Edit tour

Linux Analysis Report
jkse.ppc.elf

Overview

General Information

Sample name:jkse.ppc.elf
Analysis ID:1643720
MD5:20f20dec197593af34be2e86fa87f38c
SHA1:20c6a615d88aa4fe5e7fcb797a87adb623e919eb
SHA256:45ceeeeb407026605d2983c8a1c7f1e9c52d3d93f0ec0fe4ba034db77e05fdba
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1643720
Start date and time:2025-03-20 02:42:10 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 11s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:jkse.ppc.elf
Detection:MAL
Classification:mal48.linELF@0/0@0/0
Command:/tmp/jkse.ppc.elf
PID:6265
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Dark bot has been sent!!!
Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 6227, Parent: 4334)
  • rm (PID: 6227, Parent: 4334, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.A7Gm1InvoM /tmp/tmp.wEJI50ITHB /tmp/tmp.M5YSZriaZU
  • dash New Fork (PID: 6228, Parent: 4334)
  • cat (PID: 6228, Parent: 4334, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.A7Gm1InvoM
  • dash New Fork (PID: 6229, Parent: 4334)
  • head (PID: 6229, Parent: 4334, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6230, Parent: 4334)
  • tr (PID: 6230, Parent: 4334, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6231, Parent: 4334)
  • cut (PID: 6231, Parent: 4334, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6232, Parent: 4334)
  • cat (PID: 6232, Parent: 4334, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.A7Gm1InvoM
  • dash New Fork (PID: 6233, Parent: 4334)
  • head (PID: 6233, Parent: 4334, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6234, Parent: 4334)
  • tr (PID: 6234, Parent: 4334, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6235, Parent: 4334)
  • cut (PID: 6235, Parent: 4334, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6236, Parent: 4334)
  • rm (PID: 6236, Parent: 4334, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.A7Gm1InvoM /tmp/tmp.wEJI50ITHB /tmp/tmp.M5YSZriaZU
  • jkse.ppc.elf (PID: 6265, Parent: 6160, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/jkse.ppc.elf
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: jkse.ppc.elfReversingLabs: Detection: 33%
Source: global trafficTCP traffic: 192.168.2.23:38872 -> 196.251.81.246:2223
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 196.251.81.246
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 6227)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.A7Gm1InvoM /tmp/tmp.wEJI50ITHB /tmp/tmp.M5YSZriaZUJump to behavior
Source: /usr/bin/dash (PID: 6236)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.A7Gm1InvoM /tmp/tmp.wEJI50ITHB /tmp/tmp.M5YSZriaZUJump to behavior
Source: /tmp/jkse.ppc.elf (PID: 6265)Queries kernel information via 'uname': Jump to behavior
Source: jkse.ppc.elf, 6265.1.0000561a0529e000.0000561a0534e000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
Source: jkse.ppc.elf, 6265.1.0000561a0529e000.0000561a0534e000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: jkse.ppc.elf, 6265.1.00007fff1a669000.00007fff1a68a000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: jkse.ppc.elf, 6265.1.00007fff1a669000.00007fff1a68a000.rw-.sdmpBinary or memory string: 'x86_64/usr/bin/qemu-ppc/tmp/jkse.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jkse.ppc.elf
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1643720 Sample: jkse.ppc.elf Startdate: 20/03/2025 Architecture: LINUX Score: 48 17 196.251.81.246, 2223, 38872 SONIC-WirelessZA Seychelles 2->17 19 109.202.202.202, 80 INIT7CH Switzerland 2->19 21 2 other IPs or domains 2->21 23 Multi AV Scanner detection for submitted file 2->23 7 dash rm jkse.ppc.elf 2->7         started        9 dash rm 2->9         started        11 dash head 2->11         started        13 7 other processes 2->13 signatures3 process4 process5 15 jkse.ppc.elf 7->15         started       
SourceDetectionScannerLabelLink
jkse.ppc.elf33%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
109.202.202.202
unknownSwitzerland
13030INIT7CHfalse
196.251.81.246
unknownSeychelles
37417SONIC-WirelessZAfalse
91.189.91.43
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
91.189.91.42
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
  • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
196.251.81.246jkse.mips.elfGet hashmaliciousUnknownBrowse
