Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
arm5.elf

Overview

General Information

Sample name:arm5.elf
Analysis ID:1646956
MD5:ea6e2a41df6ff5937b64ab103c8be649
SHA1:cab394e8eb2c99ee99a2c405143350c19a57c6d6
SHA256:1872eb2e727c53c86e7194d77ed30e953d7f4a3918836696c0562ec6adf90578
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646956
Start date and time:2025-03-24 13:18:37 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 41s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5.elf
Detection:MAL
Classification:mal52.troj.linELF@0/4@2/0

Runtime Messages

Command:/tmp/arm5.elf
PID:5512
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:

Process Tree

  • system is lnxubuntu20
  • arm5.elf (PID: 5512, Parent: 5438, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.elf
    • arm5.elf New Fork (PID: 5554, Parent: 5512)
  • dash New Fork (PID: 5515, Parent: 3671)
  • rm (PID: 5515, Parent: 3671, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.kcFcOg0LDt /tmp/tmp.u9ab05KJij /tmp/tmp.jD9PV6EmTD
  • dash New Fork (PID: 5516, Parent: 3671)
  • cat (PID: 5516, Parent: 3671, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.kcFcOg0LDt
  • dash New Fork (PID: 5517, Parent: 3671)
  • head (PID: 5517, Parent: 3671, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5518, Parent: 3671)
  • tr (PID: 5518, Parent: 3671, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5519, Parent: 3671)
  • cut (PID: 5519, Parent: 3671, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5520, Parent: 3671)
  • cat (PID: 5520, Parent: 3671, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.kcFcOg0LDt
  • dash New Fork (PID: 5521, Parent: 3671)
  • head (PID: 5521, Parent: 3671, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5522, Parent: 3671)
  • tr (PID: 5522, Parent: 3671, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5523, Parent: 3671)
  • cut (PID: 5523, Parent: 3671, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5525, Parent: 3671)
  • rm (PID: 5525, Parent: 3671, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.kcFcOg0LDt /tmp/tmp.u9ab05KJij /tmp/tmp.jD9PV6EmTD
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Compliance
  • • Spreading
  • • Networking
  • • System Summary
  • • Persistence and Installation Behavior
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: arm5.elfVirustotal: Detection: 10%Perma Link
Source: arm5.elfReversingLabs: Detection: 16%
Source: unknownHTTPS traffic detected: 34.243.160.129:443 -> 192.168.2.15:36180 version: TLS 1.2
Source: arm5.elfString: /proc/%s/exe/proc/%s/cmdline/proc/%d/exe/proc/%d/cmdlinerwgettftpcurlftp/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/lib/snap/usr/lib/
Source: /tmp/arm5.elf (PID: 5554)Socket: 127.0.0.1:22448Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 36180
Source: unknownNetwork traffic detected: HTTP traffic on port 36180 -> 443
Source: unknownHTTPS traffic detected: 34.243.160.129:443 -> 192.168.2.15:36180 version: TLS 1.2
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.troj.linELF@0/4@2/0

