Edit tour

Linux Analysis Report
zerm68k.elf

Overview

General Information

Sample name:zerm68k.elf
Analysis ID:1643379
MD5:4dd58768f271d36f3b23043c9866296f
SHA1:133f7a911a2190b9e8653e3744f40bc05299384c
SHA256:a189b049572d348c7b6e967debfdc7d98c5acb66c51dae65f859c10068f8bc85
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1643379
Start date and time:2025-03-19 19:57:26 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 49s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zerm68k.elf
Detection:MAL
Classification:mal52.troj.linELF@0/0@35/0
Command:/tmp/zerm68k.elf
PID:6215
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate a lot
Standard Error:
  • system is lnxubuntu20
  • zerm68k.elf (PID: 6215, Parent: 6137, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/zerm68k.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: zerm68k.elfVirustotal: Detection: 34%Perma Link
Source: zerm68k.elfReversingLabs: Detection: 27%

Networking

barindex
Source: global trafficDNS traffic detected: malformed DNS query: watchmepull.dyn. [malformed]
Source: global trafficTCP traffic: 192.168.2.23:54350 -> 45.147.251.145:1440
Source: global trafficTCP traffic: 192.168.2.23:45244 -> 104.248.47.182:1440
Source: /tmp/zerm68k.elf (PID: 6215)Socket: 127.0.0.1:39148Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: global trafficDNS traffic detected: DNS query: ohlookthereismyboats.geek
Source: global trafficDNS traffic detected: DNS query: watchmepull.dyn. [malformed]
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > .dtelnetadminGeNeXiS@19supportguestrootvizxvZte521systemadmintelecomtelecomadmin1234solokey5upPon521userroot621Zxic521defaultS2fGqNFsFireitupBrAhMoS@15wabjtamxirtamoelinux123OxhlwSG8hkipc2016xc3511antslqicatch991cDuLJ7chslwificamtsgoingonxc12345tlJwpbo6unisheent0talc0ntr0l4!ipc71aadmin@123root123xmhdipctluafedjuantechdaemonfounder88zlxx.123456jvbzd7ujMko0admin20080826klv123GM8182hi3518huigu309hunt5759hg2x0ankorealtekIPCam@swacInasuClinuxservicetaZz@23495859groutercxlinuxmt7109qwertyf00b@ruP1K7C3ep5w2uarmarm5arm6arm7mipsmpslppcspcsh4M[NYRW_JOVV
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.troj.linELF@0/0@35/0
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1582/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/3088/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/230/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/110/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/231/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/111/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/232/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1579/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/112/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/233/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1699/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/113/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/234/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1335/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1698/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/114/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/235/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1334/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1576/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/2302/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/115/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/236/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/116/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/237/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/117/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/118/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/910/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/119/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/912/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/10/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/2307/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/11/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/918/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/12/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/13/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/14/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/15/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/16/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/17/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/18/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1594/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/120/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/121/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1349/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/122/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/243/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/123/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/2/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/124/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/3/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/4/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/125/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/126/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1344/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1465/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1586/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/127/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/6/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/248/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/128/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/249/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1463/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/800/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/9/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/801/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/20/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/21/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1900/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/22/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/23/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/24/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/25/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/26/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/27/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