Joe Sandbox Cloud Basic Analysis Report
Create Interactive Tour

Linux Analysis Report
ppc.elf

Overview

General Information

Sample name:ppc.elf
Analysis ID:1648497
MD5:87a837c8894e13465775fa888d37a85d
SHA1:c2b9b59ed1ca0ae8fa605f17f36b7b1ed5e29648
SHA256:360231c0d3cbcb4ba6b67ffecd3bd728afce759584739cf89274629104629b87
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1648497
Start date and time:2025-03-25 21:27:38 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 29s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:ppc.elf
Detection:MAL
Classification:mal56.linELF@0/0@0/0

Runtime Messages

Command:/tmp/ppc.elf
PID:5518
Exit Code:1
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • ppc.elf (PID: 5518, Parent: 5444, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/ppc.elf
  • dash New Fork (PID: 5558, Parent: 3670)
  • rm (PID: 5558, Parent: 3670, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.eu0hmobyOx /tmp/tmp.LrryTfgW6y /tmp/tmp.dOLKuqFKfi
  • dash New Fork (PID: 5559, Parent: 3670)
  • cat (PID: 5559, Parent: 3670, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.eu0hmobyOx
  • dash New Fork (PID: 5560, Parent: 3670)
  • head (PID: 5560, Parent: 3670, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5561, Parent: 3670)
  • tr (PID: 5561, Parent: 3670, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5562, Parent: 3670)
  • cut (PID: 5562, Parent: 3670, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5563, Parent: 3670)
  • cat (PID: 5563, Parent: 3670, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.eu0hmobyOx
  • dash New Fork (PID: 5564, Parent: 3670)
  • head (PID: 5564, Parent: 3670, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5565, Parent: 3670)
  • tr (PID: 5565, Parent: 3670, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5566, Parent: 3670)
  • cut (PID: 5566, Parent: 3670, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5567, Parent: 3670)
  • rm (PID: 5567, Parent: 3670, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.eu0hmobyOx /tmp/tmp.LrryTfgW6y /tmp/tmp.dOLKuqFKfi
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Compliance
  • • Networking
  • • System Summary
  • • Persistence and Installation Behavior
  • • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: ppc.elfAvira: detected
Source: ppc.elfVirustotal: Detection: 22%Perma Link
Source: ppc.elfReversingLabs: Detection: 19%
Source: unknownHTTPS traffic detected: 34.254.182.186:443 -> 192.168.2.15:44522 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownNetwork traffic detected: HTTP traffic on port 44522 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 44522
Source: unknownHTTPS traffic detected: 34.254.182.186:443 -> 192.168.2.15:44522 version: TLS 1.2
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal56.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 5558)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.eu0hmobyOx /tmp/tmp.LrryTfgW6y /tmp/tmp.dOLKuqFKfiJump to behavior
Source: /usr/bin/dash (PID: 5567)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.eu0hmobyOx /tmp/tmp.LrryTfgW6y /tmp/tmp.dOLKuqFKfiJump to behavior
Source: /tmp/ppc.elf (PID: 5518)Queries kernel information via 'uname': Jump to behavior
Source: ppc.elf, 5518.1.000056053b66d000.000056053b71d000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1/usr/libexec/fwupd/fwupd1/proc/110/exe
Source: ppc.elf, 5518.1.00007ffc70917000.00007ffc70938000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf
Source: ppc.elf, 5518.1.000056053b66d000.000056053b71d000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
Source: ppc.elf, 5518.1.000056053b66d000.000056053b71d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 5518.1.00007ffc70917000.00007ffc70938000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
Source: ppc.elf, 5518.1.000056053b66d000.000056053b71d000.rw-.sdmpBinary or memory string: V/ppc/ro10!/proc/3483/exe0!/proc/318/exe1/usr/libexec/gvfsd-fuse/bin0!/proc/3475/exe0!/proc/319/exe1/usr/bin/VGAuthServiceo10!/proc/3469/exe0!/proc/320/exe1/usr/libexec/evolution-data-server!/proc/3465/exe0!/proc/321/exe1/usr/bin/vmtoolsdpc/ro10!/proc/3461/exe0!/proc/322/exe1/usr/libexec/gvfsdc/ro10!/proc/3456/exe0!/proc/323/exe1/usr/lib/systemd/systemd-resolved!/proc/3440/exe0!/proc/324/exe1/usr/lib/policykit-1/polkitd0!/proc/3419/exe0!/proc/325/exe1/usr/sbin/acpid/ppc/ro10!/proc/3407/exe0!/proc/326/exe1/usr/lib/x86_64-linux-gnu/xfce4/panel!/proc/3399/exe0!/proc/327/exe1/usr/sbin/avahi-daemono10!/proc/3394/exe0!/proc/328/exe1/usr/libexec/dconf-service0!/proc/3379/exe0!/proc/329/exe1/usr/bin/dbus-daemonro10!/proc/3368/exe0!/proc/333/exe1/usr/bin/xfce4-screensaver0!/proc/3332/exe0!/proc/347/exe1/usr/sbin/irqbalancero10!/proc/3316/exe0!/proc/378/exe1/usr/lib/bluetoothc/ro10!/proc/3310/exe0!/proc/418/exe1/usr/bin/python3.8c/ro10!/proc/3303/exe0!/proc/419/exe1/usr/bin/ssh-agentc/ro10!/proc/3298/exe0!/proc/490/exe1/usr/lib/policykit-1ro10!/proc/3292/exe0!/proc/505/exe1/usr/libexec/geoclue-2.0/demos0!/proc/3278/exe0!/proc/515/exe1/usr/libexec/switcheroo-control0!/proc/3275/exe0!/proc/654/exe1/usr/sbin/rsyslogdc/ro10!/proc/3274/exe0!/proc/655/exe1/usr/bin/xfce4-sessiono10!/proc/3273/exe0!/proc/656/exe1/usr/libexecV/ppc/ro10!/proc/3272/exe0!/proc/657/exe1/usr/lib/x86_64-linux-gnu/xfce4/xfconf!/proc/3255/exe0!/proc/658/exe1/usr/lib/systemd/systemd-logind0!/proc/3253/exe0!/proc/674/exe1/usr/lib/udisks2/udisksd0!/proc/3252/exe0!/proc/675/exe1/usr/lib/udisks2ppc/ro10!/proc/3251/exe0!/proc/676/exe1/usr/bin/xiccd/ppc/ro10!/proc/3250/exe0!/proc/680/exe1/usr/sbin/wpa_supplicant0!/proc/3249/exe0!/proc/681/exe1/usr/lib/gdm3/gdm-session-worker!/proc/3246/exe0!/proc/723/exe1/usr/sbin/ModemManagero10!/proc/3241/exe0!/proc/724/exe1/usr/libexec/colord/ro10!/proc/3235/exe0!/proc/740/exe1/usr/sbin/kerneloopsro10!/proc/3234/exe0!/proc/764/exe1/usr/lib/systemd/systemd-udevd0!/proc/3222/exe0!/proc/766/exe1/usr/sbin/sshd/ppc/ro10!/proc/3220/exe0!/proc/777/exe1/usr/libexec/gsd-coloro10!/proc/3210/exe0!/proc/779/exe1/usr/sbin/gdm3/ppc/ro10!/proc/3205/exe0!/proc/782/exe1/usr/bin/gnome-keyring-daemon0!/proc/3201/exe0!/proc/789/exe1/usr/lib/gdm3/ppc/ro10!/proc/3197/exe0!/proc/793/exe1/usr/libexec/geoclue-2.0/demos/agent!/proc/3192/exe0!/proc/794/exe1/usr/lib/gdm3/gdm-x-session0!/proc/3188/exe0!/proc/796/exe1/usr/bin/dbus-run-session0!/proc/3183/exe0!/proc/800/exe1/usr/lib/xorg/ppc/ro10!/proc/3157/exe0!/proc/802/exe1/usr/libexec/gsd-powero10!/proc/3074/exe0!/proc/803/exe1/usr/lib/xorg/Xorgc/ro10!/proc/3064/exe0!/proc/804/exe1/usr/libexec/gsd-printer0!/proc/3062/exe0!/proc/812/exe1/usr/libexec/gnome-session-binary!/proc/3060/exe0!/proc/850/exe1/usr/libexec/at-spi-bus-launcher!/proc/3055/exe0!/proc/888/exe1/usr/libexec/ibus-memconf0!/proc/3052/exe0!/proc/911/exe1/usr/bin/gnome-shellro10!/proc/3047/exe0!/proc/914/exe1/usr/libexec/ibus-engine-simple0!/proc/3044/exe0!/proc/917/exe1/usr

