Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
lx64.elf

Overview

General Information

Sample name:lx64.elf
Analysis ID:1583050
MD5:34b5120c479bebe5c7ae0a6be4395976
SHA1:006e08ddede50718e9e630a29b74a35f9c277aff
SHA256:3fbea0c84de4cd5fb1d79955e69c3e52d5a8b37aba329fe58ff382a3f1e0e53b
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing)
Detected TCP or UDP traffic on non-standard ports
Reads CPU information from /sys indicative of miner or evasive malware
Reads the 'hosts' file potentially containing internal network hosts
Sleeps for long times indicative of sandbox evasion
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1583050
Start date and time:2025-01-01 17:31:06 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 45s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:lx64.elf
Detection:MAL
Classification:mal60.linELF@0/0@1/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample

Warnings

  • Max analysis timeout: 600s exceeded, the analysis took too long
  • VT rate limit hit for: zzz.hnyzh.co

Runtime Messages

Command:/tmp/lx64.elf
PID:6238
Exit Code:
Exit Code Info:
Killed:True
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • lx64.elf (PID: 6238, Parent: 6165, MD5: 34b5120c479bebe5c7ae0a6be4395976) Arguments: /tmp/lx64.elf
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
lx64.elfLinux_Hacktool_Flooder_8b63ff02unknownunknown
  • 0x137a:$a: DC 02 83 7D DC 01 0F 9F C0 84 C0 75 DF 83 7D DC 01 75 1D 66 C7 45 F6
lx64.elfLinux_Hacktool_Flooder_9417f77bunknownunknown
  • 0x13a0:$a: 0F B7 45 F6 0F B7 C0 48 01 C3 48 89 DA 48 C1 FA 10 0F B7 C3 48 8D
lx64.elfLinux_Trojan_Tsunami_36a98405unknownunknown
  • 0x18e8:$a: 05 88 85 50 FF FF FF 0F B6 85 50 FF FF FF 83 E0 0F 83 C8 40 88 85 50 FF
  • 0x2fee:$a: 05 88 85 50 FF FF FF 0F B6 85 50 FF FF FF 83 E0 0F 83 C8 40 88 85 50 FF
lx64.elfCN_disclosed_20180208_lslsDetects malware from disclosed CN malware setFlorian Roth
  • 0x5ac0:$x1: User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Memory Dumps