Persistence and Installation Behavior

barindex
Source: /tmp/arm5.elf (PID: 5512)File: /proc/5512/mountsJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/110/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/231/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/111/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/112/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/233/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/113/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/114/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/235/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/115/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1333/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1333/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/116/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1695/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1695/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/117/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/118/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/3872/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/3872/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/119/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/911/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/914/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/10/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/11/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/12/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/13/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/14/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/15/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/16/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/17/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/18/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/19/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1591/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1591/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/120/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/121/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1/mapsJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/122/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/243/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/2/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/123/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/3/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/124/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/125/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/4/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/246/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/126/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/5/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/127/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/6/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1585/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1585/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/128/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/7/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/129/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/8/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/9/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/802/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/802/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/803/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/803/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/804/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/804/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/20/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/21/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/3407/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/3407/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/22/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/23/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/24/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/25/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/26/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/27/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/28/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/29/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1484/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1484/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/250/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/130/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/251/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/131/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/132/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/133/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1479/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1479/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/378/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/258/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/259/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/931/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/931/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1595/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/1595/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/812/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/812/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/933/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 5512)File opened: /proc/933/cmdlineJump to behavior
Source: /usr/bin/dash (PID: 5515)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.kcFcOg0LDt /tmp/tmp.u9ab05KJij /tmp/tmp.jD9PV6EmTDJump to behavior
Source: /usr/bin/dash (PID: 5525)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.kcFcOg0LDt /tmp/tmp.u9ab05KJij /tmp/tmp.jD9PV6EmTDJump to behavior
Source: /tmp/arm5.elf (PID: 5512)Queries kernel information via 'uname': Jump to behavior
Source: arm5.elf, 5512.1.00007fe658038000.00007fe65803e000.rw-.sdmp, arm5.elf, 5554.1.00007fe658038000.00007fe65803e000.rw-.sdmpBinary or memory string: !!a1gAWFxuAXsFWUgBRQAA!!a1gAWFxuAXsAWUgKRXgA!!a1gAWFxuAXsAWEgJR3IA!!a10CWFxuAHsGWVcWQHAA!!a10CWFxuAHsGWVcWQHUA!!aFwAWF9uA3sGW0gLRgAA!1aFwAWFlpG2QBW0gJTwAA1!qemu-arm2QBW0gJTwAA!
Source: arm5.elf, 5512.1.00007fff83bae000.00007fff83bcf000.rw-.sdmp, arm5.elf, 5554.1.00007fff83bae000.00007fff83bcf000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
Source: arm5.elf, 5554.1.00007fe658038000.00007fe65803e000.rw-.sdmpBinary or memory string: vmware
Source: arm5.elf, 5512.1.000055bac81ac000.000055bac82fa000.rw-.sdmp, arm5.elf, 5554.1.000055bac81ac000.000055bac82fa000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: arm5.elf, 5512.1.00007fff83bae000.00007fff83bcf000.rw-.sdmpBinary or memory string: /tmp/qemu-open.wza7MX
Source: arm5.elf, 5512.1.00007fff83bae000.00007fff83bcf000.rw-.sdmpBinary or memory string: U/tmp/qemu-open.wza7MX:
Source: arm5.elf, 5512.1.00007fe658038000.00007fe65803e000.rw-.sdmp, arm5.elf, 5554.1.00007fe658038000.00007fe65803e000.rw-.sdmpBinary or memory string: qemu-arm
Source: arm5.elf, 5512.1.000055bac81ac000.000055bac82fa000.rw-.sdmp, arm5.elf, 5554.1.000055bac81ac000.000055bac82fa000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: arm5.elf, 5512.1.00007fff83bae000.00007fff83bcf000.rw-.sdmp, arm5.elf, 5554.1.00007fff83bae000.00007fff83bcf000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: arm5.elf, 5554.1.00007fff83bae000.00007fff83bcf000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path Interception1
File Deletion		1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646956 Sample: arm5.elf Startdate: 24/03/2025 Architecture: LINUX Score: 52 18 34.243.160.129, 36180, 443 AMAZON-02US United States 2->18 20 daisy.ubuntu.com 2->20 22 Multi AV Scanner detection for submitted file 2->22 7 arm5.elf 2->7         started        10 dash rm 2->10         started        12 dash head 2->12         started        14 8 other processes 2->14 signatures3 process4 signatures5 24 Sample reads /proc/mounts (often used for finding a writable filesystem) 7->24 16 arm5.elf 7->16         started        process6

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
arm5.elf11%VirustotalBrowse
arm5.elf17%ReversingLabsLinux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    34.243.160.129
    		unknownUnited States
    		16509AMAZON-02USfalse

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    34.243.160.129na.elfGet hashmaliciousPrometeiBrowse
      na.elfGet hashmaliciousPrometeiBrowse
        ppc.fkunigr.elfGet hashmaliciousMiraiBrowse
          mips.elfGet hashmaliciousMiraiBrowse
            na.elfGet hashmaliciousPrometeiBrowse
              wget.elfGet hashmaliciousGafgyt, MiraiBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  miner.elfGet hashmaliciousUnknownBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      linux_mipsel_softfloat.elfGet hashmaliciousChaosBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        daisy.ubuntu.comtftp.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        aarch64.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        g4za.arm5.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.24
                        g4za.arm6.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.25
                        .i.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.25
                        arm5.fkunigr.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.24
                        arm6.fkunigr.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.24
                        ppc.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        arm7.fkunigr.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.25
                        mips.fkunigr.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.24

