Edit tour

Linux Analysis Report
g4za.arm6.elf

Overview

General Information

Sample name:g4za.arm6.elf
Analysis ID:1646913
MD5:0aed865adff7a64b84fa640d4d70a347
SHA1:6ca3f1211fcf85220c8648a995d899a576cca258
SHA256:d4f3ad378a839bc37634f074909c58bd43fd72faaebd415cc6cf736204b2f6e7
Tags:elfMiraiuser-rollcalcifer
Infos:

Detection

Mirai
Score:80
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646913
Start date and time:2025-03-24 12:29:12 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 41s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:g4za.arm6.elf
Detection:MAL
Classification:mal80.troj.linELF@0/0@2/0
Command:/tmp/g4za.arm6.elf
PID:5551
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • g4za.arm6.elf (PID: 5551, Parent: 5467, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/g4za.arm6.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
g4za.arm6.elfJoeSecurity_Mirai_5Yara detected MiraiJoe Security
    g4za.arm6.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      g4za.arm6.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x15984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x159ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x159c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x159d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x159e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x159fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15a38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15a4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15a60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15a74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15a88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15a9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15ab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15ac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15ad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15aec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15b00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15b14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      g4za.arm6.elfMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
      • 0x15904:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
      SourceRuleDescriptionAuthorStrings
      5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
        5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x15984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x159ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x159c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x159d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x159e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x159fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15a10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15a24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15a38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15a4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15a60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15a74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15a88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15a9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15ab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15ac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15ad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15aec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15b00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15b14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
          • 0x15904:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
          Process Memory Space: g4za.arm6.elf PID: 5551JoeSecurity_Mirai_8Yara detected MiraiJoe Security
            Click to see the 1 entries
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: g4za.arm6.elfAvira: detected
            Source: g4za.arm6.elfVirustotal: Detection: 64%Perma Link
            Source: g4za.arm6.elfReversingLabs: Detection: 66%
            Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

            System Summary

            barindex
            Source: g4za.arm6.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: g4za.arm6.elf, type: SAMPLEMatched rule: Detects ELF malware Mirai related Author: Florian Roth
            Source: 5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
            Source: Process Memory Space: g4za.arm6.elf PID: 5551, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: g4za.arm6.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: g4za.arm6.elf, type: SAMPLEMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
            Source: 5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
            Source: Process Memory Space: g4za.arm6.elf PID: 5551, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: classification engineClassification label: mal80.troj.linELF@0/0@2/0
            Source: /tmp/g4za.arm6.elf (PID: 5551)Queries kernel information via 'uname': Jump to behavior
            Source: g4za.arm6.elf, 5551.1.000055c9b0a66000.000055c9b0b94000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
            Source: g4za.arm6.elf, 5551.1.000055c9b0a66000.000055c9b0b94000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
            Source: g4za.arm6.elf, 5551.1.00007ffc1fde8000.00007ffc1fe09000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
            Source: g4za.arm6.elf, 5551.1.00007ffc1fde8000.00007ffc1fe09000.rw-.sdmpBinary or memory string: Zx86_64/usr/bin/qemu-arm/tmp/g4za.arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/g4za.arm6.elf
            Source: g4za.arm6.elf, 5551.1.00007ffc1fde8000.00007ffc1fe09000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: g4za.arm6.elf, type: SAMPLE
            Source: Yara matchFile source: 5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: g4za.arm6.elf PID: 5551, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: g4za.arm6.elf, type: SAMPLE
            Source: Yara matchFile source: 5551.1.00007f8cb8017000.00007f8cb802f000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: g4za.arm6.elf PID: 5551, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
            Security Software Discovery
            Remote ServicesData from Local System1
            Non-Application Layer Protocol
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
            Application Layer Protocol
            Exfiltration Over BluetoothNetwork Denial of Service
            No configs have been found
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646913 Sample: g4za.arm6.elf Startdate: 24/03/2025 Architecture: LINUX Score: 80 8 daisy.ubuntu.com 2->8 10 Malicious sample detected (through community Yara rule) 2->10 12 Antivirus / Scanner detection for submitted sample 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 Yara detected Mirai 2->16 6 g4za.arm6.elf 2->6         started        signatures3 process4
            SourceDetectionScannerLabelLink
            g4za.arm6.elf64%VirustotalBrowse
            g4za.arm6.elf67%ReversingLabsLinux.Trojan.Mirai
            g4za.arm6.elf100%AviraEXP/ELF.Mirai.Z.A
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches

            Download Network PCAP: filteredfull

            NameIPActiveMaliciousAntivirus DetectionReputation
            daisy.ubuntu.com
            162.213.35.25
            truefalse
              high
              No contacted IP infos
              No context
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              daisy.ubuntu.com.i.elfGet hashmaliciousUnknownBrowse
              • 162.213.35.25
              arm5.fkunigr.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              arm6.fkunigr.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              ppc.elfGet hashmaliciousUnknownBrowse
              • 162.213.35.24
              arm7.fkunigr.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.25
              mips.fkunigr.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              m68k.fkunigr.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              ppc.fkunigr.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              arm6.elfGet hashmaliciousMirai, MoobotBrowse
              • 162.213.35.24
              sh4.elfGet hashmaliciousUnknownBrowse
              • 162.213.35.25
              No context
              No context
              No context
              No created / dropped files found
              File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
              Entropy (8bit):6.099941582011236
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:g4za.arm6.elf
              File size:99'468 bytes
              MD5:0aed865adff7a64b84fa640d4d70a347
              SHA1:6ca3f1211fcf85220c8648a995d899a576cca258
              SHA256:d4f3ad378a839bc37634f074909c58bd43fd72faaebd415cc6cf736204b2f6e7
              SHA512:81ae0c648cd0809d393037da4a38a442d0b61977a3d5fe81046e8942b9456d680360503cb90d1adc449be0d68a79276c2ddfa2e30486e9fbe3338d8c0810a156
              SSDEEP:1536:uxnkY3RS4sAjoGiIANTThKc4z5zVMN6tCPJadO5b8MVicvwR8KRz/5bYi:83c4MGET1whME0RaGvwR8KRz/xF
              TLSH:E7A32A86BC419A11C6C10677FE2F118E331257ECE2DE73138D245B607BCB81B0E6BA5A
              File Content Preview:.ELF..............(.....T...4...........4. ...(.....................Pw..Pw..........................8...............Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../.8.............-.@0....S

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:ARM
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:UNIX - System V
              ABI Version:0
              Entry Point Address:0x8154
              Flags:0x4000002
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:3
              Section Header Offset:98988
              Section Header Size:40
              Number of Section Headers:12
              Header String Table Index:11
              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
              NULL0x00x00x00x00x0000
              .initPROGBITS0x80940x940x100x00x6AX004
              .textPROGBITS0x80b00xb00x1583c0x00x6AX0016
              .finiPROGBITS0x1d8ec0x158ec0x100x00x6AX004
              .rodataPROGBITS0x1d9000x159000x1e500x00x2A008
              .init_arrayINIT_ARRAY0x200040x180080x40x00x3WA004
              .fini_arrayFINI_ARRAY0x200080x1800c0x40x00x3WA004
              .gotPROGBITS0x200100x180140x780x40x3WA004
              .dataPROGBITS0x200880x1808c0x1b00x00x3WA004
              .bssNOBITS0x202380x1823c0x27580x00x3WA004
              .ARM.attributesARM_ATTRIBUTES0x00x1823c0x100x00x0001
              .shstrtabSTRTAB0x00x1824c0x5d0x00x0001
              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x80000x80000x177500x177506.20210x5R E0x8000.init .text .fini .rodata
              LOAD0x180040x200040x200000x2380xa98c2.23870x6RW 0x8000.init_array .fini_array .got .data .bss
              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

              Download Network PCAP: filteredfull

              TimestampSource PortDest PortSource IPDest IP
              Mar 24, 2025 12:30:14.989135027 CET4515453192.168.2.148.8.8.8
              Mar 24, 2025 12:30:15.081068039 CET53451548.8.8.8192.168.2.14
              Mar 24, 2025 12:30:15.081168890 CET4515453192.168.2.148.8.8.8
              Mar 24, 2025 12:30:15.081201077 CET4515453192.168.2.148.8.8.8
              Mar 24, 2025 12:30:15.087043047 CET53451548.8.8.8192.168.2.14
              Mar 24, 2025 12:30:15.087150097 CET4515453192.168.2.148.8.8.8
              Mar 24, 2025 12:30:15.175581932 CET53451548.8.8.8192.168.2.14
              Mar 24, 2025 12:30:15.175606966 CET53451548.8.8.8192.168.2.14
              Mar 24, 2025 12:30:15.175808907 CET4515453192.168.2.148.8.8.8
              Mar 24, 2025 12:30:17.173394918 CET53451548.8.8.8192.168.2.14
              Mar 24, 2025 12:30:17.173578978 CET4515453192.168.2.148.8.8.8
              Mar 24, 2025 12:30:17.264223099 CET53451548.8.8.8192.168.2.14
              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Mar 24, 2025 12:30:14.989135027 CET192.168.2.148.8.8.80x1827Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
              Mar 24, 2025 12:30:15.081201077 CET192.168.2.148.8.8.80xd98aStandard query (0)daisy.ubuntu.com28IN (0x0001)false
              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Mar 24, 2025 12:30:15.087043047 CET8.8.8.8192.168.2.140x1827No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
              Mar 24, 2025 12:30:15.087043047 CET8.8.8.8192.168.2.140x1827No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

              System Behavior

              Start time (UTC):11:30:13
              Start date (UTC):24/03/2025
              Path:/tmp/g4za.arm6.elf
              Arguments:/tmp/g4za.arm6.elf
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1