    jkse.x86.elfGet hashmaliciousUnknownBrowse
      hgfs.mips.elfGet hashmaliciousUnknownBrowse
        hgfs.arm5.elfGet hashmaliciousUnknownBrowse
          hgfs.mpsl.elfGet hashmaliciousUnknownBrowse
            hgfs.x86.elfGet hashmaliciousUnknownBrowse
              hgfs.arm.elfGet hashmaliciousUnknownBrowse
                demon.arm.elfGet hashmaliciousUnknownBrowse
                  demon.mpsl.elfGet hashmaliciousUnknownBrowse
                    demon.x86.elfGet hashmaliciousUnknownBrowse
                      91.189.91.43jkse.mips.elfGet hashmaliciousUnknownBrowse
                        na.elfGet hashmaliciousPrometeiBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              jkse.arm6.elfGet hashmaliciousUnknownBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    sshd.elfGet hashmaliciousUnknownBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          91.189.91.42jkse.mips.elfGet hashmaliciousUnknownBrowse
                                            na.elfGet hashmaliciousPrometeiBrowse
                                              na.elfGet hashmaliciousPrometeiBrowse
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                  bin.sh.elfGet hashmaliciousMiraiBrowse
                                                    jkse.arm6.elfGet hashmaliciousUnknownBrowse
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                        na.elfGet hashmaliciousPrometeiBrowse
                                                          sshd.elfGet hashmaliciousUnknownBrowse
                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                              No context
                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              SONIC-WirelessZAjkse.mips.elfGet hashmaliciousUnknownBrowse
                                                              • 196.251.81.246
                                                              jkse.x86.elfGet hashmaliciousUnknownBrowse
                                                              • 196.251.81.246
                                                              http://xbyvrqtn.top/usGet hashmaliciousUnknownBrowse
                                                              • 196.251.84.181
                                                              http://xbyvrqtn.top/usGet hashmaliciousUnknownBrowse
                                                              • 196.251.84.181
                                                              http://xbyvrqtn.top/usGet hashmaliciousUnknownBrowse
                                                              • 196.251.84.181
                                                              https://www.google.com/url?hl=en&q=https://cdn.ampproject.org/c/s/jegv1ldtjh.a%25c2%25ade%25c2%25Adk%25C2%25Adl%25C2%25Adr%25c2%25adi%25C2%25ADn%25C2%25ADz%25C2%25adq%25c2%25adj%25C2%25Adq%25C2%25aDi%25C2%25aDb%25c2%25ADq%25C2%25Ado%25c2%25aDka.t%25e2%2580%258bop%25E2%2580%258b%25E2%2580%258B%25e2%2580%258b%25e2%2580%258B%25e2%2580%258b%25E2%2580%258B/amMgVuH15&source=gmail&ust=1742410052450000&usg=AOvVaw0GK2SUuLEby7u5w5ZWxyMh&YTdPAksnR=xagYpqPznMYk&YyfzgJrJvRpTM=RTPnZXNAiOh&PLnshNZqnl=baausDsxgpv&qJduqCVMbFdQx=BbatOoTYZZuQ&RPUUNGyEOz=qTJWgcVCEJaNbm&ufWjhADKw=eBZhUsnl&KLBhhhQa=mrGnAJdvrbof&wcUBdTuxBkmso=EkffKbil&KsqXNiBqxanKX=MtCvZcliGnM&tTjHekJYXkvvP=jTYAKbfGOAO&IWIyeMJGRCyRL=koUYltfPVrTyWqD&lbZtBn=HkHQOrPNB&cHoeySn=UAAUckZtc&ApNBSf=https://HyJrMaYnoQ&BLwCqS=uyynTqnODJSU&ecDECnehYNZRJ=LGmwkowGuNaBZ&uFYXyk=pjWCPZkOEWah&dzrPNTsALF=aShddbXpJvuB&ZCSedalrUK=amMxQTfdevAy&YOklOPCHPuxh=ArBOEbAAGCL&jgyuaVdbuP=GZTylTEAvWpIU&gaJMaMAxBAvd=EQkoxvGGFp&bbsHeAsTzlJ=WbDBQqwWuGet hashmaliciousUnknownBrowse
                                                              • 196.251.87.145
                                                              https://www.google.com/url?hl=en&q=https://cdn.ampproject.org/c/s/jeo2bu4xli.n%25c2%25Adz%25c2%25Adg%25c2%25adc%25c2%25Adr%25c2%25adf%25c2%25ADh%25C2%25Adl%25C2%25Adt%25c2%25aDa%25c2%25aDd%25c2%25aDi%25C2%25ADo%25c2%25Adw%25C2%25Adw%25C2%25addn.t%25e2%2580%258Bop%25e2%2580%258B%25E2%2580%258B%25E2%2580%258B%25E2%2580%258B%25e2%2580%258B%25E2%2580%258B%25e2%2580%258B/bwPHDPEJd&source=gmail&ust=1742413495673000&usg=AOvVaw39FbuU5xpVacJWgJQtP58b&FtlJrYdzNAhN=uknHniJ&PmCXQdns=MzApfXsDDjKokpX&WJEATipbJJkHU=wBUHmYvZBSY&MvuBQRjKnyOdG=NmBhucjwiXGhHJ&HsgJXV=vUQVLxQuP&OoHkHEYkrde=BYDXDOUHGOJFuLX&BXmGKopH=kGhpVZI&dWIzLIFvfOYsb=SRJFeyfVS&jv=PYRYelozPw&ltqhxtYX=pZOJEBKVd&SozPniSkWA=oVsZYnlxgai&ZNgdDeJB=aQDOTycq&aJQRplgTpnZSq=bTqFbYiklKcoMOv&MDXkizPwGl=https://HGDYSHGYmzPafU&zIgpqQRkTfM=MOrpRmhzLs&HJIaiQDe=jmQYqbe&cSoMIS=IekAbLKFqgNOxBi&JiDUNutRC=AHOKRzrWU&ZeaHXQPofWpSm=teYFaSKd&TToGkcLeeK=JkUmUxP&jwBftbrKOo=NdxcUwSLkn&uDUWxpwv=gakyAdL&xLcrMT=yBIWjELAduPSwGet hashmaliciousUnknownBrowse