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        AMAZON-02USarm7.elfGet hashmaliciousUnknownBrowse
                        • 54.171.230.55
                        tftp.elfGet hashmaliciousUnknownBrowse
                        • 54.217.10.153
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 34.243.160.129
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 52.212.150.54
                        8RGIkD2qeg.exeGet hashmaliciousLokibotBrowse
                        • 13.248.169.48
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 34.249.145.219
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 54.247.62.1
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 52.212.150.54
                        mips.elfGet hashmaliciousUnknownBrowse
                        • 54.171.230.55
                        Fatura-03-2025.pdfGet hashmaliciousUnknownBrowse
                        • 3.17.7.232

                        JA3 Fingerprints

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        fb4726d465c5f28b84cd6d14cedd13a7na.elfGet hashmaliciousPrometeiBrowse
                        • 34.243.160.129
                        ppc.fkunigr.elfGet hashmaliciousMiraiBrowse
                        • 34.243.160.129
                        armv5l.elfGet hashmaliciousMiraiBrowse
                        • 34.243.160.129
                        mips.elfGet hashmaliciousMiraiBrowse
                        • 34.243.160.129
                        resgod.arm.elfGet hashmaliciousMiraiBrowse
                        • 34.243.160.129
                        resgod.m68k.elfGet hashmaliciousMiraiBrowse
                        • 34.243.160.129
                        ppc.elfGet hashmaliciousMiraiBrowse
                        • 34.243.160.129
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 34.243.160.129
                        updated.elfGet hashmaliciousUnknownBrowse
                        • 34.243.160.129
                        na.elfGet hashmaliciousPrometeiBrowse
                        • 34.243.160.129

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        Process:/tmp/arm5.elf
                        File Type:data
                        Category:dropped
                        Size (bytes):14
                        Entropy (8bit):3.521640636343319
                        Encrypted:false
                        SSDEEP:3:TggLAJ5:Tgg03
                        MD5:A737667E3E61E716C83359F35BC141DA
                        SHA1:E7C3DBC96B90E28F18CFB1CADE0C7AF673FFAA57
                        SHA-256:2D8A0F430A3339E16B223D653251534539D95B1DF7142834F68D9172B1656E37
                        SHA-512:0ACAFC3F3F40EDEF3D9F2F1CCE09BAF5004FD8488434F4903F18B9B7E77B4A6CDF7F84A47856CB2FDAA4B1B0F70FC2A3EDDE82BD29831FF54CB75F4E4C74FE74
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:/tmp/arm5.elf.
                        Process:/tmp/arm5.elf
                        File Type:data
                        Category:dropped
                        Size (bytes):14
                        Entropy (8bit):3.521640636343319
                        Encrypted:false
                        SSDEEP:3:TggLAJ5:Tgg03
                        MD5:A737667E3E61E716C83359F35BC141DA
                        SHA1:E7C3DBC96B90E28F18CFB1CADE0C7AF673FFAA57
                        SHA-256:2D8A0F430A3339E16B223D653251534539D95B1DF7142834F68D9172B1656E37
                        SHA-512:0ACAFC3F3F40EDEF3D9F2F1CCE09BAF5004FD8488434F4903F18B9B7E77B4A6CDF7F84A47856CB2FDAA4B1B0F70FC2A3EDDE82BD29831FF54CB75F4E4C74FE74
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:/tmp/arm5.elf.
                        Process:/tmp/arm5.elf
                        File Type:data
                        Category:dropped
                        Size (bytes):14
                        Entropy (8bit):3.521640636343319
                        Encrypted:false
                        SSDEEP:3:TggLAJ5:Tgg03
                        MD5:A737667E3E61E716C83359F35BC141DA
                        SHA1:E7C3DBC96B90E28F18CFB1CADE0C7AF673FFAA57
                        SHA-256:2D8A0F430A3339E16B223D653251534539D95B1DF7142834F68D9172B1656E37
                        SHA-512:0ACAFC3F3F40EDEF3D9F2F1CCE09BAF5004FD8488434F4903F18B9B7E77B4A6CDF7F84A47856CB2FDAA4B1B0F70FC2A3EDDE82BD29831FF54CB75F4E4C74FE74
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:/tmp/arm5.elf.
                        Process:/tmp/arm5.elf
                        File Type:data
                        Category:dropped
                        Size (bytes):14
                        Entropy (8bit):3.521640636343319
                        Encrypted:false
                        SSDEEP:3:TggLAJ5:Tgg03
                        MD5:A737667E3E61E716C83359F35BC141DA
                        SHA1:E7C3DBC96B90E28F18CFB1CADE0C7AF673FFAA57
                        SHA-256:2D8A0F430A3339E16B223D653251534539D95B1DF7142834F68D9172B1656E37
                        SHA-512:0ACAFC3F3F40EDEF3D9F2F1CCE09BAF5004FD8488434F4903F18B9B7E77B4A6CDF7F84A47856CB2FDAA4B1B0F70FC2A3EDDE82BD29831FF54CB75F4E4C74FE74
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview:/tmp/arm5.elf.

