Edit tour

Linux Analysis Report
morte.spc.elf

Overview

General Information

Sample name:morte.spc.elf
Analysis ID:1646022
MD5:b4ad7bf4370815eefc4fc2867625246a
SHA1:670fe7adbbd581fd86551aa238f7363f38ef04e3
SHA256:a30ebd6a0eddb2890b4eae2f5301d55cf84a3b011ee35580aa7969f30e7dec85
Tags:elfuser-abuse_ch
Infos:

Detection

Okiru
Score:60
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Okiru
Contains symbols with names commonly found in malware
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646022
Start date and time:2025-03-23 04:47:16 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 33s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:morte.spc.elf
Detection:MAL
Classification:mal60.troj.linELF@0/0@0/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
Command:/tmp/morte.spc.elf
PID:6234
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory
  • system is lnxubuntu20
  • morte.spc.elf (PID: 6234, Parent: 6161, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/morte.spc.elf
  • cleanup
SourceRuleDescriptionAuthorStrings
morte.spc.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    SourceRuleDescriptionAuthorStrings
    6234.1.00007f78f8011000.00007f78f801b000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: morte.spc.elf PID: 6234JoeSecurity_OkiruYara detected OkiruJoe Security
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: morte.spc.elfReversingLabs: Detection: 33%
        Source: morte.spc.elfString: byte/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busybox/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/run/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientAm
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

        System Summary

        barindex
        Source: ELF static info symbol of initial sampleName: attack_method_greeth
        Source: ELF static info symbol of initial sampleName: attack_method_greip
        Source: ELF static info symbol of initial sampleName: attack_method_std
        Source: ELF static info symbol of initial sampleName: attack_method_tcpack
        Source: ELF static info symbol of initial sampleName: attack_method_tcpstomp
        Source: ELF static info symbol of initial sampleName: attack_method_tcpsyn
        Source: ELF static info symbol of initial sampleName: attack_method_tcpxmas
        Source: ELF static info symbol of initial sampleName: attack_method_udpdns
        Source: ELF static info symbol of initial sampleName: attack_method_udpgeneric
        Source: ELF static info symbol of initial sampleName: attack_method_udpplain
        Source: Initial sampleString containing 'busybox' found: busybox
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: busyboxxx
        Source: Initial sampleString containing 'busybox' found: busyboxx
        Source: Initial sampleString containing 'busybox' found: byte/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busybox/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/run/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp9
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal60.troj.linELF@0/0@0/0
        Source: /tmp/morte.spc.elf (PID: 6234)Queries kernel information via 'uname': Jump to behavior
        Source: morte.spc.elf, 6234.1.00007ffffc3d2000.00007ffffc3f3000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sparc/tmp/morte.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/morte.spc.elf
        Source: morte.spc.elf, 6234.1.000055f6425be000.000055f642623000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sparc
        Source: morte.spc.elf, 6234.1.000055f6425be000.000055f642623000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/sparc
        Source: morte.spc.elf, 6234.1.00007ffffc3d2000.00007ffffc3f3000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sparc

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: morte.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 6234.1.00007f78f8011000.00007f78f801b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: morte.spc.elf PID: 6234, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: morte.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 6234.1.00007f78f8011000.00007f78f801b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: morte.spc.elf PID: 6234, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting
        Valid AccountsWindows Management Instrumentation1
        Scripting
        Path InterceptionDirect Volume AccessOS Credential Dumping11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646022 Sample: morte.spc.elf Startdate: 23/03/2025 Architecture: LINUX Score: 60 8 109.202.202.202, 80 INIT7CH Switzerland 2->8 10 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->10 12 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 Yara detected Okiru 2->16 18 Contains symbols with names commonly found in malware 2->18 6 morte.spc.elf 2->6         started        signatures3 process4

