Edit tour

Linux Analysis Report
sh4.elf

Overview

General Information

Sample name:sh4.elf
Analysis ID:1616708
MD5:605f61262991934bcccf7023c58565f1
SHA1:f2e3705dc2f95b0b06ee8a6e920e8f2910d40135
SHA256:eb7bd4e06be210a01b24de7683bc769b46699e685734fb19131b194dbafa22d7
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1616708
Start date and time:2025-02-17 06:37:14 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 43s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sh4.elf
Detection:MAL
Classification:mal60.spyw.evad.linELF@0/0@1/0
Command:/tmp/sh4.elf
PID:6260
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Firmware update in progress
Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 6230, Parent: 4340)
  • rm (PID: 6230, Parent: 4340, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.j6BUEVlGn8 /tmp/tmp.aKQ50br33C /tmp/tmp.TK584rmHlH
  • dash New Fork (PID: 6231, Parent: 4340)
  • rm (PID: 6231, Parent: 4340, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.j6BUEVlGn8 /tmp/tmp.aKQ50br33C /tmp/tmp.TK584rmHlH
  • sh4.elf (PID: 6260, Parent: 6162, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.elf
    • sh4.elf New Fork (PID: 6264, Parent: 6260)
      • sh4.elf New Fork (PID: 6266, Parent: 6264)
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: sh4.elfReversingLabs: Detection: 13%
Source: sh4.elfVirustotal: Detection: 17%Perma Link

Networking

barindex
Source: /tmp/sh4.elf (PID: 6264)Opens: /sys/class/net/Jump to behavior
Source: /tmp/sh4.elf (PID: 6264)Opens: /sys/class/net/ens160/addressJump to behavior
Source: /tmp/sh4.elf (PID: 6264)Opens: /sys/class/net/ens160/flagsJump to behavior
Source: /tmp/sh4.elf (PID: 6264)Opens: /sys/class/net/ens160/carrierJump to behavior
Source: global trafficTCP traffic: 192.168.2.23:46556 -> 103.35.190.176:3478
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownTCP traffic detected without corresponding DNS query: 103.35.190.176
Source: unknownUDP traffic detected without corresponding DNS query: 172.217.192.127
Source: unknownUDP traffic detected without corresponding DNS query: 147.93.130.20
Source: global trafficDNS traffic detected: DNS query: iranistrash.libre
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal60.spyw.evad.linELF@0/0@1/0
Source: /usr/bin/dash (PID: 6230)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.j6BUEVlGn8 /tmp/tmp.aKQ50br33C /tmp/tmp.TK584rmHlHJump to behavior
Source: /usr/bin/dash (PID: 6231)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.j6BUEVlGn8 /tmp/tmp.aKQ50br33C /tmp/tmp.TK584rmHlHJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Source: /tmp/sh4.elf (PID: 6260)File: /tmp/sh4.elfJump to behavior
Source: /tmp/sh4.elf (PID: 6260)Queries kernel information via 'uname': Jump to behavior
Source: /tmp/sh4.elf (PID: 6264)Queries kernel information via 'uname': Jump to behavior
Source: sh4.elf, 6260.1.00007ffc38ce5000.00007ffc38d06000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 6260.1.000055812e0f4000.000055812e178000.rw-.sdmpBinary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 6260.1.000055812e0f4000.000055812e178000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4
Source: sh4.elf, 6260.1.00007ffc38ce5000.00007ffc38d06000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf

HIPS / PFW / Operating System Protection Evasion

barindex
Source: TrafficDNS traffic detected: queries for: iranistrash.libre
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1616708 Sample: sh4.elf Startdate: 17/02/2025 Architecture: LINUX Score: 60 18 iranistrash.libre 2->18 20 103.35.190.176, 3478, 46556 VECTANTARTERIANetworksCorporationJP Japan 2->20 22 4 other IPs or domains 2->22 24 Multi AV Scanner detection for submitted file 2->24 8 dash rm sh4.elf 2->8         started        11 dash rm 2->11         started        signatures3 26 Performs DNS TXT record lookups 18->26 process4 signatures5 28 Sample deletes itself 8->28 13 sh4.elf 8->13         started        process6 signatures7 30 Opens /sys/class/net/* files useful for querying network interface information 13->30 16 sh4.elf 13->16         started        process8
SourceDetectionScannerLabelLink
sh4.elf14%ReversingLabsLinux.Backdoor.Gafgyt
sh4.elf17%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
iranistrash.libre
unknown
unknownfalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    103.35.190.176
    unknownJapan2519VECTANTARTERIANetworksCorporationJPfalse
    109.202.202.202
    unknownSwitzerland
    13030INIT7CHfalse
    172.217.192.127
    unknownUnited States
    15169GOOGLEUSfalse
    91.189.91.43
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    91.189.91.42
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    103.35.190.176armv4l.elfGet hashmaliciousUnknownBrowse
      sparc.elfGet hashmaliciousUnknownBrowse
        mips.elfGet hashmaliciousUnknownBrowse
          mipsel.elfGet hashmaliciousUnknownBrowse
            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
            91.189.91.43na.elfGet hashmaliciousPrometeiBrowse
              dd.elfGet hashmaliciousUnknownBrowse
                sparc.elfGet hashmaliciousUnknownBrowse
                  i.elfGet hashmaliciousMiraiBrowse
                    armv4eb.elfGet hashmaliciousUnknownBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        uYtea.x86.elfGet hashmaliciousUnknownBrowse
                          uYtea.arm7.elfGet hashmaliciousMiraiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                91.189.91.42na.elfGet hashmaliciousPrometeiBrowse
                                  dd.elfGet hashmaliciousUnknownBrowse
                                    sparc.elfGet hashmaliciousUnknownBrowse
                                      i.elfGet hashmaliciousMiraiBrowse
                                        armv4eb.elfGet hashmaliciousUnknownBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            uYtea.x86.elfGet hashmaliciousUnknownBrowse
                                              uYtea.arm7.elfGet hashmaliciousMiraiBrowse
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                    No context
                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    dd.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    sparc.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    i.elfGet hashmaliciousMiraiBrowse
                                                    • 91.189.91.42
                                                    armv4eb.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    uYtea.x86.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    uYtea.arm7.elfGet hashmaliciousMiraiBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    dd.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    sparc.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    i.elfGet hashmaliciousMiraiBrowse
                                                    • 91.189.91.42
                                                    armv4eb.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    uYtea.x86.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    uYtea.arm7.elfGet hashmaliciousMiraiBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    INIT7CHna.elfGet hashmaliciousPrometeiBrowse
                                                    • 109.202.202.202
                                                    dd.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    sparc.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    i.elfGet hashmaliciousMiraiBrowse
                                                    • 109.202.202.202
                                                    armv4eb.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 109.202.202.202
                                                    uYtea.x86.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    uYtea.arm7.elfGet hashmaliciousMiraiBrowse
                                                    • 109.202.202.202
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 109.202.202.202
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 109.202.202.202
                                                    VECTANTARTERIANetworksCorporationJParmv4l.elfGet hashmaliciousUnknownBrowse
                                                    • 36.3.233.191
                                                    armv6l.elfGet hashmaliciousUnknownBrowse
                                                    • 122.223.93.2
                                                    Owari.arm.elfGet hashmaliciousUnknownBrowse
                                                    • 203.114.9.204
                                                    res.mips.elfGet hashmaliciousUnknownBrowse
                                                    • 220.158.51.57
                                                    jade.sh4.elfGet hashmaliciousMiraiBrowse
                                                    • 36.2.53.56
                                                    Fantazy.sh4.elfGet hashmaliciousMiraiBrowse
                                                    • 157.14.200.76
                                                    x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                    • 157.14.224.29
                                                    Fantazy.mips.elfGet hashmaliciousUnknownBrowse
                                                    • 202.241.163.130
                                                    jackmyx86.elfGet hashmaliciousMiraiBrowse
                                                    • 157.14.224.72
                                                    botnet.x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                    • 222.230.109.235
                                                    No context
                                                    No context
                                                    No created / dropped files found
                                                    File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
                                                    Entropy (8bit):6.722194210588231
                                                    TrID:
                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                    File name:sh4.elf
                                                    File size:66'408 bytes
                                                    MD5:605f61262991934bcccf7023c58565f1
                                                    SHA1:f2e3705dc2f95b0b06ee8a6e920e8f2910d40135
                                                    SHA256:eb7bd4e06be210a01b24de7683bc769b46699e685734fb19131b194dbafa22d7
                                                    SHA512:5f5e72cc1a47ae653990c64da05a8791571ea9ae6376f6b0180e5f054c549e3e6c4e95ef8257045a34b5d961c98e34d7f13891abd29b891ab5b8782878ceba7a
                                                    SSDEEP:1536:avhSDxDXWbW0xq05zvA0cu4U/HKRRf5x+RCQ:avhSDxDXWb3BY3uhqT5x+R
                                                    TLSH:3C539E72985C6E94E00486F5B131CF7DAF47E409E6272FB669AAC934904BE8CF1853F4
                                                    File Content Preview:.ELF..............*.......@.4...........4. ...(...............@...@.`...`.....................A...A..... ...........Q.td............................././"O.n........#.*@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

                                                    ELF header

                                                    Class:ELF32
                                                    Data:2's complement, little endian
                                                    Version:1 (current)
                                                    Machine:<unknown>
                                                    Version Number:0x1
                                                    Type:EXEC (Executable file)
                                                    OS/ABI:UNIX - System V
                                                    ABI Version:0
                                                    Entry Point Address:0x4001a0
                                                    Flags:0x9
                                                    ELF Header Size:52
                                                    Program Header Offset:52
                                                    Program Header Size:32
                                                    Number of Program Headers:3
                                                    Section Header Offset:66008
                                                    Section Header Size:40
                                                    Number of Section Headers:10
                                                    Header String Table Index:9
                                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                    NULL0x00x00x00x00x0000
                                                    .initPROGBITS0x4000940x940x300x00x6AX004
                                                    .textPROGBITS0x4000e00xe00xf3200x00x6AX0032
                                                    .finiPROGBITS0x40f4000xf4000x240x00x6AX004
                                                    .rodataPROGBITS0x40f4240xf4240x73c0x00x2A004
                                                    .ctorsPROGBITS0x4100000x100000x80x00x3WA004
                                                    .dtorsPROGBITS0x4100080x100080x80x00x3WA004
                                                    .dataPROGBITS0x4100140x100140x1840x00x3WA004
                                                    .bssNOBITS0x4101980x101980x14880x00x3WA004
                                                    .shstrtabSTRTAB0x00x101980x3e0x00x0001
                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                    LOAD0x00x4000000x4000000xfb600xfb606.82810x5R E0x10000.init .text .fini .rodata
                                                    LOAD0x100000x4100000x4100000x1980x16201.25230x6RW 0x10000.ctors .dtors .data .bss
                                                    GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                    Download Network PCAP: filteredfull

