Edit tour

Linux Analysis Report
zerppc.elf

Overview

General Information

Sample name:zerppc.elf
Analysis ID:1643383
MD5:df04325b7e4ea69392ce56ace53f9dd8
SHA1:a4a2987ce826a888eddd6405e37898f3b49be7c6
SHA256:187bad2524079311993c2e952ab3c393a365f15a046cbab3558fb1963e11ea7d
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1643383
Start date and time:2025-03-19 20:01:30 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 7s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zerppc.elf
Detection:MAL
Classification:mal52.troj.linELF@0/0@39/0
Command:/tmp/zerppc.elf
PID:6260
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate a lot
Standard Error:
  • system is lnxubuntu20
  • zerppc.elf (PID: 6260, Parent: 6180, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/zerppc.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: zerppc.elfVirustotal: Detection: 25%Perma Link
Source: zerppc.elfReversingLabs: Detection: 22%

Networking

barindex
Source: global trafficDNS traffic detected: malformed DNS query: watchmepull.dyn. [malformed]
Source: global trafficTCP traffic: 192.168.2.23:45250 -> 104.248.47.182:1440
Source: global trafficTCP traffic: 192.168.2.23:52016 -> 185.220.204.227:1440
Source: /tmp/zerppc.elf (PID: 6260)Socket: 127.0.0.1:39148Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknownUDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 81.169.136.222
Source: global trafficDNS traffic detected: DNS query: ohlookthereismyboats.geek
Source: global trafficDNS traffic detected: DNS query: watchmepull.dyn. [malformed]
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sampleString containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.troj.linELF@0/0@39/0
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1582/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/3088/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/230/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/110/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/231/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/111/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/232/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1579/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/112/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/233/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1699/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/113/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/234/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1335/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1698/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/114/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/235/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1334/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1576/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/2302/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/115/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/236/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/116/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/237/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/117/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/118/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/910/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/119/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/912/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/10/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/2307/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/11/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/918/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/12/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/13/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/6243/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/14/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/6242/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/15/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/16/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/17/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/18/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1594/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/120/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/121/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1349/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/122/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/243/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/123/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/2/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/124/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/3/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/4/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/125/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/126/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1344/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1465/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1586/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/127/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/6/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/248/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/128/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/249/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1463/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/800/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/9/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/801/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/20/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/21/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1900/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/22/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/23/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/24/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/25/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/26/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/27/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/28/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/29/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/491/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/250/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/130/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/251/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/252/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/132/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/253/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/254/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/255/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/256/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1599/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/257/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1477/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/379/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/258/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1476/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/259/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1475/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/936/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/30/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/2208/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/35/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1809/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/1494/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/260/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)File opened: /proc/261/commJump to behavior
Source: /tmp/zerppc.elf (PID: 6260)Queries kernel information via 'uname': Jump to behavior
Source: zerppc.elf, 6260.1.000055b57e311000.000055b57e3c1000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: zerppc.elf, 6260.1.00007ffee712a000.00007ffee714b000.rw-.sdmpBinary or memory string: kx86_64/usr/bin/qemu-ppc/tmp/zerppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zerppc.elf
Source: zerppc.elf, 6260.1.000055b57e311000.000055b57e3c1000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: zerppc.elf, 6260.1.00007ffee712a000.00007ffee714b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1643383 Sample: zerppc.elf Startdate: 19/03/2025 Architecture: LINUX Score: 52 14 watchmepull.dyn. [malformed] 2->14 16 109.202.202.202, 80 INIT7CH Switzerland 2->16 18 4 other IPs or domains 2->18 20 Multi AV Scanner detection for submitted file 2->20 8 zerppc.elf 2->8         started        signatures3 22 Sends malformed DNS queries 14->22 process4 process5 10 zerppc.elf 8->10         started        process6 12 zerppc.elf 10->12         started       
SourceDetectionScannerLabelLink
zerppc.elf25%VirustotalBrowse
zerppc.elf22%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
ohlookthereismyboats.geek
104.248.47.182
truefalse
    high
    watchmepull.dyn. [malformed]
    unknown
    unknownfalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      185.220.204.227
      unknownIsrael
      41436CLOUDWEBMANAGE-EUGBfalse
      104.248.47.182
      ohlookthereismyboats.geekUnited States
      14061DIGITALOCEAN-ASNUSfalse
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      185.220.204.227zermpsl.elfGet hashmaliciousUnknownBrowse
        zerarm5.elfGet hashmaliciousUnknownBrowse
          zersh4.elfGet hashmaliciousUnknownBrowse
            zerarm.elfGet hashmaliciousUnknownBrowse
