Edit tour

Linux Analysis Report
zerx86.elf

Overview

General Information

Sample name:zerx86.elf
Analysis ID:1628712
MD5:c4af54f2b2f4ca83586632ecb973c9ae
SHA1:e410db2d4a6766bd21b75a351122f940f521897a
SHA256:bb8fa9e2f5e7b24e949c278b2930c9a338466918a6acffc6de425cd41e2969df
Tags:elfuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1628712
Start date and time:2025-03-04 03:52:43 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 54s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zerx86.elf
Detection:MAL
Classification:mal60.troj.linELF@0/0@42/0
Command:/tmp/zerx86.elf
PID:6271
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate a lot
Standard Error:
  • system is lnxubuntu20
  • zerx86.elf (PID: 6271, Parent: 6194, MD5: c4af54f2b2f4ca83586632ecb973c9ae) Arguments: /tmp/zerx86.elf
  • cleanup
SourceRuleDescriptionAuthorStrings
zerx86.elfLinux_Trojan_Mirai_b14f4c5dunknownunknown
  • 0x3fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
zerx86.elfLinux_Trojan_Mirai_88de437funknownunknown
  • 0x7702:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
zerx86.elfLinux_Trojan_Mirai_cc93863bunknownunknown
  • 0x824e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
zerx86.elfLinux_Trojan_Mirai_8aa7b5d3unknownunknown
  • 0x76d2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
SourceRuleDescriptionAuthorStrings
6271.1.0000000008048000.0000000008053000.r-x.sdmpLinux_Trojan_Mirai_b14f4c5dunknownunknown
  • 0x3fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6271.1.0000000008048000.0000000008053000.r-x.sdmpLinux_Trojan_Mirai_88de437funknownunknown
  • 0x7702:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6271.1.0000000008048000.0000000008053000.r-x.sdmpLinux_Trojan_Mirai_cc93863bunknownunknown
  • 0x824e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6271.1.0000000008048000.0000000008053000.r-x.sdmpLinux_Trojan_Mirai_8aa7b5d3unknownunknown
  • 0x76d2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: zerx86.elfVirustotal: Detection: 42%Perma Link
Source: zerx86.elfReversingLabs: Detection: 44%

Networking

barindex
Source: global trafficDNS traffic detected: malformed DNS query: watchmepull.dyn. [malformed]
Source: global trafficTCP traffic: 192.168.2.23:43806 -> 46.19.143.10:1440
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: global trafficDNS traffic detected: DNS query: ohlookthereismyboats.geek
Source: global trafficDNS traffic detected: DNS query: watchmepull.dyn. [malformed]
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

