	12:28:42
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6373, Parent PID: 6261

General

Start time (UTC):	12:28:42
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6374, Parent PID: 6373

General

Start time (UTC):	12:28:42
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6374, Parent PID: 6373

General

Start time (UTC):	12:28:42
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6377, Parent PID: 6261

General

Start time (UTC):	12:28:44
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6377, Parent PID: 6261

General

Start time (UTC):	12:28:44
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6378, Parent PID: 6377

General

Start time (UTC):	12:28:44
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6378, Parent PID: 6377

General

Start time (UTC):	12:28:44
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6379, Parent PID: 6261

General

Start time (UTC):	12:28:46
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6379, Parent PID: 6261

General

Start time (UTC):	12:28:46
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6380, Parent PID: 6379

General

Start time (UTC):	12:28:46
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6380, Parent PID: 6379

General

Start time (UTC):	12:28:46
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6383, Parent PID: 6261

General

Start time (UTC):	12:28:48
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6383, Parent PID: 6261

General

Start time (UTC):	12:28:48
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6384, Parent PID: 6383

General

Start time (UTC):	12:28:48
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6384, Parent PID: 6383

General

Start time (UTC):	12:28:48
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6385, Parent PID: 6261

General

Start time (UTC):	12:28:50
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6385, Parent PID: 6261

General

Start time (UTC):	12:28:50
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6386, Parent PID: 6385

General

Start time (UTC):	12:28:50
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6386, Parent PID: 6385

General

Start time (UTC):	12:28:50
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6387, Parent PID: 6261

General

Start time (UTC):	12:28:52
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6387, Parent PID: 6261

General

Start time (UTC):	12:28:52
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6388, Parent PID: 6387

General

Start time (UTC):	12:28:52
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6388, Parent PID: 6387

General

Start time (UTC):	12:28:52
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6393, Parent PID: 6261

General

Start time (UTC):	12:28:54
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6393, Parent PID: 6261

General

Start time (UTC):	12:28:54
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6394, Parent PID: 6393

General

Start time (UTC):	12:28:54
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6394, Parent PID: 6393

General

Start time (UTC):	12:28:54
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6395, Parent PID: 6261

General

Start time (UTC):	12:28:57
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6395, Parent PID: 6261

General

Start time (UTC):	12:28:57
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6396, Parent PID: 6395

General

Start time (UTC):	12:28:57
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6396, Parent PID: 6395

General

Start time (UTC):	12:28:57
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6399, Parent PID: 6261

General

Start time (UTC):	12:28:59
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6399, Parent PID: 6261

General

Start time (UTC):	12:28:59
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6400, Parent PID: 6399

General

Start time (UTC):	12:28:59
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6400, Parent PID: 6399

General

Start time (UTC):	12:28:59
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6401, Parent PID: 6261

General

Start time (UTC):	12:29:01
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6401, Parent PID: 6261

General

Start time (UTC):	12:29:01
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6402, Parent PID: 6401

General

Start time (UTC):	12:29:01
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6402, Parent PID: 6401

General

Start time (UTC):	12:29:01
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6403, Parent PID: 6261

General

Start time (UTC):	12:29:03
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6403, Parent PID: 6261

General

Start time (UTC):	12:29:03
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6404, Parent PID: 6403

General

Start time (UTC):	12:29:03
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6404, Parent PID: 6403

General

Start time (UTC):	12:29:03
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6407, Parent PID: 6261

General

Start time (UTC):	12:29:05
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6407, Parent PID: 6261

General

Start time (UTC):	12:29:05
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6408, Parent PID: 6407

General

Start time (UTC):	12:29:05
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6408, Parent PID: 6407

General

Start time (UTC):	12:29:05
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6410, Parent PID: 6261

General

Start time (UTC):	12:29:07
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6410, Parent PID: 6261

General

Start time (UTC):	12:29:07
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6411, Parent PID: 6410

General

Start time (UTC):	12:29:07
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6411, Parent PID: 6410

General

Start time (UTC):	12:29:07
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6414, Parent PID: 6261

General

Start time (UTC):	12:29:09
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6414, Parent PID: 6261

General

Start time (UTC):	12:29:09
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6415, Parent PID: 6414

General

Start time (UTC):	12:29:09
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6415, Parent PID: 6414

General

Start time (UTC):	12:29:09
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6416, Parent PID: 6261

