Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
linux_mipsel_softfloat.elf

Overview

General Information

Sample name:linux_mipsel_softfloat.elf
Analysis ID:1644681
MD5:1bc524efea7982b3b6c8fca7c30286ec
SHA1:83021a81635d966164f19c8bfad1aeafd22f406b
SHA256:1ab8a8d49e1854d00ab7b67267eb40c4f96bfbfb5dd80dbed89c0fea0cd226fb
Tags:elfuser-abuse_ch
Infos:

Detection

Chaos
Score:56
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Chaos
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644681
Start date and time:2025-03-20 20:13:18 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 22s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:linux_mipsel_softfloat.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@0/0

Runtime Messages

Command:/tmp/linux_mipsel_softfloat.elf
PID:5426
Exit Code:2
Exit Code Info:
Killed:False
Standard Output:

Standard Error:fatal error: sigaction failed

runtime stack:
runtime.throw({0x3a34e5, 0x10})
/usr/lib/go-1.18/src/runtime/panic.go:992 +0x60
runtime.sysSigaction.func1()
/usr/lib/go-1.18/src/runtime/os_linux.go:529 +0x48
runtime.sysSigaction(0x41, 0x7ffffd00, 0x0)
/usr/lib/go-1.18/src/runtime/os_linux.go:528 +0x78
runtime.sigaction(0x41, 0x7ffffd00, 0x0)
/usr/lib/go-1.18/src/runtime/sigaction.go:15 +0x28
runtime.setsig(0x41, 0x6d830)
/usr/lib/go-1.18/src/runtime/os_linux.go:478 +0xb4
runtime.initsig(0x0)
/usr/lib/go-1.18/src/runtime/signal_unix.go:147 +0x294
runtime.mstartm0()
/usr/lib/go-1.18/src/runtime/proc.go:1442 +0x6c
runtime.mstart1()
/usr/lib/go-1.18/src/runtime/proc.go:1414 +0x90
runtime.mstart0()
/usr/lib/go-1.18/src/runtime/proc.go:1376 +0x74
runtime.mstart()
/usr/lib/go-1.18/src/runtime/asm_mipsx.s:89 +0x10

goroutine 1 [runnable]:
runtime.main()
/usr/lib/go-1.18/src/runtime/proc.go:145
runtime.goexit()
/usr/lib/go-1.18/src/runtime/asm_mipsx.s:610 +0x4

Process Tree

  • system is lnxubuntu20
  • linux_mipsel_softfloat.elf (PID: 5426, Parent: 5347, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/linux_mipsel_softfloat.elf
  • dash New Fork (PID: 5476, Parent: 3589)
  • rm (PID: 5476, Parent: 3589, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.n68riDVfdA /tmp/tmp.Mq3h1jtk8c /tmp/tmp.LrqnUbkmrB
  • dash New Fork (PID: 5477, Parent: 3589)
  • rm (PID: 5477, Parent: 3589, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.n68riDVfdA /tmp/tmp.Mq3h1jtk8c /tmp/tmp.LrqnUbkmrB
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
ChaosMulti-functional malware written in Go, targeting both Linux and Windows, evolved from elf.kaiji.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.chaos

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
linux_mipsel_softfloat.elfJoeSecurity_ChaosGoYara detected ChaosJoe Security

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    • • AV Detection
    • • Networking
    • • System Summary
    • • Persistence and Installation Behavior
    • • Malware Analysis System Evasion
    • • Stealing of Sensitive Information
    • • Remote Access Functionality