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        morte.spc.elf33%ReversingLabsLinux.Trojan.Mirai
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        No contacted domains info
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        109.202.202.202
        unknownSwitzerland
        13030INIT7CHfalse
        91.189.91.43
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        91.189.91.42
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
        • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
        91.189.91.43na.elfGet hashmaliciousPrometeiBrowse
          spc.elfGet hashmaliciousMiraiBrowse
            arm7.elfGet hashmaliciousMiraiBrowse
              arc.elfGet hashmaliciousUnknownBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  morte.ppc.elfGet hashmaliciousUnknownBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      morte.mpsl.elfGet hashmaliciousUnknownBrowse
                        .i.elfGet hashmaliciousUnknownBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            91.189.91.42na.elfGet hashmaliciousPrometeiBrowse
                              spc.elfGet hashmaliciousMiraiBrowse
                                arm7.elfGet hashmaliciousMiraiBrowse
                                  arc.elfGet hashmaliciousUnknownBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      morte.ppc.elfGet hashmaliciousUnknownBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          morte.mpsl.elfGet hashmaliciousUnknownBrowse
                                            .i.elfGet hashmaliciousUnknownBrowse
                                              na.elfGet hashmaliciousPrometeiBrowse
                                                No context
                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                spc.elfGet hashmaliciousMiraiBrowse
                                                • 91.189.91.42
                                                arm7.elfGet hashmaliciousMiraiBrowse
                                                • 91.189.91.42
                                                arc.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                arm.elfGet hashmaliciousMiraiBrowse
                                                • 185.125.190.26
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                morte.ppc.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                morte.mpsl.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                .i.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                spc.elfGet hashmaliciousMiraiBrowse
                                                • 91.189.91.42
                                                arm7.elfGet hashmaliciousMiraiBrowse
                                                • 91.189.91.42
                                                arc.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                arm.elfGet hashmaliciousMiraiBrowse
                                                • 185.125.190.26
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                morte.ppc.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                morte.mpsl.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                .i.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                INIT7CHna.elfGet hashmaliciousPrometeiBrowse
                                                • 109.202.202.202
                                                spc.elfGet hashmaliciousMiraiBrowse
                                                • 109.202.202.202
                                                arm7.elfGet hashmaliciousMiraiBrowse
                                                • 109.202.202.202
                                                arc.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 109.202.202.202
                                                morte.ppc.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 109.202.202.202
                                                morte.mpsl.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                .i.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 109.202.202.202
                                                No context
                                                No context
                                                No created / dropped files found
                                                File type:ELF 32-bit MSB executable, SPARC, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
                                                Entropy (8bit):5.606743100091928
                                                TrID:
                                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                File name:morte.spc.elf
                                                File size:45'612 bytes
                                                MD5:b4ad7bf4370815eefc4fc2867625246a
                                                SHA1:670fe7adbbd581fd86551aa238f7363f38ef04e3
                                                SHA256:a30ebd6a0eddb2890b4eae2f5301d55cf84a3b011ee35580aa7969f30e7dec85
                                                SHA512:bd5da92f031f04592dded3a8e66cef71711c35da3d0e9362b4b1815f8e1e622ef377245a61238dbe69ff253186580fe7620000e1abee0485c2679520f7a2e5c0
                                                SSDEEP:768:fkUoMQ769Hd/uKCXMWzMSqykPFblsnSfKh+CVNUCtXo:f1oOHd/uKCXjoSvSfo9VNNtY
                                                TLSH:042329B293B82F27D0E4AB7841775B0371983B9515A4CA8FBC560D0FEE56360A9237F4
                                                File Content Preview:.ELF...........................4...4.....4. ...(...........4...4...4................................................................................................................................................dt.Q............................/lib/ld-uCl