General

Start time (UTC):	12:29:11
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6416, Parent PID: 6261

General

Start time (UTC):	12:29:11
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6417, Parent PID: 6416

General

Start time (UTC):	12:29:11
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6417, Parent PID: 6416

General

Start time (UTC):	12:29:11
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6420, Parent PID: 6261

General

Start time (UTC):	12:29:13
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6420, Parent PID: 6261

General

Start time (UTC):	12:29:13
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6421, Parent PID: 6420

General

Start time (UTC):	12:29:13
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6421, Parent PID: 6420

General

Start time (UTC):	12:29:13
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6422, Parent PID: 6261

General

Start time (UTC):	12:29:15
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6422, Parent PID: 6261

General

Start time (UTC):	12:29:15
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6423, Parent PID: 6422

General

Start time (UTC):	12:29:15
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6423, Parent PID: 6422

General

Start time (UTC):	12:29:15
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6424, Parent PID: 6261

General

Start time (UTC):	12:29:17
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6424, Parent PID: 6261

General

Start time (UTC):	12:29:17
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6425, Parent PID: 6424

General

Start time (UTC):	12:29:17
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6425, Parent PID: 6424

General

Start time (UTC):	12:29:17
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6428, Parent PID: 6261

General

Start time (UTC):	12:29:19
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6428, Parent PID: 6261

General

Start time (UTC):	12:29:19
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6429, Parent PID: 6428

General

Start time (UTC):	12:29:19
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6429, Parent PID: 6428

General

Start time (UTC):	12:29:19
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6430, Parent PID: 6261

General

Start time (UTC):	12:29:21
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6430, Parent PID: 6261

General

Start time (UTC):	12:29:21
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6431, Parent PID: 6430

General

Start time (UTC):	12:29:21
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6431, Parent PID: 6430

General

Start time (UTC):	12:29:21
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6434, Parent PID: 6261

General

Start time (UTC):	12:29:23
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6434, Parent PID: 6261

General

Start time (UTC):	12:29:23
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6435, Parent PID: 6434

General

Start time (UTC):	12:29:23
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6435, Parent PID: 6434

General

Start time (UTC):	12:29:23
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6436, Parent PID: 6261

General

Start time (UTC):	12:29:25
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6436, Parent PID: 6261

General

Start time (UTC):	12:29:25
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6437, Parent PID: 6436

General

Start time (UTC):	12:29:25
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6437, Parent PID: 6436

General

Start time (UTC):	12:29:25
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6438, Parent PID: 6261

General

Start time (UTC):	12:29:27
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6438, Parent PID: 6261

General

Start time (UTC):	12:29:27
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6439, Parent PID: 6438

General

Start time (UTC):	12:29:27
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6439, Parent PID: 6438

General

Start time (UTC):	12:29:27
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6442, Parent PID: 6261

General

Start time (UTC):	12:29:29
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6442, Parent PID: 6261

General

Start time (UTC):	12:29:29
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6443, Parent PID: 6442

General

Start time (UTC):	12:29:29
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6443, Parent PID: 6442

General

Start time (UTC):	12:29:29
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6445, Parent PID: 6261

General

Start time (UTC):	12:29:31
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6445, Parent PID: 6261

General

Start time (UTC):	12:29:31
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6446, Parent PID: 6445

General

Start time (UTC):	12:29:31
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6446, Parent PID: 6445

General

Start time (UTC):	12:29:31
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6449, Parent PID: 6261

General

Start time (UTC):	12:29:33
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6449, Parent PID: 6261

General

Start time (UTC):	12:29:33
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6450, Parent PID: 6449

General

Start time (UTC):	12:29:33
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6450, Parent PID: 6449

General

Start time (UTC):	12:29:33
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6451, Parent PID: 6261

General

Start time (UTC):	12:29:35
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6451, Parent PID: 6261

General

Start time (UTC):	12:29:35
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6452, Parent PID: 6451

General

Start time (UTC):	12:29:35
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6452, Parent PID: 6451

General

Start time (UTC):	12:29:35
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6454, Parent PID: 6261

General

Start time (UTC):	12:29:38
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6454, Parent PID: 6261

General

Start time (UTC):	12:29:38
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6455, Parent PID: 6454

General

Start time (UTC):	12:29:38
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6455, Parent PID: 6454

General

Start time (UTC):	12:29:38
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6458, Parent PID: 6261