SourceRuleDescriptionAuthorStrings
6238.1.0000000000400000.0000000000407000.r-x.sdmpLinux_Hacktool_Flooder_8b63ff02unknownunknown
  • 0x137a:$a: DC 02 83 7D DC 01 0F 9F C0 84 C0 75 DF 83 7D DC 01 75 1D 66 C7 45 F6
6238.1.0000000000400000.0000000000407000.r-x.sdmpLinux_Hacktool_Flooder_9417f77bunknownunknown
  • 0x13a0:$a: 0F B7 45 F6 0F B7 C0 48 01 C3 48 89 DA 48 C1 FA 10 0F B7 C3 48 8D
6238.1.0000000000400000.0000000000407000.r-x.sdmpLinux_Trojan_Tsunami_36a98405unknownunknown
  • 0x18e8:$a: 05 88 85 50 FF FF FF 0F B6 85 50 FF FF FF 83 E0 0F 83 C8 40 88 85 50 FF
  • 0x2fee:$a: 05 88 85 50 FF FF FF 0F B6 85 50 FF FF FF 83 E0 0F 83 C8 40 88 85 50 FF
6238.1.0000000000400000.0000000000407000.r-x.sdmpCN_disclosed_20180208_lslsDetects malware from disclosed CN malware setFlorian Roth
  • 0x5ac0:$x1: User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: lx64.elfVirustotal: Detection: 55%Perma Link
Source: lx64.elfReversingLabs: Detection: 60%
Machine Learning detection for sample
Source: lx64.elfJoe Sandbox ML: detected
Source: /tmp/lx64.elf (PID: 6238)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
Source: global trafficTCP traffic: 192.168.2.23:49858 -> 205.185.126.56:5388
Source: /tmp/lx64.elf (PID: 6238)Reads hosts file: /etc/hostsJump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: zzz.hnyzh.co
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: lx64.elf, type: SAMPLEMatched rule: Linux_Hacktool_Flooder_8b63ff02 Author: unknown
Source: lx64.elf, type: SAMPLEMatched rule: Linux_Hacktool_Flooder_9417f77b Author: unknown
Source: lx64.elf, type: SAMPLEMatched rule: Linux_Trojan_Tsunami_36a98405 Author: unknown
Source: lx64.elf, type: SAMPLEMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 6238.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Flooder_8b63ff02 Author: unknown
Source: 6238.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Flooder_9417f77b Author: unknown
Source: 6238.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Tsunami_36a98405 Author: unknown
Source: 6238.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORYMatched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: lx64.elf, type: SAMPLEMatched rule: Linux_Hacktool_Flooder_8b63ff02 reference_sample = a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Hacktool.Flooder, fingerprint = af7a4df7e707c1b70fb2b29efe2492e6f77cdde5e8d1e6bfdf141acabc8759eb, id = 8b63ff02-be86-4c63-8f7b-4c70fbd8a83a, last_modified = 2021-09-16
Source: lx64.elf, type: SAMPLEMatched rule: Linux_Hacktool_Flooder_9417f77b severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 60ff13e27dad5e6eadb04011aa653a15e1a07200b6630fdd0d0d72a9ba797d68, license = Elastic License v2, threat_name = Linux.Hacktool.Flooder, fingerprint = d321ea7aeb293f8f50236bddeee99802225b70e8695bb3527a89beea51e3ffb3, id = 9417f77b-190b-4834-b57a-08a7cbfac884, last_modified = 2022-01-26
Source: lx64.elf, type: SAMPLEMatched rule: Linux_Trojan_Tsunami_36a98405 reference_sample = a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = c76ca23eece4c2d4ec6656ffb40d6e6ea7777d8a904f4775913fe60ebd606cd6, id = 36a98405-8b95-49cb-98c5-df4a445d9d39, last_modified = 2021-09-16
Source: lx64.elf, type: SAMPLEMatched rule: CN_disclosed_20180208_lsls date = 2018-02-08, hash1 = 94c6a92984df9ed255f4c644261b01c4e255acbe32ddfd0debe38b558f29a6c9, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6238.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Flooder_8b63ff02 reference_sample = a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Hacktool.Flooder, fingerprint = af7a4df7e707c1b70fb2b29efe2492e6f77cdde5e8d1e6bfdf141acabc8759eb, id = 8b63ff02-be86-4c63-8f7b-4c70fbd8a83a, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Flooder_9417f77b severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 60ff13e27dad5e6eadb04011aa653a15e1a07200b6630fdd0d0d72a9ba797d68, license = Elastic License v2, threat_name = Linux.Hacktool.Flooder, fingerprint = d321ea7aeb293f8f50236bddeee99802225b70e8695bb3527a89beea51e3ffb3, id = 9417f77b-190b-4834-b57a-08a7cbfac884, last_modified = 2022-01-26
Source: 6238.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Tsunami_36a98405 reference_sample = a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = c76ca23eece4c2d4ec6656ffb40d6e6ea7777d8a904f4775913fe60ebd606cd6, id = 36a98405-8b95-49cb-98c5-df4a445d9d39, last_modified = 2021-09-16
Source: 6238.1.0000000000400000.0000000000407000.r-x.sdmp, type: MEMORYMatched rule: CN_disclosed_20180208_lsls date = 2018-02-08, hash1 = 94c6a92984df9ed255f4c644261b01c4e255acbe32ddfd0debe38b558f29a6c9, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: classification engineClassification label: mal60.linELF@0/0@1/0
Source: ELF symbol in initial sampleSymbol name: sleep
Source: ELF symbol in initial sampleSymbol name: usleep
Source: /tmp/lx64.elf (PID: 6238)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
Source: /tmp/lx64.elf (PID: 6238)Sleeps longer then 60s: 480.0sJump to behavior
Source: /tmp/lx64.elf (PID: 6238)Queries kernel information via 'uname': Jump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception2
Virtualization/Sandbox Evasion		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory2
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable Media1
Non-Standard Port		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager1
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDS1
System Information Discovery		Distributed Component Object ModelInput Capture2
Application Layer Protocol		Traffic DuplicationData Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
lx64.elf56%VirustotalBrowse
lx64.elf61%ReversingLabsWin32.Trojan.Generic
lx64.elf100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
zzz.hnyzh.co
205.185.126.56
truefalse
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    109.202.202.202
    		unknownSwitzerland
    		13030INIT7CHfalse
    205.185.126.56
    		zzz.hnyzh.coUnited States
    		53667PONYNETUSfalse
    91.189.91.43
    		unknownUnited Kingdom
    		41231CANONICAL-ASGBfalse
    91.189.91.42
    		unknownUnited Kingdom
    		41231CANONICAL-ASGBfalse

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
    • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
    91.189.91.43arm.elfGet hashmaliciousUnknownBrowse
      mips.elfGet hashmaliciousUnknownBrowse
        arm6.elfGet hashmaliciousUnknownBrowse
          bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
            185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
              B_Y_T_E_x86.elfGet hashmaliciousMirai, OkiruBrowse
                i.elfGet hashmaliciousUnknownBrowse
                  main_x86_64.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                    89.250.72.36-sparc-2024-12-31T13_33_10.elfGet hashmaliciousGafgytBrowse
                      i.elfGet hashmaliciousUnknownBrowse
                        91.189.91.42arm.elfGet hashmaliciousUnknownBrowse
                          mips.elfGet hashmaliciousUnknownBrowse
                            arm6.elfGet hashmaliciousUnknownBrowse
                              bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                  B_Y_T_E_x86.elfGet hashmaliciousMirai, OkiruBrowse
                                    i.elfGet hashmaliciousUnknownBrowse
                                      main_x86_64.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                                        89.250.72.36-sparc-2024-12-31T13_33_10.elfGet hashmaliciousGafgytBrowse
                                          i.elfGet hashmaliciousUnknownBrowse