                        Static File Info

                        General

                        File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                        Entropy (8bit):6.099602116589115
                        TrID:
                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                        File name:arm5.elf
                        File size:100'016 bytes
                        MD5:ea6e2a41df6ff5937b64ab103c8be649
                        SHA1:cab394e8eb2c99ee99a2c405143350c19a57c6d6
                        SHA256:1872eb2e727c53c86e7194d77ed30e953d7f4a3918836696c0562ec6adf90578
                        SHA512:b3f6beb6c4c6afdccb6efa47a4db0a1b9e56d8bbd4222c505f4e7aa856ab69eda0bf959ee9b094ef4a7ff7dc5f4941b79d9de3ae2c140f9eb90bd0078853913f
                        SSDEEP:1536:donvMYOWRZneVtpfLrkyoNit849INrYe/HiY5wuBxQykrZuX1/nOhh5uOxbYIGYA:iMXWbneVt9a+INrX0uBxQ1bhhxb1yQ
                        TLSH:16A30795BC419B16C2D056BBFE1E428D33232FB8E2EA3203DD156F2077DA95A0E7B451
                        File Content Preview:.ELF..............(.....l...4...........4. ...(........p................................................................................@I..........Q.td.............................@-..@............/..@-.,@...0....S..... 0....S.........../..0...0...@..../

                        Static ELF Info

                        ELF header

                        Class:ELF32
                        Data:2's complement, little endian
                        Version:1 (current)
                        Machine:ARM
                        Version Number:0x1
                        Type:EXEC (Executable file)
                        OS/ABI:UNIX - System V
                        ABI Version:0
                        Entry Point Address:0x816c
                        Flags:0x4000002
                        ELF Header Size:52
                        Program Header Offset:52
                        Program Header Size:32
                        Number of Program Headers:4
                        Section Header Offset:99536
                        Section Header Size:40
                        Number of Section Headers:12
                        Header String Table Index:11

                        Sections

                        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                        NULL0x00x00x00x00x0000
                        .initPROGBITS0x80b40xb40x140x00x6AX001
                        .textPROGBITS0x80c80xc80x16bc00x00x6AX004
                        .finiPROGBITS0x1ec880x16c880x140x00x6AX001
                        .rodataPROGBITS0x1ec9c0x16c9c0x16440x00x2A004
                        .ARM.exidxARM_EXIDX0x202e00x182e00xc80x00x82AL204
                        .init_arrayINIT_ARRAY0x283ac0x183ac0x40x00x3WA004
                        .fini_arrayFINI_ARRAY0x283b00x183b00x40x00x3WA004
                        .gotPROGBITS0x283b80x183b80x280x40x3WA004
                        .dataPROGBITS0x283e00x183e00x980x00x3WA004
                        .bssNOBITS0x284780x184780x48740x00x3WA008
                        .shstrtabSTRTAB0x00x184780x580x00x0001

                        Program Segments

                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                        EXIDX0x182e00x202e00x202e00xc80xc84.30560x4R 0x4.ARM.exidx
                        LOAD0x00x80000x80000x183a80x183a86.10990x5R E0x8000.init .text .fini .rodata .ARM.exidx
                        LOAD0x183ac0x283ac0x283ac0xcc0x49403.56380x6RW 0x8000.init_array .fini_array .got .data .bss
                        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                        Network Behavior