/28/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/29/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/491/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/250/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/130/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/251/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/252/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/132/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/253/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/254/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/255/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/256/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1599/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/257/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1477/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/379/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/258/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1476/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/259/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1475/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/4500/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/936/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/30/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/2208/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/35/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1809/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/1494/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/260/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/261/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)File opened: /proc/141/commJump to behavior
Source: /tmp/zerm68k.elf (PID: 6215)Queries kernel information via 'uname': Jump to behavior
Source: zerm68k.elf, 6215.1.0000559e5b25e000.0000559e5b2e3000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/m68k
Source: zerm68k.elf, 6215.1.00007fff9a326000.00007fff9a347000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
Source: zerm68k.elf, 6215.1.0000559e5b25e000.0000559e5b2e3000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
Source: zerm68k.elf, 6215.1.00007fff9a326000.00007fff9a347000.rw-.sdmpBinary or memory string: &x86_64/usr/bin/qemu-m68k/tmp/zerm68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zerm68k.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1643379 Sample: zerm68k.elf Startdate: 19/03/2025 Architecture: LINUX Score: 52 14 watchmepull.dyn. [malformed] 2->14 16 ohlookthereismyboats.geek 45.147.251.145, 1440, 54350, 54352 RACKMARKTES Germany 2->16 18 4 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 8 zerm68k.elf 2->8         started        signatures3 22 Sends malformed DNS queries 14->22 process4 process5 10 zerm68k.elf 8->10         started        process6 12 zerm68k.elf 10->12         started       
SourceDetectionScannerLabelLink
zerm68k.elf34%VirustotalBrowse
zerm68k.elf28%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
ohlookthereismyboats.geek
45.147.251.145
truefalse
    high
    watchmepull.dyn. [malformed]
    unknown
    unknownfalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      104.248.47.182
      unknownUnited States
      14061DIGITALOCEAN-ASNUSfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      45.147.251.145
      ohlookthereismyboats.geekGermany
      197518RACKMARKTESfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
      104.248.47.182zermpsl.elfGet hashmaliciousUnknownBrowse
        zerarm5.elfGet hashmaliciousUnknownBrowse
          zerspc.elfGet hashmaliciousUnknownBrowse
            zerarm.elfGet hashmaliciousUnknownBrowse
              91.189.91.43nabarm6.elfGet hashmaliciousUnknownBrowse
                zerarm.elfGet hashmaliciousUnknownBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        resgod.arc.elfGet hashmaliciousMiraiBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  91.189.91.42nabarm6.elfGet hashmaliciousUnknownBrowse
                                    zerarm.elfGet hashmaliciousUnknownBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            resgod.arc.elfGet hashmaliciousMiraiBrowse
                                              na.elfGet hashmaliciousPrometeiBrowse
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                      45.147.251.145zermpsl.elfGet hashmaliciousUnknownBrowse
                                                        zerarm5.elfGet hashmaliciousUnknownBrowse
                                                          zerspc.elfGet hashmaliciousUnknownBrowse
                                                            zerarm.elfGet hashmaliciousUnknownBrowse
                                                              zerarm.elfGet hashmaliciousUnknownBrowse
                                                                zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                  zerx86.elfGet hashmaliciousUnknownBrowse
                                                                    zerspc.elfGet hashmaliciousUnknownBrowse
                                                                      zerppc.elfGet hashmaliciousUnknownBrowse
                                                                        zermpsl.elfGet hashmaliciousUnknownBrowse
                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          ohlookthereismyboats.geeksplx86.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          nabarm7.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          zermpsl.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          sh4.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          nklm68k.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          nabarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 185.220.204.227
                                                                          zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          jklarm7.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          jklppc.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          splarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                          CANONICAL-ASGBnabarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          zerarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          resgod.arc.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          DIGITALOCEAN-ASNUShttp://www.amico-grating.com/Get hashmaliciousUnknownBrowse
