Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
Space.arm5.elf

Overview

General Information

Sample name:Space.arm5.elf
Analysis ID:1644253
MD5:e126ca680700e0d72f6070e82af33bad
SHA1:2d2113a85c52f33adebe609b04dfd00d6f04fefe
SHA256:72e09e0296335158b909215457015aa42f6aa2caf6781469f369ebcb38066372
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Score:60
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "rm" command used to delete files or directories
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644253
Start date and time:2025-03-20 13:42:42 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 30s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Space.arm5.elf
Detection:MAL
Classification:mal60.evad.linELF@0/0@0/0

Runtime Messages

Command:/tmp/Space.arm5.elf
PID:5528
Exit Code:127
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • Space.arm5.elf (PID: 5528, Parent: 5446, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Space.arm5.elf
  • dash New Fork (PID: 5585, Parent: 3633)
  • rm (PID: 5585, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.mfAbmP7cjU /tmp/tmp.hkTOH83uvS /tmp/tmp.YcwOD1yxkW
  • dash New Fork (PID: 5586, Parent: 3633)
  • rm (PID: 5586, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.mfAbmP7cjU /tmp/tmp.hkTOH83uvS /tmp/tmp.YcwOD1yxkW
  • cleanup

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
5528.1.00007f1488017000.00007f1488021000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x8598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x85ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x85c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x85d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x85e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x85fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x864c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x869c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x86b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x86c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x86d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x86ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8700:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8714:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8728:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm5.elf PID: 5528Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x2d803:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d817:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d82b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d83f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d853:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d867:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d87b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d88f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d8a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d8b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d8cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d8df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d8f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d907:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d91b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d92f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d943:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d957:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d96b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d97f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2d993:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Networking
  • • System Summary
  • • Data Obfuscation
  • • Persistence and Installation Behavior
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Space.arm5.elfVirustotal: Detection: 38%Perma Link
Source: Space.arm5.elfReversingLabs: Detection: 41%
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: Space.arm5.elfString found in binary or memory: http://upx.sf.net
Source: unknownNetwork traffic detected: HTTP traffic on port 59330 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 59330

System Summary

barindex
Source: 5528.1.00007f1488017000.00007f1488021000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm5.elf PID: 5528, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: LOAD without section mappingsProgram segment: 0x8000
Source: 5528.1.00007f1488017000.00007f1488021000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm5.elf PID: 5528, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engineClassification label: mal60.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Source: /usr/bin/dash (PID: 5585)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.mfAbmP7cjU /tmp/tmp.hkTOH83uvS /tmp/tmp.YcwOD1yxkWJump to behavior
Source: /usr/bin/dash (PID: 5586)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.mfAbmP7cjU /tmp/tmp.hkTOH83uvS /tmp/tmp.YcwOD1yxkWJump to behavior
Source: Space.arm5.elfSubmission file: segment LOAD with 7.9015 entropy (max. 8.0)
Source: /tmp/Space.arm5.elf (PID: 5528)Queries kernel information via 'uname': Jump to behavior
Source: Space.arm5.elf, 5528.1.000056230bb2f000.000056230bd1d000.rw-.sdmpBinary or memory string: #V!/etc/qemu-binfmt/arm
Source: Space.arm5.elf, 5528.1.000056230bb2f000.000056230bd1d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: Space.arm5.elf, 5528.1.00007fff6ff7c000.00007fff6ff9d000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: Space.arm5.elf, 5528.1.00007fff6ff7c000.00007fff6ff9d000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/Space.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.arm5.elf

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
Obfuscated Files or Information		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
File Deletion		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644253 Sample: Space.arm5.elf Startdate: 20/03/2025 Architecture: LINUX Score: 60 12 34.254.182.186, 443, 59330 AMAZON-02US United States 2->12 14 Malicious sample detected (through community Yara rule) 2->14 16 Multi AV Scanner detection for submitted file 2->16 18 Sample is packed with UPX 2->18 6 dash rm 2->6         started        8 dash rm 2->8         started        10 Space.arm5.elf 2->10         started        signatures3 process4

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Space.arm5.elf38%VirustotalBrowse
Space.arm5.elf42%ReversingLabsLinux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://upx.sf.netSpace.arm5.elffalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    34.254.182.186
    		unknownUnited States
    		16509AMAZON-02USfalse

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    34.254.182.186arm.elfGet hashmaliciousUnknownBrowse
      bot.arm6.elfGet hashmaliciousUnknownBrowse
        hiss.arm7.elfGet hashmaliciousUnknownBrowse
          resgod.mpsl.elfGet hashmaliciousMiraiBrowse
            resgod.arm7.elfGet hashmaliciousMiraiBrowse
              .i.elfGet hashmaliciousUnknownBrowse
                x-8.6-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                  8893Xmi39S.arm5.elfGet hashmaliciousUnknownBrowse
                    sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                      na.elfGet hashmaliciousPrometeiBrowse

