Edit tour

Linux Analysis Report
zerarm7.elf

Overview

General Information

Sample name:zerarm7.elf
Analysis ID:1631634
MD5:eaabc7aad745c2d680ea6bfc9444abbb
SHA1:c1823744d9b6d8ebc3e268b769761816a3b7e707
SHA256:912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1631634
Start date and time:2025-03-07 13:07:13 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 44s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zerarm7.elf
Detection:MAL
Classification:mal52.troj.linELF@0/0@19/0
Command:/tmp/zerarm7.elf
PID:6233
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate a lot
Standard Error:
  • system is lnxubuntu20
  • zerarm7.elf (PID: 6233, Parent: 6149, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/zerarm7.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: zerarm7.elfReversingLabs: Detection: 42%

Networking

barindex
Source: global trafficDNS traffic detected: malformed DNS query: watchmepull.dyn. [malformed]
Source: global trafficTCP traffic: 192.168.2.23:54352 -> 45.147.251.145:1440
Source: global trafficTCP traffic: 192.168.2.23:56732 -> 64.227.79.152:1440
Source: /tmp/zerarm7.elf (PID: 6233)Socket: 127.0.0.1:39148Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: global trafficDNS traffic detected: DNS query: ohlookthereismyboats.geek
Source: global trafficDNS traffic detected: DNS query: watchmepull.dyn. [malformed]
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.troj.linELF@0/0@19/0
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/6233/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1582/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/3088/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/230/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/110/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/231/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/111/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/232/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1579/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/112/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/233/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1699/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/113/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/234/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1335/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1698/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/114/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/235/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1334/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1576/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/2302/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/115/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/236/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/116/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/237/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/117/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/118/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/910/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/119/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/912/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/10/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/2307/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/11/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/918/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/12/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/13/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/14/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/15/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/16/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/17/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/18/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1594/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/120/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/121/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1349/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/122/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/243/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/123/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/2/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/124/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/3/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/4/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/125/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/126/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1344/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1465/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1586/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/127/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/6/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/248/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/128/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/249/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1463/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/800/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/9/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/801/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/20/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/21/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1900/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/22/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/23/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/24/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/25/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/26/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/27/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/28/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/29/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/491/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/250/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/130/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/251/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/252/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/132/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/253/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/254/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/255/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/4509/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/256/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1599/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/257/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1477/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/379/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/258/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1476/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/259/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1475/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/936/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/30/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/2208/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/35/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1809/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/1494/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/260/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)File opened: /proc/261/commJump to behavior
Source: /tmp/zerarm7.elf (PID: 6233)Queries kernel information via 'uname': Jump to behavior
Source: zerarm7.elf, 6233.1.0000558a7eaa7000.0000558a7ebf7000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: zerarm7.elf, 6233.1.0000558a7eaa7000.0000558a7ebf7000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: zerarm7.elf, 6233.1.00007ffcf3354000.00007ffcf3375000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: zerarm7.elf, 6233.1.00007ffcf3354000.00007ffcf3375000.rw-.sdmpBinary or memory string: ox86_64/usr/bin/qemu-arm/tmp/zerarm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zerarm7.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1631634 Sample: zerarm7.elf Startdate: 07/03/2025 Architecture: LINUX Score: 52 14 watchmepull.dyn. [malformed] 2->14 16 45.147.251.145, 1440, 54352, 54354 RACKMARKTES Germany 2->16 18 4 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 8 zerarm7.elf 2->8         started        signatures3 22 Sends malformed DNS queries 14->22 process4 process5 10 zerarm7.elf 8->10         started        process6 12 zerarm7.elf 10->12         started       
SourceDetectionScannerLabelLink
zerarm7.elf42%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
ohlookthereismyboats.geek
64.227.79.152
truefalse
    high
    watchmepull.dyn. [malformed]
    unknown
    unknownfalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      64.227.79.152
      ohlookthereismyboats.geekUnited States
      14061DIGITALOCEAN-ASNUSfalse
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      45.147.251.145
      unknownGermany
      197518RACKMARKTESfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
      91.189.91.43ub8ehJSePAfc9FYqZIT6.mpsl.elfGet hashmaliciousUnknownBrowse
        ub8ehJSePAfc9FYqZIT6.arm5.elfGet hashmaliciousUnknownBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            ub8ehJSePAfc9FYqZIT6.mips.elfGet hashmaliciousUnknownBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                ub8ehJSePAfc9FYqZIT6.arm7.elfGet hashmaliciousMiraiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        na.elfGet hashmaliciousPrometeiBrowse
                          45.147.251.145zerx86.elfGet hashmaliciousUnknownBrowse
                            zerarm.elfGet hashmaliciousUnknownBrowse
                              zermpsl.elfGet hashmaliciousUnknownBrowse
                                zerppc.elfGet hashmaliciousUnknownBrowse
                                  zermips.elfGet hashmaliciousUnknownBrowse
                                    zersh4.elfGet hashmaliciousUnknownBrowse
                                      zerspc.elfGet hashmaliciousUnknownBrowse
                                        zerm68k.elfGet hashmaliciousUnknownBrowse
                                          zermpsl.elfGet hashmaliciousUnknownBrowse
                                            zerarm5.elfGet hashmaliciousUnknownBrowse
                                              91.189.91.42ub8ehJSePAfc9FYqZIT6.mpsl.elfGet hashmaliciousUnknownBrowse
                                                ub8ehJSePAfc9FYqZIT6.arm5.elfGet hashmaliciousUnknownBrowse
                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                    ub8ehJSePAfc9FYqZIT6.mips.elfGet hashmaliciousUnknownBrowse
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                        ub8ehJSePAfc9FYqZIT6.arm7.elfGet hashmaliciousMiraiBrowse
                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  ohlookthereismyboats.geekjklarm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 64.227.79.152
                                                                  splmpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 64.227.79.152
                                                                  nabmips.elfGet hashmaliciousUnknownBrowse
                                                                  • 64.227.79.152
                                                                  splmips.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  nabarm.elfGet hashmaliciousUnknownBrowse
                                                                  • 64.227.79.152
                                                                  splm68k.elfGet hashmaliciousUnknownBrowse
                                                                  • 64.227.79.152
                                                                  jklsh4.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  splarm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 193.70.94.93
                                                                  nabarm7.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  splarm7.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  CANONICAL-ASGBub8ehJSePAfc9FYqZIT6.mpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  ub8ehJSePAfc9FYqZIT6.arm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  ub8ehJSePAfc9FYqZIT6.mips.elfGet hashmaliciousUnknownBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  ub8ehJSePAfc9FYqZIT6.arm7.elfGet hashmaliciousMiraiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  sshd.elfGet hashmaliciousUnknownBrowse
                                                                  • 185.125.190.26
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 91.189.91.42
                                                                  RACKMARKTESzerx86.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zerarm.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zermpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zerppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zermips.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zersh4.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zerspc.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zerm68k.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zermpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 45.147.251.145
                                                                  DIGITALOCEAN-ASNUScbr.ppc.elfGet hashmaliciousMiraiBrowse
                                                                  • 134.123.80.30
                                                                  https://oesonline.netGet hashmaliciousUnknownBrowse
                                                                  • 104.248.224.96
                                                                  https://sfo2.digitaloceanspaces.com/mo8043/jm1208Get hashmaliciousUnknownBrowse
                                                                  • 138.68.32.225
                                                                  nklarm.elfGet hashmaliciousUnknownBrowse
                                                                  • 138.68.122.176
                                                                  JwZU4m3Nsi.batGet hashmaliciousQuasarBrowse
                                                                  • 138.197.66.62
                                                                  cbr.mips.elfGet hashmaliciousMiraiBrowse
                                                                  • 134.123.157.240
                                                                  cbr.ppc.elfGet hashmaliciousMiraiBrowse
                                                                  • 134.209.166.129
                                                                  cbr.arm7.elfGet hashmaliciousMiraiBrowse
                                                                  • 134.209.44.107
                                                                  nabsh4.elfGet hashmaliciousUnknownBrowse
                                                                  • 174.138.24.28
                                                                  Ocean-City.pdfGet hashmaliciousUnknownBrowse
                                                                  • 139.59.245.11
                                                                  INIT7CHub8ehJSePAfc9FYqZIT6.mpsl.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  ub8ehJSePAfc9FYqZIT6.arm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  ub8ehJSePAfc9FYqZIT6.mips.elfGet hashmaliciousUnknownBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  ub8ehJSePAfc9FYqZIT6.arm7.elfGet hashmaliciousMiraiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                  • 109.202.202.202
                                                                  No context
                                                                  No context
                                                                  No created / dropped files found
                                                                  File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                                                                  Entropy (8bit):6.007254950659843
                                                                  TrID:
                                                                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                  File name:zerarm7.elf
                                                                  File size:74'460 bytes
                                                                  MD5:eaabc7aad745c2d680ea6bfc9444abbb
                                                                  SHA1:c1823744d9b6d8ebc3e268b769761816a3b7e707
                                                                  SHA256:912bfae6bac55c7a62b01ba0926e88ddae64c892757e6e7e26f94ff032422b6c
                                                                  SHA512:371cb11d0555fe0ef01e36bc6fa798cc3526a4c813a64203651d3a6aa272d2146ab2823dcbff479b5a8dc413865d586d9f3f3919ce05fe51c5cce69621f81d98
                                                                  SSDEEP:1536:tdn6SsyWpUI66PvdMg3+rh5z1OZtBlDwwOLtwyGn9a9luOZciYvxLr:ZsyWUgvdMA+947BlDwwOLtwyGLu+vxn
                                                                  TLSH:30730649F8819F11D5E822BAFA1E018D332767A8E3EF7212DD105F1567CA92F0E77912
                                                                  File Content Preview:.ELF..............(.........4...4 ......4. ...(........p$...$...$...................................<...<...............<...<...<...X...t2..............@...@...@...................Q.td..................................-...L..................@-.,@...0....S

                                                                  ELF header

                                                                  Class:ELF32
                                                                  Data:2's complement, little endian
                                                                  Version:1 (current)
                                                                  Machine:ARM
                                                                  Version Number:0x1
                                                                  Type:EXEC (Executable file)
                                                                  OS/ABI:UNIX - System V
                                                                  ABI Version:0
                                                                  Entry Point Address:0x8194
                                                                  Flags:0x4000002
                                                                  ELF Header Size:52
                                                                  Program Header Offset:52
                                                                  Program Header Size:32
                                                                  Number of Program Headers:5
                                                                  Section Header Offset:73780
                                                                  Section Header Size:40
                                                                  Number of Section Headers:17
                                                                  Header String Table Index:16
                                                                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                  NULL0x00x00x00x00x0000
                                                                  .initPROGBITS0x80d40xd40x100x00x6AX004
                                                                  .textPROGBITS0x80f00xf00x112780x00x6AX0016
                                                                  .finiPROGBITS0x193680x113680x100x00x6AX004
                                                                  .rodataPROGBITS0x193780x113780x8940x00x2A004
                                                                  .ARM.extabPROGBITS0x19c0c0x11c0c0x180x00x2A004
                                                                  .ARM.exidxARM_EXIDX0x19c240x11c240x1180x00x82AL204
                                                                  .eh_framePROGBITS0x21d3c0x11d3c0x40x00x3WA004
                                                                  .tbssNOBITS0x21d400x11d400x80x00x403WAT004
                                                                  .init_arrayINIT_ARRAY0x21d400x11d400x40x00x3WA004
                                                                  .fini_arrayFINI_ARRAY0x21d440x11d440x40x00x3WA004
                                                                  .jcrPROGBITS0x21d480x11d480x40x00x3WA004
                                                                  .gotPROGBITS0x21d4c0x11d4c0xa80x40x3WA004
                                                                  .dataPROGBITS0x21df40x11df40x1a00x00x3WA004
                                                                  .bssNOBITS0x21f940x11f940x301c0x00x3WA004
                                                                  .ARM.attributesARM_ATTRIBUTES0x00x11f940x160x00x0001
                                                                  .shstrtabSTRTAB0x00x11faa0x880x00x0001
                                                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                  EXIDX0x11c240x19c240x19c240x1180x1184.47300x4R 0x4.ARM.exidx
                                                                  LOAD0x00x80000x80000x11d3c0x11d3c6.02670x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
                                                                  LOAD0x11d3c0x21d3c0x21d3c0x2580x32743.53350x6RW 0x8000.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
                                                                  TLS0x11d400x21d400x21d400x00x80.00000x4R 0x4.tbss
                                                                  GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                                  Download Network PCAP: filteredfull

                                                                  • Total Packets: 61
                                                                  • 1440 undefined
                                                                  • 443 (HTTPS)
                                                                  • 80 (HTTP)
                                                                  • 53 (DNS)
                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Mar 7, 2025 13:07:59.956321001 CET543521440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:07:59.961451054 CET14405435245.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:07:59.963143110 CET543521440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:07:59.978329897 CET543521440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:07:59.983428955 CET14405435245.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:07:59.983556986 CET543521440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:07:59.988681078 CET14405435245.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:02.330403090 CET42836443192.168.2.2391.189.91.43
                                                                  Mar 7, 2025 13:08:03.098330975 CET4251680192.168.2.23109.202.202.202
                                                                  Mar 7, 2025 13:08:09.987427950 CET543521440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:09.995527983 CET14405435245.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:17.176419020 CET43928443192.168.2.2391.189.91.42
                                                                  Mar 7, 2025 13:08:21.326710939 CET14405435245.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:21.327178001 CET543521440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:21.332472086 CET14405435245.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:22.487209082 CET543541440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:22.493465900 CET14405435445.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:22.493539095 CET543541440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:22.494462013 CET543541440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:22.499475956 CET14405435445.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:22.499541044 CET543541440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:22.504545927 CET14405435445.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:29.462693930 CET42836443192.168.2.2391.189.91.43
                                                                  Mar 7, 2025 13:08:33.558026075 CET4251680192.168.2.23109.202.202.202
                                                                  Mar 7, 2025 13:08:43.891380072 CET14405435445.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:43.891834021 CET543541440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:43.896994114 CET14405435445.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:44.990287066 CET543561440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:44.995358944 CET14405435645.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:44.995472908 CET543561440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:44.996968985 CET543561440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:45.002053976 CET14405435645.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:45.002126932 CET543561440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:08:45.007198095 CET14405435645.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:08:58.130695105 CET43928443192.168.2.2391.189.91.42
                                                                  Mar 7, 2025 13:09:06.395817995 CET14405435645.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:06.396193027 CET543561440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:06.401315928 CET14405435645.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:07.416140079 CET543581440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:07.421253920 CET14405435845.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:07.421345949 CET543581440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:07.422777891 CET543581440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:07.427845955 CET14405435845.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:07.427917957 CET543581440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:07.432971001 CET14405435845.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:17.427925110 CET543581440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:17.433481932 CET14405435845.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:28.812444925 CET14405435845.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:28.812762976 CET543581440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:28.817887068 CET14405435845.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:29.977281094 CET543601440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:29.982449055 CET14405436045.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:29.982773066 CET543601440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:29.984118938 CET543601440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:29.989262104 CET14405436045.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:29.989342928 CET543601440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:29.994394064 CET14405436045.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:51.344120026 CET14405436045.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:51.344513893 CET543601440192.168.2.2345.147.251.145
                                                                  Mar 7, 2025 13:09:51.349750042 CET14405436045.147.251.145192.168.2.23
                                                                  Mar 7, 2025 13:09:52.369672060 CET567321440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:09:52.374836922 CET14405673264.227.79.152192.168.2.23
                                                                  Mar 7, 2025 13:09:52.375066042 CET567321440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:09:52.376936913 CET567321440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:09:52.381983995 CET14405673264.227.79.152192.168.2.23
                                                                  Mar 7, 2025 13:09:52.382098913 CET567321440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:09:52.387104988 CET14405673264.227.79.152192.168.2.23
                                                                  Mar 7, 2025 13:10:03.087949038 CET14405673264.227.79.152192.168.2.23
                                                                  Mar 7, 2025 13:10:03.088300943 CET567321440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:10:03.093453884 CET14405673264.227.79.152192.168.2.23
                                                                  Mar 7, 2025 13:10:04.128865004 CET567341440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:10:04.134160042 CET14405673464.227.79.152192.168.2.23
                                                                  Mar 7, 2025 13:10:04.134269953 CET567341440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:10:04.135534048 CET567341440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:10:04.140634060 CET14405673464.227.79.152192.168.2.23
                                                                  Mar 7, 2025 13:10:04.140717030 CET567341440192.168.2.2364.227.79.152
                                                                  Mar 7, 2025 13:10:04.145915985 CET14405673464.227.79.152192.168.2.23
                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Mar 7, 2025 13:07:59.929323912 CET3460153192.168.2.2351.158.108.203
                                                                  Mar 7, 2025 13:07:59.945211887 CET533460151.158.108.203192.168.2.23
                                                                  Mar 7, 2025 13:08:22.330569029 CET3449353192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:08:22.360377073 CET533449381.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:08:22.361943007 CET5037953192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:08:22.392138958 CET535037981.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:08:22.393269062 CET5529653192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:08:22.423715115 CET535529681.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:08:22.425314903 CET4707253192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:08:22.455121040 CET534707281.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:08:22.456787109 CET4771653192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:08:22.486430883 CET534771681.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:08:44.894109964 CET6009653192.168.2.23202.61.197.122
                                                                  Mar 7, 2025 13:08:44.913000107 CET5360096202.61.197.122192.168.2.23
                                                                  Mar 7, 2025 13:08:44.913969040 CET4109453192.168.2.23202.61.197.122
                                                                  Mar 7, 2025 13:08:44.932293892 CET5341094202.61.197.122192.168.2.23
                                                                  Mar 7, 2025 13:08:44.933237076 CET5200453192.168.2.23202.61.197.122
                                                                  Mar 7, 2025 13:08:44.951071978 CET5352004202.61.197.122192.168.2.23
                                                                  Mar 7, 2025 13:08:44.952282906 CET4105853192.168.2.23202.61.197.122
                                                                  Mar 7, 2025 13:08:44.970242023 CET5341058202.61.197.122192.168.2.23
                                                                  Mar 7, 2025 13:08:44.971595049 CET5077853192.168.2.23202.61.197.122
                                                                  Mar 7, 2025 13:08:44.989680052 CET5350778202.61.197.122192.168.2.23
                                                                  Mar 7, 2025 13:09:07.399235010 CET4305753192.168.2.2351.158.108.203
                                                                  Mar 7, 2025 13:09:07.415231943 CET534305751.158.108.203192.168.2.23
                                                                  Mar 7, 2025 13:09:29.815743923 CET3402753192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:09:29.845422983 CET533402781.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:09:29.847774029 CET5730053192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:09:29.877464056 CET535730081.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:09:29.879825115 CET4069153192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:09:29.909724951 CET534069181.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:09:29.912175894 CET5317153192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:09:29.942189932 CET535317181.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:09:29.945070982 CET4262553192.168.2.2381.169.136.222
                                                                  Mar 7, 2025 13:09:29.975073099 CET534262581.169.136.222192.168.2.23
                                                                  Mar 7, 2025 13:09:52.350028992 CET4279653192.168.2.23194.36.144.87
                                                                  Mar 7, 2025 13:09:52.367364883 CET5342796194.36.144.87192.168.2.23
                                                                  Mar 7, 2025 13:10:04.091520071 CET5761953192.168.2.23185.181.61.24
                                                                  Mar 7, 2025 13:10:04.127893925 CET5357619185.181.61.24192.168.2.23
                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                  Mar 7, 2025 13:07:59.929323912 CET192.168.2.2351.158.108.2030xf84fStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:08:22.330569029 CET192.168.2.2381.169.136.2220x9bfaStandard query (0)watchmepull.dyn. [malformed]256438false
                                                                  Mar 7, 2025 13:08:22.361943007 CET192.168.2.2381.169.136.2220x9bfaStandard query (0)watchmepull.dyn. [malformed]256438false
                                                                  Mar 7, 2025 13:08:22.393269062 CET192.168.2.2381.169.136.2220x9bfaStandard query (0)watchmepull.dyn. [malformed]256438false
                                                                  Mar 7, 2025 13:08:22.425314903 CET192.168.2.2381.169.136.2220x9bfaStandard query (0)watchmepull.dyn. [malformed]256438false
                                                                  Mar 7, 2025 13:08:22.456787109 CET192.168.2.2381.169.136.2220x9bfaStandard query (0)watchmepull.dyn. [malformed]256438false
                                                                  Mar 7, 2025 13:08:44.894109964 CET192.168.2.23202.61.197.1220x2344Standard query (0)watchmepull.dyn. [malformed]256460false
                                                                  Mar 7, 2025 13:08:44.913969040 CET192.168.2.23202.61.197.1220x2344Standard query (0)watchmepull.dyn. [malformed]256460false
                                                                  Mar 7, 2025 13:08:44.933237076 CET192.168.2.23202.61.197.1220x2344Standard query (0)watchmepull.dyn. [malformed]256460false
                                                                  Mar 7, 2025 13:08:44.952282906 CET192.168.2.23202.61.197.1220x2344Standard query (0)watchmepull.dyn. [malformed]256460false
                                                                  Mar 7, 2025 13:08:44.971595049 CET192.168.2.23202.61.197.1220x2344Standard query (0)watchmepull.dyn. [malformed]256460false
                                                                  Mar 7, 2025 13:09:07.399235010 CET192.168.2.2351.158.108.2030xad59Standard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:09:29.815743923 CET192.168.2.2381.169.136.2220x6ab5Standard query (0)watchmepull.dyn. [malformed]256505false
                                                                  Mar 7, 2025 13:09:29.847774029 CET192.168.2.2381.169.136.2220x6ab5Standard query (0)watchmepull.dyn. [malformed]256505false
                                                                  Mar 7, 2025 13:09:29.879825115 CET192.168.2.2381.169.136.2220x6ab5Standard query (0)watchmepull.dyn. [malformed]256505false
                                                                  Mar 7, 2025 13:09:29.912175894 CET192.168.2.2381.169.136.2220x6ab5Standard query (0)watchmepull.dyn. [malformed]256505false
                                                                  Mar 7, 2025 13:09:29.945070982 CET192.168.2.2381.169.136.2220x6ab5Standard query (0)watchmepull.dyn. [malformed]256505false
                                                                  Mar 7, 2025 13:09:52.350028992 CET192.168.2.23194.36.144.870x23dStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:10:04.091520071 CET192.168.2.23185.181.61.240x8cfcStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                  Mar 7, 2025 13:07:59.945211887 CET51.158.108.203192.168.2.230xf84fNo error (0)ohlookthereismyboats.geek64.227.79.152A (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:07:59.945211887 CET51.158.108.203192.168.2.230xf84fNo error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:09:07.415231943 CET51.158.108.203192.168.2.230xad59No error (0)ohlookthereismyboats.geek64.227.79.152A (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:09:07.415231943 CET51.158.108.203192.168.2.230xad59No error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:09:52.367364883 CET194.36.144.87192.168.2.230x23dNo error (0)ohlookthereismyboats.geek193.70.94.93A (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:09:52.367364883 CET194.36.144.87192.168.2.230x23dNo error (0)ohlookthereismyboats.geek64.227.79.152A (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:10:04.127893925 CET185.181.61.24192.168.2.230x8cfcNo error (0)ohlookthereismyboats.geek64.227.79.152A (IP address)IN (0x0001)false
                                                                  Mar 7, 2025 13:10:04.127893925 CET185.181.61.24192.168.2.230x8cfcNo error (0)ohlookthereismyboats.geek193.70.94.93A (IP address)IN (0x0001)false

                                                                  System Behavior

                                                                  Start time (UTC):12:07:59
                                                                  Start date (UTC):07/03/2025
                                                                  Path:/tmp/zerarm7.elf
                                                                  Arguments:-
                                                                  File size:4956856 bytes
                                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                  Start time (UTC):12:07:59
                                                                  Start date (UTC):07/03/2025
                                                                  Path:/tmp/zerarm7.elf
                                                                  Arguments:-
                                                                  File size:4956856 bytes
                                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1