                                            Domains

                                            ⊘No context

                                            ASNs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            CANONICAL-ASGBarm.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            mips.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            arm6.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                            • 91.189.91.42
                                            185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                            • 91.189.91.42
                                            B_Y_T_E_x86.elfGet hashmaliciousMirai, OkiruBrowse
                                            • 91.189.91.42
                                            i.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            main_x86_64.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                                            • 91.189.91.42
                                            89.250.72.36-sparc-2024-12-31T13_33_10.elfGet hashmaliciousGafgytBrowse
                                            • 91.189.91.42
                                            i.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            CANONICAL-ASGBarm.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            mips.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            arm6.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                            • 91.189.91.42
                                            185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                            • 91.189.91.42
                                            B_Y_T_E_x86.elfGet hashmaliciousMirai, OkiruBrowse
                                            • 91.189.91.42
                                            i.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            main_x86_64.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                                            • 91.189.91.42
                                            89.250.72.36-sparc-2024-12-31T13_33_10.elfGet hashmaliciousGafgytBrowse
                                            • 91.189.91.42
                                            i.elfGet hashmaliciousUnknownBrowse
                                            • 91.189.91.42
                                            INIT7CHarm.elfGet hashmaliciousUnknownBrowse
                                            • 109.202.202.202
                                            mips.elfGet hashmaliciousUnknownBrowse
                                            • 109.202.202.202
                                            arm6.elfGet hashmaliciousUnknownBrowse
                                            • 109.202.202.202
                                            bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                            • 109.202.202.202
                                            185.232.205.48-bot.mpsl-2025-01-01T09_56_39.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                            • 109.202.202.202
                                            B_Y_T_E_x86.elfGet hashmaliciousMirai, OkiruBrowse
                                            • 109.202.202.202
                                            i.elfGet hashmaliciousUnknownBrowse
                                            • 109.202.202.202
                                            main_x86_64.elfGet hashmaliciousGafgyt, Mirai, OkiruBrowse
                                            • 109.202.202.202
                                            89.250.72.36-sparc-2024-12-31T13_33_10.elfGet hashmaliciousGafgytBrowse
                                            • 109.202.202.202
                                            i.elfGet hashmaliciousUnknownBrowse
                                            • 109.202.202.202
                                            PONYNETUShttps://u48917305.ct.sendgrid.net/ls/click?upn=u001.ztQPJiWtq2gO8V-2Ftd7SxY9UCAq3VScTPSloeIw5UEMPd6e3nbPRvJ98moPTqmrdQ1eNbvwZHJ-2BEb4HrooVFNCTltmXW6SgRONKSmPzdFoWfDQT97cczFZ0vj7M2xBd2izDTi-2BL-2BoVqB8yVzV2GW7vOPvy3s9yVghrOS5vs-2BSnWyzJMkXQxVEReq4oLCDet7QAOvo_JkpSD-2Bg6VoLAQppUKMb-2BxDh4v4nbOeQFT31aoN-2FLkhvFCzY6wdlGM7RTNIi47OKR1tTaghG8tTKssArDNPSXAfX9wO6nsZ2FHn-2FunyaOti-2FaII-2FnbKYDXJOImW-2Bs9f4tYnWj8rqO7L0kp4KNRHBDo0iHoL8DEOGc8GMtzqzsIqERel6-2FxJyY4DBnsnUTOc2I4HCPKA6lxcCEXMtxEA1-2FnQ-3D-3DGet hashmaliciousHTMLPhisherBrowse
                                            • 198.251.89.144
                                            arm6.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 209.141.47.117
                                            JkICQ13OOY.dllGet hashmaliciousUnknownBrowse
                                            • 107.189.14.43
                                            JkICQ13OOY.dllGet hashmaliciousUnknownBrowse
                                            • 104.244.76.24
                                            Clienter.dll.dllGet hashmaliciousUnknownBrowse
                                            • 107.189.1.9
                                            SC_TR11670000_pdf.exeGet hashmaliciousFormBookBrowse
                                            • 198.251.84.200
                                            vpn.exeGet hashmaliciousMetasploitBrowse
                                            • 209.141.35.225
                                            jew.sh4.elfGet hashmaliciousUnknownBrowse
                                            • 144.172.104.27
                                            MGj3hwACvs.htmlGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
                                            • 104.194.152.148
                                            http://papyrefb2tdk6czd.onion.lyGet hashmaliciousUnknownBrowse
                                            • 198.251.88.129