                                                              • 196.251.87.145
                                                              original.emlGet hashmaliciousunknownBrowse
                                                              • 196.251.87.145
                                                              http://xbyvrqtn.top/usGet hashmaliciousUnknownBrowse
                                                              • 196.251.84.181
                                                              http://lihi.cc/6nCRBGet hashmaliciousUnknownBrowse
                                                              • 196.251.81.216
                                                              CANONICAL-ASGBjkse.mips.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              bin.sh.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              jkse.arm6.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              .i.elfGet hashmaliciousUnknownBrowse
                                                              • 185.125.190.26
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              sshd.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              CANONICAL-ASGBjkse.mips.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              bin.sh.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              jkse.arm6.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              .i.elfGet hashmaliciousUnknownBrowse
                                                              • 185.125.190.26
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              sshd.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              INIT7CHjkse.mips.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              bin.sh.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              jkse.arm6.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              sshd.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              No context
                                                              No context
                                                              No created / dropped files found
                                                              File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
                                                              Entropy (8bit):5.738498135215635
                                                              TrID:
                                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                              File name:jkse.ppc.elf
                                                              File size:21'544 bytes
                                                              MD5:20f20dec197593af34be2e86fa87f38c
                                                              SHA1:20c6a615d88aa4fe5e7fcb797a87adb623e919eb
                                                              SHA256:45ceeeeb407026605d2983c8a1c7f1e9c52d3d93f0ec0fe4ba034db77e05fdba
                                                              SHA512:8270c333dadd5404436f19ef3ca2123bf28a774a1a7a9ed57565a106c46183237e3fdeb1c2153a69e7624eafb4b97ef7bd2d72e5dc1762cf8945ba761fc3391c
                                                              SSDEEP:384:0CSGX6k6B6hRqvQRDMk5AqFP1ipEIiTmLZCjilCAyS4kR:pckhRVMxiCZi2CAB
                                                              TLSH:02A2F841B32C0957C1773BB07A3F17E0D39EEEA121A4E184225F968AC1B6E3195D2E9D
                                                              File Content Preview:.ELF...........................4..RH.....4. ...(......................K|..K|..............P...P...P.................dt.Q.............................!..|......$H...H.D....$8!. |...N.. .!..|.......?.........R<..../...@..\?.....P..+../...A..$8...})....P.N..

