Edit tour

Linux Analysis Report
i686.elf

Overview

General Information

Sample name:i686.elf
Analysis ID:1618325
MD5:0af2f42ae9ad50e0bf805bd1c5ae0bfb
SHA1:2d35e87f1093187d299cac5022248e7268b586f6
SHA256:295cdf63984684eebace65615d5016b6e2f29229b0a357eb212609d8f8cc820f
Tags:elfuser-abuse_ch
Infos:

Detection

Score:72
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Performs DNS TXT record lookups
Sample reads /proc/mounts (often used for finding a writable filesystem)
Uses STUN server to do NAT traversial
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1618325
Start date and time:2025-02-18 20:12:44 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 54s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:i686.elf
Detection:MAL
Classification:mal72.troj.evad.linELF@0/0@4/0
  • VT rate limit hit for: lib.libre
Command:/tmp/i686.elf
PID:5432
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world, that he gave his only begotten Son, that whosoever believeth in him should not perish, but have everlasting life
Standard Error:
  • system is lnxubuntu20
  • i686.elf (PID: 5432, Parent: 5356, MD5: 0af2f42ae9ad50e0bf805bd1c5ae0bfb) Arguments: /tmp/i686.elf
    • i686.elf New Fork (PID: 5434, Parent: 5432)
    • i686.elf New Fork (PID: 5435, Parent: 5432)
    • i686.elf New Fork (PID: 5478, Parent: 5432)
  • cleanup
SourceRuleDescriptionAuthorStrings
i686.elfLinux_Trojan_Gafgyt_9e9530a7unknownunknown
  • 0xb3bc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
i686.elfLinux_Trojan_Gafgyt_807911a2unknownunknown
  • 0xbbab:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
i686.elfLinux_Trojan_Gafgyt_d4227dbfunknownunknown
  • 0x7eea:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
  • 0x804c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
i686.elfLinux_Trojan_Gafgyt_d996d335unknownunknown
  • 0xe19a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
i686.elfLinux_Trojan_Gafgyt_620087b9unknownunknown
  • 0xb76b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
Click to see the 2 entries
SourceRuleDescriptionAuthorStrings
5432.1.0000000000400000.0000000000411000.r-x.sdmpLinux_Trojan_Gafgyt_9e9530a7unknownunknown
  • 0xb3bc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5432.1.0000000000400000.0000000000411000.r-x.sdmpLinux_Trojan_Gafgyt_807911a2unknownunknown
  • 0xbbab:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5432.1.0000000000400000.0000000000411000.r-x.sdmpLinux_Trojan_Gafgyt_d4227dbfunknownunknown
  • 0x7eea:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
  • 0x804c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5432.1.0000000000400000.0000000000411000.r-x.sdmpLinux_Trojan_Gafgyt_d996d335unknownunknown
  • 0xe19a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5432.1.0000000000400000.0000000000411000.r-x.sdmpLinux_Trojan_Gafgyt_620087b9unknownunknown
  • 0xb76b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
Click to see the 2 entries
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: i686.elfVirustotal: Detection: 15%Perma Link
Source: i686.elfReversingLabs: Detection: 27%

Networking

barindex
Source: global trafficTCP traffic: 64.23.188.144 ports 0,1,3,5,57301,7
Source: unknownDNS query: name: stun.l.google.com
Source: global trafficTCP traffic: 192.168.2.13:58562 -> 64.23.188.144:57301
Source: global trafficUDP traffic: 192.168.2.13:58932 -> 74.125.250.129:19302
Source: /tmp/i686.elf (PID: 5432)Socket: 127.0.0.1:43478Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownTCP traffic detected without corresponding DNS query: 64.23.188.144
Source: unknownUDP traffic detected without corresponding DNS query: 162.243.19.47
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: lib.libre
Source: global trafficDNS traffic detected: DNS query: stun.l.google.com
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

barindex
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_1cb033f3 Author: unknown
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_1cb033f3 Author: unknown
Source: ELF static info symbol of initial sample.symtab present: no
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: i686.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_1cb033f3 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358, id = 1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5432.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_1cb033f3 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358, id = 1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e, last_modified = 2021-09-16
Source: classification engineClassification label: mal72.troj.evad.linELF@0/0@4/0