System Summary

barindex
Source: zerx86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: zerx86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: zerx86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: zerx86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6271.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6271.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6271.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6271.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: ELF static info symbol of initial sample.symtab present: no
Source: zerx86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: zerx86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: zerx86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: zerx86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6271.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6271.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6271.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6271.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engineClassification label: mal60.troj.linELF@0/0@42/0
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1628712 Sample: zerx86.elf Startdate: 04/03/2025 Architecture: LINUX Score: 60 14 watchmepull.dyn. [malformed] 2->14 16 ohlookthereismyboats.geek 46.19.143.10, 1440, 43806, 43808 PLI-ASCH Switzerland 2->16 18 3 other IPs or domains 2->18 20 Malicious sample detected (through community Yara rule) 2->20 22 Multi AV Scanner detection for submitted file 2->22 8 zerx86.elf 2->8         started        signatures3 24 Sends malformed DNS queries 14->24 process4 process5 10 zerx86.elf 8->10         started        process6 12 zerx86.elf 10->12         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
zerx86.elf43%VirustotalBrowse
zerx86.elf45%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
ohlookthereismyboats.geek
46.19.143.10
truefalse
    high
    watchmepull.dyn. [malformed]
    unknown
    unknownfalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      46.19.143.10
      ohlookthereismyboats.geekSwitzerland
      51852PLI-ASCHfalse
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      46.19.143.10zerppc.elfGet hashmaliciousUnknownBrowse
        zerspc.elfGet hashmaliciousUnknownBrowse
          zerarm7.elfGet hashmaliciousUnknownBrowse
            zerarm7.elfGet hashmaliciousUnknownBrowse
              zerx86.elfGet hashmaliciousUnknownBrowse
                zerspc.elfGet hashmaliciousUnknownBrowse
                  zerarm5.elfGet hashmaliciousUnknownBrowse
                    zerm68k.elfGet hashmaliciousUnknownBrowse
                      zermips.elfGet hashmaliciousUnknownBrowse
                        zerppc.elfGet hashmaliciousUnknownBrowse
                          109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                          • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                          91.189.91.43nabarm6.elfGet hashmaliciousUnknownBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            sshd.elfGet hashmaliciousUnknownBrowse
                                              91.189.91.42nabarm6.elfGet hashmaliciousUnknownBrowse
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                        na.elfGet hashmaliciousPrometeiBrowse
                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                                sshd.elfGet hashmaliciousUnknownBrowse
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  ohlookthereismyboats.geeknabmips.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  jklarm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 1.2.3.4
                                                                  splx86.elfGet hashmaliciousUnknownBrowse
                                                                  • 1.2.3.4
                                                                  zerspc.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  nabarm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  nabmpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  nklmips.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  mpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 1.2.3.4
                                                                  jklarm7.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  CANONICAL-ASGBzerppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 185.125.190.26
                                                                  nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  CANONICAL-ASGBzerppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 185.125.190.26
                                                                  nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  PLI-ASCHzerppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerspc.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerarm7.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerarm7.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerx86.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerspc.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerm68k.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zermips.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  zerppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 46.19.143.10
                                                                  INIT7CHnabarm6.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  sshd.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  No context
                                                                  No context
                                                                  No created / dropped files found
                                                                  File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
                                                                  Entropy (8bit):6.3626367991338375
                                                                  TrID:
                                                                  • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                                                                  • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                                                                  File name:zerx86.elf
                                                                  File size:46'140 bytes
                                                                  MD5:c4af54f2b2f4ca83586632ecb973c9ae
                                                                  SHA1:e410db2d4a6766bd21b75a351122f940f521897a
                                                                  SHA256:bb8fa9e2f5e7b24e949c278b2930c9a338466918a6acffc6de425cd41e2969df
                                                                  SHA512:28a8e40f94981226b931ae93950bd6bc3bb190e8282b130ca65ad5d9c8d8522a50701f40c6bef8c0f055c8341726db9443e4870a39a73ffb80c2120963d2306e
                                                                  SSDEEP:768:cD+yNVu5rQu0eKlanWBbWXmJGpdBon4UWfx4ImA+/JlrWqLiN9:cqyNVu5rQu0eKoWBbWXnZzfxTmL/JdWq
                                                                  TLSH:71234BC0A857DCF8D85605717037FB734AB6E03A6199EAC7D3AE9632EC42A11D24739C
                                                                  File Content Preview:.ELF....................d...4...........4. ...(..............................................@...@..<...\(..........Q.td............................U..S.......{....h........[]...$.............U......=@B...t..5....D@.....D@......u........t....h.0..........

