Linux
Analysis Report
46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf
Overview
General Information
Detection
Score: | 80 |
Range: | 0 - 100 |
Signatures
Classification
Joe Sandbox version: | 42.0.0 Malachite |
Analysis ID: | 1626865 |
Start date and time: | 2025-03-01 00:10:25 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 5m 6s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | defaultlinuxfilecookbook.jbs |
Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
Analysis Mode: | default |
Sample name: | 46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf |
Detection: | MAL |
Classification: | mal80.spre.troj.evad.linELF@0/0@2/0 |
Command: | /tmp/46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf |
PID: | 5524 |
Exit Code: | 0 |
Exit Code Info: | |
Killed: | False |
Standard Output: | lzrd cock fest"/proc/"/exe |
Standard Error: |
- system is lnxubuntu20
- 46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf New Fork (PID: 5526, Parent: 5524)
- 46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf New Fork (PID: 5528, Parent: 5524)
- 46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf New Fork (PID: 5529, Parent: 5524)
- xfce4-panel New Fork (PID: 5542, Parent: 3235)
- xfce4-panel New Fork (PID: 5543, Parent: 3235)
- xfce4-panel New Fork (PID: 5544, Parent: 3235)
- xfce4-panel New Fork (PID: 5545, Parent: 3235)
- wrapper-2.0 New Fork (PID: 5566, Parent: 5545)
- xfce4-panel New Fork (PID: 5546, Parent: 3235)
- xfce4-panel New Fork (PID: 5547, Parent: 3235)
- dbus-daemon New Fork (PID: 5563, Parent: 5562)
- systemd New Fork (PID: 5574, Parent: 3044)
- dbus-daemon New Fork (PID: 5600, Parent: 5599)
- cleanup
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
Linux_Trojan_Gafgyt_ea92cca8 | unknown | unknown |
| |
Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
Linux_Trojan_Gafgyt_ea92cca8 | unknown | unknown |
| |
Linux_Trojan_Gafgyt_28a2fe0c | unknown | unknown |
| |
Click to see the 7 entries |
- • AV Detection
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Stealing of Sensitive Information
- • Remote Access Functionality
Click to jump to signature section
AV Detection |
---|
Source: | Avira: |
Source: | ReversingLabs: |
Source: | TCP traffic: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | DNS traffic detected: |
Source: | String found in binary or memory: |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior |
Source: | Program segment: |
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior | ||
Source: | SIGKILL sent: | Jump to behavior |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Classification label: |
Data Obfuscation |
---|
Source: | String containing UPX found: | ||
Source: | String containing UPX found: | ||
Source: | String containing UPX found: |
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior | ||
Source: | Directory: | Jump to behavior |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Submission file: |
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior | ||
Source: | Queries kernel information via 'uname': | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | 1 Hidden Files and Directories | 1 OS Credential Dumping | 11 Security Software Discovery | Remote Services | Data from Local System | 1 Non-Standard Port | Exfiltration Over Other Network Medium | 1 Service Stop |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 11 Obfuscated Files or Information | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
58% | ReversingLabs | Linux.Trojan.Mirai | ||
100% | Avira | EXP/ELF.Agent.F.118 |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
daisy.ubuntu.com | 162.213.35.25 | true | false | high |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
46.247.108.221 | unknown | United Kingdom | 39545 | FLUIDATAGB | true |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
daisy.ubuntu.com | Get hash | malicious | Mirai | Browse |
| |
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai, Moobot | Browse |
| ||
Get hash | malicious | Gafgyt, Mirai | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
FLUIDATAGB | Get hash | malicious | Mirai | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai, Moobot | Browse |
|
File type: | |
Entropy (8bit): | 7.9043007245187535 |
TrID: |
|
File name: | 46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf |
File size: | 21'884 bytes |
MD5: | 84c8629e8f940f72494f7410a19b3d1b |
SHA1: | a15e747522e162587db3d4b6a8fb73ba5cdab9ca |
SHA256: | c13e293726f83f93814c9b5fbb4818fcbf6d0ef1d74b54b4497f848df8b7ad47 |
SHA512: | 11ebd61a0428611356cfdccddbc69d847558bf9c1c2ae5f2795f3a55919c88d56907e3a0c2c4497098f2e9321df47439ff3f2a233ab48c048a75ab402d992aa9 |
SSDEEP: | 384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5m7M4uVcqgw05VxJ4:9RxsSVsMD6xiJJE5zRWN8o4uVcqgw09u |
TLSH: | 7DA2D025D345AEF4DFEF9C9053C2C2C276F543C6268AC8E280EEAF016506046BB89D59 |
File Content Preview: | .ELF......................B....4.........4. ...(......................Tx..Tx...............D...D...D................dt.Q................................UPX!...........\...\.......R.......?.E.h4...@b............./.}....D*aN.........t.w..X.^6>....d........+ |
ELF header | |
---|---|
