Edit tour

Linux Analysis Report
g1.elf

Overview

General Information

Sample name:g1.elf
Analysis ID:1589771
MD5:569829d6149095d322d46df6ef3d0239
SHA1:3a24353d3f13ed0d13f47ccd1553280f3500a80d
SHA256:5933573c845e389b9300209ff46dbf88d55779f4c607540dcc7acb5e3c1f682f
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1589771
Start date and time:2025-01-13 06:16:06 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 44s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:g1.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0
Command:/tmp/g1.elf
PID:6240
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • g1.elf (PID: 6240, Parent: 6163, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/g1.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: g1.elfReversingLabs: Detection: 21%
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: g1.elfString found in binary or memory: http://%d.%d.%d.%d/%s
Source: g1.elf, 6240.1.00007fdff045a000.00007fdff045f000.rw-.sdmpString found in binary or memory: http://1/wget.sh
Source: g1.elf, 6240.1.00007fdff045a000.00007fdff045f000.rw-.sdmpString found in binary or memory: http://9/curl.sh
Source: g1.elf, 6240.1.00007fdff045a000.00007fdff045f000.rw-.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: g1.elf, 6240.1.00007fdff045a000.00007fdff045f000.rw-.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/g1.elf (PID: 6240)SIGKILL sent: pid: 2018, result: successfulJump to behavior
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/793/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1612/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1656/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1654/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/796/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1532/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/797/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/799/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/759/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/6240/statusJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1668/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1623/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/761/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1622/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/884/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1389/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1664/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1983/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/720/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/721/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1860/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1661/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/847/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1629/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1627/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1900/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/491/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1877/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/2009/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/772/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1633/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1599/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1632/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1477/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/774/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1476/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1872/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1475/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/777/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/658/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/936/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1639/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1638/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1809/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1494/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1890/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1888/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1601/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1886/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1489/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/785/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1642/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/2014/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1320/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/788/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/789/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/904/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)File opened: /proc/1648/cmdlineJump to behavior
Source: /tmp/g1.elf (PID: 6240)Queries kernel information via 'uname': Jump to behavior
Source: g1.elf, 6240.1.00005633ca468000.00005633ca510000.rw-.sdmpBinary or memory string: 3V!/etc/qemu-binfmt/mips
Source: g1.elf, 6240.1.00005633ca468000.00005633ca510000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
Source: g1.elf, 6240.1.00007ffe8f4d7000.00007ffe8f4f8000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
Source: g1.elf, 6240.1.00007ffe8f4d7000.00007ffe8f4f8000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: g1.elf, 6240.1.00007ffe8f4d7000.00007ffe8f4f8000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mips/tmp/g1.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/g1.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1589771 Sample: g1.elf Startdate: 13/01/2025 Architecture: LINUX Score: 48 8 109.202.202.202, 80 INIT7CH Switzerland 2->8 10 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->10 12 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->12 14 Multi AV Scanner detection for submitted file 2->14 6 g1.elf 2->6         started        signatures3 process4
SourceDetectionScannerLabelLink
g1.elf21%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://%d.%d.%d.%d/%sg1.elffalse
    high
    http://1/wget.shg1.elf, 6240.1.00007fdff045a000.00007fdff045f000.rw-.sdmpfalse
      high
      http://schemas.xmlsoap.org/soap/encoding/g1.elf, 6240.1.00007fdff045a000.00007fdff045f000.rw-.sdmpfalse
        high
        http://9/curl.shg1.elf, 6240.1.00007fdff045a000.00007fdff045f000.rw-.sdmpfalse
          high
          http://schemas.xmlsoap.org/soap/envelope/g1.elf, 6240.1.00007fdff045a000.00007fdff045f000.rw-.sdmpfalse
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            109.202.202.202
            unknownSwitzerland
            13030INIT7CHfalse
            91.189.91.43
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            91.189.91.42
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
            91.189.91.43x86.elfGet hashmaliciousUnknownBrowse
              byte.x86.elfGet hashmaliciousMirai, OkiruBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  byte.arm5.elfGet hashmaliciousMirai, OkiruBrowse
                    byte.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                      byte.sh4.elfGet hashmaliciousMirai, OkiruBrowse
                        byte.ppc.elfGet hashmaliciousMirai, OkiruBrowse
                          byte.spc.elfGet hashmaliciousMirai, OkiruBrowse
                            byte.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                              spc.elfGet hashmaliciousUnknownBrowse
                                91.189.91.42x86.elfGet hashmaliciousUnknownBrowse
                                  byte.x86.elfGet hashmaliciousMirai, OkiruBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      byte.arm5.elfGet hashmaliciousMirai, OkiruBrowse
                                        byte.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                          byte.sh4.elfGet hashmaliciousMirai, OkiruBrowse
                                            byte.ppc.elfGet hashmaliciousMirai, OkiruBrowse
                                              byte.spc.elfGet hashmaliciousMirai, OkiruBrowse
                                                byte.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                  spc.elfGet hashmaliciousUnknownBrowse
                                                    No context
                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    CANONICAL-ASGBx86.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    byte.x86.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    byte.arm5.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.sh4.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.ppc.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.spc.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    spc.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    CANONICAL-ASGBx86.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    byte.x86.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    byte.arm5.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.sh4.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.ppc.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.spc.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    byte.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 91.189.91.42
                                                    spc.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    INIT7CHx86.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    byte.x86.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 109.202.202.202
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 109.202.202.202
                                                    byte.arm5.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 109.202.202.202
                                                    byte.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 109.202.202.202
                                                    byte.sh4.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 109.202.202.202
                                                    byte.ppc.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 109.202.202.202
                                                    byte.spc.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 109.202.202.202
                                                    byte.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 109.202.202.202
                                                    spc.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    No context
                                                    No context
                                                    No created / dropped files found
                                                    File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                                                    Entropy (8bit):5.557823582465444
                                                    TrID:
                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                    File name:g1.elf
                                                    File size:106'816 bytes
                                                    MD5:569829d6149095d322d46df6ef3d0239
                                                    SHA1:3a24353d3f13ed0d13f47ccd1553280f3500a80d
                                                    SHA256:5933573c845e389b9300209ff46dbf88d55779f4c607540dcc7acb5e3c1f682f
                                                    SHA512:75f7dac5e8568eb8c51125977d019cabdc834e5acaade7fac48fbe73963c44a8e0d6df7604282bd595bf63ac27187571f8a2bc413f4c56ddedbf34b122a10940
                                                    SSDEEP:1536:RnPXHk5Bxo9M/zOGqt6nA2Ybq+pbnWP+nYhmxK1ILKVQnwU1CVY/A7MLWZ7A7Mbx:5P05Bxo95t6nA2e2cTCCJTUT
                                                    TLSH:DBA3C89D6E224FBCF3A9873547B78D30925833922796D641E1ACDA115E6034FAC0FB78
                                                    File Content Preview:.ELF.....................@.p...4.........4. ...(.............@...@..... ... ............... .E. .E. ...X..4(........dt.Q............................<...'......!'.......................<...'..h...!........'9... ......................<...'..8...!... ....'9u