                                                                  ELF header

                                                                  Class:ELF32
                                                                  Data:2's complement, little endian
                                                                  Version:1 (current)
                                                                  Machine:Intel 80386
                                                                  Version Number:0x1
                                                                  Type:EXEC (Executable file)
                                                                  OS/ABI:UNIX - System V
                                                                  ABI Version:0
                                                                  Entry Point Address:0x8048164
                                                                  Flags:0x0
                                                                  ELF Header Size:52
                                                                  Program Header Offset:52
                                                                  Program Header Size:32
                                                                  Number of Program Headers:3
                                                                  Section Header Offset:45700
                                                                  Section Header Size:40
                                                                  Number of Section Headers:11
                                                                  Header String Table Index:10
                                                                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                  NULL0x00x00x00x00x0000
                                                                  .initPROGBITS0x80480940x940x1c0x00x6AX001
                                                                  .textPROGBITS0x80480b00xb00xa4c60x00x6AX0016
                                                                  .finiPROGBITS0x80525760xa5760x170x00x6AX001
                                                                  .rodataPROGBITS0x80525a00xa5a00xa600x00x2A0032
                                                                  .ctorsPROGBITS0x80540040xb0040x80x00x3WA004
                                                                  .dtorsPROGBITS0x805400c0xb00c0x80x00x3WA004
                                                                  .jcrPROGBITS0x80540140xb0140x40x00x3WA004
                                                                  .dataPROGBITS0x80540400xb0400x2000x00x3WA0032
                                                                  .bssNOBITS0x80542400xb2400x26200x00x3WA0032
                                                                  .shstrtabSTRTAB0x00xb2400x430x00x0001
                                                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                  LOAD0x00x80480000x80480000xb0000xb0006.41190x5R E0x1000.init .text .fini .rodata
                                                                  LOAD0xb0040x80540040x80540040x23c0x285c2.53350x6RW 0x1000.ctors .dtors .jcr .data .bss
                                                                  GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                                  Download Network PCAP: filteredfull