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: linux_mipsel_softfloat.elfReversingLabs: Detection: 41%
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing connectionhttp: message cannot contain multiple Content-Length headers; got %qpadding bytes must all be zeros unless AllowIllegalWrites is enabledreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)tls: handshake message of length %d bytes exceeds maximum of %d bytestls: peer doesn't support the certificate custom signature algorithmsbytes.Buffer: UnreadByte: previous operation was not a successful readcannot convert slice with length %y to pointer to array with length %xgot %s for stream %d; expected CONTINUATION following %s for stream %dx509: PKCS#8 wrapping contained private key with unknown algorithm: %vx509: certificate relies on legacy Common Name field, use SANs insteadMozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)Sogou Pic Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)dynamic table size update MUST occur at the beginning of a header blockssh: no common algorithm for %s; client offered: %v, server offered: %vtls: peer doesn't support any of the certificate's signature algorithmstoo many concurrent operations on a single file or socket (max 1048575)x509: issuer has name constraints but leaf doesn't have a SAN extensionMozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)tls: server's certificate contains an unsupported type of public key: %Ttls: received unexpected handshake message of type %T when waiting for %T91289437fa036b34da55d57af6192768c27bd433fa012169d626d934e0051b24dd67dd3cf49d7cc827bc012d259d7ac226e70829239d7ac226e7082968de60d520eb433722c07fd236f6crypto/elliptic: internal error: Unmarshal rejected a valid point encodingmalformed response from server: malformed non-numeric status pseudo headernet/http: server replied with more than declared Content-Length; truncatedtls: certificate RSA key size too small for supported signature algorithmsUnsolicited response received on idle HTTP channel starting with %q; err=%vtls: internal error: attempted to read record with pending application datatls: failed to send closeNotify alert (but connection was closed anyway): %wtls: server certificate contains incorrect key type for selected ciphersuite((2(5[0-5]|[0-4]\d))|[0-1]?\d{1,2})(\.((2(5[0-5]|[0-4]\d))|[0-1]?\d{1,2})){3}MapIter.Next called on an iterator that does not have an associated map Valuecrypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabled115792089210356248762697446949407573529996955224135760342422259061068512044369115792089210356248762697446949407573530086143415290314195533631308867097853951ssh: internal error: algorithmSignerWrapper invoked with non-default algorithmssh: unable to authenticate, attempted methods %v, no supported methods remainx509: signature check attempt
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http: RoundTripper implementation (%T) returned a nil *Response with a nil errortls: either ServerName or InsecureSkipVerify must be specified in the tls.Configx509: invalid signature: parent certificate cannot sign this kind of certificaterefusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxyx509: a root or intermediate certificate is not authorized to sign for this name: (possibly because of %q while trying to verify candidate authority certificate %q)Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)x509: issuer has name constraints but leaf contains unknown or unconstrained name: tls: downgrade attempt detected, possibly due to a MitM attack or a broken middleboxx509: signature algorithm specifies an %s public key, but have public key of type %Treflect.Value.Interface: cannot return value obtained from unexported field or methodx509: failed to parse private key (use ParseECPrivateKey instead for this key format)Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/;)reflect: New of type that may not be allocated in heap (possibly undefined cgo C type)x509: a root or intermediate certificate is not authorized for an extended key usage: fxfzUc6gtMGc/i26ld3KydGKy1k7QqyMMyxjbU1Rlk+F9LQxnaTeCHGHsDUpaBeOWDeY6l+2kHlB7EWTLcGwfg==whv+Kf1cEtOXzr+zuvmef2as0WfbUDm8l2LMWBMel10NDnbShg9CsMUt327VJhOTbXLoPYJVTKy8MBPCVwoT8A==x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)x509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format)Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)http2: server sent GOAWAY and closed the connection; LastStreamID=%v, ErrCode=%v, debug=%qapplication/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5tls: handshake hash for a client certificate requested after discarding the handshake buffertls: unsupported certificate: private key is *ed25519.PrivateKey, expected ed25519.PrivateKey3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5faa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefhttp: RoundTripper implementation (%T) returned a *Response with content length %d but a nil BodyNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertcipher: the nonce can't have zero length, or the security of the key will be immediately compromised1.0.3<<RMS>> equals www.yahoo.com (Yahoo)
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)x509:
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://search.msn.com/msnbot.htm
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.baidu.com/search/spider.html)Mozilla/5.0
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.baidu.com/search/spider.html)http2:
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.entireweb.com/about/search_tech/speedy_spider/)text/html
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.google.com/mobile/adsbot.html)
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.haosou.com/help/help_3_2.htmlMozilla/5.0
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://www.youdao.com/help/webmaster/spider/;)reflect:
    Source: linux_mipsel_softfloat.elfString found in binary or memory: http://yandex.com/bots)http:
    Source: linux_mipsel_softfloat.elfString found in binary or memory: https://search.yahoo.com/search?p=illegal
    Source: linux_mipsel_softfloat.elfString found in binary or memory: https://www.baidu.com/s?wd=insufficient
    Source: linux_mipsel_softfloat.elfString found in binary or memory: https://www.so.com/s?q=index
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50532
    Source: unknownNetwork traffic detected: HTTP traffic on port 50532 -> 443
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: classification engineClassification label: mal56.troj.linELF@0/0@0/0
    Source: ELF file sectionSubmission: linux_mipsel_softfloat.elf
    Source: /usr/bin/dash (PID: 5476)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.n68riDVfdA /tmp/tmp.Mq3h1jtk8c /tmp/tmp.LrqnUbkmrBJump to behavior
    Source: /usr/bin/dash (PID: 5477)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.n68riDVfdA /tmp/tmp.Mq3h1jtk8c /tmp/tmp.LrqnUbkmrBJump to behavior
    Source: /tmp/linux_mipsel_softfloat.elf (PID: 5426)Queries kernel information via 'uname': Jump to behavior
    Source: linux_mipsel_softfloat.elf, 5426.1.000055db979b3000.000055db97cfe000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
    Source: linux_mipsel_softfloat.elf, 5426.1.000055db979b3000.000055db97cfe000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
    Source: linux_mipsel_softfloat.elf, 5426.1.00007ffca97d4000.00007ffca97f5000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/linux_mipsel_softfloat.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/linux_mipsel_softfloat.elf
    Source: linux_mipsel_softfloat.elf, 5426.1.00007ffca97d4000.00007ffca97f5000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: linux_mipsel_softfloat.elf, type: SAMPLE