                                                                          • 104.248.224.96
                                                                          zermpsl.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          nabarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 107.170.130.190
                                                                          zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          jklarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 178.128.18.8
                                                                          zerspc.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          zerarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 104.248.47.182
                                                                          resgod.ppc.elfGet hashmaliciousMiraiBrowse
                                                                          • 206.189.186.139
                                                                          http://jcbajqjo.abdomed-ua.online/redirect/#ZDJsc2JtRkFjSEpsZEhkcGJDNWpieTU2WVE9PQ==&_blankGet hashmaliciousUnknownBrowse
                                                                          • 134.209.177.172
                                                                          https://trezzerwalletse.webflow.io/Get hashmaliciousHTMLPhisherBrowse
                                                                          • 167.99.228.137
                                                                          CANONICAL-ASGBnabarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          zerarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          resgod.arc.elfGet hashmaliciousMiraiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 91.189.91.42
                                                                          RACKMARKTESzermpsl.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          zerspc.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          zerarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          graviola.dllGet hashmaliciousUnknownBrowse
                                                                          • 185.228.72.203
                                                                          graviola.dllGet hashmaliciousUnknownBrowse
                                                                          • 185.228.72.203
                                                                          zerarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          zerx86.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          zerspc.elfGet hashmaliciousUnknownBrowse
                                                                          • 45.147.251.145
                                                                          INIT7CHnabarm6.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          zerarm.elfGet hashmaliciousUnknownBrowse
                                                                          • 109.202.202.202
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 109.202.202.202
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 109.202.202.202
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 109.202.202.202
                                                                          resgod.arc.elfGet hashmaliciousMiraiBrowse
                                                                          • 109.202.202.202
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 109.202.202.202
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 109.202.202.202
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 109.202.202.202
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                          • 109.202.202.202
                                                                          No context
                                                                          No context
                                                                          No created / dropped files found
                                                                          File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
                                                                          Entropy (8bit):6.212182824059992
                                                                          TrID:
                                                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                          File name:zerm68k.elf
                                                                          File size:47'980 bytes
                                                                          MD5:4dd58768f271d36f3b23043c9866296f
                                                                          SHA1:133f7a911a2190b9e8653e3744f40bc05299384c
                                                                          SHA256:a189b049572d348c7b6e967debfdc7d98c5acb66c51dae65f859c10068f8bc85
                                                                          SHA512:560ec5f717847e1bad3295b251cd2157cd7c63abe1b331dc5b8b61af5425bb6c5ae7de9373735d46777b95f7ad39d9989c1a6718acd7715804c4396cb6b79b40
                                                                          SSDEEP:768:kmWPexCFxIdISH3hdUd84vztioO2ABveg7XHT8uqjFH8Z0v5Uu:kzPCCFzSHxdUeWtiB2AB/7XHwuqJ8Zwh
                                                                          TLSH:EE231995A801AC3DFD4BE7BE8513090DF561375610820B3BA3ABFED36D722E49D26D81
                                                                          File Content Preview:.ELF.......................D...4.........4. ...(.................................. ............................... .dt.Q............................NV..a....da....PN^NuNV..J9...pf>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X........pN^NuNV..N^NuN

                                                                          ELF header

                                                                          Class:ELF32
                                                                          Data:2's complement, big endian
                                                                          Version:1 (current)
                                                                          Machine:MC68000
                                                                          Version Number:0x1