Class: | |
Data: | |
Version: | |
Machine: | |
Version Number: | |
Type: | |
OS/ABI: | |
ABI Version: | 0 |
Entry Point Address: | |
Flags: | |
ELF Header Size: | 52 |
Program Header Offset: | 52 |
Program Header Size: | 32 |
Number of Program Headers: | 3 |
Section Header Offset: | 0 |
Section Header Size: | 40 |
Number of Section Headers: | 0 |
Header String Table Index: | 0 |
Type | Offset | Virtual Address | Physical Address | File Size | Memory Size | Entropy | Flags | Flags Description | Align | Prog Interpreter | Section Mappings |
---|---|---|---|---|---|---|---|---|---|---|---|
LOAD | 0x0 | 0x100000 | 0x100000 | 0x5478 | 0x5478 | 7.9088 | 0x5 | R E | 0x10000 | ||
LOAD | 0xd544 | 0x1001d544 | 0x1001d544 | 0x0 | 0x0 | 0.0000 | 0x6 | RW | 0x10000 | ||
GNU_STACK | 0x0 | 0x0 | 0x0 | 0x0 | 0x0 | 0.0000 | 0x6 | RW | 0x4 |
Download Network PCAP: filtered – full
- Total Packets: 32
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Mar 1, 2025 00:11:07.769579887 CET | 53608 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:07.852221012 CET | 3778 | 53608 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:07.852288008 CET | 53608 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:07.865272045 CET | 53608 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:07.870383024 CET | 3778 | 53608 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:07.870429039 CET | 53608 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:07.875493050 CET | 3778 | 53608 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:08.483468056 CET | 3778 | 53608 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:08.483714104 CET | 53608 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:08.483933926 CET | 53608 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:08.484838963 CET | 53610 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:08.489954948 CET | 3778 | 53610 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:08.490005016 CET | 53610 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:08.491605997 CET | 53610 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:08.496587992 CET | 3778 | 53610 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:08.496629953 CET | 53610 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:08.501847029 CET | 3778 | 53610 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:09.119843006 CET | 3778 | 53610 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:09.120006084 CET | 53610 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.120064974 CET | 53610 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.123482943 CET | 53612 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.128638029 CET | 3778 | 53612 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:09.128720999 CET | 53612 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.131118059 CET | 53612 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.136208057 CET | 3778 | 53612 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:09.136270046 CET | 53612 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.141318083 CET | 3778 | 53612 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:09.757555962 CET | 3778 | 53612 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:09.757728100 CET | 53612 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.757905960 CET | 53612 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.758477926 CET | 53614 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.763560057 CET | 3778 | 53614 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:09.763617992 CET | 53614 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.764303923 CET | 53614 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.769251108 CET | 3778 | 53614 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:09.769288063 CET | 53614 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:09.774333000 CET | 3778 | 53614 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:10.400464058 CET | 3778 | 53614 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:10.400638103 CET | 53614 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:10.400840998 CET | 53614 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:10.401393890 CET | 53616 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:10.406881094 CET | 3778 | 53616 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:10.406971931 CET | 53616 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:10.407874107 CET | 53616 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:10.413435936 CET | 3778 | 53616 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:10.413487911 CET | 53616 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:10.418490887 CET | 3778 | 53616 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:13.250884056 CET | 53616 | 3778 | 192.168.2.15 | 46.247.108.221 |
Mar 1, 2025 00:11:13.259200096 CET | 3778 | 53616 | 46.247.108.221 | 192.168.2.15 |
Mar 1, 2025 00:11:13.259284019 CET | 53616 | 3778 | 192.168.2.15 | 46.247.108.221 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Mar 1, 2025 00:13:52.494478941 CET | 38653 | 53 | 192.168.2.15 | 1.1.1.1 |
Mar 1, 2025 00:13:52.494518995 CET | 36196 | 53 | 192.168.2.15 | 1.1.1.1 |