              zermips.elfGet hashmaliciousUnknownBrowse
                zerx86.elfGet hashmaliciousUnknownBrowse
                  zerppc.elfGet hashmaliciousUnknownBrowse
                    zermpsl.elfGet hashmaliciousUnknownBrowse
                      zerm68k.elfGet hashmaliciousUnknownBrowse
                        zersh4.elfGet hashmaliciousUnknownBrowse
                          104.248.47.182zerm68k.elfGet hashmaliciousUnknownBrowse
                            zermpsl.elfGet hashmaliciousUnknownBrowse
                              zerarm5.elfGet hashmaliciousUnknownBrowse
                                zerspc.elfGet hashmaliciousUnknownBrowse
                                  zerarm.elfGet hashmaliciousUnknownBrowse
                                    109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                                    • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                                    91.189.91.43zerm68k.elfGet hashmaliciousUnknownBrowse
                                      nabarm6.elfGet hashmaliciousUnknownBrowse
                                        zerarm.elfGet hashmaliciousUnknownBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            na.elfGet hashmaliciousPrometeiBrowse
                                              na.elfGet hashmaliciousPrometeiBrowse
                                                resgod.arc.elfGet hashmaliciousMiraiBrowse
                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                        91.189.91.42zerm68k.elfGet hashmaliciousUnknownBrowse
                                                          nabarm6.elfGet hashmaliciousUnknownBrowse
                                                            zerarm.elfGet hashmaliciousUnknownBrowse
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                    resgod.arc.elfGet hashmaliciousMiraiBrowse
                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                        na.elfGet hashmaliciousPrometeiBrowse
                                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                            ohlookthereismyboats.geeksplsh4.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            splspc.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            nklarm5.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            zerm68k.elfGet hashmaliciousUnknownBrowse
                                                                            • 45.147.251.145
                                                                            splx86.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            nabarm7.elfGet hashmaliciousUnknownBrowse
                                                                            • 45.147.251.145
                                                                            zermpsl.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            sh4.elfGet hashmaliciousUnknownBrowse
                                                                            • 45.147.251.145
                                                                            nklm68k.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            nabarm.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                            CANONICAL-ASGBzerm68k.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            zerarm.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            resgod.arc.elfGet hashmaliciousMiraiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            DIGITALOCEAN-ASNUShttps://eventer.cc/webGet hashmaliciousUnknownBrowse
                                                                            • 64.227.36.222
                                                                            zerm68k.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            http://www.amico-grating.com/Get hashmaliciousUnknownBrowse
                                                                            • 104.248.224.96
                                                                            zermpsl.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            nabarm.elfGet hashmaliciousUnknownBrowse
                                                                            • 107.170.130.190
                                                                            zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            jklarm.elfGet hashmaliciousUnknownBrowse
                                                                            • 178.128.18.8
                                                                            zerspc.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            zerarm.elfGet hashmaliciousUnknownBrowse
                                                                            • 104.248.47.182
                                                                            resgod.ppc.elfGet hashmaliciousMiraiBrowse
                                                                            • 206.189.186.139
                                                                            CANONICAL-ASGBzerm68k.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            zerarm.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            resgod.arc.elfGet hashmaliciousMiraiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 91.189.91.42
                                                                            CLOUDWEBMANAGE-EUGBzermpsl.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zerarm5.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zersh4.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zerarm.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zermips.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zerx86.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zerppc.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zermpsl.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zerm68k.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            zersh4.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.220.204.227
                                                                            INIT7CHzerm68k.elfGet hashmaliciousUnknownBrowse
                                                                            • 109.202.202.202
                                                                            nabarm6.elfGet hashmaliciousUnknownBrowse
                                                                            • 109.202.202.202
                                                                            zerarm.elfGet hashmaliciousUnknownBrowse
                                                                            • 109.202.202.202
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 109.202.202.202
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 109.202.202.202
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 109.202.202.202
                                                                            resgod.arc.elfGet hashmaliciousMiraiBrowse
                                                                            • 109.202.202.202
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 109.202.202.202
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 109.202.202.202
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                            • 109.202.202.202
                                                                            No context
                                                                            No context
                                                                            No created / dropped files found
                                                                            File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
                                                                            Entropy (8bit):6.161219015340242
                                                                            TrID:
                                                                            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                            File name:zerppc.elf
                                                                            File size:46'112 bytes
                                                                            MD5:df04325b7e4ea69392ce56ace53f9dd8
                                                                            SHA1:a4a2987ce826a888eddd6405e37898f3b49be7c6
                                                                            SHA256:187bad2524079311993c2e952ab3c393a365f15a046cbab3558fb1963e11ea7d
                                                                            SHA512:8bae60d77b7a6931001558c6557cabb6fa276f246dcc43b5a14401dae566bb17efe2cf87ae91d8f5d77158028a7d2336da1c1811b484a9204a255f498d6e2189
                                                                            SSDEEP:768:wmvztLvDjcBRWzoqhfZ+nHPLYAL4rW0yzijSQbmSZaP7IsKuXP4u:wkpLvnk3qfsnHMAuWpilbmSZg7KuXPT
                                                                            TLSH:58234B43721C0A57C1A65AB5253F07E097FFBEA025F0B685680F9B568A71F331086F9E
                                                                            File Content Preview:.ELF...........................4.........4. ...(.......................|...|........................................dt.Q.............................!..|......$H...H..a...$8!. |...N.. .!..|.......?.......... ..../...@..\?........+../...A..$8...})......N..