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: linux_mipsel_softfloat.elf, type: SAMPLE

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    File Deletion    		OS Credential Dumping11
    Security Software Discovery    		Remote ServicesData from Local System1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Application Layer Protocol    		Exfiltration Over BluetoothNetwork Denial of Service

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644681 Sample: linux_mipsel_softfloat.elf Startdate: 20/03/2025 Architecture: LINUX Score: 56 12 34.243.160.129, 443, 50532 AMAZON-02US United States 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 Yara detected Chaos 2->16 6 dash rm 2->6         started        8 dash rm 2->8         started        10 linux_mipsel_softfloat.elf 2->10         started        signatures3 process4

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    linux_mipsel_softfloat.elf42%ReversingLabsLinux.Trojan.Kaiji

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Download Network PCAP: filtered – full

    Contacted Domains

    ⊘No contacted domains info
    NameSourceMaliciousAntivirus DetectionReputation
    http://www.baidu.com/search/spider.html)linux_mipsel_softfloat.elffalse
      		high
      http://search.msn.com/msnbot.htmlinux_mipsel_softfloat.elffalse
        		high
        http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829linux_mipsel_softfloat.elffalse
          		high
          https://www.so.com/s?q=indexlinux_mipsel_softfloat.elffalse
            		high
            http://help.yahoo.com/help/us/ysearch/slurp)x509:linux_mipsel_softfloat.elffalse
              		high
              http://www.google.com/mobile/adsbot.html)linux_mipsel_softfloat.elffalse
                		high
                http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0linux_mipsel_softfloat.elffalse
                  		high
                  http://www.baidu.com/search/spider.html)http2:linux_mipsel_softfloat.elffalse
                    		high
                    http://yandex.com/bots)http:linux_mipsel_softfloat.elffalse
                      		high
                      http://www.baidu.com/search/spider.html)Mozilla/5.0linux_mipsel_softfloat.elffalse
                        		high
                        http://www.entireweb.com/about/search_tech/speedy_spider/)text/htmllinux_mipsel_softfloat.elffalse
                          		high
                          http://www.haosou.com/help/help_3_2.htmlMozilla/5.0linux_mipsel_softfloat.elffalse
                            		high
                            https://www.baidu.com/s?wd=insufficientlinux_mipsel_softfloat.elffalse
                              		high
                              http://www.youdao.com/help/webmaster/spider/;)reflect:linux_mipsel_softfloat.elffalse
                                		high
                                https://search.yahoo.com/search?p=illegallinux_mipsel_softfloat.elffalse
                                  		high

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  34.243.160.129
                                  		unknownUnited States
                                  		16509AMAZON-02USfalse

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  34.243.160.129boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      main_sh4.elfGet hashmaliciousMiraiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          miner.elfGet hashmaliciousUnknownBrowse
                                            arm.elfGet hashmaliciousUnknownBrowse
                                              main_x86.elfGet hashmaliciousMiraiBrowse
                                                hiss.arm7.elfGet hashmaliciousUnknownBrowse
                                                  gigab.i686.elfGet hashmaliciousUnknownBrowse
                                                    na.elfGet hashmaliciousPrometeiBrowse