                                                                          Type:EXEC (Executable file)
                                                                          OS/ABI:UNIX - System V
                                                                          ABI Version:0
                                                                          Entry Point Address:0x80000144
                                                                          Flags:0x0
                                                                          ELF Header Size:52
                                                                          Program Header Offset:52
                                                                          Program Header Size:32
                                                                          Number of Program Headers:3
                                                                          Section Header Offset:47540
                                                                          Section Header Size:40
                                                                          Number of Section Headers:11
                                                                          Header String Table Index:10
                                                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                          NULL0x00x00x00x00x0000
                                                                          .initPROGBITS0x800000940x940x140x00x6AX002
                                                                          .textPROGBITS0x800000a80xa80xaf7a0x00x6AX004
                                                                          .finiPROGBITS0x8000b0220xb0220xe0x00x6AX002
                                                                          .rodataPROGBITS0x8000b0300xb0300x77e0x00x2A002
                                                                          .ctorsPROGBITS0x8000d7b40xb7b40x80x00x3WA004
                                                                          .dtorsPROGBITS0x8000d7bc0xb7bc0x80x00x3WA004
                                                                          .jcrPROGBITS0x8000d7c40xb7c40x40x00x3WA004
                                                                          .dataPROGBITS0x8000d7c80xb7c80x1a80x00x3WA004
                                                                          .bssNOBITS0x8000d9700xb9700x22c0x00x3WA004
                                                                          .shstrtabSTRTAB0x00xb9700x430x00x0001
                                                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                          LOAD0x00x800000000x800000000xb7ae0xb7ae6.25510x5R E0x2000.init .text .fini .rodata
                                                                          LOAD0xb7b40x8000d7b40x8000d7b40x1bc0x3e82.32090x6RW 0x2000.ctors .dtors .jcr .data .bss
                                                                          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                                          Download Network PCAP: filteredfull

                                                                          • Total Packets: 99
                                                                          • 1440 undefined
                                                                          • 443 (HTTPS)
                                                                          • 80 (HTTP)
                                                                          • 53 (DNS)
                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Mar 19, 2025 19:58:15.275203943 CET43928443192.168.2.2391.189.91.42
                                                                          Mar 19, 2025 19:58:19.013299942 CET543501440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:19.018059015 CET14405435045.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:19.021145105 CET543501440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:19.074059010 CET543501440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:19.078778982 CET14405435045.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:19.079461098 CET543501440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:19.084152937 CET14405435045.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:20.650818110 CET42836443192.168.2.2391.189.91.43
                                                                          Mar 19, 2025 19:58:21.418426991 CET4251680192.168.2.23109.202.202.202
                                                                          Mar 19, 2025 19:58:29.082956076 CET543501440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:29.093375921 CET14405435045.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:29.308587074 CET14405435045.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:29.308942080 CET543501440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:29.313630104 CET14405435045.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:30.497742891 CET543521440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:30.502439022 CET14405435245.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:30.502499104 CET543521440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:30.504391909 CET543521440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:30.509057999 CET14405435245.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:30.509104013 CET543521440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:30.513799906 CET14405435245.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:36.008343935 CET43928443192.168.2.2391.189.91.42
                                                                          Mar 19, 2025 19:58:41.123586893 CET14405435245.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:41.124229908 CET543521440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:41.129353046 CET14405435245.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:42.318721056 CET543541440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:42.323493958 CET14405435445.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:42.323620081 CET543541440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:42.325048923 CET543541440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:42.329839945 CET14405435445.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:42.329936981 CET543541440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:42.334590912 CET14405435445.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:46.246941090 CET42836443192.168.2.2391.189.91.43