                                                                            ELF header

                                                                            Class:ELF32
                                                                            Data:2's complement, big endian
                                                                            Version:1 (current)
                                                                            Machine:PowerPC
                                                                            Version Number:0x1
                                                                            Type:EXEC (Executable file)
                                                                            OS/ABI:UNIX - System V
                                                                            ABI Version:0
                                                                            Entry Point Address:0x100001f0
                                                                            Flags:0x0
                                                                            ELF Header Size:52
                                                                            Program Header Offset:52
                                                                            Program Header Size:32
                                                                            Number of Program Headers:3
                                                                            Section Header Offset:45592
                                                                            Section Header Size:40
                                                                            Number of Section Headers:13
                                                                            Header String Table Index:12
                                                                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                            NULL0x00x00x00x00x0000
                                                                            .initPROGBITS0x100000940x940x240x00x6AX004
                                                                            .textPROGBITS0x100000b80xb80xa4b80x00x6AX004
                                                                            .finiPROGBITS0x1000a5700xa5700x200x00x6AX004
                                                                            .rodataPROGBITS0x1000a5900xa5900x8ec0x00x2A004
                                                                            .ctorsPROGBITS0x1001b0000xb0000x80x00x3WA004
                                                                            .dtorsPROGBITS0x1001b0080xb0080x80x00x3WA004
                                                                            .jcrPROGBITS0x1001b0100xb0100x40x00x3WA004
                                                                            .dataPROGBITS0x1001b0180xb0180x1980x00x3WA008
                                                                            .sdataPROGBITS0x1001b1b00xb1b00x180x00x3WA004
                                                                            .sbssNOBITS0x1001b1c80xb1c80x580x00x3WA004
                                                                            .bssNOBITS0x1001b2200xb1c80x1fc0x00x3WA004
                                                                            .shstrtabSTRTAB0x00xb1c80x500x00x0001
                                                                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                            LOAD0x00x100000000x100000000xae7c0xae7c6.24660x5R E0x10000.init .text .fini .rodata
                                                                            LOAD0xb0000x1001b0000x1001b0000x1c80x41c2.31100x6RW 0x10000.ctors .dtors .jcr .data .sdata .sbss .bss
                                                                            GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                                            Download Network PCAP: filteredfull

                                                                            • Total Packets: 102
                                                                            • 1440 undefined
                                                                            • 443 (HTTPS)
                                                                            • 80 (HTTP)
                                                                            • 53 (DNS)
                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                            Mar 19, 2025 20:02:34.473242998 CET43928443192.168.2.2391.189.91.42
                                                                            Mar 19, 2025 20:02:37.686289072 CET452501440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:37.691097975 CET144045250104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:37.691214085 CET452501440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:37.700056076 CET452501440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:37.704936981 CET144045250104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:37.704986095 CET452501440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:37.709713936 CET144045250104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:39.848537922 CET42836443192.168.2.2391.189.91.43
                                                                            Mar 19, 2025 20:02:47.709115982 CET452501440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:47.715612888 CET144045250104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:47.915740967 CET144045250104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:47.916445971 CET452501440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:47.921235085 CET144045250104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:49.232961893 CET452521440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:49.237659931 CET144045252104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:49.237742901 CET452521440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:49.238528967 CET452521440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:49.243179083 CET144045252104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:49.243243933 CET452521440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:49.247895956 CET144045252104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:55.718374014 CET43928443192.168.2.2391.189.91.42