                        Domains

                        ⊘No context

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        AMAZON-02USNyx4r.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                        • 13.235.242.244
                        Nyx4r.m68k.elfGet hashmaliciousOkiruBrowse
                        • 54.121.79.8
                        Nyx4r.sh4.elfGet hashmaliciousOkiruBrowse
                        • 18.248.212.201
                        Nyx4r.spc.elfGet hashmaliciousOkiruBrowse
                        • 18.217.152.126
                        hoho.mips.elfGet hashmaliciousUnknownBrowse
                        • 13.245.212.34
                        hoho.i486.elfGet hashmaliciousUnknownBrowse
                        • 35.157.3.224
                        hoho.armv5l.elfGet hashmaliciousUnknownBrowse
                        • 18.180.172.151
                        mips.elfGet hashmaliciousUnknownBrowse
                        • 34.249.145.219
                        arm.elfGet hashmaliciousUnknownBrowse
                        • 34.243.160.129
                        root.elfGet hashmaliciousUnknownBrowse
                        • 13.61.153.130

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        ⊘No created / dropped files found

                        Static File Info

                        General

                        File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
                        Entropy (8bit):7.897933320682434
                        TrID:
                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                        File name:Space.arm5.elf
                        File size:20'276 bytes
                        MD5:e126ca680700e0d72f6070e82af33bad
                        SHA1:2d2113a85c52f33adebe609b04dfd00d6f04fefe
                        SHA256:72e09e0296335158b909215457015aa42f6aa2caf6781469f369ebcb38066372
                        SHA512:f1b1baced354d5f560e04caea4d9f32dd7ffb9d53926f5f0d76e7238e8734eeb99cd149fd61b25aa6f5d3687e08fc43c81ec81f6203c486c603073f2cfe38009
                        SSDEEP:384:G3me3Vg19bm2MxowbW6kn0HG0sdXIC62vnL6My/HHxjvfyh7qmdGUEpiaMyt:43Vg19bm2Wo9aHG0uFLqjvfy9q3UEL/t
                        TLSH:5292E11277280CA1ECB11C365E6B47E7691D8BFC615E307352A082F88D99973BBFD145
                        File Content Preview:.ELF..............(.........4...........4. ...(......................M...M...............&..........................Q.td............................=.%<UPX!........h...h.......n..........?.E.h;....#..$.......ZI...\........N.0.#U....%..3?..O.`....q.$...\..

                        Static ELF Info

                        ELF header

                        Class:ELF32
                        Data:2's complement, little endian
                        Version:1 (current)
                        Machine:ARM
                        Version Number:0x1
                        Type:EXEC (Executable file)
                        OS/ABI:UNIX - Linux
                        ABI Version:0
                        Entry Point Address:0xbb98
                        Flags:0x4000002
                        ELF Header Size:52
                        Program Header Offset:52
                        Program Header Size:32
                        Number of Program Headers:3
                        Section Header Offset:0
                        Section Header Size:40
                        Number of Section Headers:0
                        Header String Table Index:0

                        Program Segments

                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                        LOAD0x00x80000x80000x4d850x4d857.90150x5R E0x8000
                        LOAD0x26f00x1a6f00x1a6f00x00x00.00000x6RW 0x8000
                        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                        Network Behavior

                        Download Network PCAP: filtered – full

                        TimestampSource PortDest PortSource IPDest IP
                        Mar 20, 2025 13:43:51.664560080 CET59330443192.168.2.1434.254.182.186
                        Mar 20, 2025 13:43:51.664606094 CET4435933034.254.182.186192.168.2.14
                        Mar 20, 2025 13:43:51.664766073 CET59330443192.168.2.1434.254.182.186
                        Mar 20, 2025 13:43:51.666516066 CET59330443192.168.2.1434.254.182.186
                        Mar 20, 2025 13:43:51.666526079 CET4435933034.254.182.186192.168.2.14
                        Mar 20, 2025 13:44:51.663374901 CET59330443192.168.2.1434.254.182.186
                        Mar 20, 2025 13:44:51.708340883 CET4435933034.254.182.186192.168.2.14
                        Mar 20, 2025 13:45:37.080991030 CET4435933034.254.182.186192.168.2.14

                        System Behavior

                        General

                        Start time (UTC):12:43:32
                        Start date (UTC):20/03/2025
                        Path:/tmp/Space.arm5.elf
                        Arguments:/tmp/Space.arm5.elf
                        File size:4956856 bytes
                        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                        File Activities

                        Process Activities

                        System Activities


                        General

                        Start time (UTC):12:44:50
                        Start date (UTC):20/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:44:50
                        Start date (UTC):20/03/2025
                        Path:/usr/bin/rm
                        Arguments:rm -f /tmp/tmp.mfAbmP7cjU /tmp/tmp.hkTOH83uvS /tmp/tmp.YcwOD1yxkW
                        File size:72056 bytes
                        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                        File Activities


                        General

                        Start time (UTC):12:44:50
                        Start date (UTC):20/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:44:50
                        Start date (UTC):20/03/2025
                        Path:/usr/bin/rm
                        Arguments:rm -f /tmp/tmp.mfAbmP7cjU /tmp/tmp.hkTOH83uvS /tmp/tmp.YcwOD1yxkW
                        File size:72056 bytes
                        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                        File Activities