Persistence and Installation Behavior

barindex
Source: /tmp/i686.elf (PID: 5432)File: /proc/5432/mountsJump to behavior
Source: /tmp/i686.elf (PID: 5434)File: /proc/5434/mountsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3122/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3122/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3122/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3117/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3117/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3117/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3114/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/5415/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/914/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/5416/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/917/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/5275/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/5275/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/5275/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/5432/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/5432/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3134/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3375/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3375/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3375/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3132/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3095/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3095/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3095/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1745/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1866/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1866/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1866/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1588/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1588/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/884/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1982/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1982/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1982/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/765/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/765/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/765/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3246/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3246/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3246/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/800/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/800/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/767/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/767/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/767/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1906/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1906/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1906/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/802/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/802/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/802/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/803/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1748/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1748/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1748/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3420/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3420/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3420/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1482/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1482/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1482/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/490/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/490/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1480/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1480/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1480/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1755/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1755/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1755/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1875/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1875/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1875/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/2964/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3413/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3413/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3413/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1751/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1751/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1751/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1872/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1872/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1872/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/2961/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1475/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1475/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1475/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/778/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3773/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3773/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3773/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/936/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/816/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1879/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1879/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1879/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1891/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1891/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/1891/cmdlineJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3310/mapsJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3310/statusJump to behavior
Source: /tmp/i686.elf (PID: 5432)File opened: /proc/3310/cmdlineJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: TrafficDNS traffic detected: queries for: lib.libre
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping
1
File and Directory Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1618325 Sample: i686.elf Startdate: 18/02/2025 Architecture: LINUX Score: 72 17 lib.libre 2->17 19 stun.l.google.com 2->19 21 3 other IPs or domains 2->21 23 Malicious sample detected (through community Yara rule) 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Connects to many ports of the same IP (likely port scanning) 2->27 7 i686.elf 2->7         started        signatures3 29 Performs DNS TXT record lookups 17->29 31 Uses STUN server to do NAT traversial 19->31 process4 signatures5 33 Sample reads /proc/mounts (often used for finding a writable filesystem) 7->33 10 i686.elf 7->10         started        13 i686.elf 7->13         started        15 i686.elf 7->15         started        process6 signatures7 35 Sample reads /proc/mounts (often used for finding a writable filesystem) 10->35
SourceDetectionScannerLabelLink
i686.elf16%VirustotalBrowse
i686.elf27%ReversingLabsLinux.Backdoor.Gafgyt
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.24
truefalse
    high
    stun.l.google.com
    74.125.250.129
    truefalse
      high
      lib.libre
      unknown
      unknowntrue
        unknown
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        64.23.188.144
        unknownUnited States
        3064AFFINITY-FTLUStrue
        74.125.250.129
        stun.l.google.comUnited States
        15169GOOGLEUSfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        64.23.188.144i686.elfGet hashmaliciousUnknownBrowse
          i686.elfGet hashmaliciousUnknownBrowse
            na.elfGet hashmaliciousUnknownBrowse
              i686.elfGet hashmaliciousUnknownBrowse
                na.elfGet hashmaliciousUnknownBrowse
                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  daisy.ubuntu.comm68k.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.24
                  sh4.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.25
                  arm5.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.24
                  arm5.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.25
                  m68k.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.25
                  arm7.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.25
                  spc.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.25
                  i686.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.25
                  zteGet hashmaliciousUnknownBrowse
                  • 162.213.35.25
                  arm5.elfGet hashmaliciousUnknownBrowse
                  • 162.213.35.25
                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                  AFFINITY-FTLUSi686.elfGet hashmaliciousUnknownBrowse
                  • 64.23.188.144
                  i686.elfGet hashmaliciousUnknownBrowse
                  • 64.23.188.144
                  na.elfGet hashmaliciousUnknownBrowse
                  • 64.23.188.144
                  i686.elfGet hashmaliciousUnknownBrowse
                  • 64.23.188.144
                  na.elfGet hashmaliciousUnknownBrowse
                  • 64.23.188.144
                  arm7.elfGet hashmaliciousMirai, MoobotBrowse
                  • 207.36.98.138
                  arm7.elfGet hashmaliciousMirai, MoobotBrowse
                  • 64.159.94.16
                  https://gffd-5ru.pages.dev/?email=nobody@wp.pl&mail=wp.plGet hashmaliciousHTMLPhisherBrowse
                  • 66.113.135.6
                  sh4.elfGet hashmaliciousMirai, MoobotBrowse
                  • 66.232.157.134
                  telnet.x86.elfGet hashmaliciousUnknownBrowse
                  • 216.219.155.110
                  No context
                  No context
                  No created / dropped files found
                  File type:ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
                  Entropy (8bit):6.08728933436269
                  TrID:
                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                  File name:i686.elf
                  File size:75'808 bytes
                  MD5:0af2f42ae9ad50e0bf805bd1c5ae0bfb
                  SHA1:2d35e87f1093187d299cac5022248e7268b586f6
                  SHA256:295cdf63984684eebace65615d5016b6e2f29229b0a357eb212609d8f8cc820f
                  SHA512:f7c2799584cc5c34c4029d234e3c9a9dae89da9df6aa7744e66f98e412abdeb4113b370e1dc4e7199d90d6dfa7a8176027e43906cd54a07dd70f0fa7adee9779
                  SSDEEP:1536:w5OzVJYmoH30uuKtyiUS2Oo1Rh92wsjX6f7T41iBxX1:w5oJYmoH3pzyin+T92l6DiiBxX1
                  TLSH:F3735C076881C0FDC496C3784B6EE62BD533F4792536F25A6BD4BE276E5AE201F2E101
                  File Content Preview:.ELF..............>.......@.....@...................@.8...@.......................@.......@...............................................Q.......Q.....`........o..............Q.td....................................................H...._........H........