                                            JA3 Fingerprints

                                            ⊘No context

                                            Dropped Files

                                            ⊘No context

                                            Created / dropped Files

                                            ⊘No created / dropped files found

                                            Static File Info

                                            General

                                            File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=9031f633fefc14b45340d1c56aed061a4cd1c65d, not stripped
                                            Entropy (8bit):5.326251783507403
                                            TrID:
                                            • ELF Executable and Linkable format (Linux) (4029/14) 49.77%
                                            • ELF Executable and Linkable format (generic) (4004/1) 49.46%
                                            • Lumena CEL bitmap (63/63) 0.78%
                                            File name:lx64.elf
                                            File size:35'137 bytes
                                            MD5:34b5120c479bebe5c7ae0a6be4395976
                                            SHA1:006e08ddede50718e9e630a29b74a35f9c277aff
                                            SHA256:3fbea0c84de4cd5fb1d79955e69c3e52d5a8b37aba329fe58ff382a3f1e0e53b
                                            SHA512:c3d292c66bcadf1d17b4f0fb3b80bed63849b0511ec287c5538030b7cdce1cc123e294b419a199b654c5560ff9b3cfec2d5cbcfc3689f41b20f93a8151c50cb3
                                            SSDEEP:384:Xhvwal0MRWiEHoEn5BJIloF2N2WHunOGmubIbY5eXdhlopXC7lIPW8zoSC8JWCz0:xIaYv4HNxuODx71D27Pl1s+c21on
                                            TLSH:9BF2D513A695E539C442E2301EFF462544A3B0F54B32735B7B21B66AB871ACC0F2DA5B
                                            File Content Preview:.ELF..............>.....0.@.....@.......Pj..........@.8...@.............@.......@.@.....@.@...............................................@.......@...............................................@.......@......b.......b........ ..............b.......b`....

                                            Static ELF Info

                                            ELF header

                                            Class:ELF64
                                            Data:2's complement, little endian
                                            Version:1 (current)
                                            Machine:Advanced Micro Devices X86-64
                                            Version Number:0x1
                                            Type:EXEC (Executable file)
                                            OS/ABI:UNIX - System V
                                            ABI Version:0
                                            Entry Point Address:0x401230
                                            Flags:0x0
                                            ELF Header Size:64
                                            Program Header Offset:64
                                            Program Header Size:56
                                            Number of Program Headers:8
                                            Section Header Offset:27216
                                            Section Header Size:64
                                            Number of Section Headers:30
                                            Header String Table Index:27

                                            Sections

                                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                            NULL0x00x00x00x00x0000
                                            .interpPROGBITS0x4002000x2000x1c0x00x2A001
                                            .note.ABI-tagNOTE0x40021c0x21c0x200x00x2A004
                                            .note.gnu.build-idNOTE0x40023c0x23c0x240x00x2A004
                                            .gnu.hashGNU_HASH0x4002600x2600x280x00x2A508
                                            .dynsymDYNSYM0x4002880x2880x4e00x180x2A618
                                            .dynstrSTRTAB0x4007680x7680x2100x00x2A001
                                            .gnu.versionVERSYM0x4009780x9780x680x20x2A502
                                            .gnu.version_rVERNEED0x4009e00x9e00x700x00x2A638
                                            .rela.dynRELA0x400a500xa500x300x180x2A508
                                            .rela.pltRELA0x400a800xa800x4800x180x2A5128
                                            .initPROGBITS0x400f000xf000x180x00x6AX004
                                            .pltPROGBITS0x400f180xf180x3100x100x6AX004
                                            .textPROGBITS0x4012300x12300x47b80x00x6AX0016
                                            .finiPROGBITS0x4059e80x59e80xe0x00x6AX004
                                            .rodataPROGBITS0x4059f80x59f80x28d0x00x2A008
                                            .eh_frame_hdrPROGBITS0x405c880x5c880x1340x00x2A004
                                            .eh_framePROGBITS0x405dc00x5dc00x5240x00x2A008
                                            .ctorsPROGBITS0x6062e80x62e80x100x00x3WA008
                                            .dtorsPROGBITS0x6062f80x62f80x100x00x3WA008
                                            .jcrPROGBITS0x6063080x63080x80x00x3WA008
                                            .dynamicDYNAMIC0x6063100x63100x1d00x100x3WA608
                                            .gotPROGBITS0x6064e00x64e00x80x80x3WA008
                                            .got.pltPROGBITS0x6064e80x64e80x1980x80x3WA008
                                            .dataPROGBITS0x6066800x66800x2780x00x3WA0032
                                            .bssNOBITS0x6069000x68f80x800580x00x3WA0032
                                            .commentPROGBITS0x00x68f80x590x10x30MS001
                                            .shstrtabSTRTAB0x00x69510xfe0x00x0001
                                            .symtabSYMTAB0x00x71d00xeb80x180x029478
                                            .strtabSTRTAB0x00x80880x8b90x00x0001

