Edit tour

Linux Analysis Report
boatnet.ppc.elf

Overview

General Information

Sample name:boatnet.ppc.elf
Analysis ID:1646383
MD5:199810c7a478ecdb47571bd98eba85a8
SHA1:bbd691a082e13256028cdc89e68d4cd24b12f281
SHA256:05c3454bf112da26cc9bc23f462abb0ab097e543dc6ad6e8f56bd9ade9a7a0f8
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646383
Start date and time:2025-03-24 00:22:39 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 10s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.ppc.elf
Detection:MAL
Classification:mal72.troj.linELF@0/0@0/0
Command:/tmp/boatnet.ppc.elf
PID:6238
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
boatnet.ppc.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    boatnet.ppc.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xbb10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbb24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbb38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbb4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbb60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbb74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xbca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    boatnet.ppc.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xc068:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    SourceRuleDescriptionAuthorStrings
    6241.1.00007f9878001000.00007f987800e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6241.1.00007f9878001000.00007f987800e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xbb10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbb24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbb38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbb4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbb60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbb74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      6241.1.00007f9878001000.00007f987800e000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xc068:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      6238.1.00007f9878001000.00007f987800e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        6238.1.00007f9878001000.00007f987800e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0xbb10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbb9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbbb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbbc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbbd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbbec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbc8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xbca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        Click to see the 7 entries
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: boatnet.ppc.elfAvira: detected
        Source: boatnet.ppc.elfReversingLabs: Detection: 63%
        Source: boatnet.ppc.elfVirustotal: Detection: 60%Perma Link
        Source: global trafficTCP traffic: 192.168.2.23:51508 -> 209.141.36.93:3778
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