                                                ELF header

                                                Class:ELF32
                                                Data:2's complement, big endian
                                                Version:1 (current)
                                                Machine:Sparc
                                                Version Number:0x1
                                                Type:EXEC (Executable file)
                                                OS/ABI:UNIX - System V
                                                ABI Version:0
                                                Entry Point Address:0x111c0
                                                Flags:0x0
                                                ELF Header Size:52
                                                Program Header Offset:52
                                                Program Header Size:32
                                                Number of Program Headers:6
                                                Section Header Offset:44852
                                                Section Header Size:40
                                                Number of Section Headers:19
                                                Header String Table Index:18
                                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                NULL0x00x00x00x00x0000
                                                .interpPROGBITS0x100f40xf40x140x00x2A001
                                                .hashHASH0x101080x1080x2800x40x2A304
                                                .dynsymDYNSYM0x103880x3880x5b00x100x2A414
                                                .dynstrSTRTAB0x109380x9380x3b60x00x2A001
                                                .rela.dynRELA0x10cf00xcf00x1380xc0x2A304
                                                .rela.pltRELA0x10e280xe280x2880xc0x2A3154
                                                .initPROGBITS0x110b00x10b00x1c0x00x6AX004
                                                .textPROGBITS0x110cc0x10cc0x66a00x00x6AX004
                                                .finiPROGBITS0x1776c0x776c0x140x00x6AX004
                                                .rodataPROGBITS0x177800x77800x19180x00x2A008
                                                .ctorsPROGBITS0x2a0000xa0000x80x00x3WA004
                                                .dtorsPROGBITS0x2a0080xa0080x80x00x3WA004
                                                .dynamicDYNAMIC0x2a0140xa0140xb80x80x3WA404
                                                .gotPROGBITS0x2a0cc0xa0cc0x1b80x40x3WA004
                                                .pltPROGBITS0x2a2840xa2840x2bc0xc0x7WAX004
                                                .dataPROGBITS0x2a5400xa5400x9740x00x3WA004
                                                .bssNOBITS0x2aeb40xaeb40x2140x00x3WA004
                                                .shstrtabSTRTAB0x00xaeb40x7e0x00x0001
                                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                PHDR0x340x100340x100340xc00xc02.17400x5R E0x4
                                                INTERP0xf40x100f40x100f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                                                LOAD0x00x100000x100000x90980x90986.04760x5R E0x10000.interp .hash .dynsym .dynstr .rela.dyn .rela.plt .init .text .fini .rodata
                                                LOAD0xa0000x2a0000x2a0000xeb40x10c84.33060x7RWE0x10000.ctors .dtors .dynamic .got .plt .data .bss
                                                DYNAMIC0xa0140x2a0140x2a0140xb80xb82.11370x6RW 0x4.dynamic
                                                GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                                TypeMetaValueTag
                                                DT_NEEDEDsharedliblibpthread.so.00x1
                                                DT_NEEDEDsharedliblibc.so.00x1
                                                DT_INITvalue0x110b00xc
                                                DT_FINIvalue0x1776c0xd
                                                DT_HASHvalue0x101080x4
                                                DT_STRTABvalue0x109380x5
                                                DT_SYMTABvalue0x103880x6
                                                DT_STRSZbytes9500xa
                                                DT_SYMENTbytes160xb
                                                DT_DEBUGvalue0x00x15
                                                DT_PLTGOTvalue0x2a2840x3
                                                DT_PLTRELSZbytes6480x2
                                                DT_PLTRELpltrelDT_RELA0x14
                                                DT_JMPRELvalue0x10e280x17
                                                DT_RELAvalue0x10cf00x7
                                                DT_RELASZbytes9600x8
                                                DT_RELAENTbytes120x9
                                                DT_NULLvalue0x00x0
                                                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                                .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                LOCAL_ADDR.dynsym0x2aef04OBJECT<unknown>DEFAULT19