                                                                            Mar 19, 2025 20:02:59.836867094 CET144045252104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:02:59.837424040 CET452521440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:02:59.842175007 CET144045252104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:00.936392069 CET452541440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:00.941153049 CET144045254104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:00.941292048 CET452541440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:00.942476988 CET452541440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:00.947226048 CET144045254104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:00.947305918 CET452541440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:00.952018023 CET144045254104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:01.861613035 CET4251680192.168.2.23109.202.202.202
                                                                            Mar 19, 2025 20:03:05.957196951 CET42836443192.168.2.2391.189.91.43
                                                                            Mar 19, 2025 20:03:11.529082060 CET144045254104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:11.529416084 CET452541440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:11.534143925 CET144045254104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:12.612689018 CET452561440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:12.617350101 CET144045256104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:12.617419004 CET452561440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:12.618192911 CET452561440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:12.622833967 CET144045256104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:12.622929096 CET452561440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:12.627810001 CET144045256104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:23.200279951 CET144045256104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:23.200563908 CET452561440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:23.206185102 CET144045256104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:24.286741018 CET452581440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:24.291474104 CET144045258104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:24.291554928 CET452581440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:24.292609930 CET452581440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:24.297369957 CET144045258104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:24.297421932 CET452581440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:24.302119970 CET144045258104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:34.852746964 CET144045258104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:34.853051901 CET452581440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:34.859350920 CET144045258104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:35.874622107 CET452601440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:35.879340887 CET144045260104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:35.879427910 CET452601440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:35.880906105 CET452601440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:35.885552883 CET144045260104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:35.885628939 CET452601440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:35.890325069 CET144045260104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:36.672964096 CET43928443192.168.2.2391.189.91.42
                                                                            Mar 19, 2025 20:03:46.442532063 CET144045260104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:46.442859888 CET452601440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:46.447572947 CET144045260104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:47.608701944 CET452621440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:47.613409042 CET144045262104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:47.613507986 CET452621440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:47.614379883 CET452621440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:47.619023085 CET144045262104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:47.619102001 CET452621440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:47.623806000 CET144045262104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:57.150099039 CET42836443192.168.2.2391.189.91.43
                                                                            Mar 19, 2025 20:03:57.615833998 CET452621440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:57.620600939 CET144045262104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:57.814191103 CET144045262104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:57.814368963 CET452621440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:57.819057941 CET144045262104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:58.900214911 CET452641440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:58.904907942 CET144045264104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:58.905000925 CET452641440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:58.906040907 CET452641440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:58.910937071 CET144045264104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:03:58.910995007 CET452641440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:03:58.915637016 CET144045264104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:04:09.508491993 CET144045264104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:04:09.508749008 CET452641440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:04:09.513355017 CET144045264104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:04:10.538858891 CET520161440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:10.546554089 CET144052016185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:10.546623945 