                                            Program Segments

                                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                            PHDR0x400x4000400x4000400x1c00x1c01.75030x5R E0x8
                                            INTERP0x2000x4002000x4002000x1c0x1c3.94080x4R 0x1/lib64/ld-linux-x86-64.so.2.interp
                                            LOAD0x00x4000000x4000000x62e40x62e45.67520x5R E0x200000.interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
                                            LOAD0x62e80x6062e80x6062e80x6100x806701.50120x6RW 0x200000.ctors .dtors .jcr .dynamic .got .got.plt .data .bss
                                            DYNAMIC0x63100x6063100x6063100x1d00x1d01.47220x6RW 0x8.dynamic
                                            NOTE0x21c0x40021c0x40021c0x440x443.43360x4R 0x4.note.ABI-tag .note.gnu.build-id
                                            GNU_EH_FRAME0x5c880x405c880x405c880x1340x1344.39600x4R 0x4.eh_frame_hdr
                                            GNU_STACK0x00x00x00x00x00.00000x6RW 0x8

                                            Dynamic Tags

                                            TypeMetaValueTag
                                            DT_NEEDEDsharedliblibpthread.so.00x1
                                            DT_NEEDEDsharedliblibstdc++.so.60x1
                                            DT_NEEDEDsharedliblibm.so.60x1
                                            DT_NEEDEDsharedliblibgcc_s.so.10x1
                                            DT_NEEDEDsharedliblibc.so.60x1
                                            DT_INITvalue0x400f000xc
                                            DT_FINIvalue0x4059e80xd
                                            DT_GNU_HASHvalue0x4002600x6ffffef5
                                            DT_STRTABvalue0x4007680x5
                                            DT_SYMTABvalue0x4002880x6
                                            DT_STRSZbytes5280xa
                                            DT_SYMENTbytes240xb
                                            DT_DEBUGvalue0x00x15
                                            DT_PLTGOTvalue0x6064e80x3
                                            DT_PLTRELSZbytes11520x2
                                            DT_PLTRELpltrelDT_RELA0x14
                                            DT_JMPRELvalue0x400a800x17
                                            DT_RELAvalue0x400a500x7
                                            DT_RELASZbytes480x8
                                            DT_RELAENTbytes240x9
                                            DT_VERNEEDvalue0x4009e00x6ffffffe
                                            DT_VERNEEDNUMvalue30x6fffffff
                                            DT_VERSYMvalue0x4009780x6ffffff0
                                            DT_NULLvalue0x00x0