                                                    • Total Packets: 13
                                                    • 3478 undefined
                                                    • 443 (HTTPS)
                                                    • 80 (HTTP)
                                                    • 53 (DNS)
                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Feb 17, 2025 06:38:06.573556900 CET42836443192.168.2.2391.189.91.43
                                                    Feb 17, 2025 06:38:07.226555109 CET465563478192.168.2.23103.35.190.176
                                                    Feb 17, 2025 06:38:07.231475115 CET347846556103.35.190.176192.168.2.23
                                                    Feb 17, 2025 06:38:07.231548071 CET465563478192.168.2.23103.35.190.176
                                                    Feb 17, 2025 06:38:07.235235929 CET465563478192.168.2.23103.35.190.176
                                                    Feb 17, 2025 06:38:07.240159035 CET347846556103.35.190.176192.168.2.23
                                                    Feb 17, 2025 06:38:07.597404957 CET4251680192.168.2.23109.202.202.202
                                                    Feb 17, 2025 06:38:07.698180914 CET347846556103.35.190.176192.168.2.23
                                                    Feb 17, 2025 06:38:07.698273897 CET465563478192.168.2.23103.35.190.176
                                                    Feb 17, 2025 06:38:21.419528008 CET43928443192.168.2.2391.189.91.42
                                                    Feb 17, 2025 06:38:33.706013918 CET42836443192.168.2.2391.189.91.43
                                                    Feb 17, 2025 06:38:37.801284075 CET4251680192.168.2.23109.202.202.202
                                                    Feb 17, 2025 06:39:02.374082088 CET43928443192.168.2.2391.189.91.42
                                                    Feb 17, 2025 06:39:47.778448105 CET465563478192.168.2.23103.35.190.176
                                                    Feb 17, 2025 06:39:47.783273935 CET347846556103.35.190.176192.168.2.23
                                                    Feb 17, 2025 06:39:47.878108025 CET347846556103.35.190.176192.168.2.23
                                                    Feb 17, 2025 06:39:47.878241062 CET465563478192.168.2.23103.35.190.176
                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Feb 17, 2025 06:38:06.497327089 CET126333478192.168.2.23172.217.192.127
                                                    Feb 17, 2025 06:38:07.061922073 CET347812633172.217.192.127192.168.2.23
                                                    Feb 17, 2025 06:38:07.103571892 CET6055753192.168.2.23147.93.130.20
                                                    Feb 17, 2025 06:38:07.219013929 CET5360557147.93.130.20192.168.2.23
                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                    Feb 17, 2025 06:38:07.103571892 CET192.168.2.23147.93.130.200xa8e0Standard query (0)iranistrash.libre16IN (0x0001)false
                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                    Feb 17, 2025 06:38:07.219013929 CET147.93.130.20192.168.2.230xa8e0No error (0)iranistrash.libreTXT (Text strings)IN (0x0001)false

                                                    System Behavior

                                                    Start time (UTC):05:37:56
                                                    Start date (UTC):17/02/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):05:37:56
                                                    Start date (UTC):17/02/2025
                                                    Path:/usr/bin/rm
                                                    Arguments:rm -f /tmp/tmp.j6BUEVlGn8 /tmp/tmp.aKQ50br33C /tmp/tmp.TK584rmHlH
                                                    File size:72056 bytes
                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                    Start time (UTC):05:37:57
                                                    Start date (UTC):17/02/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):05:37:57
                                                    Start date (UTC):17/02/2025
                                                    Path:/usr/bin/rm
                                                    Arguments:rm -f /tmp/tmp.j6BUEVlGn8 /tmp/tmp.aKQ50br33C /tmp/tmp.TK584rmHlH
                                                    File size:72056 bytes
                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                    Start time (UTC):05:38:02
                                                    Start date (UTC):17/02/2025
                                                    Path:/tmp/sh4.elf
                                                    Arguments:/tmp/sh4.elf
                                                    File size:4139976 bytes
                                                    MD5 hash:8943e5f8f8c280467b4472c15ae93ba9

                                                    Start time (UTC):05:38:06
                                                    Start date (UTC):17/02/2025
                                                    Path:/tmp/sh4.elf
                                                    Arguments:-
                                                    File size:4139976 bytes
                                                    MD5 hash:8943e5f8f8c280467b4472c15ae93ba9