                  ELF header

                  Class:ELF64
                  Data:2's complement, little endian
                  Version:1 (current)
                  Machine:Advanced Micro Devices X86-64
                  Version Number:0x1
                  Type:EXEC (Executable file)
                  OS/ABI:UNIX - System V
                  ABI Version:0
                  Entry Point Address:0x400194
                  Flags:0x0
                  ELF Header Size:64
                  Program Header Offset:64
                  Program Header Size:56
                  Number of Program Headers:3
                  Section Header Offset:71072
                  Section Header Size:64
                  Number of Section Headers:10
                  Header String Table Index:9
                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                  NULL0x00x00x00x00x0000
                  .initPROGBITS0x4000e80xe80x130x00x6AX001
                  .textPROGBITS0x4001000x1000xe5160x00x6AX0016
                  .finiPROGBITS0x40e6160xe6160xe0x00x6AX001
                  .rodataPROGBITS0x40e6400xe6400x29700x00x2A0032
                  .ctorsPROGBITS0x5110000x110000x100x00x3WA008
                  .dtorsPROGBITS0x5110100x110100x100x00x3WA008
                  .dataPROGBITS0x5110400x110400x5200x00x3WA0032
                  .bssNOBITS0x5115600x115600x6a880x00x3WA0032
                  .shstrtabSTRTAB0x00x115600x3e0x00x0001
                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                  LOAD0x00x4000000x4000000x10fb00x10fb06.39260x5R E0x100000.init .text .fini .rodata
                  LOAD0x110000x5110000x5110000x5600x6fe82.35390x6RW 0x100000.ctors .dtors .data .bss
                  GNU_STACK0x00x00x00x00x00.00000x6RW 0x8

