Edit tour

Linux Analysis Report
Space.arm.elf

Overview

General Information

Sample name:Space.arm.elf
Analysis ID:1644277
MD5:ccac3c5df1e62bc057cbc9d8531d5f26
SHA1:c1f4e72a17649d67f003fc4b798d1c9f08e38718
SHA256:940b89e061cfc3e51ccf2647c4b35063943bf8f1ac25e8e50f26d6c325a6966b
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Mirai
Score:68
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644277
Start date and time:2025-03-20 14:02:58 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 50s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Space.arm.elf
Detection:MAL
Classification:mal68.troj.evad.linELF@0/0@0/0
Command:/tmp/Space.arm.elf
PID:5512
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
5516.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    5516.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    5523.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5523.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x11f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1201c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1206c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x120a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x120bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5514.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        Click to see the 11 entries
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: Space.arm.elfVirustotal: Detection: 28%Perma Link
        Source: Space.arm.elfReversingLabs: Detection: 36%
        Source: global trafficTCP traffic: 192.168.2.14:51296 -> 209.97.147.158:3778
        Source: global trafficTCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
        Source: Space.arm.elfString found in binary or memory: http://upx.sf.net
        Source: unknownNetwork traffic detected: HTTP traffic on port 46540 -> 443

        System Summary

        barindex
        Source: 5516.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5523.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5514.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5512.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: Space.arm.elf PID: 5512, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: Space.arm.elf PID: 5514, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: Space.arm.elf PID: 5516, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: Space.arm.elf PID: 5523, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: LOAD without section mappingsProgram segment: 0x8000
        Source: 5516.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5523.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5514.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5512.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: Space.arm.elf PID: 5512, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: Space.arm.elf PID: 5514, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: Space.arm.elf PID: 5516, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: Space.arm.elf PID: 5523, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: classification engineClassification label: mal68.troj.evad.linELF@0/0@0/0

        Data Obfuscation

        barindex
        Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
        Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
        Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3760/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3761/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/1583/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/2672/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/110/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3759/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/111/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/112/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/113/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/234/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/1577/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/114/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/235/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/115/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/116/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/117/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/118/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/119/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3636/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/10/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/917/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/11/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/12/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/13/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/14/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/15/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/16/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/17/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/18/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/19/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/1593/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/240/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/120/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3094/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/121/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/242/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3406/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/1/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/122/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/243/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/2/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/123/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/244/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/1589/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/124/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/245/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/1588/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/125/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/4/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/246/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3402/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/126/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/5/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/247/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/127/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/6/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/248/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/128/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/7/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/249/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/8/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/129/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/800/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3762/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/9/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/801/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/803/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/20/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/806/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/21/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/807/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/928/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/22/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/23/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/24/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/25/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/26/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/27/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/28/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/29/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3420/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/490/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/250/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/130/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/251/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/131/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/252/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/132/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/253/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/254/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/255/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/135/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/256/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/1599/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/257/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/378/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/258/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/3412/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/259/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/30/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/35/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/1371/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/260/statusJump to behavior
        Source: /tmp/Space.arm.elf (PID: 5512)File opened: /proc/261/statusJump to behavior
        Source: Space.arm.elfSubmission file: segment LOAD with 7.9706 entropy (max. 8.0)
        Source: /tmp/Space.arm.elf (PID: 5512)Queries kernel information via 'uname': Jump to behavior
        Source: Space.arm.elf, 5512.1.000055c7cef81000.000055c7cf131000.rw-.sdmp, Space.arm.elf, 5514.1.000055c7cef81000.000055c7cf10f000.rw-.sdmp, Space.arm.elf, 5516.1.000055c7cef81000.000055c7cf10f000.rw-.sdmp, Space.arm.elf, 5523.1.000055c7cef81000.000055c7cf131000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
        Source: Space.arm.elf, 5512.1.000055c7cef81000.000055c7cf131000.rw-.sdmp, Space.arm.elf, 5514.1.000055c7cef81000.000055c7cf10f000.rw-.sdmp, Space.arm.elf, 5516.1.000055c7cef81000.000055c7cf10f000.rw-.sdmp, Space.arm.elf, 5523.1.000055c7cef81000.000055c7cf131000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: Space.arm.elf, 5512.1.00007ffd221d3000.00007ffd221f4000.rw-.sdmp, Space.arm.elf, 5514.1.00007ffd221d3000.00007ffd221f4000.rw-.sdmp, Space.arm.elf, 5516.1.00007ffd221d3000.00007ffd221f4000.rw-.sdmp, Space.arm.elf, 5523.1.00007ffd221d3000.00007ffd221f4000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: Space.arm.elf, 5512.1.00007ffd221d3000.00007ffd221f4000.rw-.sdmp, Space.arm.elf, 5514.1.00007ffd221d3000.00007ffd221f4000.rw-.sdmp, Space.arm.elf, 5516.1.00007ffd221d3000.00007ffd221f4000.rw-.sdmp, Space.arm.elf, 5523.1.00007ffd221d3000.00007ffd221f4000.rw-.sdmpBinary or memory string: Lx86_64/usr/bin/qemu-arm/tmp/Space.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.arm.elf