                                                                          Mar 19, 2025 19:58:52.390166998 CET4251680192.168.2.23109.202.202.202
                                                                          Mar 19, 2025 19:58:52.952117920 CET14405435445.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:52.952550888 CET543541440192.168.2.2345.147.251.145
                                                                          Mar 19, 2025 19:58:52.957351923 CET14405435445.147.251.145192.168.2.23
                                                                          Mar 19, 2025 19:58:53.980611086 CET452441440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:58:53.985321045 CET144045244104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:58:53.985379934 CET452441440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:58:53.986747980 CET452441440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:58:53.991439104 CET144045244104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:58:53.991492033 CET452441440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:58:53.996201038 CET144045244104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:04.558557987 CET144045244104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:04.558876038 CET452441440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:04.564151049 CET144045244104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:05.656835079 CET452461440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:05.661750078 CET144045246104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:05.661812067 CET452461440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:05.662797928 CET452461440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:05.667459011 CET144045246104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:05.667570114 CET452461440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:05.672266006 CET144045246104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:16.243410110 CET144045246104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:16.243627071 CET452461440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:16.248367071 CET144045246104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:16.962759018 CET43928443192.168.2.2391.189.91.42
                                                                          Mar 19, 2025 19:59:17.272553921 CET452481440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:17.277839899 CET144045248104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:17.277954102 CET452481440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:17.279306889 CET452481440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:17.284454107 CET144045248104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:17.284527063 CET452481440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:17.290844917 CET144045248104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:27.875766039 CET144045248104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:27.876317978 CET452481440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:27.881048918 CET144045248104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:29.328950882 CET452501440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:29.333767891 CET144045250104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:29.333856106 CET452501440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:29.335488081 CET452501440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:29.340152979 CET144045250104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:29.340224981 CET452501440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:29.346261024 CET144045250104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:37.439856052 CET42836443192.168.2.2391.189.91.43
                                                                          Mar 19, 2025 19:59:39.343585014 CET452501440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:39.349205017 CET144045250104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:39.542864084 CET144045250104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:39.543154955 CET452501440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:39.547842026 CET144045250104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:40.564584017 CET452521440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:40.569325924 CET144045252104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:40.569452047 CET452521440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:40.571508884 CET452521440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:40.576245070 CET144045252104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:40.576318026 CET452521440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:40.581037045 CET144045252104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:51.165476084 CET144045252104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:51.165774107 CET452521440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:51.170588017 CET144045252104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:52.779273033 CET452541440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:52.783950090 CET144045254104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:52.784044981 CET452541440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:52.785423994 CET452541440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:52.790024042 CET144045254104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 19:59:52.790077925 CET452541440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 19:59:52.794702053 CET144045254104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:03.348254919 CET144045254104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:03.348558903 CET452541440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:03.353228092 CET144045254104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:04.367573023 CET452561440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:04.372309923 CET144045256104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:04.372369051 CET452561440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:04.373402119 CET452561440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:04.378045082 CET144045256104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:04.378096104 CET452561440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:04.382847071 CET144045256104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:14.949330091 CET144045256104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:14.949667931 CET452561440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:14.954374075 CET144045256104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:16.075364113 CET452581440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:16.080373049 CET144045258104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:16.080451012 CET452581440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:16.081633091 CET452581440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:16.086311102 CET144045258104.248.47.182192.168.2.23
