Edit tour

Linux Analysis Report
45.126.126.33-sora.spc-2025-03-12T01_48_28.elf

Overview

General Information

Sample name:45.126.126.33-sora.spc-2025-03-12T01_48_28.elf
Analysis ID:1644129
MD5:6683079c0364b57b6fadef19dd37b236
SHA1:adb8f038eb70bb61bdf72b56381e6cf2c682d302
SHA256:7490fc5b6cffa2b64c8793fa8b0243ad8dc0a7717d9ab06ba78eea77c6945b60
Tags:elfuser-threatquery
Infos:

Detection

Mirai
Score:80
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644129
Start date and time:2025-03-20 11:48:29 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 34s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:45.126.126.33-sora.spc-2025-03-12T01_48_28.elf
Detection:MAL
Classification:mal80.troj.linELF@0/0@0/0
Command:/tmp/45.126.126.33-sora.spc-2025-03-12T01_48_28.elf
PID:6255
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 6218, Parent: 4337)
  • rm (PID: 6218, Parent: 4337, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.IDaU4Tv8ld /tmp/tmp.rRcQY6zSNQ /tmp/tmp.Zu68n8uu4j
  • dash New Fork (PID: 6219, Parent: 4337)
  • cat (PID: 6219, Parent: 4337, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.IDaU4Tv8ld
  • dash New Fork (PID: 6220, Parent: 4337)
  • head (PID: 6220, Parent: 4337, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6221, Parent: 4337)
  • tr (PID: 6221, Parent: 4337, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6222, Parent: 4337)
  • cut (PID: 6222, Parent: 4337, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6223, Parent: 4337)
  • cat (PID: 6223, Parent: 4337, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.IDaU4Tv8ld
  • dash New Fork (PID: 6224, Parent: 4337)
  • head (PID: 6224, Parent: 4337, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6225, Parent: 4337)
  • tr (PID: 6225, Parent: 4337, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6226, Parent: 4337)
  • cut (PID: 6226, Parent: 4337, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6227, Parent: 4337)
  • rm (PID: 6227, Parent: 4337, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.IDaU4Tv8ld /tmp/tmp.rRcQY6zSNQ /tmp/tmp.Zu68n8uu4j
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
45.126.126.33-sora.spc-2025-03-12T01_48_28.elfJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    45.126.126.33-sora.spc-2025-03-12T01_48_28.elfJoeSecurity_Mirai_5Yara detected MiraiJoe Security
      45.126.126.33-sora.spc-2025-03-12T01_48_28.elfMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
      • 0x10be0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
      SourceRuleDescriptionAuthorStrings
      6255.1.00007fa988011000.00007fa988023000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
        6255.1.00007fa988011000.00007fa988023000.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
          6255.1.00007fa988011000.00007fa988023000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
          • 0x10be0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
          Process Memory Space: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf PID: 6255JoeSecurity_Mirai_9Yara detected MiraiJoe Security
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elfAvira: detected
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elfVirustotal: Detection: 62%Perma Link
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elfReversingLabs: Detection: 69%
            Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
            Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
            Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
            Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
            Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
            Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

            System Summary

            barindex
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf, type: SAMPLEMatched rule: Detects ELF malware Mirai related Author: Florian Roth
            Source: 6255.1.00007fa988011000.00007fa988023000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf, type: SAMPLEMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
            Source: 6255.1.00007fa988011000.00007fa988023000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
            Source: classification engineClassification label: mal80.troj.linELF@0/0@0/0
            Source: /usr/bin/dash (PID: 6218)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IDaU4Tv8ld /tmp/tmp.rRcQY6zSNQ /tmp/tmp.Zu68n8uu4jJump to behavior
            Source: /usr/bin/dash (PID: 6227)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IDaU4Tv8ld /tmp/tmp.rRcQY6zSNQ /tmp/tmp.Zu68n8uu4jJump to behavior
            Source: /tmp/45.126.126.33-sora.spc-2025-03-12T01_48_28.elf (PID: 6255)Queries kernel information via 'uname': Jump to behavior
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf, 6255.1.000056422c203000.000056422c288000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sparc
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf, 6255.1.000056422c203000.000056422c288000.rw-.sdmpBinary or memory string: L ,BV!/etc/qemu-binfmt/sparc
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf, 6255.1.00007ffcc48eb000.00007ffcc490c000.rw-.sdmpBinary or memory string: 4u8x86_64/usr/bin/qemu-sparc/tmp/45.126.126.33-sora.spc-2025-03-12T01_48_28.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/45.126.126.33-sora.spc-2025-03-12T01_48_28.elf
            Source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf, 6255.1.00007ffcc48eb000.00007ffcc490c000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sparc