                                            Symbols

                                            NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                            .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                            _Jv_RegisterClasses.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                            _ZdaPvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            _ZnamGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            __errno_locationGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            __gmon_start__.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                            __gxx_personality_v0CXXABI_1.3libstdc++.so.6.dynsym0x4011e80FUNC<unknown>DEFAULTSHN_UNDEF
                                            __libc_start_mainGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            bcopyGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            bzeroGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            closeGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            connectGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            exitGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            fcntlGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            fwriteGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            gethostbynameGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            getpidGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            getsockoptGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            gettimeofdayGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            htonsGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            if_nameindexGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            inet_addrGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            ioctlGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            memcpyGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            memsetGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            perrorGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            printfGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            pthread_createGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            pthread_exitGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            pthread_joinGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            randGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            randomGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            recvGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            selectGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            sendGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            sendtoGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            setsockoptGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            signalGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            sleepGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            snprintfGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            socketGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            srandGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            stderrGLIBC_2.2.5libc.so.6.dynsym0x6069008OBJECT<unknown>DEFAULT25
                                            strcpyGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            strerrorGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            strlenGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            strncpyGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            sysconfGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            systemGLIBC_2.2.5libpthread.so.0.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            timeGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            unameGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            usleepGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                            GLIBC_2.2.5libc.so.6.symtab0x4002000SECTION<unknown>DEFAULT1
                                            GLIBC_2.2.5libc.so.6.symtab0x40021c0SECTION<unknown>DEFAULT2
                                            GLIBC_2.2.5libc.so.6.symtab0x40023c0SECTION<unknown>DEFAULT3
                                            GLIBC_2.2.5libpthread.so.0.symtab0x4002600SECTION<unknown>DEFAULT4
                                            GLIBC_2.2.5libc.so.6.symtab0x4002880SECTION<unknown>DEFAULT5
                                            GLIBC_2.2.5libc.so.6.symtab0x4007680SECTION<unknown>DEFAULT6
                                            .symtab0x4009780SECTION<unknown>DEFAULT7
                                            .symtab0x4009e00SECTION<unknown>DEFAULT8
                                            GLIBCXX_3.4libstdc++.so.6.symtab0x400a500SECTION<unknown>DEFAULT9
                                            GLIBC_2.2.5libc.so.6.symtab0x400a800SECTION<unknown>DEFAULT10
                                            GLIBC_2.2.5libc.so.6.symtab0x400f000SECTION<unknown>DEFAULT11
                                            GLIBC_2.2.5libc.so.6.symtab0x400f180SECTION<unknown>DEFAULT12
                                            GLIBC_2.2.5libc.so.6.symtab0x4012300SECTION<unknown>DEFAULT13
                                            GLIBC_2.2.5libc.so.6.symtab0x4059e80SECTION<unknown>DEFAULT14
                                            GLIBC_2.2.5libc.so.6.symtab0x4059f80SECTION<unknown>DEFAULT15
                                            GLIBC_2.2.5libpthread.so.0.symtab0x405c880SECTION<unknown>DEFAULT16
                                            GLIBC_2.2.5libpthread.so.0.symtab0x405dc00SECTION<unknown>DEFAULT17
                                            GLIBC_2.2.5libc.so.6.symtab0x6062e80SECTION<unknown>DEFAULT18
                                            GLIBC_2.2.5libc.so.6.symtab0x6062f80SECTION<unknown>DEFAULT19
                                            GLIBC_2.2.5libc.so.6.symtab0x6063080SECTION<unknown>DEFAULT20
                                            GLIBC_2.2.5libc.so.6.symtab0x6063100SECTION<unknown>DEFAULT21
                                            GLIBC_2.2.5libc.so.6.symtab0x6064e00SECTION<unknown>DEFAULT22
                                            GLIBC_2.2.5libpthread.so.0.symtab0x6064e80SECTION<unknown>DEFAULT23
                                            GLIBC_2.2.5libc.so.6.symtab0x6066800SECTION<unknown>DEFAULT24
                                            GLIBC_2.2.5libc.so.6.symtab0x6069000SECTION<unknown>DEFAULT25
                                            GLIBC_2.2.5libpthread.so.0.symtab0x00SECTION<unknown>DEFAULT26
                                            Admin_MainSocket.symtab0x60692c4OBJECT<unknown>DEFAULT25
                                            CpuSpeed.symtab0x6869388OBJECT<unknown>DEFAULT25
                                            MainSocket.symtab0x6069284OBJECT<unknown>DEFAULT25
                                            NetSpeed.symtab0x6869408OBJECT<unknown>DEFAULT25
                                            SendSpeed.symtab0x6869488OBJECT<unknown>DEFAULT25
                                            StopFlag.symtab0x6066a04OBJECT<unknown>DEFAULT24
                                            StopFlag2.symtab0x6066a44OBJECT<unknown>DEFAULT24
                                            _DYNAMICGLIBC_2.2.5libc.so.6.symtab0x6063100OBJECT<unknown>DEFAULT21
                                            _GLOBAL_OFFSET_TABLE_GLIBC_2.2.5libpthread.so.0.symtab0x6064e80OBJECT<unknown>DEFAULT23
                                            _IO_stdin_used.symtab0x4059f84OBJECT<unknown>DEFAULT15
                                            _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                            _Z10DNS_Flood2Pv.symtab0x402c79599FUNC<unknown>DEFAULT13
                                            _Z10FAST_FloodPv.symtab0x4029c6691FUNC<unknown>DEFAULT13
                                            _Z10GET_Flood2Pv.symtab0x403728949FUNC<unknown>DEFAULT13
                                            _Z10ICMP_FloodPv.symtab0x401df5295FUNC<unknown>DEFAULT13
                                            _Z10POST_FloodPv.symtab0x4023d7949FUNC<unknown>DEFAULT13
                                            _Z10SYN_Flood2Pv.symtab0x402ed01579FUNC<unknown>DEFAULT13
                                            _Z10SetDNSHeadPcS_i.symtab0x401487236FUNC<unknown>DEFAULT13
                                            _Z10TCP_Flood2Pv.symtab0x403e92570FUNC<unknown>DEFAULT13
                                            _Z10UDP_Flood2Pv.symtab0x403622262FUNC<unknown>DEFAULT13
                                            _Z11FAST_Flood2PvCXXABI_1.3libstdc++.so.6.symtab0x4040cc691FUNC<unknown>DEFAULT13
                                            _Z11ICMP_Flood2Pv.symtab0x4034fb295FUNC<unknown>DEFAULT13
                                            _Z11POST_Flood2Pv.symtab0x403add949FUNC<unknown>DEFAULT13
                                            _Z12CreateTimeerPvGLIBC_2.2.5libc.so.6.symtab0x404487119FUNC<unknown>DEFAULT13
                                            _Z12DealwithDDoSP8_MSGHEAD.symtab0x4044fe709FUNC<unknown>DEFAULT13
                                            _Z13CreateAutoRunvGLIBC_2.2.5libc.so.6.symtab0x4057da6FUNC<unknown>DEFAULT13