                                                                          Mar 19, 2025 20:00:16.086380005 CET452581440192.168.2.23104.248.47.182
                                                                          Mar 19, 2025 20:00:16.091562033 CET144045258104.248.47.182192.168.2.23
                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                          Mar 19, 2025 19:58:18.938385963 CET3486753192.168.2.2381.169.136.222
                                                                          Mar 19, 2025 19:58:18.968059063 CET533486781.169.136.222192.168.2.23
                                                                          Mar 19, 2025 19:58:30.311816931 CET5738653192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:30.348360062 CET5357386185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:30.350167036 CET5213953192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:30.386076927 CET5352139185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:30.387160063 CET5881753192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:30.422776937 CET5358817185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:30.423893929 CET3788753192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:30.459500074 CET5337887185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:30.461323023 CET5762853192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:30.497081041 CET5357628185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:42.130305052 CET4836653192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:42.166039944 CET5348366185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:42.168205976 CET4742553192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:42.203798056 CET5347425185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:42.206139088 CET3779853192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:42.241698027 CET5337798185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:42.243581057 CET4779453192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:42.279023886 CET5347794185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:42.281188011 CET3353453192.168.2.23185.181.61.24
                                                                          Mar 19, 2025 19:58:42.316809893 CET5333534185.181.61.24192.168.2.23
                                                                          Mar 19, 2025 19:58:53.955540895 CET4179553192.168.2.23194.36.144.87
                                                                          Mar 19, 2025 19:58:53.979490995 CET5341795194.36.144.87192.168.2.23
                                                                          Mar 19, 2025 19:59:05.561845064 CET3351853192.168.2.23202.61.197.122
                                                                          Mar 19, 2025 19:59:05.579330921 CET5333518202.61.197.122192.168.2.23
                                                                          Mar 19, 2025 19:59:05.580899000 CET4395653192.168.2.23202.61.197.122
                                                                          Mar 19, 2025 19:59:05.598627090 CET5343956202.61.197.122192.168.2.23
                                                                          Mar 19, 2025 19:59:05.600672007 CET6017453192.168.2.23202.61.197.122
                                                                          Mar 19, 2025 19:59:05.618324041 CET5360174202.61.197.122192.168.2.23
                                                                          Mar 19, 2025 19:59:05.619997025 CET4744153192.168.2.23202.61.197.122
                                                                          Mar 19, 2025 19:59:05.637651920 CET5347441202.61.197.122192.168.2.23
                                                                          Mar 19, 2025 19:59:05.638840914 CET3834353192.168.2.23202.61.197.122
                                                                          Mar 19, 2025 19:59:05.656157017 CET5338343202.61.197.122192.168.2.23
                                                                          Mar 19, 2025 19:59:17.247596025 CET4221453192.168.2.23194.36.144.87
                                                                          Mar 19, 2025 19:59:17.271200895 CET5342214194.36.144.87192.168.2.23
                                                                          Mar 19, 2025 19:59:28.879451990 CET5507853192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:28.968696117 CET5355078168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:28.970607042 CET4767453192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:29.058770895 CET5347674168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:29.060587883 CET6082753192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:29.147984982 CET5360827168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:29.149817944 CET3490953192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:29.238691092 CET5334909168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:29.240850925 CET4794953192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:29.327655077 CET5347949168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:40.545681000 CET4825253192.168.2.23202.61.197.122
                                                                          Mar 19, 2025 19:59:40.563940048 CET5348252202.61.197.122192.168.2.23