                                                                  • Total Packets: 99
                                                                  • 1440 undefined
                                                                  • 443 (HTTPS)
                                                                  • 80 (HTTP)
                                                                  • 53 (DNS)
                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Mar 4, 2025 03:53:47.728658915 CET43928443192.168.2.2391.189.91.42
                                                                  Mar 4, 2025 03:53:47.752851963 CET438061440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:47.757992983 CET14404380646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:53:47.758066893 CET438061440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:47.758105040 CET438061440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:47.763248920 CET14404380646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:53:47.763307095 CET438061440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:47.768368959 CET14404380646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:53:53.104175091 CET42836443192.168.2.2391.189.91.43
                                                                  Mar 4, 2025 03:53:57.766988993 CET438061440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:57.772066116 CET14404380646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:53:57.960331917 CET14404380646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:53:57.960632086 CET438061440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:57.966922998 CET14404380646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:53:59.056716919 CET438081440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:59.062242031 CET14404380846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:53:59.062360048 CET438081440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:59.062401056 CET438081440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:59.067476034 CET14404380846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:53:59.067553043 CET438081440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:53:59.072633982 CET14404380846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:09.229765892 CET43928443192.168.2.2391.189.91.42
                                                                  Mar 4, 2025 03:54:09.619556904 CET14404380846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:09.619856119 CET438081440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:09.625057936 CET14404380846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:15.372968912 CET4251680192.168.2.23109.202.202.202
                                                                  Mar 4, 2025 03:54:19.468493938 CET42836443192.168.2.2391.189.91.43
                                                                  Mar 4, 2025 03:54:25.668181896 CET438101440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:25.673458099 CET14404381046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:25.673795938 CET438101440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:25.673854113 CET438101440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:25.679054022 CET14404381046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:25.679157972 CET438101440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:25.684286118 CET14404381046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:36.222851992 CET14404381046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:36.223197937 CET438101440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:36.228305101 CET14404381046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:37.242649078 CET438121440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:37.247698069 CET14404381246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:37.247880936 CET438121440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:37.247894049 CET438121440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:37.252899885 CET14404381246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:37.252960920 CET438121440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:37.258007050 CET14404381246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:47.810306072 CET14404381246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:47.810570002 CET438121440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:47.815664053 CET14404381246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:49.002325058 CET438141440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:49.007452011 CET14404381446.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:49.007661104 CET438141440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:49.007661104 CET438141440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:49.012720108 CET14404381446.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:49.012837887 CET438141440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:49.017970085 CET14404381446.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:50.184248924 CET43928443192.168.2.2391.189.91.42
                                                                  Mar 4, 2025 03:54:59.567255974 CET14404381446.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:54:59.567665100 CET438141440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:54:59.572659969 CET14404381446.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:00.671677113 CET438161440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:00.676750898 CET14404381646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:00.677088976 CET438161440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:00.677088976 CET438161440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:00.682208061 CET14404381646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:00.682316065 CET438161440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:00.687371016 CET14404381646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:11.225439072 CET14404381646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:11.225681067 CET438161440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:11.231050968 CET14404381646.