                        Download Network PCAP: filtered – full

                        Network Port Distribution

                        • Total Packets: 17
                        • • 443 (HTTPS)
                        • • 53 (DNS)
                        TimestampSource PortDest PortSource IPDest IP
                        Mar 24, 2025 13:19:17.557395935 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:17.766401052 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.741097927 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.741125107 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.741142035 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.741157055 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.741157055 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:19.741170883 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.741185904 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.741189003 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:19.741189003 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:19.741189003 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:19.741216898 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:19.741216898 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:19.742007971 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:19.960313082 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.961553097 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:19.961591959 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:19.961774111 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:20.151595116 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:20.151652098 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:20.151679039 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:20.152160883 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:20.152690887 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:20.375883102 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:20.375933886 CET4433618034.243.160.129192.168.2.15
                        Mar 24, 2025 13:19:20.375979900 CET36180443192.168.2.1534.243.160.129
                        Mar 24, 2025 13:19:20.376019955 CET36180443192.168.2.1534.243.160.129
                        TimestampSource PortDest PortSource IPDest IP
                        Mar 24, 2025 13:19:23.763585091 CET3984353192.168.2.151.1.1.1
                        Mar 24, 2025 13:19:23.763641119 CET5690553192.168.2.151.1.1.1
                        Mar 24, 2025 13:19:23.865096092 CET53398431.1.1.1192.168.2.15
                        Mar 24, 2025 13:19:23.878910065 CET53569051.1.1.1192.168.2.15

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Mar 24, 2025 13:19:23.763585091 CET192.168.2.151.1.1.10x9325Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                        Mar 24, 2025 13:19:23.763641119 CET192.168.2.151.1.1.10x1fc6Standard query (0)daisy.ubuntu.com28IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Mar 24, 2025 13:19:23.865096092 CET1.1.1.1192.168.2.150x9325No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                        Mar 24, 2025 13:19:23.865096092 CET1.1.1.1192.168.2.150x9325No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                        HTTPS Connections

                        TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                        Mar 24, 2025 13:19:19.741185904 CET34.243.160.129443192.168.2.1536180CN=motd.ubuntu.com CN=R10, O=Let's Encrypt, C=USCN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USSat Mar 22 09:18:05 CET 2025 Wed Mar 13 01:00:00 CET 2024Fri Jun 20 10:18:04 CEST 2025 Sat Mar 13 00:59:59 CET 2027771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2fb4726d465c5f28b84cd6d14cedd13a7
                        CN=R10, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USWed Mar 13 01:00:00 CET 2024Sat Mar 13 00:59:59 CET 2027

                        System Behavior

                        General

                        Start time (UTC):12:19:18
                        Start date (UTC):24/03/2025
                        Path:/tmp/arm5.elf
                        Arguments:/tmp/arm5.elf
                        File size:4956856 bytes
                        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                        File Activities

                        Process Activities

                        System Activities

                        Network Activities


                        General

                        Start time (UTC):12:19:21
                        Start date (UTC):24/03/2025
                        Path:/tmp/arm5.elf
                        Arguments:-
                        File size:4956856 bytes
                        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                        File Activities

                        Process Activities

                        Network Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/rm
                        Arguments:rm -f /tmp/tmp.kcFcOg0LDt /tmp/tmp.u9ab05KJij /tmp/tmp.jD9PV6EmTD
                        File size:72056 bytes
                        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/cat
                        Arguments:cat /tmp/tmp.kcFcOg0LDt
                        File size:43416 bytes
                        MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/head
                        Arguments:head -n 10
                        File size:47480 bytes
                        MD5 hash:fd96a67145172477dd57131396fc9608

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/tr
                        Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                        File size:51544 bytes
                        MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/cut
                        Arguments:cut -c -80
                        File size:47480 bytes
                        MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/cat
                        Arguments:cat /tmp/tmp.kcFcOg0LDt
                        File size:43416 bytes
                        MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/head
                        Arguments:head -n 10
                        File size:47480 bytes
                        MD5 hash:fd96a67145172477dd57131396fc9608

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/tr
                        Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                        File size:51544 bytes
                        MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/cut
                        Arguments:cut -c -80
                        File size:47480 bytes
                        MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                        File Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/dash
                        Arguments:-
                        File size:129816 bytes
                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                        Process Activities


                        General

                        Start time (UTC):12:19:19
                        Start date (UTC):24/03/2025
                        Path:/usr/bin/rm
                        Arguments:rm -f /tmp/tmp.kcFcOg0LDt /tmp/tmp.u9ab05KJij /tmp/tmp.jD9PV6EmTD
                        File size:72056 bytes
                        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                        File Activities