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf, type: SAMPLE
            Source: Yara matchFile source: 6255.1.00007fa988011000.00007fa988023000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf PID: 6255, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf, type: SAMPLE
            Source: Yara matchFile source: 6255.1.00007fa988011000.00007fa988023000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf PID: 6255, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
            File Deletion
            OS Credential Dumping11
            Security Software Discovery
            Remote ServicesData from Local System1
            Encrypted Channel
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
            Application Layer Protocol
            Exfiltration Over BluetoothNetwork Denial of Service
            No configs have been found
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644129 Sample: 45.126.126.33-sora.spc-2025... Startdate: 20/03/2025 Architecture: LINUX Score: 80 14 109.202.202.202, 80 INIT7CH Switzerland 2->14 16 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->16 18 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->18 20 Malicious sample detected (through community Yara rule) 2->20 22 Antivirus / Scanner detection for submitted sample 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected Mirai 2->26 6 dash rm 45.126.126.33-sora.spc-2025-03-12T01_48_28.elf 2->6         started        8 dash rm 2->8         started        10 dash cat 2->10         started        12 7 other processes 2->12 signatures3 process4
            SourceDetectionScannerLabelLink
            45.126.126.33-sora.spc-2025-03-12T01_48_28.elf62%VirustotalBrowse
            45.126.126.33-sora.spc-2025-03-12T01_48_28.elf69%ReversingLabsLinux.Backdoor.Mirai
            45.126.126.33-sora.spc-2025-03-12T01_48_28.elf100%AviraLINUX/Mirai.bonb
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches

            Download Network PCAP: filteredfull

            No contacted domains info
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            109.202.202.202
            unknownSwitzerland
            13030INIT7CHfalse
            91.189.91.43
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            91.189.91.42
            unknownUnited Kingdom
            41231CANONICAL-ASGBfalse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
            91.189.91.43i.elfGet hashmaliciousMiraiBrowse
              tftp.elfGet hashmaliciousUnknownBrowse
                miner.elfGet hashmaliciousUnknownBrowse
                  miner.elfGet hashmaliciousUnknownBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        na.elfGet hashmaliciousPrometeiBrowse
                          miner.elfGet hashmaliciousUnknownBrowse
                            gigab.sh4.elfGet hashmaliciousUnknownBrowse
                              gigab.ppc.elfGet hashmaliciousUnknownBrowse
                                91.189.91.42i.elfGet hashmaliciousMiraiBrowse
                                  tftp.elfGet hashmaliciousUnknownBrowse
                                    miner.elfGet hashmaliciousUnknownBrowse
                                      miner.elfGet hashmaliciousUnknownBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            na.elfGet hashmaliciousPrometeiBrowse
                                              miner.elfGet hashmaliciousUnknownBrowse
                                                gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                                  gigab.ppc.elfGet hashmaliciousUnknownBrowse
                                                    No context
                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    CANONICAL-ASGBi.elfGet hashmaliciousMiraiBrowse
                                                    • 91.189.91.42
                                                    tftp.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    hiss.arm7.elfGet hashmaliciousUnknownBrowse
                                                    • 185.125.190.26
                                                    CANONICAL-ASGBi.elfGet hashmaliciousMiraiBrowse
                                                    • 91.189.91.42
                                                    tftp.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 91.189.91.42
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                                    • 91.189.91.42
                                                    hiss.arm7.elfGet hashmaliciousUnknownBrowse
                                                    • 185.125.190.26
                                                    INIT7CHi.elfGet hashmaliciousMiraiBrowse
                                                    • 109.202.202.202
                                                    tftp.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 109.202.202.202
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 109.202.202.202
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                    • 109.202.202.202
                                                    miner.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    gigab.sh4.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    gigab.ppc.elfGet hashmaliciousUnknownBrowse
                                                    • 109.202.202.202
                                                    No context
                                                    No context
                                                    No created / dropped files found
                                                    File type:ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
                                                    Entropy (8bit):6.104673453881513
                                                    TrID:
                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                    File name:45.126.126.33-sora.spc-2025-03-12T01_48_28.elf
                                                    File size:74'752 bytes
                                                    MD5:6683079c0364b57b6fadef19dd37b236
                                                    SHA1:adb8f038eb70bb61bdf72b56381e6cf2c682d302
                                                    SHA256:7490fc5b6cffa2b64c8793fa8b0243ad8dc0a7717d9ab06ba78eea77c6945b60
                                                    SHA512:002fbcb2e236a6f3547823cf88d687c87d1958d377838cc986aa1a4372a1dbdcc28654ca4c135049134b237dfc540540e4504e26185de17d10000f569e2f175f
                                                    SSDEEP:1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8B:YwfdNu4cmZvFqI3w7B
                                                    TLSH:28735D24A97D2E26C0D4A17B62FB8361F2F6230E2570965D7C760F8FFF2464468162B7
                                                    File Content Preview:.ELF...........................4.."p.....4. ...(.......................P...P.............. ... ... ....0............dt.Q................................@..(....@.B.................#.....b0..`.....!..... ...@.....".........`......$ ... ...@...........`....