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:12.670743942 CET438181440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:12.675765991 CET14404381846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:12.675852060 CET438181440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:12.676032066 CET438181440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:12.681024075 CET14404381846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:12.681140900 CET438181440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:12.686920881 CET14404381846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:22.684653044 CET438181440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:22.689685106 CET14404381846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:22.874145985 CET14404381846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:22.874393940 CET438181440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:22.879983902 CET14404381846.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:24.317387104 CET438201440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:24.322434902 CET14404382046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:24.322565079 CET438201440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:24.322630882 CET438201440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:24.327699900 CET14404382046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:24.327822924 CET438201440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:24.332906008 CET14404382046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:34.878308058 CET14404382046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:34.878509045 CET438201440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:34.883584023 CET14404382046.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:35.972274065 CET438221440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:35.977377892 CET14404382246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:35.977447987 CET438221440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:35.977474928 CET438221440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:35.982475996 CET14404382246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:35.982525110 CET438221440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:35.987622023 CET14404382246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:46.546821117 CET14404382246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:46.547080994 CET438221440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:46.555872917 CET14404382246.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:47.714135885 CET438241440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:47.719132900 CET14404382446.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:47.719242096 CET438241440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:47.719300985 CET438241440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:47.724288940 CET14404382446.19.143.10192.168.2.23
                                                                  Mar 4, 2025 03:55:47.724365950 CET438241440192.168.2.2346.19.143.10
                                                                  Mar 4, 2025 03:55:47.729352951 CET14404382446.19.143.10192.168.2.23
                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Mar 4, 2025 03:53:47.729607105 CET5177153192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:53:47.752737045 CET5351771194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:53:58.962804079 CET4161553192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:53:58.980030060 CET5341615194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:53:58.980201960 CET4125653192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:53:59.003895998 CET5341256194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:53:59.004302979 CET3683553192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:53:59.021586895 CET5336835194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:53:59.021800041 CET5063453192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:53:59.038994074 CET5350634194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:53:59.039208889 CET3819753192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:53:59.056427002 CET5338197194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:54:10.621957064 CET4633553192.168.2.2351.158.108.203
                                                                  Mar 4, 2025 03:54:15.626656055 CET4333753192.168.2.2351.158.108.203
                                                                  Mar 4, 2025 03:54:20.631108046 CET4494753192.168.2.2351.158.108.203
                                                                  Mar 4, 2025 03:54:25.635724068 CET4049753192.168.2.2351.158.108.203
                                                                  Mar 4, 2025 03:54:25.651680946 CET534049751.158.108.203192.168.2.23
                                                                  Mar 4, 2025 03:54:25.651884079 CET5523353192.168.2.2351.158.108.203
                                                                  Mar 4, 2025 03:54:25.668046951 CET535523351.158.108.203192.168.2.23
                                                                  Mar 4, 2025 03:54:37.224826097 CET5780153192.168.2.23202.61.197.122
                                                                  Mar 4, 2025 03:54:37.242525101 CET5357801202.61.197.122192.168.2.23
                                                                  Mar 4, 2025 03:54:48.813278913 CET4744653192.168.2.23185.181.61.24
                                                                  Mar 4, 2025 03:54:48.850830078 CET5347446185.181.61.24192.168.2.23
                                                                  Mar 4, 2025 03:54:48.851026058 CET3562153192.168.2.23185.181.61.24
                                                                  Mar 4, 2025 03:54:48.888461113 CET5335621185.181.61.24192.168.2.23
                                                                  Mar 4, 2025 03:54:48.888778925 CET5147853192.168.2.23185.181.61.24
                                                                  Mar 4, 2025 03:54:48.926327944 CET5351478185.181.61.24192.168.2.23
                                                                  Mar 4, 2025 03:54:48.926764011 CET3363953192.168.2.23185.181.61.24
                                                                  Mar 4, 2025 03:54:48.964411974 CET5333639185.181.61.24192.168.2.23