                                                                          Mar 19, 2025 19:59:52.169198990 CET4165853192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:52.416045904 CET5341658168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:52.417737007 CET5473353192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:52.506804943 CET5354733168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:52.508352041 CET4811453192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:52.595469952 CET5348114168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:52.597090006 CET5314553192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:52.686135054 CET5353145168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 19:59:52.687510967 CET4135853192.168.2.23168.235.111.72
                                                                          Mar 19, 2025 19:59:52.778234959 CET5341358168.235.111.72192.168.2.23
                                                                          Mar 19, 2025 20:00:04.351552963 CET5966653192.168.2.2351.158.108.203
                                                                          Mar 19, 2025 20:00:04.366988897 CET535966651.158.108.203192.168.2.23
                                                                          Mar 19, 2025 20:00:15.952207088 CET3556753192.168.2.23194.36.144.87
                                                                          Mar 19, 2025 20:00:15.974725008 CET5335567194.36.144.87192.168.2.23
                                                                          Mar 19, 2025 20:00:15.976022959 CET5002153192.168.2.23194.36.144.87
                                                                          Mar 19, 2025 20:00:15.999417067 CET5350021194.36.144.87192.168.2.23
                                                                          Mar 19, 2025 20:00:16.000808954 CET6022153192.168.2.23194.36.144.87
                                                                          Mar 19, 2025 20:00:16.024589062 CET5360221194.36.144.87192.168.2.23
                                                                          Mar 19, 2025 20:00:16.025599003 CET5771953192.168.2.23194.36.144.87
                                                                          Mar 19, 2025 20:00:16.048108101 CET5357719194.36.144.87192.168.2.23
                                                                          Mar 19, 2025 20:00:16.049556971 CET5114653192.168.2.23194.36.144.87
                                                                          Mar 19, 2025 20:00:16.074584007 CET5351146194.36.144.87192.168.2.23
                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                          Mar 19, 2025 19:58:18.938385963 CET192.168.2.2381.169.136.2220x6eccStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:58:30.311816931 CET192.168.2.23185.181.61.240xb52cStandard query (0)watchmepull.dyn. [malformed]256470false
                                                                          Mar 19, 2025 19:58:30.350167036 CET192.168.2.23185.181.61.240xb52cStandard query (0)watchmepull.dyn. [malformed]256470false
                                                                          Mar 19, 2025 19:58:30.387160063 CET192.168.2.23185.181.61.240xb52cStandard query (0)watchmepull.dyn. [malformed]256470false
                                                                          Mar 19, 2025 19:58:30.423893929 CET192.168.2.23185.181.61.240xb52cStandard query (0)watchmepull.dyn. [malformed]256470false
                                                                          Mar 19, 2025 19:58:30.461323023 CET192.168.2.23185.181.61.240xb52cStandard query (0)watchmepull.dyn. [malformed]256470false
                                                                          Mar 19, 2025 19:58:42.130305052 CET192.168.2.23185.181.61.240xb322Standard query (0)watchmepull.dyn. [malformed]256482false
                                                                          Mar 19, 2025 19:58:42.168205976 CET192.168.2.23185.181.61.240xb322Standard query (0)watchmepull.dyn. [malformed]256482false
                                                                          Mar 19, 2025 19:58:42.206139088 CET192.168.2.23185.181.61.240xb322Standard query (0)watchmepull.dyn. [malformed]256482false
                                                                          Mar 19, 2025 19:58:42.243581057 CET192.168.2.23185.181.61.240xb322Standard query (0)watchmepull.dyn. [malformed]256482false
                                                                          Mar 19, 2025 19:58:42.281188011 CET192.168.2.23185.181.61.240xb322Standard query (0)watchmepull.dyn. [malformed]256482false
                                                                          Mar 19, 2025 19:58:53.955540895 CET192.168.2.23194.36.144.870xe4bbStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:05.561845064 CET192.168.2.23202.61.197.1220x173cStandard query (0)watchmepull.dyn. [malformed]256505false
                                                                          Mar 19, 2025 19:59:05.580899000 CET192.168.2.23202.61.197.1220x173cStandard query (0)watchmepull.dyn. [malformed]256505false
                                                                          Mar 19, 2025 19:59:05.600672007 CET192.168.2.23202.61.197.1220x173cStandard query (0)watchmepull.dyn. [malformed]256505false
                                                                          Mar 19, 2025 19:59:05.619997025 CET192.168.2.23202.61.197.1220x173cStandard query (0)watchmepull.dyn. [malformed]256505false
                                                                          Mar 19, 2025 19:59:05.638840914 CET192.168.2.23202.61.197.1220x173cStandard query (0)watchmepull.dyn. [malformed]256505false
                                                                          Mar 19, 2025 19:59:17.247596025 CET192.168.2.23194.36.144.870x41c2Standard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:28.879451990 CET192.168.2.23168.235.111.720x9eefStandard query (0)watchmepull.dyn. [malformed]256272false
                                                                          Mar 19, 2025 19:59:28.970607042 CET192.168.2.23168.235.111.720x9eefStandard query (0)watchmepull.dyn. [malformed]256273false
                                                                          Mar 19, 2025 19:59:29.060587883 CET192.168.2.23168.235.111.720x9eefStandard query (0)watchmepull.dyn. [malformed]256273false
                                                                          Mar 19, 2025 19:59:29.149817944 CET192.168.2.23168.235.111.720x9eefStandard query (0)watchmepull.dyn. [malformed]256273false