                                                    ELF header

                                                    Class:ELF32
                                                    Data:2's complement, big endian
                                                    Version:1 (current)
                                                    Machine:MIPS R3000
                                                    Version Number:0x1
                                                    Type:EXEC (Executable file)
                                                    OS/ABI:UNIX - System V
                                                    ABI Version:0
                                                    Entry Point Address:0x400270
                                                    Flags:0x1007
                                                    ELF Header Size:52
                                                    Program Header Offset:52
                                                    Program Header Size:32
                                                    Number of Program Headers:3
                                                    Section Header Offset:106216
                                                    Section Header Size:40
                                                    Number of Section Headers:15
                                                    Header String Table Index:14
                                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                    NULL0x00x00x00x00x0000
                                                    .initPROGBITS0x4000940x940x8c0x00x6AX004
                                                    .textPROGBITS0x4001200x1200x174900x00x6AX0016
                                                    .finiPROGBITS0x4175b00x175b00x5c0x00x6AX004
                                                    .rodataPROGBITS0x4176100x176100x1e100x00x2A0016
                                                    .eh_framePROGBITS0x4594200x194200x40x00x3WA004
                                                    .ctorsPROGBITS0x4594240x194240x80x00x3WA004
                                                    .dtorsPROGBITS0x45942c0x1942c0x80x00x3WA004
                                                    .data.rel.roPROGBITS0x4594380x194380xc0x00x3WA004
                                                    .dataPROGBITS0x4594500x194500x4d80x00x3WA0016
                                                    .gotPROGBITS0x4599300x199300x5480x40x10000003WAp0016
                                                    .sbssNOBITS0x459e780x19e780x180x00x10000003WAp004
                                                    .bssNOBITS0x459e900x19e780x29b80x00x3WA0016
                                                    .mdebug.abi32PROGBITS0x9d80x19e780x00x00x0001
                                                    .shstrtabSTRTAB0x00x19e780x6e0x00x0001
                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                    LOAD0x00x4000000x4000000x194200x194205.54260x5R E0x10000.init .text .fini .rodata
                                                    LOAD0x194200x4594200x4594200xa580x34285.33360x6RW 0x10000.eh_frame .ctors .dtors .data.rel.ro .data .got .sbss .bss
                                                    GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                    Download Network PCAP: filteredfull

                                                    • Total Packets: 6
                                                    • 443 (HTTPS)
                                                    • 80 (HTTP)
                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Jan 13, 2025 06:16:59.911761045 CET42836443192.168.2.2391.189.91.43
                                                    Jan 13, 2025 06:17:00.423655987 CET4251680192.168.2.23109.202.202.202
                                                    Jan 13, 2025 06:17:16.037790060 CET43928443192.168.2.2391.189.91.42
                                                    Jan 13, 2025 06:17:26.276078939 CET42836443192.168.2.2391.189.91.43
                                                    Jan 13, 2025 06:17:30.371572018 CET4251680192.168.2.23109.202.202.202
                                                    Jan 13, 2025 06:17:56.991766930 CET43928443192.168.2.2391.189.91.42

                                                    System Behavior

                                                    Start time (UTC):05:16:55
                                                    Start date (UTC):13/01/2025
                                                    Path:/tmp/g1.elf
                                                    Arguments:/tmp/g1.elf
                                                    File size:5777432 bytes
                                                    MD5 hash:0083f1f0e77be34ad27f849842bbb00c