Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
m68k.elf

Overview

General Information

Sample name:m68k.elf
Analysis ID:1590757
MD5:16bc43c9c282afd06ad2d8ab0fff5f7a
SHA1:2c3348c0cd4bd4043277ab8cea272d364cc003dc
SHA256:0c4f7ae34fdcb42d6e8b41eff333c6f0bd292bc2e964831eabf3391a150b55cc
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Mirai
Yara detected Moobot
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1590757
Start date and time:2025-01-14 15:53:18 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 23s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:m68k.elf
Detection:MAL
Classification:mal100.troj.evad.linELF@0/0@1/0
Command:/tmp/m68k.elf
PID:5435
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
done.
Standard Error:
  • system is lnxubuntu20
  • m68k.elf (PID: 5435, Parent: 5358, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/m68k.elf
    • m68k.elf New Fork (PID: 5437, Parent: 5435)
      • m68k.elf New Fork (PID: 5439, Parent: 5437)
      • m68k.elf New Fork (PID: 5441, Parent: 5437)
        • m68k.elf New Fork (PID: 5443, Parent: 5441)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
NameDescriptionAttributionBlogpost URLsLink
MooBotNo Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot
SourceRuleDescriptionAuthorStrings
m68k.elfJoeSecurity_MoobotYara detected MoobotJoe Security
    m68k.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      m68k.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xd313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd33b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd34f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd38b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd39f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd3b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd3c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd3db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd3ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd403:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd417:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd42b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd43f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd453:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd467:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd47b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd48f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xd4a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      SourceRuleDescriptionAuthorStrings
      5435.1.00007f0198001000.00007f0198010000.r-x.sdmpJoeSecurity_MoobotYara detected MoobotJoe Security
        5435.1.00007f0198001000.00007f0198010000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          5435.1.00007f0198001000.00007f0198010000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0xd313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd33b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd34f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd38b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd39f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd3b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd3c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd3db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd3ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd403:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd417:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd42b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd43f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd453:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd467:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd47b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd48f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xd4a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          Process Memory Space: m68k.elf PID: 5435JoeSecurity_MoobotYara detected MoobotJoe Security
            Process Memory Space: m68k.elf PID: 5435JoeSecurity_Mirai_8Yara detected MiraiJoe Security
              Click to see the 1 entries
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-14T15:53:59.663421+010020304911Malware Command and Control Activity Detected192.168.2.1339366107.189.3.21430242TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-14T15:54:00.183568+010020304891Malware Command and Control Activity Detected107.189.3.21430242192.168.2.1339366TCP
              2025-01-14T15:54:08.938462+010020304891Malware Command and Control Activity Detected107.189.3.21430242192.168.2.1339366TCP
              2025-01-14T15:54:28.941833+010020304891Malware Command and Control Activity Detected107.189.3.21430242192.168.2.1339366TCP
              2025-01-14T15:54:48.951215+010020304891Malware Command and Control Activity Detected107.189.3.21430242192.168.2.1339366TCP
              2025-01-14T15:55:08.948296+010020304891Malware Command and Control Activity Detected107.189.3.21430242192.168.2.1339366TCP
              2025-01-14T15:55:28.950918+010020304891Malware Command and Control Activity Detected107.189.3.21430242192.168.2.1339366TCP
              2025-01-14T15:55:48.954428+010020304891Malware Command and Control Activity Detected107.189.3.21430242192.168.2.1339366TCP

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Source: m68k.elfAvira: detected
              Source: m68k.elfVirustotal: Detection: 55%Perma Link
              Source: m68k.elfReversingLabs: Detection: 60%

              Networking

              barindex
              Source: Network trafficSuricata IDS: 2030491 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+) : 192.168.2.13:39366 -> 107.189.3.214:30242
              Source: Network trafficSuricata IDS: 2030489 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response : 107.189.3.214:30242 -> 192.168.2.13:39366
              Source: global trafficTCP traffic: 192.168.2.13:39366 -> 107.189.3.214:30242
              Source: global trafficTCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
              Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
              Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
              Source: global trafficDNS traffic detected: DNS query: bot.tianyadd.top
              Source: unknownNetwork traffic detected: HTTP traffic on port 48202 -> 443