                                                                  Mar 4, 2025 03:54:48.964699984 CET5338753192.168.2.23185.181.61.24
                                                                  Mar 4, 2025 03:54:49.002162933 CET5353387185.181.61.24192.168.2.23
                                                                  Mar 4, 2025 03:55:00.570127964 CET3546153192.168.2.23152.53.15.127
                                                                  Mar 4, 2025 03:55:00.587670088 CET5335461152.53.15.127192.168.2.23
                                                                  Mar 4, 2025 03:55:00.587858915 CET4014053192.168.2.23152.53.15.127
                                                                  Mar 4, 2025 03:55:00.611233950 CET5340140152.53.15.127192.168.2.23
                                                                  Mar 4, 2025 03:55:00.611344099 CET3289253192.168.2.23152.53.15.127
                                                                  Mar 4, 2025 03:55:00.628551960 CET5332892152.53.15.127192.168.2.23
                                                                  Mar 4, 2025 03:55:00.629373074 CET3749853192.168.2.23152.53.15.127
                                                                  Mar 4, 2025 03:55:00.646812916 CET5337498152.53.15.127192.168.2.23
                                                                  Mar 4, 2025 03:55:00.646981001 CET5064553192.168.2.23152.53.15.127
                                                                  Mar 4, 2025 03:55:00.671456099 CET5350645152.53.15.127192.168.2.23
                                                                  Mar 4, 2025 03:55:12.227690935 CET5267153192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:12.315128088 CET5352671168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:12.315592051 CET4222253192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:12.404612064 CET5342222168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:12.405065060 CET3463953192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:12.492645979 CET5334639168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:12.492871046 CET4819753192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:12.582480907 CET5348197168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:12.582782984 CET3536653192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:12.670383930 CET5335366168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:23.876883984 CET5570153192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:23.964620113 CET5355701168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:23.965079069 CET5857953192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:24.054467916 CET5358579168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:24.054704905 CET4720253192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:24.142007113 CET5347202168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:24.142194033 CET5188153192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:24.229222059 CET5351881168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:24.229414940 CET5103653192.168.2.23168.235.111.72
                                                                  Mar 4, 2025 03:55:24.317147017 CET5351036168.235.111.72192.168.2.23
                                                                  Mar 4, 2025 03:55:35.880068064 CET3487853192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:55:35.897272110 CET5334878194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:55:35.897479057 CET5200653192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:55:35.914556980 CET5352006194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:55:35.914654970 CET4625553192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:55:35.937705994 CET5346255194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:55:35.937854052 CET4680853192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:55:35.955014944 CET5346808194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:55:35.955112934 CET5135553192.168.2.23194.36.144.87
                                                                  Mar 4, 2025 03:55:35.972178936 CET5351355194.36.144.87192.168.2.23
                                                                  Mar 4, 2025 03:55:47.549330950 CET5037953192.168.2.2381.169.136.222
                                                                  Mar 4, 2025 03:55:47.581145048 CET535037981.169.136.222192.168.2.23
                                                                  Mar 4, 2025 03:55:47.581470966 CET3987053192.168.2.2381.169.136.222
                                                                  Mar 4, 2025 03:55:47.613234997 CET533987081.169.136.222192.168.2.23
                                                                  Mar 4, 2025 03:55:47.613449097 CET4727753192.168.2.2381.169.136.222
                                                                  Mar 4, 2025 03:55:47.646336079 CET534727781.169.136.222192.168.2.23
                                                                  Mar 4, 2025 03:55:47.646580935 CET6076853192.168.2.2381.169.136.222
                                                                  Mar 4, 2025 03:55:47.682281971 CET536076881.169.136.222192.168.2.23
                                                                  Mar 4, 2025 03:55:47.682512999 CET3438053192.168.2.2381.169.136.222
                                                                  Mar 4, 2025 03:55:47.713922977 CET533438081.169.136.222192.168.2.23
                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                  Mar 4, 2025 03:53:47.729607105 CET192.168.2.23194.36.144.870x42a1Standard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:53:58.962804079 CET192.168.2.23194.36.144.870xb3e8Standard query (0)watchmepull.dyn. [malformed]256326false
                                                                  Mar 4, 2025 03:53:58.980201960 CET192.168.2.23194.36.144.870xb3e8Standard query (0)watchmepull.dyn. [malformed]256327false
                                                                  Mar 4, 2025 03:53:59.004302979 CET192.168.2.23194.36.144.870xb3e8Standard query (0)watchmepull.dyn. [malformed]256327false
                                                                  Mar 4, 2025 03:53:59.021800041 CET192.168.2.23194.36.144.870xb3e8Standard query (0)watchmepull.dyn. [malformed]256327false