CET520161440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:10.547677994 CET520161440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:10.554476976 CET144052016185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:10.554533005 CET520161440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:10.561186075 CET144052016185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:21.087065935 CET144052016185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:21.087362051 CET520161440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:21.092253923 CET144052016185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:22.189032078 CET520181440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:22.193732023 CET144052018185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:22.193903923 CET520181440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:22.196105957 CET520181440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:22.200778008 CET144052018185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:22.200869083 CET520181440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:22.205508947 CET144052018185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:32.739747047 CET144052018185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:32.740158081 CET520181440192.168.2.23185.220.204.227
                                                                            Mar 19, 2025 20:04:32.744970083 CET144052018185.220.204.227192.168.2.23
                                                                            Mar 19, 2025 20:04:33.773269892 CET452701440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:04:33.777932882 CET144045270104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:04:33.778027058 CET452701440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:04:33.779129028 CET452701440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:04:33.783855915 CET144045270104.248.47.182192.168.2.23
                                                                            Mar 19, 2025 20:04:33.783932924 CET452701440192.168.2.23104.248.47.182
                                                                            Mar 19, 2025 20:04:33.788630962 CET144045270104.248.47.182192.168.2.23
                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                            Mar 19, 2025 20:02:37.662947893 CET3936753192.168.2.23194.36.144.87
                                                                            Mar 19, 2025 20:02:37.679655075 CET5339367194.36.144.87192.168.2.23
                                                                            Mar 19, 2025 20:02:48.919270039 CET4438753192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:02:48.936558008 CET5344387202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:02:48.937585115 CET5222453192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:02:48.954785109 CET5352224202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:02:48.955594063 CET5143553192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:02:49.191099882 CET5351435202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:02:49.192718983 CET3557053192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:02:49.214138985 CET5335570202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:02:49.215121984 CET6031453192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:02:49.232392073 CET5360314202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:03:00.840280056 CET3306053192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:03:00.858063936 CET5333060202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:03:00.859723091 CET5737953192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:03:00.877588987 CET5357379202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:03:00.878922939 CET5075253192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:03:00.896972895 CET5350752202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:03:00.898441076 CET3936053192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:03:00.916621923 CET5339360202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:03:00.918004036 CET5809553192.168.2.23202.61.197.122
                                                                            Mar 19, 2025 20:03:00.935487986 CET5358095202.61.197.122192.168.2.23
                                                                            Mar 19, 2025 20:03:12.531909943 CET5026153192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:12.546947956 CET535026151.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:12.547884941 CET5358753192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:12.563124895 CET535358751.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:12.564234972 CET3619853192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:12.579400063 CET533619851.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:12.580329895 CET4505253192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:12.595506907 CET534505251.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:12.596478939 CET4903553192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:12.612123966 CET534903551.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:24.203315973 CET5254253192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:24.219132900 CET535254251.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:24.220273018 CET3326153192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:24.235796928 CET533326151.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:24.237010002 CET3897053192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:24.252275944 CET533897051.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:24.253371954 CET3474253192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:24.268706083 CET533474251.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:24.269985914 CET4614153192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:24.285747051 CET534614151.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:35.855966091 CET4006953192.168.2.23152.53.15.127
                                                                            Mar 19, 2025 20:03:35.873408079 CET5340069152.53.15.127192.168.2.23
                                                                            Mar 19, 2025 20:03:47.453455925 CET4945753192.168.2.2381.169.136.222