              System Summary

              barindex
              Source: m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 5435.1.00007f0198001000.00007f0198010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: m68k.elf PID: 5435, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: ELF static info symbol of initial sample.symtab present: no
              Source: m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 5435.1.00007f0198001000.00007f0198010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: m68k.elf PID: 5435, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: classification engineClassification label: mal100.troj.evad.linELF@0/0@1/0
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/5380/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/230/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/110/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/231/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/111/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/232/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/112/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/233/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/113/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/234/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/114/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/235/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/115/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/236/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/116/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/237/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/117/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/238/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/118/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/239/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/119/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/914/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/3635/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/10/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/917/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/11/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/12/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/13/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/5274/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/14/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/15/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/16/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/17/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/18/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/19/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/240/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/3095/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/120/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/241/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/121/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/242/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/1/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/122/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/243/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/2/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/123/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/244/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/3/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/124/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/245/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/1588/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/125/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/4/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/246/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/126/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/5/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/247/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/127/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/6/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/248/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/128/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/7/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/249/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/129/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/8/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/800/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/9/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/1906/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/802/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/803/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/20/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/21/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/22/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/23/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/24/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/25/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/26/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/3780/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/27/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/28/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/29/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/3420/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/1482/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/490/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/1480/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/250/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/371/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/130/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/251/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/131/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/252/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/132/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/253/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/254/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/1238/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/134/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/255/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/256/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/257/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/378/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/3413/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/258/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/259/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/1475/cmdlineJump to behavior
              Source: /tmp/m68k.elf (PID: 5439)File opened: /proc/936/cmdlineJump to behavior

              Hooking and other Techniques for Hiding and Protection

              barindex
              Source: /tmp/m68k.elf (PID: 5435)File: /tmp/m68k.elfJump to behavior
              Source: /tmp/m68k.elf (PID: 5435)Queries kernel information via 'uname': Jump to behavior
              Source: m68k.elf, 5435.1.00007ffdd639c000.00007ffdd63bd000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
              Source: m68k.elf, 5435.1.0000563c136a4000.0000563c13729000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
              Source: m68k.elf, 5435.1.0000563c136a4000.0000563c13729000.rw-.sdmpBinary or memory string: <V!/etc/qemu-binfmt/m68k
              Source: m68k.elf, 5435.1.00007ffdd639c000.00007ffdd63bd000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-m68k/tmp/m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m68k.elf