        System Summary

        barindex
        Source: boatnet.ppc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: boatnet.ppc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 6241.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 6241.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 6238.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 6238.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.ppc.elf PID: 6238, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.ppc.elf PID: 6238, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.ppc.elf PID: 6241, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.ppc.elf PID: 6241, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: boatnet.ppc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: boatnet.ppc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 6241.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 6241.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 6238.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 6238.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.ppc.elf PID: 6238, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.ppc.elf PID: 6238, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.ppc.elf PID: 6241, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.ppc.elf PID: 6241, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: classification engineClassification label: mal72.troj.linELF@0/0@0/0
        Source: /tmp/boatnet.ppc.elf (PID: 6238)Queries kernel information via 'uname': Jump to behavior
        Source: boatnet.ppc.elf, 6238.1.000055b9c2487000.000055b9c2537000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
        Source: boatnet.ppc.elf, 6238.1.00007ffdccc4e000.00007ffdccc6f000.rw-.sdmp, boatnet.ppc.elf, 6241.1.00007ffdccc4e000.00007ffdccc6f000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/boatnet.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.ppc.elf
        Source: boatnet.ppc.elf, 6241.1.000055b9c2487000.000055b9c2537000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
        Source: boatnet.ppc.elf, 6238.1.000055b9c2487000.000055b9c2537000.rw-.sdmp, boatnet.ppc.elf, 6241.1.000055b9c2487000.000055b9c2537000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
        Source: boatnet.ppc.elf, 6238.1.00007ffdccc4e000.00007ffdccc6f000.rw-.sdmp, boatnet.ppc.elf, 6241.1.00007ffdccc4e000.00007ffdccc6f000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: boatnet.ppc.elf, type: SAMPLE
        Source: Yara matchFile source: 6241.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6238.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.ppc.elf PID: 6238, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: boatnet.ppc.elf PID: 6241, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: boatnet.ppc.elf, type: SAMPLE
        Source: Yara matchFile source: 6241.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6238.1.00007f9878001000.00007f987800e000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.ppc.elf PID: 6238, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: boatnet.ppc.elf PID: 6241, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Standard Port
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646383 Sample: boatnet.ppc.elf Startdate: 24/03/2025 Architecture: LINUX Score: 72 15 209.141.36.93, 3778, 51508, 51510 PONYNETUS United States 2->15 17 109.202.202.202, 80 INIT7CH Switzerland 2->17 19 2 other IPs or domains 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Mirai 2->27 7 boatnet.ppc.elf 2->7         started        signatures3 process4 process5 9 boatnet.ppc.elf 7->9         started        11 boatnet.ppc.elf 7->11         started        13 boatnet.ppc.elf 7->13         started       
        SourceDetectionScannerLabelLink
        boatnet.ppc.elf64%ReversingLabsLinux.Trojan.Mirai
        boatnet.ppc.elf61%VirustotalBrowse
        boatnet.ppc.elf100%AviraEXP/ELF.Gafgyt.D
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        No contacted domains info
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        209.141.36.93
        unknownUnited States
        53667PONYNETUSfalse
        109.202.202.202
        unknownSwitzerland
        13030INIT7CHfalse
        91.189.91.43
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        91.189.91.42
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        209.141.36.93boatnet.mips.elfGet hashmaliciousMiraiBrowse
          boatnet.spc.elfGet hashmaliciousMiraiBrowse
            boatnet.arm7.elfGet hashmaliciousMiraiBrowse
              boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                boatnet.x86.elfGet hashmaliciousMiraiBrowse
                  boatnet.mips.elfGet hashmaliciousMiraiBrowse
                    boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                      boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                        boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                          boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                            91.189.91.43arm5.elfGet hashmaliciousMiraiBrowse
                              gigab.x86.elfGet hashmaliciousUnknownBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  ixXoLDt5pH.elfGet hashmaliciousUnknownBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      powerpc.elfGet hashmaliciousMiraiBrowse
                                        m68k.elfGet hashmaliciousMiraiBrowse
                                          x86_64.elfGet hashmaliciousMiraiBrowse
                                            mips.elfGet hashmaliciousMiraiBrowse
                                              mipsel.elfGet hashmaliciousMiraiBrowse
                                                91.189.91.42arm5.elfGet hashmaliciousMiraiBrowse
                                                  gigab.x86.elfGet hashmaliciousUnknownBrowse
                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                      ixXoLDt5pH.elfGet hashmaliciousUnknownBrowse
                                                        na.elfGet hashmaliciousPrometeiBrowse
                                                          powerpc.elfGet hashmaliciousMiraiBrowse
                                                            m68k.elfGet hashmaliciousMiraiBrowse
                                                              x86_64.elfGet hashmaliciousMiraiBrowse
                                                                mips.elfGet hashmaliciousMiraiBrowse
                                                                  mipsel.elfGet hashmaliciousMiraiBrowse
                                                                    No context
                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                    CANONICAL-ASGBarm5.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    gigab.x86.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    ixXoLDt5pH.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    powerpc.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    m68k.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    x86_64.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    mips.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    mipsel.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    CANONICAL-ASGBarm5.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    gigab.x86.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    ixXoLDt5pH.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    powerpc.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    m68k.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    x86_64.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    mips.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    mipsel.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    PONYNETUSspc.elfGet hashmaliciousMiraiBrowse
                                                                    • 198.98.51.68
                                                                    sh4.elfGet hashmaliciousMiraiBrowse
                                                                    • 198.98.51.68
                                                                    m68k.elfGet hashmaliciousMiraiBrowse
                                                                    • 198.98.51.68
                                                                    i686.elfGet hashmaliciousMiraiBrowse
                                                                    • 198.98.51.68
                                                                    ppc.elfGet hashmaliciousUnknownBrowse
                                                                    • 198.98.51.68
                                                                    arm.elfGet hashmaliciousMiraiBrowse
                                                                    • 198.98.51.68
                                                                    x86.elfGet hashmaliciousMiraiBrowse
                                                                    • 198.98.51.68
                                                                    mpsl.elfGet hashmaliciousMiraiBrowse
                                                                    • 198.98.51.68
                                                                    mips.elfGet hashmaliciousMiraiBrowse
                                                                    • 198.98.51.68
                                                                    i486.elfGet hashmaliciousUnknownBrowse
                                                                    • 198.98.51.68
                                                                    INIT7CHarm5.elfGet hashmaliciousMiraiBrowse
                                                                    • 109.202.202.202
                                                                    gigab.x86.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 109.202.202.202
                                                                    ixXoLDt5pH.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 109.202.202.202
                                                                    powerpc.elfGet hashmaliciousMiraiBrowse
                                                                    • 109.202.202.202
                                                                    m68k.elfGet hashmaliciousMiraiBrowse
                                                                    • 109.202.202.202
                                                                    x86_64.elfGet hashmaliciousMiraiBrowse
                                                                    • 109.202.202.202
                                                                    mips.elfGet hashmaliciousMiraiBrowse
                                                                    • 109.202.202.202
                                                                    mipsel.elfGet hashmaliciousMiraiBrowse
                                                                    • 109.202.202.202
                                                                    No context
                                                                    No context
                                                                    No created / dropped files found
                                                                    File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
                                                                    Entropy (8bit):6.175282857541183
                                                                    TrID:
                                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                    File name:boatnet.ppc.elf
                                                                    File size:54'680 bytes
                                                                    MD5:199810c7a478ecdb47571bd98eba85a8
                                                                    SHA1:bbd691a082e13256028cdc89e68d4cd24b12f281
                                                                    SHA256:05c3454bf112da26cc9bc23f462abb0ab097e543dc6ad6e8f56bd9ade9a7a0f8
                                                                    SHA512:dac1298b6fac2f97dc1fabf05970f5d31c2117806134fd6edcc7e0f95ab0d7e7ae9209db54b648bef9aac69a35bb52b69df2a96e31cd802426e49ea42d8d86df
                                                                    SSDEEP:768:n4062iIKJT2RQGK6nXYEOAqPDnitaGRxKOPdeiL/t6I5/mql0c8cIC/VKZYwe:40LqQYEAPDisSx37/p/tgcIQg5e
                                                                    TLSH:8D334B43722C0E57C1931970253F5BE49BFBE9D022E4F686295F8B668A35E371485ECC
                                                                    File Content Preview:.ELF...........................4.........4. ...(.......................................................l..6|........dt.Q.............................!..|......$H...H......$8!. |...N.. .!..|.......?.............../...@..\?........+../...A..$8...})......N..