                                            _Z14_ConnectServerv.symtab0x404f841018FUNC<unknown>DEFAULT13
                                            _Z15AnalysisAddressPc.symtab0x40131463FUNC<unknown>DEFAULT13
                                            _Z15TurnonKeepAliveij.symtab0x404ea4224FUNC<unknown>DEFAULT13
                                            _Z16ServerConnectCliv.symtab0x404d3e151FUNC<unknown>DEFAULT13
                                            _Z18Admin_DealwithDDoSP8_MSGHEAD.symtab0x4047c3709FUNC<unknown>DEFAULT13
                                            _Z19Admin_ConnectServerPv.symtab0x40537e1025FUNC<unknown>DEFAULT13
                                            _Z22Admin_ServerConnectCliv.symtab0x404dd5207FUNC<unknown>DEFAULT13
                                            _Z6ChNamePcS_.symtab0x4013cd186FUNC<unknown>DEFAULT13
                                            _Z6F_MainPv.symtab0x40577f91FUNC<unknown>DEFAULT13
                                            _Z6strrevPc.symtab0x40437f121FUNC<unknown>DEFAULT13
                                            _Z8CheckSumPti.symtab0x401353122FUNC<unknown>DEFAULT13
                                            _Z8CmdShellPvGLIBC_2.2.5libc.so.6.symtab0x4043f8143FUNC<unknown>DEFAULT13
                                            _Z9DNS_FloodPv.symtab0x401573599FUNC<unknown>DEFAULT13
                                            _Z9GET_FloodPv.symtab0x402022949FUNC<unknown>DEFAULT13
                                            _Z9SYN_FloodPv.symtab0x4017ca1579FUNC<unknown>DEFAULT13
                                            _Z9TCP_FloodPv.symtab0x40278c570FUNC<unknown>DEFAULT13
                                            _Z9UDP_FloodPv.symtab0x401f1c262FUNC<unknown>DEFAULT13
                                            _Z9myconnectiP8sockaddrji.symtab0x404aa7663FUNC<unknown>DEFAULT13
                                            _ZL5rdtscvGLIBC_2.2.5libc.so.6.symtab0x404a8831FUNC<unknown>DEFAULT13
                                            _ZdaPv@@GLIBCXX_3.4.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            _Znam@@GLIBCXX_3.4.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            __CTOR_END__GLIBC_2.2.5libpthread.so.0.symtab0x6062f00OBJECT<unknown>DEFAULT18
                                            __CTOR_LIST__GLIBC_2.2.5libpthread.so.0.symtab0x6062e80OBJECT<unknown>DEFAULT18
                                            __DTOR_END__.symtab0x6063000OBJECT<unknown>HIDDEN19
                                            __DTOR_LIST__GLIBC_2.2.5libc.so.6.symtab0x6062f80OBJECT<unknown>DEFAULT19
                                            __FRAME_END__GLIBC_2.2.5libc.so.6.symtab0x4062e00OBJECT<unknown>DEFAULT17
                                            __JCR_END__GLIBC_2.2.5libc.so.6.symtab0x6063080OBJECT<unknown>DEFAULT20
                                            __JCR_LIST__GLIBC_2.2.5libc.so.6.symtab0x6063080OBJECT<unknown>DEFAULT20
                                            __bss_start.symtab0x6068f80NOTYPE<unknown>DEFAULTSHN_ABS
                                            __data_start.symtab0x6066800NOTYPE<unknown>DEFAULT24
                                            __do_global_ctors_auxGLIBCXX_3.4libstdc++.so.6.symtab0x4059b00FUNC<unknown>DEFAULT13
                                            __do_global_dtors_auxGLIBC_2.2.5libpthread.so.0.symtab0x4012800FUNC<unknown>DEFAULT13
                                            __dso_handle.symtab0x405a000OBJECT<unknown>HIDDEN15
                                            __errno_location@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            __gmon_start__.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                            __gxx_personality_v0@@CXXABI_1.3.symtab0x4011e80FUNC<unknown>DEFAULTSHN_UNDEF
                                            __init_array_endGLIBC_2.2.5libc.so.6.symtab0x6062e40NOTYPE<unknown>DEFAULT18
                                            __init_array_startGLIBC_2.2.5libc.so.6.symtab0x6062e40NOTYPE<unknown>DEFAULT18
                                            __libc_csu_fini.symtab0x4059102FUNC<unknown>DEFAULT13
                                            __libc_csu_init.symtab0x405920137FUNC<unknown>DEFAULT13
                                            __libc_start_main@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            _edata.symtab0x6068f80NOTYPE<unknown>DEFAULTSHN_ABS
                                            _end.symtab0x6869580NOTYPE<unknown>DEFAULTSHN_ABS
                                            _fini.symtab0x4059e80FUNC<unknown>DEFAULT14
                                            _init.symtab0x400f000FUNC<unknown>DEFAULT11
                                            _start.symtab0x4012300FUNC<unknown>DEFAULT13
                                            bcopy@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            bzero@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            call_gmon_startGLIBC_2.2.5libc.so.6.symtab0x40125c0FUNC<unknown>DEFAULT13
                                            close@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            completed.6352GLIBC_2.2.5libc.so.6.symtab0x6069081OBJECT<unknown>DEFAULT25
                                            connect@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            crtstuff.cGLIBC_2.2.5libc.so.6.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                            crtstuff.cGLIBC_2.2.5libpthread.so.0.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                            data_startGLIBC_2.2.5libpthread.so.0.symtab0x6066800NOTYPE<unknown>DEFAULT24
                                            dtor_idx.6354GLIBC_2.2.5libc.so.6.symtab0x6069108OBJECT<unknown>DEFAULT25
                                            exit@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            fcntl@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            frame_dummyGLIBC_2.2.5libc.so.6.symtab0x4012f00FUNC<unknown>DEFAULT13
                                            fwrite@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            gethostbyname@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            getpid@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            getsockopt@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            gettimeofday@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            htons@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            id.symtab0x606940524280OBJECT<unknown>DEFAULT25
                                            if_nameindex@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            inet_addr@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            ioctl@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            linux_data.symtab0x6066c0568OBJECT<unknown>DEFAULT24
                                            main.symtab0x4057e0293FUNC<unknown>DEFAULT13
                                            main.cppGLIBC_2.2.5libc.so.6.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                            memcpy@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            memset@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            netuse.symtab0x6869544OBJECT<unknown>DEFAULT25
                                            perror@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            printf@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            pthread_create@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            pthread_exit@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            pthread_join@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            rand@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            random@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            recv@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            select@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            send@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            sendto@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            setsockopt@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            signal@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            sin.symtab0x6069208OBJECT<unknown>DEFAULT25
                                            sleep@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            snprintf@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            socket@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            srand@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            stderr@@GLIBC_2.2.5.symtab0x6069008OBJECT<unknown>DEFAULT25
                                            strcpy@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            strerror@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            strlen@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            strncpy@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            sysconf@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            system@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            time@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            uname@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                            usage.symtab0x6869504OBJECT<unknown>DEFAULT25
                                            usleep@@GLIBC_2.2.5.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF

                                            Network Behavior

                                            Network Port Distribution

                                            TCP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Jan 1, 2025 17:31:49.517694950 CET498585388192.168.2.23205.185.126.56
                                            Jan 1, 2025 17:31:49.522476912 CET538849858205.185.126.56192.168.2.23
                                            Jan 1, 2025 17:31:49.522550106 CET498585388192.168.2.23205.185.126.56
                                            Jan 1, 2025 17:31:52.043037891 CET43928443192.168.2.2391.189.91.42
                                            Jan 1, 2025 17:31:52.521253109 CET498585388192.168.2.23205.185.126.56
                                            Jan 1, 2025 17:31:52.526299953 CET538849858205.185.126.56192.168.2.23
                                            Jan 1, 2025 17:31:57.418311119 CET42836443192.168.2.2391.189.91.43
                                            Jan 1, 2025 17:31:58.954082966 CET4251680192.168.2.23109.202.202.202
                                            Jan 1, 2025 17:31:59.021327019 CET538849858205.185.126.56192.168.2.23
                                            Jan 1, 2025 17:31:59.021480083 CET498585388192.168.2.23205.185.126.56
                                            Jan 1, 2025 17:32:13.544090033 CET43928443192.168.2.2391.189.91.42
                                            Jan 1, 2025 17:32:23.782675982 CET42836443192.168.2.2391.189.91.43
                                            Jan 1, 2025 17:32:29.062536955 CET538849858205.185.126.56192.168.2.23
                                            Jan 1, 2025 17:32:29.062695026 CET498585388192.168.2.23205.185.126.56
                                            Jan 1, 2025 17:32:29.925868034 CET4251680192.168.2.23109.202.202.202
                                            Jan 1, 2025 17:32:34.041982889 CET498585388192.168.2.23205.185.126.56
                                            Jan 1, 2025 17:32:34.047172070 CET538849858205.185.126.56192.168.2.23
                                            Jan 1, 2025 17:32:34.047246933 CET498585388192.168.2.23205.185.126.56
                                            Jan 1, 2025 17:32:54.498790979 CET43928443192.168.2.2391.189.91.42

                                            UDP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Jan 1, 2025 17:31:49.045907974 CET4868653192.168.2.231.1.1.1
                                            Jan 1, 2025 17:31:49.517096996 CET53486861.1.1.1192.168.2.23

                                            DNS Queries

                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                            Jan 1, 2025 17:31:49.045907974 CET192.168.2.231.1.1.10xec7cStandard query (0)zzz.hnyzh.coA (IP address)IN (0x0001)false

                                            DNS Answers

                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                            Jan 1, 2025 17:31:49.517096996 CET1.1.1.1192.168.2.230xec7cNo error (0)zzz.hnyzh.co205.185.126.56A (IP address)IN (0x0001)false

                                            System Behavior

                                            General

                                            Start time (UTC):16:31:47
                                            Start date (UTC):01/01/2025
                                            Path:/tmp/lx64.elf
                                            Arguments:/tmp/lx64.elf
                                            File size:35137 bytes
                                            MD5 hash:34b5120c479bebe5c7ae0a6be4395976

                                            Chronological Activities