General

Start time (UTC):	12:29:40
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6458, Parent PID: 6261

General

Start time (UTC):	12:29:40
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6459, Parent PID: 6458

General

Start time (UTC):	12:29:40
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6459, Parent PID: 6458

General

Start time (UTC):	12:29:40
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6460, Parent PID: 6261

General

Start time (UTC):	12:29:42
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6460, Parent PID: 6261

General

Start time (UTC):	12:29:42
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6461, Parent PID: 6460

General

Start time (UTC):	12:29:42
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6461, Parent PID: 6460

General

Start time (UTC):	12:29:42
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6464, Parent PID: 6261

General

Start time (UTC):	12:29:44
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6464, Parent PID: 6261

General

Start time (UTC):	12:29:44
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6465, Parent PID: 6464

General

Start time (UTC):	12:29:44
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6465, Parent PID: 6464

General

Start time (UTC):	12:29:44
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6466, Parent PID: 6261

General

Start time (UTC):	12:29:46
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6466, Parent PID: 6261

General

Start time (UTC):	12:29:46
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6467, Parent PID: 6466

General

Start time (UTC):	12:29:46
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6467, Parent PID: 6466

General

Start time (UTC):	12:29:46
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6468, Parent PID: 6261

General

Start time (UTC):	12:29:48
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6468, Parent PID: 6261

General

Start time (UTC):	12:29:48
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6469, Parent PID: 6468

General

Start time (UTC):	12:29:48
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6469, Parent PID: 6468

General

Start time (UTC):	12:29:48
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6472, Parent PID: 6261

General

Start time (UTC):	12:29:50
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6472, Parent PID: 6261

General

Start time (UTC):	12:29:50
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6473, Parent PID: 6472

General

Start time (UTC):	12:29:50
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6473, Parent PID: 6472

General

Start time (UTC):	12:29:50
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6474, Parent PID: 6261

General

Start time (UTC):	12:29:52
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6474, Parent PID: 6261

General

Start time (UTC):	12:29:52
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6475, Parent PID: 6474

General

Start time (UTC):	12:29:52
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6475, Parent PID: 6474

General

Start time (UTC):	12:29:52
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6480, Parent PID: 6261

General

Start time (UTC):	12:29:54
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6480, Parent PID: 6261

General

Start time (UTC):	12:29:54
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6481, Parent PID: 6480

General

Start time (UTC):	12:29:54
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6481, Parent PID: 6480

General

Start time (UTC):	12:29:54
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6482, Parent PID: 6261

General

Start time (UTC):	12:29:56
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6482, Parent PID: 6261

General

Start time (UTC):	12:29:56
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6483, Parent PID: 6482

General

Start time (UTC):	12:29:56
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6483, Parent PID: 6482

General

Start time (UTC):	12:29:56
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: 10000.elf PID: 6491, Parent PID: 6261

General

Start time (UTC):	12:29:58
Start date (UTC):	29/12/2024
Path:	/tmp/10000.elf
Arguments:	-
File size:	896872 bytes
MD5 hash:	5beba5cbe11be5fe0c7e8181d5fad806

Chronological Activities

Analysis Process: sh PID: 6491, Parent PID: 6261

General

Start time (UTC):	12:29:58
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	sh -c "ip route show default"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6492, Parent PID: 6491

General

Start time (UTC):	12:29:58
Start date (UTC):	29/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ip PID: 6492, Parent PID: 6491

General

Start time (UTC):	12:29:58
Start date (UTC):	29/12/2024
Path:	/usr/sbin/ip
Arguments:	ip route show default
File size:	611960 bytes
MD5 hash:	cd92bd28c8337a4dc4e8b3433befe7e2

Chronological Activities

Analysis Process: udisksd PID: 6273, Parent PID: 799

General

Start time (UTC):	12:27:53
Start date (UTC):	29/12/2024
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Chronological Activities

Analysis Process: dumpe2fs PID: 6273, Parent PID: 799

General

Start time (UTC):	12:27:54
Start date (UTC):	29/12/2024
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 10000.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/tmp/.loc

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 6222, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6222, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6223, Parent PID: 4331

General

Chronological Activities

Analysis Process: cat PID: 6223, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6224, Parent PID: 4331

General

Chronological Activities

Analysis Process: head PID: 6224, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6225, Parent PID: 4331

General

Chronological Activities

Linux Analysis Report
10000.elf