                                                                    ELF header

                                                                    Class:ELF32
                                                                    Data:2's complement, big endian
                                                                    Version:1 (current)
                                                                    Machine:PowerPC
                                                                    Version Number:0x1
                                                                    Type:EXEC (Executable file)
                                                                    OS/ABI:UNIX - System V
                                                                    ABI Version:0
                                                                    Entry Point Address:0x100001f0
                                                                    Flags:0x0
                                                                    ELF Header Size:52
                                                                    Program Header Offset:52
                                                                    Program Header Size:32
                                                                    Number of Program Headers:3
                                                                    Section Header Offset:54200
                                                                    Section Header Size:40
                                                                    Number of Section Headers:12
                                                                    Header String Table Index:11
                                                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                    NULL0x00x00x00x00x0000
                                                                    .initPROGBITS0x100000940x940x240x00x6AX004
                                                                    .textPROGBITS0x100000b80xb80xba380x00x6AX004
                                                                    .finiPROGBITS0x1000baf00xbaf00x200x00x6AX004
                                                                    .rodataPROGBITS0x1000bb100xbb100x11940x00x2A004
                                                                    .ctorsPROGBITS0x1001d0000xd0000x80x00x3WA004
                                                                    .dtorsPROGBITS0x1001d0080xd0080x80x00x3WA004
                                                                    .dataPROGBITS0x1001d0180xd0180x3140x00x3WA008
                                                                    .sdataPROGBITS0x1001d32c0xd32c0x400x00x3WA004
                                                                    .sbssNOBITS0x1001d36c0xd36c0x640x00x3WA004
                                                                    .bssNOBITS0x1001d3d00xd36c0x32ac0x00x3WA004
                                                                    .shstrtabSTRTAB0x00xd36c0x4b0x00x0001
                                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                    LOAD0x00x100000000x100000000xcca40xcca46.29400x5R E0x10000.init .text .fini .rodata
                                                                    LOAD0xd0000x1001d0000x1001d0000x36c0x367c2.78490x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
                                                                    GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                                    Download Network PCAP: filteredfull