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: 5516.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5523.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5514.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5512.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Space.arm.elf PID: 5512, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: Space.arm.elf PID: 5514, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: Space.arm.elf PID: 5516, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: Space.arm.elf PID: 5523, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: 5516.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5523.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5514.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5512.1.00007f1e2c017000.00007f1e2c02c000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Space.arm.elf PID: 5512, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: Space.arm.elf PID: 5514, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: Space.arm.elf PID: 5516, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: Space.arm.elf PID: 5523, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
        Obfuscated Files or Information
        1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Standard Port
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644277 Sample: Space.arm.elf Startdate: 20/03/2025 Architecture: LINUX Score: 68 20 209.97.147.158, 3778 DIGITALOCEAN-ASNUS United States 2->20 22 185.125.190.26, 443 CANONICAL-ASGB United Kingdom 2->22 24 Malicious sample detected (through community Yara rule) 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Mirai 2->28 30 Sample is packed with UPX 2->30 8 Space.arm.elf 2->8         started        signatures3 process4 process5 10 Space.arm.elf 8->10         started        12 Space.arm.elf 8->12         started        14 Space.arm.elf 8->14         started        process6 16 Space.arm.elf 10->16         started        18 Space.arm.elf 10->18         started       

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        Space.arm.elf28%VirustotalBrowse
        Space.arm.elf36%ReversingLabsLinux.Backdoor.Mirai
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        No contacted domains info
        NameSourceMaliciousAntivirus DetectionReputation
        http://upx.sf.netSpace.arm.elffalse
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          185.125.190.26
          unknownUnited Kingdom
          41231CANONICAL-ASGBfalse
          209.97.147.158
          unknownUnited States
          14061DIGITALOCEAN-ASNUSfalse
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          185.125.190.26Space.mips.elfGet hashmaliciousUnknownBrowse
            Space.x86_64.elfGet hashmaliciousUnknownBrowse
              sshd.elfGet hashmaliciousUnknownBrowse
                .5r3fqt67ew531has4231.sh4.elfGet hashmaliciousGafgyt, Mirai, Moobot, OkiruBrowse
                  yakuza.m68k.elfGet hashmaliciousGafgyt, MiraiBrowse
                    .5r3fqt67ew531has4231.arm5.elfGet hashmaliciousUnknownBrowse
                      main_arm6.elfGet hashmaliciousMiraiBrowse
                        main_mips.elfGet hashmaliciousMiraiBrowse
                          bot.arm6.elfGet hashmaliciousUnknownBrowse
                            hiss.arm7.elfGet hashmaliciousUnknownBrowse
                              209.97.147.158Space.mips.elfGet hashmaliciousUnknownBrowse
                                Space.ppc.elfGet hashmaliciousUnknownBrowse
                                  Space.arm7.elfGet hashmaliciousMiraiBrowse
                                    Space.arm6.elfGet hashmaliciousUnknownBrowse
                                      Space.mpsl.elfGet hashmaliciousUnknownBrowse
                                        Space.i686.elfGet hashmaliciousUnknownBrowse
                                          Space.x86_64.elfGet hashmaliciousUnknownBrowse
                                            Space.sh4.elfGet hashmaliciousUnknownBrowse
                                              Space.m68k.elfGet hashmaliciousMiraiBrowse
                                                Space.x86.elfGet hashmaliciousUnknownBrowse
                                                  No context
                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  CANONICAL-ASGBSpace.mips.elfGet hashmaliciousUnknownBrowse
                                                  • 185.125.190.26
                                                  Space.ppc.elfGet hashmaliciousUnknownBrowse
                                                  • 91.189.91.42
                                                  686i.elfGet hashmaliciousUnknownBrowse
                                                  • 91.189.91.42
                                                  Space.x86_64.elfGet hashmaliciousUnknownBrowse
                                                  • 185.125.190.26
                                                  sshd.elfGet hashmaliciousUnknownBrowse
                                                  • 185.125.190.26
                                                  Space.sh4.elfGet hashmaliciousUnknownBrowse
                                                  • 91.189.91.42
                                                  Space.m68k.elfGet hashmaliciousMiraiBrowse
                                                  • 91.189.91.42
                                                  mips.elfGet hashmaliciousUnknownBrowse