                                                      Domains

                                                      ⊘No context

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      AMAZON-02UShttps://emails.certa.in/ls/click?upn=u001.iAjcacKhDdX1J4JfQQ5nTBv8arrhNwbSC7Z7YOpbCzfgf-2F84h8udo2F8ceDYH2vesCwn_GwWzR5CPD3uhhoxi7nJtY0-2BQC5TKRtJEXtldUtgGNIXSt8nXiShm6hsa2YaABYh2TZC0v3L7cn9ITurcFtVWlGPrJKRiGHy55d4ptGe15usxcMP6zq8V3IQhE28-2BM1xOhJcGK0RN4pv-2FEdooxiSuAEwYysS6PaDKeDMM5SJj2o26oYst5kZF78CMofBrxC-2Bi3268dPgaFTamsKxmM-2BD7k4t1pfdYwsonFNKuuXTxy7VSHXUKdlwhQquRpB3peBAlnuvIAbNYmjvW3gwhEzYKRNejWDpA5LmNQWEZU72fo9GCUxILqTTrUrVMZv8YssJOAbKOC7shgIUBR8JCEosIu1LpVzKwthWgcNoeLhwSmbfaEpMRbHIGim8a-2BoUsZet4Get hashmaliciousUnknownBrowse
                                                      • 18.238.80.19
                                                      boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                                      • 34.249.145.219
                                                      boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                      • 34.249.145.219
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 54.255.164.76
                                                      boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                                      • 34.249.145.219
                                                      https://techresearchs.benchurl.com/c/l?u=12450653&e=199143A&c=163607&&t=0&l=12689B51E&email=VHWZIWwomIKWc0sY%2B8V5agif8GG0Zxj9&seq=1Get hashmaliciousUnknownBrowse
                                                      • 54.76.75.65
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 34.249.145.219
                                                      boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                      • 54.171.230.55
                                                      https://gamma.app/docs/Maui-Police-Department-a50fopf77jftjw5?mode=present#card-ye73d3tp4jd8wbiGet hashmaliciousHTMLPhisherBrowse
                                                      • 76.223.31.44
                                                      https://veriqwyrfizxhsmh.serveirc.com/kabQ8B9Get hashmaliciousUnknownBrowse
                                                      • 3.168.122.11

                                                      JA3 Fingerprints

                                                      ⊘No context

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      ⊘No created / dropped files found

                                                      Static File Info

                                                      General

                                                      File type:ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), statically linked, Go BuildID=CJjLD_0E1ddCcnPMDlR3/nGaOsKBX_QHYXWcVYtw3/lP7GXKQXb12_yFW-I3Bx/THPVET7-bIc4Oj_hJnCL, stripped
                                                      Entropy (8bit):5.525006953535005
                                                      TrID:
                                                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                      File name:linux_mipsel_softfloat.elf
                                                      File size:5'898'240 bytes
                                                      MD5:1bc524efea7982b3b6c8fca7c30286ec
                                                      SHA1:83021a81635d966164f19c8bfad1aeafd22f406b
                                                      SHA256:1ab8a8d49e1854d00ab7b67267eb40c4f96bfbfb5dd80dbed89c0fea0cd226fb
                                                      SHA512:4f5dd02820a316ab77dfb69d42265d4398af846f9b59c64e46de57c9bf05fd8a94208027008e1367641d052321de17c8e6874c722f24aa0e5db84443cd35fe4f
                                                      SSDEEP:49152:+RxVVRFMTwGupkYzfgh7rxQ2USaU85Jbq1rQcR6VYv0VF1:
                                                      TLSH:3956E604BDC46BB6C82C8B7584E6CA9223B06D144AF15A271664FED9BC762787F47CCC
                                                      File Content Preview:.ELF....................$...4...4......P4. ...(.........4...4...4...................................d...d...........................Xo2.Xo2...............3...4...4..."..."...............V...W...W.................Q.td...............................e.......

                                                      Static ELF Info

                                                      ELF header

                                                      Class:ELF32
                                                      Data:2's complement, little endian
                                                      Version:1 (current)
                                                      Machine:MIPS R3000
                                                      Version Number:0x1
                                                      Type:EXEC (Executable file)
                                                      OS/ABI:UNIX - System V
                                                      ABI Version:0
                                                      Entry Point Address:0x8f524
                                                      Flags:0x50001004
                                                      ELF Header Size:52
                                                      Program Header Offset:52
                                                      Program Header Size:32
                                                      Number of Program Headers:8
                                                      Section Header Offset:308
                                                      Section Header Size:40
                                                      Number of Section Headers:16
                                                      Header String Table Index:4