Mar 1, 2025 00:13:52.503514051 CET | 53 | 36196 | 1.1.1.1 | 192.168.2.15 |
Mar 1, 2025 00:13:52.517606974 CET | 53 | 38653 | 1.1.1.1 | 192.168.2.15 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Mar 1, 2025 00:13:52.494478941 CET | 192.168.2.15 | 1.1.1.1 | 0xb51 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Mar 1, 2025 00:13:52.494518995 CET | 192.168.2.15 | 1.1.1.1 | 0x1d87 | Standard query (0) | 28 | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Mar 1, 2025 00:13:52.517606974 CET | 1.1.1.1 | 192.168.2.15 | 0xb51 | No error (0) | 162.213.35.25 | A (IP address) | IN (0x0001) | false | ||
Mar 1, 2025 00:13:52.517606974 CET | 1.1.1.1 | 192.168.2.15 | 0xb51 | No error (0) | 162.213.35.24 | A (IP address) | IN (0x0001) | false |
System Behavior
Start time (UTC): | 23:11:06 |
Start date (UTC): | 28/02/2025 |
Path: | /tmp/46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf |
Arguments: | /tmp/46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf |
File size: | 5388968 bytes |
MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
Start time (UTC): | 23:11:06 |
Start date (UTC): | 28/02/2025 |
Path: | /tmp/46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf |
Arguments: | - |
File size: | 5388968 bytes |
MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
Start time (UTC): | 23:11:06 |
Start date (UTC): | 28/02/2025 |
Path: | /tmp/46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf |
Arguments: | - |
File size: | 5388968 bytes |
MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
Start time (UTC): | 23:11:06 |
Start date (UTC): | 28/02/2025 |
Path: | /tmp/46.247.108.221-boatnet.ppc-2025-02-28T21_19_25.elf |
Arguments: | - |
File size: | 5388968 bytes |
MD5 hash: | ae65271c943d3451b7f026d1fadccea6 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/bin/xfce4-panel |
Arguments: | - |
File size: | 375768 bytes |
MD5 hash: | a15b657c7d54ac1385f1f15004ea6784 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear" |
File size: | 35136 bytes |
MD5 hash: | ac0b8a906f359a8ae102244738682e76 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/bin/xfce4-panel |
Arguments: | - |
File size: | 375768 bytes |
MD5 hash: | a15b657c7d54ac1385f1f15004ea6784 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)" |
File size: | 35136 bytes |
MD5 hash: | ac0b8a906f359a8ae102244738682e76 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/bin/xfce4-panel |
Arguments: | - |
File size: | 375768 bytes |
MD5 hash: | a15b657c7d54ac1385f1f15004ea6784 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system" |
File size: | 35136 bytes |
MD5 hash: | ac0b8a906f359a8ae102244738682e76 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/bin/xfce4-panel |
Arguments: | - |
File size: | 375768 bytes |
MD5 hash: | a15b657c7d54ac1385f1f15004ea6784 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display" |
File size: | 35136 bytes |
MD5 hash: | ac0b8a906f359a8ae102244738682e76 |
Start time (UTC): | 23:11:19 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 |
Arguments: | - |
File size: | 35136 bytes |
MD5 hash: | ac0b8a906f359a8ae102244738682e76 |
Start time (UTC): | 23:11:19 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/sbin/xfpm-power-backlight-helper |
Arguments: | /usr/sbin/xfpm-power-backlight-helper --get-max-brightness |
File size: | 14656 bytes |
MD5 hash: | 3d221ad23f28ca3259f599b1664e2427 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/bin/xfce4-panel |
Arguments: | - |
File size: | 375768 bytes |
MD5 hash: | a15b657c7d54ac1385f1f15004ea6784 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel" |
File size: | 35136 bytes |
MD5 hash: | ac0b8a906f359a8ae102244738682e76 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/bin/xfce4-panel |
Arguments: | - |
File size: | 375768 bytes |
MD5 hash: | a15b657c7d54ac1385f1f15004ea6784 |
Start time (UTC): | 23:11:12 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions" |
File size: | 35136 bytes |
MD5 hash: | ac0b8a906f359a8ae102244738682e76 |
Start time (UTC): | 23:11:19 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/bin/dbus-daemon |
Arguments: | - |
File size: | 249032 bytes |
MD5 hash: | 3089d47e3f3ab84cd81c48fd406d7a8c |
Start time (UTC): | 23:11:19 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd |
File size: | 112880 bytes |
MD5 hash: | 4c7a0d6d258bb970905b19b84abcd8e9 |
Start time (UTC): | 23:11:24 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/systemd/systemd |
Arguments: | - |
File size: | 1620224 bytes |
MD5 hash: | 9b2bec7092a40488108543f9334aab75 |
Start time (UTC): | 23:11:24 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd |
File size: | 112872 bytes |
MD5 hash: | eee956f1b227c1d5031f9c61223255d1 |
Start time (UTC): | 23:11:26 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/bin/dbus-daemon |
Arguments: | - |
File size: | 249032 bytes |
MD5 hash: | 3089d47e3f3ab84cd81c48fd406d7a8c |
Start time (UTC): | 23:11:26 |
Start date (UTC): | 28/02/2025 |
Path: | /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd |
Arguments: | /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd |
File size: | 112880 bytes |
MD5 hash: | 4c7a0d6d258bb970905b19b84abcd8e9 |