                                                  • 91.189.91.42
                                                  smips.elfGet hashmaliciousUnknownBrowse
                                                  • 91.189.91.42
                                                  psmpsl.elfGet hashmaliciousUnknownBrowse
                                                  • 91.189.91.42
                                                  DIGITALOCEAN-ASNUSSpace.mips.elfGet hashmaliciousUnknownBrowse
                                                  • 209.97.147.158
                                                  Space.ppc.elfGet hashmaliciousUnknownBrowse
                                                  • 209.97.147.158
                                                  Space.arm7.elfGet hashmaliciousMiraiBrowse
                                                  • 209.97.147.158
                                                  Space.arm6.elfGet hashmaliciousUnknownBrowse
                                                  • 209.97.147.158
                                                  Space.mpsl.elfGet hashmaliciousUnknownBrowse
                                                  • 209.97.147.158
                                                  Space.i686.elfGet hashmaliciousUnknownBrowse
                                                  • 209.97.147.158
                                                  Space.x86_64.elfGet hashmaliciousUnknownBrowse
                                                  • 209.97.147.158
                                                  Space.sh4.elfGet hashmaliciousUnknownBrowse
                                                  • 209.97.147.158
                                                  Space.m68k.elfGet hashmaliciousMiraiBrowse
                                                  • 209.97.147.158
                                                  Space.x86.elfGet hashmaliciousUnknownBrowse
                                                  • 209.97.147.158
                                                  No context
                                                  No context
                                                  No created / dropped files found
                                                  File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
                                                  Entropy (8bit):7.96870235715474
                                                  TrID:
                                                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                  File name:Space.arm.elf
                                                  File size:39'296 bytes
                                                  MD5:ccac3c5df1e62bc057cbc9d8531d5f26
                                                  SHA1:c1f4e72a17649d67f003fc4b798d1c9f08e38718
                                                  SHA256:940b89e061cfc3e51ccf2647c4b35063943bf8f1ac25e8e50f26d6c325a6966b
                                                  SHA512:58b04431ac73d5f80613a9e6694d03736716fa8a0a63bfad32b4b4736f7f28bd7bec21ee562d84fc13b6cdc2da422c6d46faa5efc55fedba07596d8c6108bb8f
                                                  SSDEEP:768:eu7RATMUu4f7RDdP6NM8I52VNbvdFsDJ4bL6ps3UozOZ:TRAC4fNDdP6N5pd+DULjzOZ
                                                  TLSH:08030296B99BE511E8908934BE3F05127A27BEBCC1E7312891210638BDD1747722CEDA
                                                  File Content Preview:.ELF...a..........(.........4...........4. ...(....................._..._................{...{...{..................Q.td............................s.y.UPX!.........T...T......S..........?.E.h;.}...^..........fK..z..,vU...].XLU..0.)..0(7n..V5.'...,;.q9...

                                                  ELF header

                                                  Class:ELF32
                                                  Data:2's complement, little endian
                                                  Version:1 (current)
                                                  Machine:ARM
                                                  Version Number:0x1
                                                  Type:EXEC (Executable file)
                                                  OS/ABI:ARM - ABI
                                                  ABI Version:0
                                                  Entry Point Address:0x106b0
                                                  Flags:0x202
                                                  ELF Header Size:52
                                                  Program Header Offset:52
                                                  Program Header Size:32
                                                  Number of Program Headers:3
                                                  Section Header Offset:0
                                                  Section Header Size:40
                                                  Number of Section Headers:0
                                                  Header String Table Index:0
                                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                  LOAD0x00x80000x80000x985f0x985f7.97060x5R E0x8000
                                                  LOAD0x7bc80x27bc80x27bc80x00x00.00000x6RW 0x8000
                                                  GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                  Download Network PCAP: filteredfull