                                                _Jv_RegisterClasses.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                __bss_start.dynsym0x2aeb40NOTYPE<unknown>DEFAULTSHN_ABS
                                                __deregister_frame_info.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                __errno_location.dynsym0x2a4ac8FUNC<unknown>DEFAULTSHN_UNDEF
                                                __register_frame_info.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                __uClibc_main.dynsym0x2a440544FUNC<unknown>DEFAULTSHN_UNDEF
                                                _edata.dynsym0x2aeb40NOTYPE<unknown>DEFAULTSHN_ABS
                                                _end.dynsym0x2b0c80NOTYPE<unknown>DEFAULTSHN_ABS
                                                _fini.dynsym0x1776c8FUNC<unknown>DEFAULT9
                                                _init.dynsym0x110b08FUNC<unknown>DEFAULT7
                                                _start.dynsym0x111c056FUNC<unknown>DEFAULT8
                                                allowed_ports.dynsym0x2a54832OBJECT<unknown>DEFAULT18
                                                allowed_ports_size.dynsym0x2a5684OBJECT<unknown>DEFAULT18
                                                atoi.dynsym0x2a4c424FUNC<unknown>DEFAULTSHN_UNDEF
                                                attack_method_greeth.dynsym0x121741656FUNC<unknown>DEFAULT8
                                                attack_method_greip.dynsym0x127ec1472FUNC<unknown>DEFAULT8
                                                attack_method_std.dynsym0x153f8588FUNC<unknown>DEFAULT8
                                                attack_method_tcpack.dynsym0x146d81712FUNC<unknown>DEFAULT8
                                                attack_method_tcpstomp.dynsym0x13f801880FUNC<unknown>DEFAULT8
                                                attack_method_tcpsyn.dynsym0x14d881648FUNC<unknown>DEFAULT8
                                                attack_method_tcpxmas.dynsym0x138281880FUNC<unknown>DEFAULT8
                                                attack_method_udpdns.dynsym0x131981680FUNC<unknown>DEFAULT8
                                                attack_method_udpgeneric.dynsym0x11c381340FUNC<unknown>DEFAULT8
                                                attack_method_udpplain.dynsym0x119ec588FUNC<unknown>DEFAULT8
                                                attack_method_udpvse.dynsym0x12dac1004FUNC<unknown>DEFAULT8
                                                bind.dynsym0x2a3bc36FUNC<unknown>DEFAULTSHN_UNDEF
                                                calloc.dynsym0x2a398112FUNC<unknown>DEFAULTSHN_UNDEF
                                                clock.dynsym0x2a4dc56FUNC<unknown>DEFAULTSHN_UNDEF
                                                close.dynsym0x2a50c48FUNC<unknown>DEFAULTSHN_UNDEF
                                                closedir.dynsym0x2a4f4148FUNC<unknown>DEFAULTSHN_UNDEF
                                                connect.dynsym0x2a2d856FUNC<unknown>DEFAULTSHN_UNDEF
                                                exit.dynsym0x2a4b8164FUNC<unknown>DEFAULTSHN_UNDEF
                                                fclose.dynsym0x2a458368FUNC<unknown>DEFAULTSHN_UNDEF
                                                fcntl.dynsym0x2a50080FUNC<unknown>DEFAULTSHN_UNDEF
                                                fd_ctrl.dynsym0x2aea04OBJECT<unknown>DEFAULT18
                                                fd_serv.dynsym0x2aea44OBJECT<unknown>DEFAULT18
                                                fgets.dynsym0x2a314116FUNC<unknown>DEFAULTSHN_UNDEF
                                                fopen.dynsym0x2a44c24FUNC<unknown>DEFAULTSHN_UNDEF
                                                fork.dynsym0x2a428376FUNC<unknown>DEFAULTSHN_UNDEF
                                                free.dynsym0x2a518280FUNC<unknown>DEFAULTSHN_UNDEF
                                                getpid.dynsym0x2a30864FUNC<unknown>DEFAULTSHN_UNDEF
                                                getppid.dynsym0x2a46464FUNC<unknown>DEFAULTSHN_UNDEF
                                                getsockname.dynsym0x2a53076FUNC<unknown>DEFAULTSHN_UNDEF
                                                getsockopt.dynsym0x2a4a084FUNC<unknown>DEFAULTSHN_UNDEF
                                                inet_addr.dynsym0x2a3c840FUNC<unknown>DEFAULTSHN_UNDEF
                                                ioctl.dynsym0x2a2c0100FUNC<unknown>DEFAULTSHN_UNDEF
                                                kill.dynsym0x2a3b072FUNC<unknown>DEFAULTSHN_UNDEF
                                                listen.dynsym0x2a41c28FUNC<unknown>DEFAULTSHN_UNDEF
                                                malloc.dynsym0x2a32c376FUNC<unknown>DEFAULTSHN_UNDEF
                                                memcpy.dynsym0x04212FUNC<unknown>DEFAULTSHN_UNDEF
                                                methods.dynsym0x2aed44OBJECT<unknown>DEFAULT19
                                                methods_len.dynsym0x2aed01OBJECT<unknown>DEFAULT19
                                                open.dynsym0x2a4d080FUNC<unknown>DEFAULTSHN_UNDEF