                                                                            Mar 19, 2025 20:03:47.482856035 CET534945781.169.136.222192.168.2.23
                                                                            Mar 19, 2025 20:03:47.484563112 CET4688753192.168.2.2381.169.136.222
                                                                            Mar 19, 2025 20:03:47.514993906 CET534688781.169.136.222192.168.2.23
                                                                            Mar 19, 2025 20:03:47.516511917 CET4107153192.168.2.2381.169.136.222
                                                                            Mar 19, 2025 20:03:47.546017885 CET534107181.169.136.222192.168.2.23
                                                                            Mar 19, 2025 20:03:47.547291994 CET4251953192.168.2.2381.169.136.222
                                                                            Mar 19, 2025 20:03:47.576747894 CET534251981.169.136.222192.168.2.23
                                                                            Mar 19, 2025 20:03:47.578290939 CET5208753192.168.2.2381.169.136.222
                                                                            Mar 19, 2025 20:03:47.607882023 CET535208781.169.136.222192.168.2.23
                                                                            Mar 19, 2025 20:03:58.816668034 CET5135353192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:58.832509041 CET535135351.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:58.833651066 CET3630953192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:58.849179983 CET533630951.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:58.850274086 CET4471153192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:58.866003990 CET534471151.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:58.867063046 CET4268853192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:58.882616043 CET534268851.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:03:58.884030104 CET3358953192.168.2.2351.158.108.203
                                                                            Mar 19, 2025 20:03:58.899559975 CET533358951.158.108.203192.168.2.23
                                                                            Mar 19, 2025 20:04:10.512254953 CET5112053192.168.2.23152.53.15.127
                                                                            Mar 19, 2025 20:04:10.537863970 CET5351120152.53.15.127192.168.2.23
                                                                            Mar 19, 2025 20:04:22.090760946 CET4149453192.168.2.23194.36.144.87
                                                                            Mar 19, 2025 20:04:22.107415915 CET5341494194.36.144.87192.168.2.23
                                                                            Mar 19, 2025 20:04:22.109792948 CET4117353192.168.2.23194.36.144.87
                                                                            Mar 19, 2025 20:04:22.132428885 CET5341173194.36.144.87192.168.2.23
                                                                            Mar 19, 2025 20:04:22.134712934 CET5343353192.168.2.23194.36.144.87
                                                                            Mar 19, 2025 20:04:22.151444912 CET5353433194.36.144.87192.168.2.23
                                                                            Mar 19, 2025 20:04:22.153284073 CET5304553192.168.2.23194.36.144.87
                                                                            Mar 19, 2025 20:04:22.170100927 CET5353045194.36.144.87192.168.2.23
                                                                            Mar 19, 2025 20:04:22.171231985 CET5321653192.168.2.23194.36.144.87
                                                                            Mar 19, 2025 20:04:22.187915087 CET5353216194.36.144.87192.168.2.23
                                                                            Mar 19, 2025 20:04:33.742955923 CET4158953192.168.2.2381.169.136.222
                                                                            Mar 19, 2025 20:04:33.772247076 CET534158981.169.136.222192.168.2.23
                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                            Mar 19, 2025 20:02:37.662947893 CET192.168.2.23194.36.144.870x7ffdStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:02:48.919270039 CET192.168.2.23202.61.197.1220xc681Standard query (0)watchmepull.dyn. [malformed]256472false
                                                                            Mar 19, 2025 20:02:48.937585115 CET192.168.2.23202.61.197.1220xc681Standard query (0)watchmepull.dyn. [malformed]256472false
                                                                            Mar 19, 2025 20:02:48.955594063 CET192.168.2.23202.61.197.1220xc681Standard query (0)watchmepull.dyn. [malformed]256473false
                                                                            Mar 19, 2025 20:02:49.192718983 CET192.168.2.23202.61.197.1220xc681Standard query (0)watchmepull.dyn. [malformed]256473false
                                                                            Mar 19, 2025 20:02:49.215121984 CET192.168.2.23202.61.197.1220xc681Standard query (0)watchmepull.dyn. [malformed]256473false
                                                                            Mar 19, 2025 20:03:00.840280056 CET192.168.2.23202.61.197.1220x6060Standard query (0)watchmepull.dyn. [malformed]256484false
                                                                            Mar 19, 2025 20:03:00.859723091 CET192.168.2.23202.61.197.1220x6060Standard query (0)watchmepull.dyn. [malformed]256484false
                                                                            Mar 19, 2025 20:03:00.878922939 CET192.168.2.23202.61.197.1220x6060Standard query (0)watchmepull.dyn. [malformed]256484false
                                                                            Mar 19, 2025 20:03:00.898441076 CET192.168.2.23202.61.197.1220x6060Standard query (0)watchmepull.dyn. [malformed]256484false