              Stealing of Sensitive Information

              barindex
              Source: Yara matchFile source: m68k.elf, type: SAMPLE
              Source: Yara matchFile source: 5435.1.00007f0198001000.00007f0198010000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: m68k.elf PID: 5435, type: MEMORYSTR
              Source: Yara matchFile source: m68k.elf, type: SAMPLE
              Source: Yara matchFile source: 5435.1.00007f0198001000.00007f0198010000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: m68k.elf PID: 5435, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: Yara matchFile source: m68k.elf, type: SAMPLE
              Source: Yara matchFile source: 5435.1.00007f0198001000.00007f0198010000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: m68k.elf PID: 5435, type: MEMORYSTR
              Source: Yara matchFile source: m68k.elf, type: SAMPLE
              Source: Yara matchFile source: 5435.1.00007f0198001000.00007f0198010000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: m68k.elf PID: 5435, type: MEMORYSTR
              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
              File Deletion
              1
              OS Credential Dumping
              11
              Security Software Discovery
              Remote ServicesData from Local System1
              Encrypted Channel
              Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
              Non-Standard Port
              Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
              Non-Application Layer Protocol
              Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
              Application Layer Protocol
              Traffic DuplicationData Destruction
              No configs have been found
              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Number of created Files
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1590757 Sample: m68k.elf Startdate: 14/01/2025 Architecture: LINUX Score: 100 20 bot.tianyadd.top 107.189.3.214, 30242, 39366 PONYNETUS United States 2->20 22 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->22 24 Suricata IDS alerts for network traffic 2->24 26 Malicious sample detected (through community Yara rule) 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 4 other signatures 2->30 9 m68k.elf 2->9         started        signatures3 process4 signatures5 32 Sample deletes itself 9->32 12 m68k.elf 9->12         started        process6 process7 14 m68k.elf 12->14         started        16 m68k.elf 12->16         started        process8 18 m68k.elf 14->18         started       
              SourceDetectionScannerLabelLink
              m68k.elf56%VirustotalBrowse
              m68k.elf61%ReversingLabsLinux.Trojan.Mirai
              m68k.elf100%AviraEXP/ELF.Mirai.Z.A
              No Antivirus matches
              No Antivirus matches
              No Antivirus matches
              NameIPActiveMaliciousAntivirus DetectionReputation
              bot.tianyadd.top
              107.189.3.214
              truefalse
                high
                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs
                IPDomainCountryFlagASNASN NameMalicious
                107.189.3.214
                bot.tianyadd.topUnited States
                53667PONYNETUSfalse
                185.125.190.26
                unknownUnited Kingdom
                41231CANONICAL-ASGBfalse
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                107.189.3.214x86.elfGet hashmaliciousMirai, MoobotBrowse
                  x86_64.elfGet hashmaliciousMirai, MoobotBrowse
                    ppc.elfGet hashmaliciousMirai, MoobotBrowse
                      spc.elfGet hashmaliciousMirai, MoobotBrowse
                        mpsl.elfGet hashmaliciousMirai, MoobotBrowse
                          185.125.190.26x86.elfGet hashmaliciousMirai, MoobotBrowse
                            rebirth.mips.elfGet hashmaliciousGafgytBrowse
                              rebirth.x86.elfGet hashmaliciousGafgytBrowse
                                camp.mips.elfGet hashmaliciousMiraiBrowse
                                  camp.arm6.elfGet hashmaliciousMiraiBrowse
                                    boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                                      armv6l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                        96.62.214.10-boatnet.x86-2025-01-13T13_31_47.elfGet hashmaliciousMiraiBrowse
                                          t6.elfGet hashmaliciousUnknownBrowse
                                            boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              bot.tianyadd.topx86.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              x86_64.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              ppc.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              spc.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              mpsl.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              CANONICAL-ASGBx86.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 185.125.190.26
                                              rebirth.ppc.elfGet hashmaliciousGafgytBrowse
                                              • 91.189.91.42
                                              x86_64.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 91.189.91.42
                                              p-p.c-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 91.189.91.42
                                              rebirth.mips.elfGet hashmaliciousGafgytBrowse
                                              • 185.125.190.26
                                              rebirth.arm5.elfGet hashmaliciousGafgytBrowse
                                              • 91.189.91.42
                                              rebirth.x86.elfGet hashmaliciousGafgytBrowse
                                              • 185.125.190.26
                                              Aqua.i686.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              PONYNETUSx86.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              x86_64.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              ppc.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              spc.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              mpsl.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.3.214
                                              https://clients.dedicatedservicesusa.comGet hashmaliciousUnknownBrowse
                                              • 198.98.59.241
                                              m68k.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.4.201
                                              ppc.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.4.201
                                              spc.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.4.201
                                              sh4.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 107.189.4.201
                                              No context
                                              No context
                                              No created / dropped files found
                                              File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
                                              Entropy (8bit):6.206893971559077
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:m68k.elf
                                              File size:61'704 bytes
                                              MD5:16bc43c9c282afd06ad2d8ab0fff5f7a
                                              SHA1:2c3348c0cd4bd4043277ab8cea272d364cc003dc
                                              SHA256:0c4f7ae34fdcb42d6e8b41eff333c6f0bd292bc2e964831eabf3391a150b55cc
                                              SHA512:3861e7825ef43672a9db73587c1a3bfaf318ea06f0d2390eabc2bb3fafc95ff20291738bd797567d0e94c4ede80442838e47f2c6296772ac1739570416699460
                                              SSDEEP:1536:Nk04g/XHsK+THgk8L6ny+xG5T7D7XMpUeayX8YM6:Nk01/clTHgVoxsTfIrX8YM6
                                              TLSH:6B533C9AF801CE7DF85BD77B4457090AB632B3D102821B3663A7B997BC731A91D23E41
                                              File Content Preview:.ELF.......................D...4...x.....4. ...(.................................. ....................d..%$...... .dt.Q............................NV..a....da....dN^NuNV..J9...8f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X........8N^NuNV..N^NuN