                                                opendir.dynsym0x2a47c260FUNC<unknown>DEFAULTSHN_UNDEF
                                                pending_connection.dynsym0x2aedc1OBJECT<unknown>DEFAULT19
                                                read.dynsym0x2a3f856FUNC<unknown>DEFAULTSHN_UNDEF
                                                readdir.dynsym0x2a368184FUNC<unknown>DEFAULTSHN_UNDEF
                                                readlink.dynsym0x2a32076FUNC<unknown>DEFAULTSHN_UNDEF
                                                realloc.dynsym0x2a410316FUNC<unknown>DEFAULTSHN_UNDEF
                                                recv.dynsym0x2a2cc60FUNC<unknown>DEFAULTSHN_UNDEF
                                                recvfrom.dynsym0x2a34468FUNC<unknown>DEFAULTSHN_UNDEF
                                                resolve_func.dynsym0x2aea84OBJECT<unknown>DEFAULT18
                                                restricted_substrings.dynsym0x2a6342156OBJECT<unknown>DEFAULT18
                                                select.dynsym0x2a35c84FUNC<unknown>DEFAULTSHN_UNDEF
                                                send.dynsym0x2a38060FUNC<unknown>DEFAULTSHN_UNDEF
                                                sendto.dynsym0x2a40468FUNC<unknown>DEFAULTSHN_UNDEF
                                                setsid.dynsym0x2a4e864FUNC<unknown>DEFAULTSHN_UNDEF
                                                setsockopt.dynsym0x2a3d444FUNC<unknown>DEFAULTSHN_UNDEF
                                                sigaddset.dynsym0x2a37456FUNC<unknown>DEFAULTSHN_UNDEF
                                                sigemptyset.dynsym0x2a2e432FUNC<unknown>DEFAULTSHN_UNDEF
                                                signal.dynsym0x2a3ec204FUNC<unknown>DEFAULTSHN_UNDEF
                                                sigprocmask.dynsym0x2a524140FUNC<unknown>DEFAULTSHN_UNDEF
                                                sleep.dynsym0x2a338428FUNC<unknown>DEFAULTSHN_UNDEF
                                                snprintf.dynsym0x2a2f048FUNC<unknown>DEFAULTSHN_UNDEF
                                                socket.dynsym0x2a35076FUNC<unknown>DEFAULTSHN_UNDEF
                                                sprintf.dynsym0x2a49452FUNC<unknown>DEFAULTSHN_UNDEF
                                                srv_addr.dynsym0x2aef416OBJECT<unknown>DEFAULT19
                                                sscanf.dynsym0x2a43448FUNC<unknown>DEFAULTSHN_UNDEF
                                                strcmp.dynsym0x2a488648FUNC<unknown>DEFAULTSHN_UNDEF
                                                strcpy.dynsym0x2a2b4804FUNC<unknown>DEFAULTSHN_UNDEF
                                                strstr.dynsym0x2a3e0288FUNC<unknown>DEFAULTSHN_UNDEF
                                                strtol.dynsym0x2a38c20FUNC<unknown>DEFAULTSHN_UNDEF
                                                table.dynsym0x2af04448OBJECT<unknown>DEFAULT19
                                                table_key.dynsym0x2aeb04OBJECT<unknown>DEFAULT18
                                                time.dynsym0x2a47072FUNC<unknown>DEFAULTSHN_UNDEF
                                                usleep.dynsym0x2a2fc72FUNC<unknown>DEFAULTSHN_UNDEF
                                                watchdog_pid.dynsym0x2aed84OBJECT<unknown>DEFAULT19
                                                whitelistpaths.dynsym0x2a56c200OBJECT<unknown>DEFAULT18
                                                write.dynsym0x2a3a456FUNC<unknown>DEFAULTSHN_UNDEF

                                                Download Network PCAP: filteredfull

                                                • Total Packets: 7
                                                • 443 (HTTPS)
                                                • 80 (HTTP)
                                                TimestampSource PortDest PortSource IPDest IP
                                                Mar 23, 2025 04:48:05.408658028 CET43928443192.168.2.2391.189.91.42
                                                Mar 23, 2025 04:48:11.039895058 CET42836443192.168.2.2391.189.91.43
                                                Mar 23, 2025 04:48:11.807811975 CET4251680192.168.2.23109.202.202.202
                                                Mar 23, 2025 04:48:26.141801119 CET43928443192.168.2.2391.189.91.42
                                                Mar 23, 2025 04:48:38.428025007 CET42836443192.168.2.2391.189.91.43
                                                Mar 23, 2025 04:48:42.523403883 CET4251680192.168.2.23109.202.202.202
                                                Mar 23, 2025 04:49:07.095829010 CET43928443192.168.2.2391.189.91.42

                                                System Behavior

                                                Start time (UTC):03:48:04
                                                Start date (UTC):23/03/2025
                                                Path:/tmp/morte.spc.elf
                                                Arguments:/tmp/morte.spc.elf
                                                File size:4379400 bytes
                                                MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e