                                                                            Mar 19, 2025 20:03:00.918004036 CET192.168.2.23202.61.197.1220x6060Standard query (0)watchmepull.dyn. [malformed]256484false
                                                                            Mar 19, 2025 20:03:12.531909943 CET192.168.2.2351.158.108.2030xdf57Standard query (0)watchmepull.dyn. [malformed]256496false
                                                                            Mar 19, 2025 20:03:12.547884941 CET192.168.2.2351.158.108.2030xdf57Standard query (0)watchmepull.dyn. [malformed]256496false
                                                                            Mar 19, 2025 20:03:12.564234972 CET192.168.2.2351.158.108.2030xdf57Standard query (0)watchmepull.dyn. [malformed]256496false
                                                                            Mar 19, 2025 20:03:12.580329895 CET192.168.2.2351.158.108.2030xdf57Standard query (0)watchmepull.dyn. [malformed]256496false
                                                                            Mar 19, 2025 20:03:12.596478939 CET192.168.2.2351.158.108.2030xdf57Standard query (0)watchmepull.dyn. [malformed]256496false
                                                                            Mar 19, 2025 20:03:24.203315973 CET192.168.2.2351.158.108.2030x8bbcStandard query (0)watchmepull.dyn. [malformed]256508false
                                                                            Mar 19, 2025 20:03:24.220273018 CET192.168.2.2351.158.108.2030x8bbcStandard query (0)watchmepull.dyn. [malformed]256508false
                                                                            Mar 19, 2025 20:03:24.237010002 CET192.168.2.2351.158.108.2030x8bbcStandard query (0)watchmepull.dyn. [malformed]256508false
                                                                            Mar 19, 2025 20:03:24.253371954 CET192.168.2.2351.158.108.2030x8bbcStandard query (0)watchmepull.dyn. [malformed]256508false
                                                                            Mar 19, 2025 20:03:24.269985914 CET192.168.2.2351.158.108.2030x8bbcStandard query (0)watchmepull.dyn. [malformed]256508false
                                                                            Mar 19, 2025 20:03:35.855966091 CET192.168.2.23152.53.15.1270xbc41Standard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:03:47.453455925 CET192.168.2.2381.169.136.2220x5504Standard query (0)watchmepull.dyn. [malformed]256275false
                                                                            Mar 19, 2025 20:03:47.484563112 CET192.168.2.2381.169.136.2220x5504Standard query (0)watchmepull.dyn. [malformed]256275false
                                                                            Mar 19, 2025 20:03:47.516511917 CET192.168.2.2381.169.136.2220x5504Standard query (0)watchmepull.dyn. [malformed]256275false
                                                                            Mar 19, 2025 20:03:47.547291994 CET192.168.2.2381.169.136.2220x5504Standard query (0)watchmepull.dyn. [malformed]256275false
                                                                            Mar 19, 2025 20:03:47.578290939 CET192.168.2.2381.169.136.2220x5504Standard query (0)watchmepull.dyn. [malformed]256275false
                                                                            Mar 19, 2025 20:03:58.816668034 CET192.168.2.2351.158.108.2030xe562Standard query (0)watchmepull.dyn. [malformed]256286false
                                                                            Mar 19, 2025 20:03:58.833651066 CET192.168.2.2351.158.108.2030xe562Standard query (0)watchmepull.dyn. [malformed]256286false
                                                                            Mar 19, 2025 20:03:58.850274086 CET192.168.2.2351.158.108.2030xe562Standard query (0)watchmepull.dyn. [malformed]256286false
                                                                            Mar 19, 2025 20:03:58.867063046 CET192.168.2.2351.158.108.2030xe562Standard query (0)watchmepull.dyn. [malformed]256286false
                                                                            Mar 19, 2025 20:03:58.884030104 CET192.168.2.2351.158.108.2030xe562Standard query (0)watchmepull.dyn. [malformed]256286false
                                                                            Mar 19, 2025 20:04:10.512254953 CET192.168.2.23152.53.15.1270xbea4Standard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:04:22.090760946 CET192.168.2.23194.36.144.870x94b8Standard query (0)watchmepull.dyn. [malformed]256310false
                                                                            Mar 19, 2025 20:04:22.109792948 CET192.168.2.23194.36.144.870x94b8Standard query (0)watchmepull.dyn. [malformed]256310false
                                                                            Mar 19, 2025 20:04:22.134712934 CET192.168.2.23194.36.144.870x94b8Standard query (0)watchmepull.dyn. [malformed]256310false
                                                                            Mar 19, 2025 20:04:22.153284073 CET192.168.2.23194.36.144.870x94b8Standard query (0)watchmepull.dyn. [malformed]256310false
                                                                            Mar 19, 2025 20:04:22.171231985 CET192.168.2.23194.36.144.870x94b8Standard query (0)watchmepull.dyn. [malformed]256310false
                                                                            Mar 19, 2025 20:04:33.742955923 CET192.168.2.2381.169.136.2220x5c7dStandard query (0)ohlookthereismyboats.geekA (IP address)IN (0x0001)false
                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                            Mar 19, 2025 20:02:37.679655075 CET194.36.144.87192.168.2.230x7ffdNo error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:02:37.679655075 CET194.36.144.87192.168.2.230x7ffdNo error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:02:37.679655075 CET194.36.144.87192.168.2.230x7ffdNo error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:03:12.546947956 CET51.158.108.203192.168.2.230xdf57Format error (1)watchmepull.dyn. [malformed]nonenone256496false
                                                                            Mar 19, 2025 20:03:12.563124895 CET51.158.108.203192.168.2.230xdf57Format error (1)watchmepull.dyn. [malformed]nonenone256496false