                  Download Network PCAP: filteredfull

                  • Total Packets: 41
                  • 57301 undefined
                  • 19302 undefined
                  • 53 (DNS)
                  TimestampSource PortDest PortSource IPDest IP
                  Feb 18, 2025 20:13:33.490784883 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:13:33.495976925 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:13:33.496028900 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:13:34.053524971 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:13:34.053695917 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:13:34.140372992 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:13:34.140435934 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:13:39.738190889 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:13:39.744070053 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:13:49.746293068 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:13:49.751676083 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:13:49.751720905 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:13:49.757071018 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:13:57.836730957 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:13:57.836837053 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:07.846904993 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:07.851933002 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:14:07.851990938 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:07.857019901 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:14:22.018301964 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:22.023416996 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:14:22.023471117 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:22.028484106 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:14:34.256257057 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:34.261434078 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:14:34.261492968 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:34.266536951 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:14:48.426323891 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:48.432918072 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:14:48.432977915 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:14:48.439419031 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:00.882381916 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:00.887531996 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:00.887590885 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:00.892587900 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:05.862709999 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:05.862854004 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:15.870351076 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:15.875571012 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:15.875624895 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:15.880600929 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:30.047585964 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:30.052834034 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:30.052900076 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:30.058151007 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:44.766390085 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:44.771646976 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:44.771730900 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:44.776757956 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:59.341264009 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:59.346544981 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:15:59.346638918 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:15:59.351708889 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:12.182769060 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:12.188046932 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:12.188128948 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:12.193218946 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:24.718306065 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:24.723552942 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:24.723618984 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:24.728666067 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:33.881505013 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:33.881573915 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:43.887624979 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:43.892669916 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:43.892740011 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:43.897735119 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:58.338345051 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:58.343390942 CET573015856264.23.188.144192.168.2.13
                  Feb 18, 2025 20:16:58.343457937 CET5856257301192.168.2.1364.23.188.144
                  Feb 18, 2025 20:16:58.348479033 CET573015856264.23.188.144192.168.2.13
                  TimestampSource PortDest PortSource IPDest IP
                  Feb 18, 2025 20:13:33.400933981 CET4015553192.168.2.13162.243.19.47
                  Feb 18, 2025 20:13:33.487395048 CET5340155162.243.19.47192.168.2.13
                  Feb 18, 2025 20:13:34.494849920 CET3324253192.168.2.138.8.8.8
                  Feb 18, 2025 20:13:34.504242897 CET53332428.8.8.8192.168.2.13
                  Feb 18, 2025 20:13:34.504334927 CET5893219302192.168.2.1374.125.250.129
                  Feb 18, 2025 20:13:34.963685036 CET193025893274.125.250.129192.168.2.13
                  Feb 18, 2025 20:16:16.340753078 CET5619353192.168.2.131.1.1.1
                  Feb 18, 2025 20:16:16.340879917 CET4517453192.168.2.131.1.1.1
                  Feb 18, 2025 20:16:16.349708080 CET53561931.1.1.1192.168.2.13
                  Feb 18, 2025 20:16:16.364423037 CET53451741.1.1.1192.168.2.13
                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                  Feb 18, 2025 20:13:33.400933981 CET192.168.2.13162.243.19.470x6438Standard query (0)lib.libre16IN (0x0001)false
                  Feb 18, 2025 20:13:34.494849920 CET192.168.2.138.8.8.80xfa51Standard query (0)stun.l.google.comA (IP address)IN (0x0001)false
                  Feb 18, 2025 20:16:16.340753078 CET192.168.2.131.1.1.10x9c76Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                  Feb 18, 2025 20:16:16.340879917 CET192.168.2.131.1.1.10x5eb7Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                  Feb 18, 2025 20:13:33.487395048 CET162.243.19.47192.168.2.130x6438No error (0)lib.libreTXT (Text strings)IN (0x0001)false
                  Feb 18, 2025 20:13:34.504242897 CET8.8.8.8192.168.2.130xfa51No error (0)stun.l.google.com74.125.250.129A (IP address)IN (0x0001)false
                  Feb 18, 2025 20:16:16.349708080 CET1.1.1.1192.168.2.130x9c76No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                  Feb 18, 2025 20:16:16.349708080 CET1.1.1.1192.168.2.130x9c76No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                  System Behavior

                  Start time (UTC):19:13:32
                  Start date (UTC):18/02/2025
                  Path:/tmp/i686.elf
                  Arguments:/tmp/i686.elf
                  File size:75808 bytes
                  MD5 hash:0af2f42ae9ad50e0bf805bd1c5ae0bfb

                  Start time (UTC):19:13:32
                  Start date (UTC):18/02/2025
                  Path:/tmp/i686.elf
                  Arguments:-
                  File size:75808 bytes
                  MD5 hash:0af2f42ae9ad50e0bf805bd1c5ae0bfb

                  Start time (UTC):19:13:32
                  Start date (UTC):18/02/2025
                  Path:/tmp/i686.elf
                  Arguments:-
                  File size:75808 bytes
                  MD5 hash:0af2f42ae9ad50e0bf805bd1c5ae0bfb

                  Start time (UTC):19:13:32
                  Start date (UTC):18/02/2025
                  Path:/tmp/i686.elf
                  Arguments:-
                  File size:75808 bytes
                  MD5 hash:0af2f42ae9ad50e0bf805bd1c5ae0bfb