                                                  • Total Packets: 97
                                                  • 3778 undefined
                                                  • 443 (HTTPS)
                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Mar 20, 2025 14:03:55.082326889 CET512963778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:03:56.094584942 CET512963778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:03:58.110666990 CET512963778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:00.805672884 CET512983778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:01.822473049 CET512983778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:02.142275095 CET512963778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:02.910342932 CET46540443192.168.2.14185.125.190.26
                                                  Mar 20, 2025 14:04:03.838304043 CET512983778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:06.114341974 CET513003778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:07.134274960 CET513003778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:08.030158997 CET512983778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:09.150257111 CET513003778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:11.835941076 CET513023778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:12.861968040 CET513023778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:13.405932903 CET513003778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:14.877963066 CET513023778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:17.127837896 CET513043778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:18.141742945 CET513043778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:19.037815094 CET513023778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:20.157645941 CET513043778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:22.849517107 CET513063778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:23.869621992 CET513063778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:24.413490057 CET513043778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:25.885386944 CET513063778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:28.141247034 CET513083778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:29.149408102 CET513083778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:30.045311928 CET513063778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:31.165175915 CET513083778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:33.629225016 CET46540443192.168.2.14185.125.190.26
                                                  Mar 20, 2025 14:04:33.862041950 CET513103778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:34.877237082 CET513103778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:35.421508074 CET513083778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:36.892993927 CET513103778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:39.154301882 CET513123778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:40.156883001 CET513123778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:41.052867889 CET513103778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:42.172892094 CET513123778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:44.874480009 CET513143778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:45.884711981 CET513143778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:46.428862095 CET513123778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:47.901024103 CET513143778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:50.167263031 CET513163778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:51.196461916 CET513163778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:52.060427904 CET513143778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:53.212335110 CET513163778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:55.887691021 CET513183778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:56.892208099 CET513183778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:57.436265945 CET513163778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:04:58.908174992 CET513183778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:01.180551052 CET513203778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:02.204088926 CET513203778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:03.068229914 CET513183778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:04.220024109 CET513203778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:06.902112961 CET513223778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:07.931972980 CET513223778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:08.443768978 CET513203778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:09.947801113 CET513223778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:12.191018105 CET513243778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:13.211771965 CET513243778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:14.075609922 CET513223778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:15.227534056 CET513243778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:17.914828062 CET513263778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:18.939464092 CET513263778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:19.451426983 CET513243778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:20.955437899 CET513263778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:23.202632904 CET513283778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:24.219221115 CET513283778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:25.083208084 CET513263778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:26.235197067 CET513283778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:28.927431107 CET513303778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:29.947541952 CET513303778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:30.458995104 CET513283778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:31.963027000 CET513303778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:34.213572025 CET513323778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:35.226721048 CET513323778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:36.090893030 CET513303778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:37.242784977 CET513323778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:39.932745934 CET513343778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:40.954585075 CET513343778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:41.466490984 CET513323778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:42.970557928 CET513343778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:45.227238894 CET513363778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:46.234364033 CET513363778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:47.098431110 CET513343778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:48.250288963 CET513363778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:50.946907043 CET513383778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:51.962165117 CET513383778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:52.474047899 CET513363778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:53.978172064 CET513383778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:56.241036892 CET513403778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:57.241954088 CET513403778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:58.105917931 CET513383778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:05:59.257836103 CET513403778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:06:01.959722996 CET513423778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:06:02.969819069 CET513423778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:06:03.481797934 CET513403778192.168.2.14209.97.147.158
                                                  Mar 20, 2025 14:06:04.985574007 CET513423778192.168.2.14209.97.147.158

                                                  System Behavior

                                                  Start time (UTC):13:03:53
                                                  Start date (UTC):20/03/2025
                                                  Path:/tmp/Space.arm.elf
                                                  Arguments:/tmp/Space.arm.elf
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Start time (UTC):13:03:54
                                                  Start date (UTC):20/03/2025
                                                  Path:/tmp/Space.arm.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Start time (UTC):13:03:54
                                                  Start date (UTC):20/03/2025
                                                  Path:/tmp/Space.arm.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Start time (UTC):13:03:54
                                                  Start date (UTC):20/03/2025
                                                  Path:/tmp/Space.arm.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Start time (UTC):13:03:59
                                                  Start date (UTC):20/03/2025
                                                  Path:/tmp/Space.arm.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                  Start time (UTC):13:03:59
                                                  Start date (UTC):20/03/2025
                                                  Path:/tmp/Space.arm.elf
                                                  Arguments:-
                                                  File size:4956856 bytes
                                                  MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1