                                                                          Mar 19, 2025 19:59:29.240850925 CET192.168.2.23168.235.111.720x9eefStandard query (0)watchmepull.dyn. [malformed]256273false
                                                                          Mar 19, 2025 19:59:40.545681000 CET192.168.2.23202.61.197.1220x472cStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:52.169198990 CET192.168.2.23168.235.111.720x69b6Standard query (0)watchmepull.dyn. [malformed]256296false
                                                                          Mar 19, 2025 19:59:52.417737007 CET192.168.2.23168.235.111.720x69b6Standard query (0)watchmepull.dyn. [malformed]256296false
                                                                          Mar 19, 2025 19:59:52.508352041 CET192.168.2.23168.235.111.720x69b6Standard query (0)watchmepull.dyn. [malformed]256296false
                                                                          Mar 19, 2025 19:59:52.597090006 CET192.168.2.23168.235.111.720x69b6Standard query (0)watchmepull.dyn. [malformed]256296false
                                                                          Mar 19, 2025 19:59:52.687510967 CET192.168.2.23168.235.111.720x69b6Standard query (0)watchmepull.dyn. [malformed]256296false
                                                                          Mar 19, 2025 20:00:04.351552963 CET192.168.2.2351.158.108.2030x6603Standard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 20:00:15.952207088 CET192.168.2.23194.36.144.870xdc93Standard query (0)watchmepull.dyn. [malformed]256319false
                                                                          Mar 19, 2025 20:00:15.976022959 CET192.168.2.23194.36.144.870xdc93Standard query (0)watchmepull.dyn. [malformed]256319false
                                                                          Mar 19, 2025 20:00:16.000808954 CET192.168.2.23194.36.144.870xdc93Standard query (0)watchmepull.dyn. [malformed]256320false
                                                                          Mar 19, 2025 20:00:16.025599003 CET192.168.2.23194.36.144.870xdc93Standard query (0)watchmepull.dyn. [malformed]256320false
                                                                          Mar 19, 2025 20:00:16.049556971 CET192.168.2.23194.36.144.870xdc93Standard query (0)watchmepull.dyn. [malformed]256320false
                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                          Mar 19, 2025 19:58:18.968059063 CET81.169.136.222192.168.2.230x6eccNo error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:58:18.968059063 CET81.169.136.222192.168.2.230x6eccNo error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:58:18.968059063 CET81.169.136.222192.168.2.230x6eccNo error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:58:53.979490995 CET194.36.144.87192.168.2.230xe4bbNo error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:58:53.979490995 CET194.36.144.87192.168.2.230xe4bbNo error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:58:53.979490995 CET194.36.144.87192.168.2.230xe4bbNo error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:17.271200895 CET194.36.144.87192.168.2.230x41c2No error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:17.271200895 CET194.36.144.87192.168.2.230x41c2No error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:17.271200895 CET194.36.144.87192.168.2.230x41c2No error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:40.563940048 CET202.61.197.122192.168.2.230x472cNo error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:40.563940048 CET202.61.197.122192.168.2.230x472cNo error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 19:59:40.563940048 CET202.61.197.122192.168.2.230x472cNo error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 20:00:04.366988897 CET51.158.108.203192.168.2.230x6603No error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 20:00:04.366988897 CET51.158.108.203192.168.2.230x6603No error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 20:00:04.366988897 CET51.158.108.203192.168.2.230x6603No error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                          Mar 19, 2025 20:00:15.974725008 CET194.36.144.87192.168.2.230xdc93Format error (1)watchmepull.dyn. [malformed]nonenone256319false
                                                                          Mar 19, 2025 20:00:15.999417067 CET194.36.144.87192.168.2.230xdc93Format error (1)watchmepull.dyn. [malformed]nonenone256320false
                                                                          Mar 19, 2025 20:00:16.024589062 CET194.36.144.87192.168.2.230xdc93Format error (1)watchmepull.dyn. [malformed]nonenone256320false
                                                                          Mar 19, 2025 20:00:16.048108101 CET194.36.144.87192.168.2.230xdc93Format error (1)watchmepull.dyn. [malformed]nonenone256320false
                                                                          Mar 19, 2025 20:00:16.074584007 CET194.36.144.87192.168.2.230xdc93Format error (1)watchmepull.dyn. [malformed]nonenone256320false

                                                                          System Behavior

                                                                          Start time (UTC):18:58:18
                                                                          Start date (UTC):19/03/2025
                                                                          Path:/tmp/zerm68k.elf
                                                                          Arguments:-
                                                                          File size:4463432 bytes
                                                                          MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                                          Start time (UTC):18:58:18
                                                                          Start date (UTC):19/03/2025
                                                                          Path:/tmp/zerm68k.elf
                                                                          Arguments:-
                                                                          File size:4463432 bytes
                                                                          MD5 hash:cd177594338c77b895ae27c33f8f86cc