                                                                    • Total Packets: 30
                                                                    • 3778 undefined
                                                                    • 443 (HTTPS)
                                                                    • 80 (HTTP)
                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Mar 24, 2025 00:23:25.584857941 CET43928443192.168.2.2391.189.91.42
                                                                    Mar 24, 2025 00:23:26.672997952 CET515083778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:23:26.830756903 CET377851508209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:23:30.959988117 CET42836443192.168.2.2391.189.91.43
                                                                    Mar 24, 2025 00:23:32.239819050 CET4251680192.168.2.23109.202.202.202
                                                                    Mar 24, 2025 00:23:34.862782955 CET515103778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:23:35.012888908 CET377851510209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:23:45.013166904 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:23:45.163321972 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:23:45.163503885 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:23:45.164666891 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:23:45.314040899 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:23:45.314151049 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:23:45.463135004 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:23:47.341811895 CET43928443192.168.2.2391.189.91.42
                                                                    Mar 24, 2025 00:23:55.168612957 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:23:55.317575932 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:23:55.317697048 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:23:55.317918062 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:23:57.580396891 CET42836443192.168.2.2391.189.91.43
                                                                    Mar 24, 2025 00:24:01.675836086 CET4251680192.168.2.23109.202.202.202
                                                                    Mar 24, 2025 00:24:10.482264996 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:24:10.482377052 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:24:25.631927013 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:24:25.632356882 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:24:28.296497107 CET43928443192.168.2.2391.189.91.42
                                                                    Mar 24, 2025 00:24:40.817163944 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:24:40.817573071 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:24:55.356344938 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:24:55.507019997 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:24:55.507478952 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:25:10.674494982 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:25:10.675153017 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:25:25.823458910 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:25:25.824043989 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:25:40.976284981 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:25:40.976573944 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:25:55.535294056 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:25:55.684822083 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:25:55.684977055 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:26:10.865752935 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:26:10.866002083 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:26:26.018384933 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:26:26.018613100 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:26:41.169369936 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:26:41.170229912 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:26:55.722630024 CET515123778192.168.2.23209.141.36.93
                                                                    Mar 24, 2025 00:26:55.871622086 CET377851512209.141.36.93192.168.2.23
                                                                    Mar 24, 2025 00:26:55.871931076 CET515123778192.168.2.23209.141.36.93

                                                                    System Behavior

                                                                    Start time (UTC):23:23:25
                                                                    Start date (UTC):23/03/2025
                                                                    Path:/tmp/boatnet.ppc.elf
                                                                    Arguments:/tmp/boatnet.ppc.elf
                                                                    File size:5388968 bytes
                                                                    MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                                    Start time (UTC):23:23:25
                                                                    Start date (UTC):23/03/2025
                                                                    Path:/tmp/boatnet.ppc.elf
                                                                    Arguments:-
                                                                    File size:5388968 bytes
                                                                    MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                                    Start time (UTC):23:23:25
                                                                    Start date (UTC):23/03/2025
                                                                    Path:/tmp/boatnet.ppc.elf
                                                                    Arguments:-
                                                                    File size:5388968 bytes
                                                                    MD5 hash:ae65271c943d3451b7f026d1fadccea6

                                                                    Start time (UTC):23:23:25
                                                                    Start date (UTC):23/03/2025
                                                                    Path:/tmp/boatnet.ppc.elf
                                                                    Arguments:-
                                                                    File size:5388968 bytes
                                                                    MD5 hash:ae65271c943d3451b7f026d1fadccea6