                                                    ELF header

                                                    Class:ELF32
                                                    Data:2's complement, big endian
                                                    Version:1 (current)
                                                    Machine:Sparc
                                                    Version Number:0x1
                                                    Type:EXEC (Executable file)
                                                    OS/ABI:UNIX - System V
                                                    ABI Version:0
                                                    Entry Point Address:0x101a4
                                                    Flags:0x0
                                                    ELF Header Size:52
                                                    Program Header Offset:52
                                                    Program Header Size:32
                                                    Number of Program Headers:3
                                                    Section Header Offset:74352
                                                    Section Header Size:40
                                                    Number of Section Headers:10
                                                    Header String Table Index:9
                                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                    NULL0x00x00x00x00x0000
                                                    .initPROGBITS0x100940x940x1c0x00x6AX004
                                                    .textPROGBITS0x100b00xb00x10b0c0x00x6AX004
                                                    .finiPROGBITS0x20bbc0x10bbc0x140x00x6AX004
                                                    .rodataPROGBITS0x20bd00x10bd00x11800x00x2A008
                                                    .ctorsPROGBITS0x320000x120000x80x00x3WA004
                                                    .dtorsPROGBITS0x320080x120080x80x00x3WA004
                                                    .dataPROGBITS0x320180x120180x2180x00x3WA008
                                                    .bssNOBITS0x322300x122300x2880x00x3WA008
                                                    .shstrtabSTRTAB0x00x122300x3e0x00x0001
                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                    LOAD0x00x100000x100000x11d500x11d506.15720x5R E0x10000.init .text .fini .rodata
                                                    LOAD0x120000x320000x320000x2300x4b82.93520x6RW 0x10000.ctors .dtors .data .bss
                                                    GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                    Download Network PCAP: filteredfull

                                                    • Total Packets: 6
                                                    • 443 (HTTPS)
                                                    • 80 (HTTP)
                                                    TimestampSource PortDest PortSource IPDest IP
                                                    Mar 20, 2025 11:49:20.652333975 CET42836443192.168.2.2391.189.91.43
                                                    Mar 20, 2025 11:49:22.187690020 CET4251680192.168.2.23109.202.202.202
                                                    Mar 20, 2025 11:49:37.033659935 CET43928443192.168.2.2391.189.91.42
                                                    Mar 20, 2025 11:49:47.272233963 CET42836443192.168.2.2391.189.91.43
                                                    Mar 20, 2025 11:49:53.415458918 CET4251680192.168.2.23109.202.202.202
                                                    Mar 20, 2025 11:50:17.987999916 CET43928443192.168.2.2391.189.91.42

                                                    System Behavior

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/rm
                                                    Arguments:rm -f /tmp/tmp.IDaU4Tv8ld /tmp/tmp.rRcQY6zSNQ /tmp/tmp.Zu68n8uu4j
                                                    File size:72056 bytes
                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/cat
                                                    Arguments:cat /tmp/tmp.IDaU4Tv8ld
                                                    File size:43416 bytes
                                                    MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/head
                                                    Arguments:head -n 10
                                                    File size:47480 bytes
                                                    MD5 hash:fd96a67145172477dd57131396fc9608

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/tr
                                                    Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                    File size:51544 bytes
                                                    MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:09
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/cut
                                                    Arguments:cut -c -80
                                                    File size:47480 bytes
                                                    MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/cat
                                                    Arguments:cat /tmp/tmp.IDaU4Tv8ld
                                                    File size:43416 bytes
                                                    MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/head
                                                    Arguments:head -n 10
                                                    File size:47480 bytes
                                                    MD5 hash:fd96a67145172477dd57131396fc9608

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/tr
                                                    Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                    File size:51544 bytes
                                                    MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/cut
                                                    Arguments:cut -c -80
                                                    File size:47480 bytes
                                                    MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/dash
                                                    Arguments:-
                                                    File size:129816 bytes
                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                    Start time (UTC):10:49:10
                                                    Start date (UTC):20/03/2025
                                                    Path:/usr/bin/rm
                                                    Arguments:rm -f /tmp/tmp.IDaU4Tv8ld /tmp/tmp.rRcQY6zSNQ /tmp/tmp.Zu68n8uu4j
                                                    File size:72056 bytes
                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                    Start time (UTC):10:49:16
                                                    Start date (UTC):20/03/2025
                                                    Path:/tmp/45.126.126.33-sora.spc-2025-03-12T01_48_28.elf
                                                    Arguments:/tmp/45.126.126.33-sora.spc-2025-03-12T01_48_28.elf
                                                    File size:4379400 bytes
                                                    MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e