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, big endian
                                              Version:1 (current)
                                              Machine:MC68000
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:UNIX - System V
                                              ABI Version:0
                                              Entry Point Address:0x80000144
                                              Flags:0x0
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:3
                                              Section Header Offset:61304
                                              Section Header Size:40
                                              Number of Section Headers:10
                                              Header String Table Index:9
                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                              NULL0x00x00x00x00x0000
                                              .initPROGBITS0x800000940x940x140x00x6AX002
                                              .textPROGBITS0x800000a80xa80xd18e0x00x6AX004
                                              .finiPROGBITS0x8000d2360xd2360xe0x00x6AX002
                                              .rodataPROGBITS0x8000d2440xd2440x198c0x00x2A002
                                              .ctorsPROGBITS0x80010bd40xebd40x80x00x3WA004
                                              .dtorsPROGBITS0x80010bdc0xebdc0x80x00x3WA004
                                              .dataPROGBITS0x80010be80xebe80x3500x00x3WA004
                                              .bssNOBITS0x80010f380xef380x21c00x00x3WA004
                                              .shstrtabSTRTAB0x00xef380x3e0x00x0001
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              LOAD0x00x800000000x800000000xebd00xebd06.24720x5R E0x2000.init .text .fini .rodata
                                              LOAD0xebd40x80010bd40x80010bd40x3640x25242.82590x6RW 0x2000.ctors .dtors .data .bss
                                              GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                              2025-01-14T15:53:59.663421+01002030491ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)1192.168.2.1339366107.189.3.21430242TCP
                                              2025-01-14T15:54:00.183568+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.3.21430242192.168.2.1339366TCP
                                              2025-01-14T15:54:08.938462+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.3.21430242192.168.2.1339366TCP
                                              2025-01-14T15:54:28.941833+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.3.21430242192.168.2.1339366TCP
                                              2025-01-14T15:54:48.951215+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.3.21430242192.168.2.1339366TCP
                                              2025-01-14T15:55:08.948296+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.3.21430242192.168.2.1339366TCP
                                              2025-01-14T15:55:28.950918+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.3.21430242192.168.2.1339366TCP
                                              2025-01-14T15:55:48.954428+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response1107.189.3.21430242192.168.2.1339366TCP
                                              TimestampSource PortDest PortSource IPDest IP
                                              Jan 14, 2025 15:53:58.618195057 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:53:58.622983932 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:53:58.623042107 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:53:59.645915031 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:53:59.650712013 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:53:59.650862932 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:53:59.663420916 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:53:59.668241024 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:54:00.183568001 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:54:00.183682919 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:54:08.253900051 CET48202443192.168.2.13185.125.190.26
                                              Jan 14, 2025 15:54:08.938462019 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:54:08.938524008 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:54:18.949006081 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:54:18.953852892 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:54:28.941833019 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:54:28.941972971 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:54:39.997941017 CET48202443192.168.2.13185.125.190.26
                                              Jan 14, 2025 15:54:48.951215029 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:54:48.951328039 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:55:08.948296070 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:55:08.948508024 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:55:28.950917959 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:55:28.951117992 CET3936630242192.168.2.13107.189.3.214
                                              Jan 14, 2025 15:55:48.954427958 CET3024239366107.189.3.214192.168.2.13
                                              Jan 14, 2025 15:55:48.954549074 CET3936630242192.168.2.13107.189.3.214
                                              TimestampSource PortDest PortSource IPDest IP
                                              Jan 14, 2025 15:53:58.314632893 CET3333353192.168.2.138.8.8.8
                                              Jan 14, 2025 15:53:58.617307901 CET53333338.8.8.8192.168.2.13
                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Jan 14, 2025 15:53:58.314632893 CET192.168.2.138.8.8.80x9b31Standard query (0)bot.tianyadd.topA (IP address)IN (0x0001)false
                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Jan 14, 2025 15:53:58.617307901 CET8.8.8.8192.168.2.130x9b31No error (0)bot.tianyadd.top107.189.3.214A (IP address)IN (0x0001)false

                                              System Behavior

                                              Start time (UTC):14:53:56
                                              Start date (UTC):14/01/2025
                                              Path:/tmp/m68k.elf
                                              Arguments:/tmp/m68k.elf
                                              File size:4463432 bytes
                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                              Start time (UTC):14:53:56
                                              Start date (UTC):14/01/2025
                                              Path:/tmp/m68k.elf
                                              Arguments:-
                                              File size:4463432 bytes
                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                              Start time (UTC):14:53:56
                                              Start date (UTC):14/01/2025
                                              Path:/tmp/m68k.elf
                                              Arguments:-
                                              File size:4463432 bytes
                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                              Start time (UTC):14:53:57
                                              Start date (UTC):14/01/2025
                                              Path:/tmp/m68k.elf
                                              Arguments:-
                                              File size:4463432 bytes
                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                              Start time (UTC):14:53:57
                                              Start date (UTC):14/01/2025
                                              Path:/tmp/m68k.elf
                                              Arguments:-
                                              File size:4463432 bytes
                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc