Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
ppc.elf

Overview

General Information

Sample name:ppc.elf
Analysis ID:1639657
MD5:91ce138c951ff08297796b79daa48298
SHA1:8e7352f909acf760eb6a5b21ddb2406301916c7f
SHA256:bed004af38c7f2ca314dab0d275591483efcd431639b7451c78f8f078e682d50
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1639657
Start date and time:2025-03-16 02:27:37 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 41s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:ppc.elf
Detection:MAL
Classification:mal48.linELF@0/2@0/0
  • Excluded IPs from analysis (whitelisted): 8.8.8.8

Runtime Messages

Command:/tmp/ppc.elf
PID:5592
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:

Process Tree

  • system is lnxubuntu20
  • ppc.elf (PID: 5592, Parent: 5509, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/ppc.elf
    • ppc.elf New Fork (PID: 5594, Parent: 5592)
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Persistence and Installation Behavior
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: ppc.elfVirustotal: Detection: 9%Perma Link
Source: ppc.elfReversingLabs: Detection: 13%
Source: global trafficTCP traffic: 192.168.2.14:33668 -> 156.244.45.113:46164
Source: /tmp/ppc.elf (PID: 5594)Socket: 127.0.0.1:22448Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.45.113
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.45.113
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.45.113
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.45.113
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.45.113
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.45.113
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/2@0/0
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3760/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3761/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/1583/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/2672/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/110/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3759/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/111/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/112/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/113/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/234/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/1577/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/114/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/235/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/115/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/116/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/117/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/118/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/119/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3875/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/10/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3758/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/11/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/12/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/13/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/14/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/15/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/16/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/17/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/18/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/19/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/1593/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/240/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/120/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3094/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/121/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/242/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3406/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/122/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/243/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/2/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/123/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/244/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/1589/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/124/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/245/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/125/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/4/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/246/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3402/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/126/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/5/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/247/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/127/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/6/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/248/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/128/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/7/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/249/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/8/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/129/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/9/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/803/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/20/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/806/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/21/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/807/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/928/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/22/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/23/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/24/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/25/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/26/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/27/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/28/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/29/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3420/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/250/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/130/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/251/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/131/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/252/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/132/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/253/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/254/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/255/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/135/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/256/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/1599/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/257/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/378/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/258/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/3412/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/259/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/30/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/35/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/1371/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/260/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)File opened: /proc/261/cmdlineJump to behavior
Source: /tmp/ppc.elf (PID: 5592)Queries kernel information via 'uname': Jump to behavior
Source: ppc.elf, 5592.1.00007fffcd10a000.00007fffcd12b000.rw-.sdmpBinary or memory string: PV/tmp/qemu-open.Lffea4\D
Source: ppc.elf, 5592.1.00007f38e0025000.00007f38e002b000.rw-.sdmpBinary or memory string: vmware
Source: ppc.elf, 5592.1.00005650cd4cf000.00005650cd57f000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: ppc.elf, 5592.1.00005650cd4cf000.00005650cd57f000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 5592.1.00007fffcd10a000.00007fffcd12b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: ppc.elf, 5592.1.00007fffcd10a000.00007fffcd12b000.rw-.sdmpBinary or memory string: %s/qemu-op
Source: ppc.elf, 5592.1.00007fffcd10a000.00007fffcd12b000.rw-.sdmpBinary or memory string: Ox86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf
Source: ppc.elf, 5592.1.00007fffcd10a000.00007fffcd12b000.rw-.sdmpBinary or memory string: /tmp/qemu-open.Lffea4
Source: ppc.elf, 5592.1.00007fffcd10a000.00007fffcd12b000.rw-.sdmpBinary or memory string: MPDIR%s/qemu-op
Source: ppc.elf, 5592.1.00007f38e0025000.00007f38e002b000.rw-.sdmpBinary or memory string: !qemu-arm
Source: ppc.elf, 5592.1.00007f38e0025000.00007f38e002b000.rw-.sdmpBinary or memory string: !!a1gAWFxuAXsFWUgBRQAA!!a1gAWFxuAXsAWUgKRXgA!!a1gAWFxuAXsAWEgJR3IA!!a10CWFxuAHsGWVcWQHAA!!a10CWFxuAHsGWVcWQHUA!!aFwAWF9uA3sGW0gLRgAA!!aFwAWFlpG2QBW0gJTwAA!!qemu-arm2QBW0gJTwAA!

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1639657 Sample: ppc.elf Startdate: 16/03/2025 Architecture: LINUX Score: 48 11 156.244.45.113, 33668, 46164 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 2->11 13 Multi AV Scanner detection for submitted file 2->13 7 ppc.elf 2->7         started        signatures3 process4 process5 9 ppc.elf 7->9         started       

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ppc.elf9%VirustotalBrowse
ppc.elf14%ReversingLabsLinux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
156.244.45.113
unknownSeychelles
132839POWERLINE-AS-APPOWERLINEDATACENTERHKfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
156.244.45.113arm.elfGet hashmaliciousUnknownBrowse

    Domains

    ⊘No context

    ASNs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    POWERLINE-AS-APPOWERLINEDATACENTERHKarm.elfGet hashmaliciousUnknownBrowse
    • 156.244.45.113
    KKveTTgaAAsecNNaaaa.x86.elfGet hashmaliciousUnknownBrowse
    • 147.78.152.244
    boatnet.mips.elfGet hashmaliciousMiraiBrowse
    • 156.253.227.112
    boatnet.ppc.elfGet hashmaliciousMiraiBrowse
    • 156.253.227.112
    boatnet.m68k.elfGet hashmaliciousMiraiBrowse
    • 156.253.227.112
    boatnet.sh4.elfGet hashmaliciousMiraiBrowse
    • 156.253.227.112
    boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
    • 156.253.227.112
    boatnet.spc.elfGet hashmaliciousMiraiBrowse
    • 156.253.227.112
    boatnet.x86.elfGet hashmaliciousMiraiBrowse
    • 156.253.227.112
    http://pastorizaplastics.comGet hashmaliciousUnknownBrowse
    • 154.89.52.219

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    Process:/tmp/ppc.elf
    File Type:ASCII text, with no line terminators
    Category:dropped
    Size (bytes):13
    Entropy (8bit):3.1808329872054406
    Encrypted:false
    SSDEEP:3:Tg/cA3:TgkG
    MD5:B4B673815F84B3C325AF4B636EF3F7E8
    SHA1:0D795B3294AE13B67B5977896D2C28B777A2216A
    SHA-256:BA14832061879D30329B0378D53F56199440D741567578D0482343247629A00C
    SHA-512:DC4969EF1C3132480F4001EB78586B888D6E75CE84121CDF2B9679DA13062DC56604B4E7F1B1BBD205F9CC707B4BF311AAA9C19F0C67224026F270C18FDCD7EF
    Malicious:false
    Reputation:moderate, very likely benign file
    Preview:/tmp/ppc.elf.
    Process:/tmp/ppc.elf
    File Type:ASCII text, with no line terminators
    Category:dropped
    Size (bytes):13
    Entropy (8bit):3.1808329872054406
    Encrypted:false
    SSDEEP:3:Tg/cA3:TgkG
    MD5:B4B673815F84B3C325AF4B636EF3F7E8
    SHA1:0D795B3294AE13B67B5977896D2C28B777A2216A
    SHA-256:BA14832061879D30329B0378D53F56199440D741567578D0482343247629A00C
    SHA-512:DC4969EF1C3132480F4001EB78586B888D6E75CE84121CDF2B9679DA13062DC56604B4E7F1B1BBD205F9CC707B4BF311AAA9C19F0C67224026F270C18FDCD7EF
    Malicious:false
    Reputation:moderate, very likely benign file
    Preview:/tmp/ppc.elf.

    Static File Info

    General

    File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
    Entropy (8bit):6.343406798427541
    TrID:
    • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
    • ELF Executable and Linkable format (generic) (4004/1) 49.84%
    File name:ppc.elf
    File size:78'992 bytes
    MD5:91ce138c951ff08297796b79daa48298
    SHA1:8e7352f909acf760eb6a5b21ddb2406301916c7f
    SHA256:bed004af38c7f2ca314dab0d275591483efcd431639b7451c78f8f078e682d50
    SHA512:0c192f41117db23a256a88d5f600e4b93ccb4a1c3c2ce8e1f3db0fc542a399dba21f734448832cfa62b2ad0aa31d842c2e56e0d0c64496c233f48ebf7aee579c
    SSDEEP:1536:KqeH5KUIXtOyE7QPiN6hW8O48UuXECQfknCgEG9CnbHSrR8:Daat2TUuXEyCn2R8
    TLSH:8A735C41B7190987E1B35DF03B3F2BE187EA8D4221F46248785FBB459672E322446EDD
    File Content Preview:.ELF...........................4..2......4. ...(......................1T..1T..............1...1...1.......F.........dt.Q.............................!..|......$H...H......$8!. |...N.. .!..|.......?.........2...../...@..`= ..;.1......+../...A..$8...}).....

    Static ELF Info

    ELF header

    Class:ELF32
    Data:2's complement, big endian
    Version:1 (current)
    Machine:PowerPC
    Version Number:0x1
    Type:EXEC (Executable file)
    OS/ABI:UNIX - System V
    ABI Version:0
    Entry Point Address:0x100001f8
    Flags:0x0
    ELF Header Size:52
    Program Header Offset:52
    Program Header Size:32
    Number of Program Headers:3
    Section Header Offset:78512
    Section Header Size:40
    Number of Section Headers:12
    Header String Table Index:11

    Sections

    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
    NULL0x00x00x00x00x0000
    .initPROGBITS0x100000940x940x240x00x6AX004
    .textPROGBITS0x100000b80xb80x119f40x00x6AX004
    .finiPROGBITS0x10011aac0x11aac0x200x00x6AX004
    .rodataPROGBITS0x10011ad00x11ad00x16840x00x2A008
    .ctorsPROGBITS0x100231c40x131c40x80x00x3WA004
    .dtorsPROGBITS0x100231cc0x131cc0x80x00x3WA004
    .dataPROGBITS0x100231d80x131d80x840x00x3WA004
    .sdataPROGBITS0x1002325c0x1325c0x90x00x3WA004
    .sbssNOBITS0x100232680x132650x280x00x3WA004
    .bssNOBITS0x100232900x132650x46280x00x3WA008
    .shstrtabSTRTAB0x00x132650x4b0x00x0001

    Program Segments

    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
    LOAD0x00x100000000x100000000x131540x131546.36500x5R E0x10000.init .text .fini .rodata
    LOAD0x131c40x100231c40x100231c40xa10x46f44.19860x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
    GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

    Network Behavior

    Download Network PCAP: filtered – full

    TimestampSource PortDest PortSource IPDest IP
    Mar 16, 2025 02:28:37.784662008 CET3366846164192.168.2.14156.244.45.113
    Mar 16, 2025 02:28:37.789361000 CET4616433668156.244.45.113192.168.2.14
    Mar 16, 2025 02:28:37.789491892 CET3366846164192.168.2.14156.244.45.113
    Mar 16, 2025 02:28:38.363702059 CET4616433668156.244.45.113192.168.2.14
    Mar 16, 2025 02:28:38.364001036 CET3366846164192.168.2.14156.244.45.113
    Mar 16, 2025 02:28:38.454324961 CET4616433668156.244.45.113192.168.2.14
    Mar 16, 2025 02:28:38.454562902 CET3366846164192.168.2.14156.244.45.113
    Mar 16, 2025 02:28:47.892169952 CET3366846164192.168.2.14156.244.45.113
    Mar 16, 2025 02:28:47.897408009 CET4616433668156.244.45.113192.168.2.14
    Mar 16, 2025 02:28:48.060168028 CET4616433668156.244.45.113192.168.2.14
    Mar 16, 2025 02:28:48.104211092 CET3366846164192.168.2.14156.244.45.113

    System Behavior

    General

    Start time (UTC):01:28:35
    Start date (UTC):16/03/2025
    Path:/tmp/ppc.elf
    Arguments:/tmp/ppc.elf
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    File Activities

    Process Activities

    System Activities

    Network Activities


    General

    Start time (UTC):01:28:36
    Start date (UTC):16/03/2025
    Path:/tmp/ppc.elf
    Arguments:-
    File size:5388968 bytes
    MD5 hash:ae65271c943d3451b7f026d1fadccea6

    File Activities

    Process Activities

    Network Activities