                                                                  Mar 4, 2025 03:53:59.039208889 CET192.168.2.23194.36.144.870xb3e8Standard query (0)watchmepull.dyn. [malformed]256327false
                                                                  Mar 4, 2025 03:54:10.621957064 CET192.168.2.2351.158.108.2030x9a19Standard query (0)watchmepull.dyn. [malformed]256343false
                                                                  Mar 4, 2025 03:54:15.626656055 CET192.168.2.2351.158.108.2030x9a19Standard query (0)watchmepull.dyn. [malformed]256347false
                                                                  Mar 4, 2025 03:54:20.631108046 CET192.168.2.2351.158.108.2030x9a19Standard query (0)watchmepull.dyn. [malformed]256353false
                                                                  Mar 4, 2025 03:54:25.635724068 CET192.168.2.2351.158.108.2030x9a19Standard query (0)watchmepull.dyn. [malformed]256353false
                                                                  Mar 4, 2025 03:54:25.651884079 CET192.168.2.2351.158.108.2030x9a19Standard query (0)watchmepull.dyn. [malformed]256353false
                                                                  Mar 4, 2025 03:54:37.224826097 CET192.168.2.23202.61.197.1220xbec9Standard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:54:48.813278913 CET192.168.2.23185.181.61.240xba25Standard query (0)watchmepull.dyn. [malformed]256376false
                                                                  Mar 4, 2025 03:54:48.851026058 CET192.168.2.23185.181.61.240xba25Standard query (0)watchmepull.dyn. [malformed]256376false
                                                                  Mar 4, 2025 03:54:48.888778925 CET192.168.2.23185.181.61.240xba25Standard query (0)watchmepull.dyn. [malformed]256376false
                                                                  Mar 4, 2025 03:54:48.926764011 CET192.168.2.23185.181.61.240xba25Standard query (0)watchmepull.dyn. [malformed]256376false
                                                                  Mar 4, 2025 03:54:48.964699984 CET192.168.2.23185.181.61.240xba25Standard query (0)watchmepull.dyn. [malformed]256377false
                                                                  Mar 4, 2025 03:55:00.570127964 CET192.168.2.23152.53.15.1270x45e7Standard query (0)watchmepull.dyn. [malformed]256388false
                                                                  Mar 4, 2025 03:55:00.587858915 CET192.168.2.23152.53.15.1270x45e7Standard query (0)watchmepull.dyn. [malformed]256388false
                                                                  Mar 4, 2025 03:55:00.611344099 CET192.168.2.23152.53.15.1270x45e7Standard query (0)watchmepull.dyn. [malformed]256388false
                                                                  Mar 4, 2025 03:55:00.629373074 CET192.168.2.23152.53.15.1270x45e7Standard query (0)watchmepull.dyn. [malformed]256388false
                                                                  Mar 4, 2025 03:55:00.646981001 CET192.168.2.23152.53.15.1270x45e7Standard query (0)watchmepull.dyn. [malformed]256388false
                                                                  Mar 4, 2025 03:55:12.227690935 CET192.168.2.23168.235.111.720xd47aStandard query (0)watchmepull.dyn. [malformed]256400false
                                                                  Mar 4, 2025 03:55:12.315592051 CET192.168.2.23168.235.111.720xd47aStandard query (0)watchmepull.dyn. [malformed]256400false
                                                                  Mar 4, 2025 03:55:12.405065060 CET192.168.2.23168.235.111.720xd47aStandard query (0)watchmepull.dyn. [malformed]256400false
                                                                  Mar 4, 2025 03:55:12.492871046 CET192.168.2.23168.235.111.720xd47aStandard query (0)watchmepull.dyn. [malformed]256400false
                                                                  Mar 4, 2025 03:55:12.582782984 CET192.168.2.23168.235.111.720xd47aStandard query (0)watchmepull.dyn. [malformed]256400false
                                                                  Mar 4, 2025 03:55:23.876883984 CET192.168.2.23168.235.111.720x3b58Standard query (0)watchmepull.dyn. [malformed]256411false
                                                                  Mar 4, 2025 03:55:23.965079069 CET192.168.2.23168.235.111.720x3b58Standard query (0)watchmepull.dyn. [malformed]256412false
                                                                  Mar 4, 2025 03:55:24.054704905 CET192.168.2.23168.235.111.720x3b58Standard query (0)watchmepull.dyn. [malformed]256412false
                                                                  Mar 4, 2025 03:55:24.142194033 CET192.168.2.23168.235.111.720x3b58Standard query (0)watchmepull.dyn. [malformed]256412false
                                                                  Mar 4, 2025 03:55:24.229414940 CET192.168.2.23168.235.111.720x3b58Standard query (0)watchmepull.dyn. [malformed]256412false
                                                                  Mar 4, 2025 03:55:35.880068064 CET192.168.2.23194.36.144.870x80d5Standard query (0)watchmepull.dyn. [malformed]256423false
                                                                  Mar 4, 2025 03:55:35.897479057 CET192.168.2.23194.36.144.870x80d5Standard query (0)watchmepull.dyn. [malformed]256423false
                                                                  Mar 4, 2025 03:55:35.914654970 CET192.168.2.23194.36.144.870x80d5Standard query (0)watchmepull.dyn. [malformed]256423false
                                                                  Mar 4, 2025 03:55:35.937854052 CET192.168.2.23194.36.144.870x80d5Standard query (0)watchmepull.dyn. [malformed]256423false
                                                                  Mar 4, 2025 03:55:35.955112934 CET192.168.2.23194.36.144.870x80d5Standard query (0)watchmepull.dyn. [malformed]256423false