                                                              ELF header

                                                              Class:ELF32
                                                              Data:2's complement, big endian
                                                              Version:1 (current)
                                                              Machine:PowerPC
                                                              Version Number:0x1
                                                              Type:EXEC (Executable file)
                                                              OS/ABI:UNIX - System V
                                                              ABI Version:0
                                                              Entry Point Address:0x100001f0
                                                              Flags:0x0
                                                              ELF Header Size:52
                                                              Program Header Offset:52
                                                              Program Header Size:32
                                                              Number of Program Headers:3
                                                              Section Header Offset:21064
                                                              Section Header Size:40
                                                              Number of Section Headers:12
                                                              Header String Table Index:11
                                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                              NULL0x00x00x00x00x0000
                                                              .initPROGBITS0x100000940x940x240x00x6AX004
                                                              .textPROGBITS0x100000b80xb80x45000x00x6AX004
                                                              .finiPROGBITS0x100045b80x45b80x200x00x6AX004
                                                              .rodataPROGBITS0x100045d80x45d80x5a40x00x2A004
                                                              .ctorsPROGBITS0x100150000x50000x80x00x3WA004
                                                              .dtorsPROGBITS0x100150080x50080x80x00x3WA004
                                                              .dataPROGBITS0x100150180x50180x1d00x00x3WA008
                                                              .sdataPROGBITS0x100151e80x51e80x140x00x3WA004
                                                              .sbssNOBITS0x100151fc0x51fc0x400x00x3WA004
                                                              .bssNOBITS0x1001523c0x51fc0xd4d80x00x3WA004
                                                              .shstrtabSTRTAB0x00x51fc0x4b0x00x0001
                                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                              LOAD0x00x100000000x100000000x4b7c0x4b7c6.05020x5R E0x10000.init .text .fini .rodata
                                                              LOAD0x50000x100150000x100150000x1fc0xd7143.09420x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
                                                              GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                              Download Network PCAP: filteredfull

                                                              • Total Packets: 11
                                                              • 2223 undefined
                                                              • 443 (HTTPS)
                                                              • 80 (HTTP)
                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Mar 20, 2025 02:42:59.299042940 CET388722223192.168.2.23196.251.81.246
                                                              Mar 20, 2025 02:42:59.484663010 CET222338872196.251.81.246192.168.2.23
                                                              Mar 20, 2025 02:42:59.484796047 CET388722223192.168.2.23196.251.81.246
                                                              Mar 20, 2025 02:42:59.486325979 CET388722223192.168.2.23196.251.81.246
                                                              Mar 20, 2025 02:42:59.655222893 CET222338872196.251.81.246192.168.2.23
                                                              Mar 20, 2025 02:42:59.655627966 CET388722223192.168.2.23196.251.81.246
                                                              Mar 20, 2025 02:42:59.831263065 CET222338872196.251.81.246192.168.2.23
                                                              Mar 20, 2025 02:43:00.228621960 CET43928443192.168.2.2391.189.91.42
                                                              Mar 20, 2025 02:43:05.604000092 CET42836443192.168.2.2391.189.91.43
                                                              Mar 20, 2025 02:43:06.627706051 CET4251680192.168.2.23109.202.202.202
                                                              Mar 20, 2025 02:43:21.985692024 CET43928443192.168.2.2391.189.91.42
                                                              Mar 20, 2025 02:43:32.224201918 CET42836443192.168.2.2391.189.91.43
                                                              Mar 20, 2025 02:43:36.319874048 CET4251680192.168.2.23109.202.202.202
                                                              Mar 20, 2025 02:44:02.940160990 CET43928443192.168.2.2391.189.91.42

                                                              System Behavior

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.A7Gm1InvoM /tmp/tmp.wEJI50ITHB /tmp/tmp.M5YSZriaZU
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/cat
                                                              Arguments:cat /tmp/tmp.A7Gm1InvoM
                                                              File size:43416 bytes
                                                              MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/head
                                                              Arguments:head -n 10
                                                              File size:47480 bytes
                                                              MD5 hash:fd96a67145172477dd57131396fc9608

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/tr
                                                              Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                              File size:51544 bytes
                                                              MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:51
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/cut
                                                              Arguments:cut -c -80
                                                              File size:47480 bytes
                                                              MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/cat
                                                              Arguments:cat /tmp/tmp.A7Gm1InvoM
                                                              File size:43416 bytes
                                                              MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/head
                                                              Arguments:head -n 10
                                                              File size:47480 bytes
                                                              MD5 hash:fd96a67145172477dd57131396fc9608

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/tr
                                                              Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                              File size:51544 bytes
                                                              MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/cut
                                                              Arguments:cut -c -80
                                                              File size:47480 bytes
                                                              MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):01:42:52
                                                              Start date (UTC):20/03/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.A7Gm1InvoM /tmp/tmp.wEJI50ITHB /tmp/tmp.M5YSZriaZU
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                              Start time (UTC):01:42:58
                                                              Start date (UTC):20/03/2025
                                                              Path:/tmp/jkse.ppc.elf
                                                              Arguments:/tmp/jkse.ppc.elf
                                                              File size:5388968 bytes
                                                              MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                              Start time (UTC):01:42:58
                                                              Start date (UTC):20/03/2025
                                                              Path:/tmp/jkse.ppc.elf
                                                              Arguments:-
                                                              File size:5388968 bytes
                                                              MD5 hash:ae65271c943d3451b7f026d1fadccea6