                                                      Sections

                                                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                      NULL0x00x00x00x00x0000
                                                      .textPROGBITS0x110000x10000x325f580x00x6AX004
                                                      .rodataPROGBITS0x3400000x3300000xdbd580x00x2A0032
                                                      .gnu.attributesGNU_ATTRIBUTES0x00x40bd600x100x00x0001
                                                      .shstrtabSTRTAB0x00x40bd800xc40x00x0001
                                                      .typelinkPROGBITS0x41be600x40be600x17bc0x00x2A0032
                                                      .itablinkPROGBITS0x41d6200x40d6200x4a40x00x2A0032
                                                      .gosymtabPROGBITS0x41dac40x40dac40x00x00x2A001
                                                      .gopclntabPROGBITS0x41dae00x40dae00x14b2b80x00x2A0032
                                                      .go.buildinfoPROGBITS0x5700000x5600000xe00x00x3WA0016
                                                      .noptrdataPROGBITS0x5700e00x5600e00x301d80x00x3WA0032
                                                      .dataPROGBITS0x5a02c00x5902c00x81b00x00x3WA0032
                                                      .bssNOBITS0x5a84800x5984800x1347c0x00x3WA0032
                                                      .noptrbssNOBITS0x5bb9000x5ab9000xe7ec0x00x3WA0032
                                                      .note.go.buildidNOTE0x10f9c0xf9c0x640x00x2A004
                                                      .MIPS.abiflagsMIPS_ABIFLAGS0x10f840xf840x180x00x2A008

                                                      Program Segments

                                                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                      PHDR0x340x100340x100340x1000x1002.34880x4R 0x10000
                                                      NOTE0xf9c0x10f9c0x10f9c0x640x645.28080x4R 0x4.note.go.buildid
                                                      LOAD0x00x100000x100000x326f580x326f585.16200x5R E0x10000.text .note.go.buildid .MIPS.abiflags
                                                      LOAD0x3300000x3400000x3400000x228d980x228d985.60060x4R 0x10000.rodata .typelink .itablink .gosymtab .gopclntab
                                                      LOAD0x5600000x5700000x5700000x384800x5a0ec5.67220x6RW 0x10000.go.buildinfo .noptrdata .data .bss .noptrbss
                                                      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                                      LOOS+50415800x00x00x00x00x00.00000x2a00 0x4
                                                      ABIFLAGS0xf840x10f840x10f840x180x181.02390x4R 0x8.MIPS.abiflags

                                                      Network Behavior

                                                      Download Network PCAP: filtered – full

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Mar 20, 2025 20:14:01.321125031 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:01.499458075 CET4435053234.243.160.129192.168.2.13
                                                      Mar 20, 2025 20:14:01.499774933 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:01.504374981 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:02.057109118 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:02.601202965 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:03.689120054 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:05.929248095 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:10.281128883 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:18.985291004 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:14:37.417229891 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:15:01.500466108 CET50532443192.168.2.1334.243.160.129
                                                      Mar 20, 2025 20:15:01.726028919 CET4435053234.243.160.129192.168.2.13

                                                      System Behavior

                                                      General

                                                      Start time (UTC):19:13:57
                                                      Start date (UTC):20/03/2025
                                                      Path:/tmp/linux_mipsel_softfloat.elf
                                                      Arguments:/tmp/linux_mipsel_softfloat.elf
                                                      File size:5773336 bytes
                                                      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                                      File Activities

                                                      Process Activities

                                                      System Activities


                                                      General

                                                      Start time (UTC):19:15:00
                                                      Start date (UTC):20/03/2025
                                                      Path:/usr/bin/dash
                                                      Arguments:-
                                                      File size:129816 bytes
                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                      Process Activities


                                                      General

                                                      Start time (UTC):19:15:00
                                                      Start date (UTC):20/03/2025
                                                      Path:/usr/bin/rm
                                                      Arguments:rm -f /tmp/tmp.n68riDVfdA /tmp/tmp.Mq3h1jtk8c /tmp/tmp.LrqnUbkmrB
                                                      File size:72056 bytes
                                                      MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                      File Activities


                                                      General

                                                      Start time (UTC):19:15:00
                                                      Start date (UTC):20/03/2025
                                                      Path:/usr/bin/dash
                                                      Arguments:-
                                                      File size:129816 bytes
                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                      Process Activities


                                                      General

                                                      Start time (UTC):19:15:00
                                                      Start date (UTC):20/03/2025
                                                      Path:/usr/bin/rm
                                                      Arguments:rm -f /tmp/tmp.n68riDVfdA /tmp/tmp.Mq3h1jtk8c /tmp/tmp.LrqnUbkmrB
                                                      File size:72056 bytes
                                                      MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                      File Activities