                                                                  Mar 4, 2025 03:55:47.549330950 CET192.168.2.2381.169.136.2220xceabStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:47.581470966 CET192.168.2.2381.169.136.2220xceabStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:47.613449097 CET192.168.2.2381.169.136.2220xceabStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:47.646580935 CET192.168.2.2381.169.136.2220xceabStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:47.682512999 CET192.168.2.2381.169.136.2220xceabStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                  Mar 4, 2025 03:53:47.752737045 CET194.36.144.87192.168.2.230x42a1No error (0)ohlookthereismyboats.geek46.19.143.10A (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:53:58.980030060 CET194.36.144.87192.168.2.230xb3e8Format error (1)watchmepull.dyn. [malformed]nonenone256326false
                                                                  Mar 4, 2025 03:53:59.003895998 CET194.36.144.87192.168.2.230xb3e8Format error (1)watchmepull.dyn. [malformed]nonenone256327false
                                                                  Mar 4, 2025 03:53:59.021586895 CET194.36.144.87192.168.2.230xb3e8Format error (1)watchmepull.dyn. [malformed]nonenone256327false
                                                                  Mar 4, 2025 03:53:59.038994074 CET194.36.144.87192.168.2.230xb3e8Format error (1)watchmepull.dyn. [malformed]nonenone256327false
                                                                  Mar 4, 2025 03:53:59.056427002 CET194.36.144.87192.168.2.230xb3e8Format error (1)watchmepull.dyn. [malformed]nonenone256327false
                                                                  Mar 4, 2025 03:54:25.651680946 CET51.158.108.203192.168.2.230x9a19Format error (1)watchmepull.dyn. [malformed]nonenone256353false
                                                                  Mar 4, 2025 03:54:25.668046951 CET51.158.108.203192.168.2.230x9a19Format error (1)watchmepull.dyn. [malformed]nonenone256353false
                                                                  Mar 4, 2025 03:54:37.242525101 CET202.61.197.122192.168.2.230xbec9No error (0)ohlookthereismyboats.geek46.19.143.10A (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:00.587670088 CET152.53.15.127192.168.2.230x45e7Format error (1)watchmepull.dyn. [malformed]nonenone256388false
                                                                  Mar 4, 2025 03:55:00.611233950 CET152.53.15.127192.168.2.230x45e7Format error (1)watchmepull.dyn. [malformed]nonenone256388false
                                                                  Mar 4, 2025 03:55:00.628551960 CET152.53.15.127192.168.2.230x45e7Format error (1)watchmepull.dyn. [malformed]nonenone256388false
                                                                  Mar 4, 2025 03:55:00.646812916 CET152.53.15.127192.168.2.230x45e7Format error (1)watchmepull.dyn. [malformed]nonenone256388false
                                                                  Mar 4, 2025 03:55:00.671456099 CET152.53.15.127192.168.2.230x45e7Format error (1)watchmepull.dyn. [malformed]nonenone256388false
                                                                  Mar 4, 2025 03:55:35.897272110 CET194.36.144.87192.168.2.230x80d5Format error (1)watchmepull.dyn. [malformed]nonenone256423false
                                                                  Mar 4, 2025 03:55:35.914556980 CET194.36.144.87192.168.2.230x80d5Format error (1)watchmepull.dyn. [malformed]nonenone256423false
                                                                  Mar 4, 2025 03:55:35.937705994 CET194.36.144.87192.168.2.230x80d5Format error (1)watchmepull.dyn. [malformed]nonenone256423false
                                                                  Mar 4, 2025 03:55:35.955014944 CET194.36.144.87192.168.2.230x80d5Format error (1)watchmepull.dyn. [malformed]nonenone256423false
                                                                  Mar 4, 2025 03:55:35.972178936 CET194.36.144.87192.168.2.230x80d5Format error (1)watchmepull.dyn. [malformed]nonenone256423false
                                                                  Mar 4, 2025 03:55:47.581145048 CET81.169.136.222192.168.2.230xceabName error (3)ohlookthereismyboats.geeknonenoneA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:47.613234997 CET81.169.136.222192.168.2.230xceabName error (3)ohlookthereismyboats.geeknonenoneA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:47.646336079 CET81.169.136.222192.168.2.230xceabName error (3)ohlookthereismyboats.geeknonenoneA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:47.682281971 CET81.169.136.222192.168.2.230xceabName error (3)ohlookthereismyboats.geeknonenoneA (IP address)IN (0x0001)false
                                                                  Mar 4, 2025 03:55:47.713922977 CET81.169.136.222192.168.2.230xceabName error (3)ohlookthereismyboats.geeknonenoneA (IP address)IN (0x0001)false

                                                                  System Behavior

                                                                  Start time (UTC):02:53:47
                                                                  Start date (UTC):04/03/2025
                                                                  Path:/tmp/zerx86.elf
                                                                  Arguments:/tmp/zerx86.elf
                                                                  File size:46140 bytes
                                                                  MD5 hash:c4af54f2b2f4ca83586632ecb973c9ae

                                                                  Start time (UTC):02:53:47
                                                                  Start date (UTC):04/03/2025
                                                                  Path:/tmp/zerx86.elf
                                                                  Arguments:-
                                                                  File size:46140 bytes
                                                                  MD5 hash:c4af54f2b2f4ca83586632ecb973c9ae

                                                                  Start time (UTC):02:53:47
                                                                  Start date (UTC):04/03/2025
                                                                  Path:/tmp/zerx86.elf
                                                                  Arguments:-
                                                                  File size:46140 bytes
                                                                  MD5 hash:c4af54f2b2f4ca83586632ecb973c9ae