                                                                            Mar 19, 2025 20:03:12.579400063 CET51.158.108.203192.168.2.230xdf57Format error (1)watchmepull.dyn. [malformed]nonenone256496false
                                                                            Mar 19, 2025 20:03:12.595506907 CET51.158.108.203192.168.2.230xdf57Format error (1)watchmepull.dyn. [malformed]nonenone256496false
                                                                            Mar 19, 2025 20:03:12.612123966 CET51.158.108.203192.168.2.230xdf57Format error (1)watchmepull.dyn. [malformed]nonenone256496false
                                                                            Mar 19, 2025 20:03:24.219132900 CET51.158.108.203192.168.2.230x8bbcFormat error (1)watchmepull.dyn. [malformed]nonenone256508false
                                                                            Mar 19, 2025 20:03:24.235796928 CET51.158.108.203192.168.2.230x8bbcFormat error (1)watchmepull.dyn. [malformed]nonenone256508false
                                                                            Mar 19, 2025 20:03:24.252275944 CET51.158.108.203192.168.2.230x8bbcFormat error (1)watchmepull.dyn. [malformed]nonenone256508false
                                                                            Mar 19, 2025 20:03:24.268706083 CET51.158.108.203192.168.2.230x8bbcFormat error (1)watchmepull.dyn. [malformed]nonenone256508false
                                                                            Mar 19, 2025 20:03:24.285747051 CET51.158.108.203192.168.2.230x8bbcFormat error (1)watchmepull.dyn. [malformed]nonenone256508false
                                                                            Mar 19, 2025 20:03:35.873408079 CET152.53.15.127192.168.2.230xbc41No error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:03:35.873408079 CET152.53.15.127192.168.2.230xbc41No error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:03:35.873408079 CET152.53.15.127192.168.2.230xbc41No error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:03:58.832509041 CET51.158.108.203192.168.2.230xe562Format error (1)watchmepull.dyn. [malformed]nonenone256286false
                                                                            Mar 19, 2025 20:03:58.849179983 CET51.158.108.203192.168.2.230xe562Format error (1)watchmepull.dyn. [malformed]nonenone256286false
                                                                            Mar 19, 2025 20:03:58.866003990 CET51.158.108.203192.168.2.230xe562Format error (1)watchmepull.dyn. [malformed]nonenone256286false
                                                                            Mar 19, 2025 20:03:58.882616043 CET51.158.108.203192.168.2.230xe562Format error (1)watchmepull.dyn. [malformed]nonenone256286false
                                                                            Mar 19, 2025 20:03:58.899559975 CET51.158.108.203192.168.2.230xe562Format error (1)watchmepull.dyn. [malformed]nonenone256286false
                                                                            Mar 19, 2025 20:04:10.537863970 CET152.53.15.127192.168.2.230xbea4No error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:04:10.537863970 CET152.53.15.127192.168.2.230xbea4No error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:04:10.537863970 CET152.53.15.127192.168.2.230xbea4No error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:04:22.107415915 CET194.36.144.87192.168.2.230x94b8Format error (1)watchmepull.dyn. [malformed]nonenone256310false
                                                                            Mar 19, 2025 20:04:22.132428885 CET194.36.144.87192.168.2.230x94b8Format error (1)watchmepull.dyn. [malformed]nonenone256310false
                                                                            Mar 19, 2025 20:04:22.151444912 CET194.36.144.87192.168.2.230x94b8Format error (1)watchmepull.dyn. [malformed]nonenone256310false
                                                                            Mar 19, 2025 20:04:22.170100927 CET194.36.144.87192.168.2.230x94b8Format error (1)watchmepull.dyn. [malformed]nonenone256310false
                                                                            Mar 19, 2025 20:04:22.187915087 CET194.36.144.87192.168.2.230x94b8Format error (1)watchmepull.dyn. [malformed]nonenone256310false
                                                                            Mar 19, 2025 20:04:33.772247076 CET81.169.136.222192.168.2.230x5c7dNo error (0)ohlookthereismyboats.geek185.220.204.227A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:04:33.772247076 CET81.169.136.222192.168.2.230x5c7dNo error (0)ohlookthereismyboats.geek104.248.47.182A (IP address)IN (0x0001)false
                                                                            Mar 19, 2025 20:04:33.772247076 CET81.169.136.222192.168.2.230x5c7dNo error (0)ohlookthereismyboats.geek45.147.251.145A (IP address)IN (0x0001)false

                                                                            System Behavior

                                                                            Start time (UTC):19:02:36
                                                                            Start date (UTC):19/03/2025
                                                                            Path:/tmp/zerppc.elf
                                                                            Arguments:-
                                                                            File size:5388968 bytes
                                                                            MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                                            Start time (UTC):19:02:36
                                                                            Start date (UTC):19/03/2025
                                                                            Path:/tmp/zerppc.elf
                                                                            Arguments:-
                                                                            File size:5388968 bytes
                                                                            MD5 hash:ae65271c943d3451b7f026d1fadccea6