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion		OS Credential Dumping11
Security Software Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1648497 Sample: ppc.elf Startdate: 25/03/2025 Architecture: LINUX Score: 56 14 34.254.182.186, 443, 44522 AMAZON-02US United States 2->14 16 Antivirus / Scanner detection for submitted sample 2->16 18 Multi AV Scanner detection for submitted file 2->18 6 dash rm 2->6         started        8 dash head 2->8         started        10 dash tr 2->10         started        12 8 other processes 2->12 signatures3 process4

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ppc.elf22%VirustotalBrowse
ppc.elf19%ReversingLabsLinux.Trojan.Mirai
ppc.elf100%AviraLINUX/GM.Mirai.ET

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
34.254.182.186
unknownUnited States
16509AMAZON-02USfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
34.254.182.186na.elfGet hashmaliciousPrometeiBrowse
    boatnet.arm6.elfGet hashmaliciousMiraiBrowse
      tarm5.elfGet hashmaliciousUnknownBrowse
        arm5.elfGet hashmaliciousUnknownBrowse
          arm7.elfGet hashmaliciousMiraiBrowse
            mpsl.elfGet hashmaliciousUnknownBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  arc.elfGet hashmaliciousMiraiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AMAZON-02USna.elfGet hashmaliciousPrometeiBrowse
                      • 54.247.62.1
                      boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                      • 34.243.160.129
                      mips.elfGet hashmaliciousMiraiBrowse
                      • 54.171.230.55
                      arm7.elfGet hashmaliciousUnknownBrowse
                      • 54.217.10.153
                      mips.elfGet hashmaliciousMiraiBrowse
                      • 54.247.62.1
                      https://protect.checkpoint.com/v2/r02/___https://lsems.gravityzone.bitdefender.com/xhfsdfMW5hMR*~*QDcqg1KugH/rhrqqgrWni2pyg1KugH/og75AgMRA37Cu37x!i2GzU2ZBRIJzYIFyRp4R0KWU0rWugMmJiYWAVpWKV1K4i6V8hIZ5SM0ZiLWEW1OmR5/DRLcQX0iG12ODR6m0Z2uCX54XhMGr31/03pyTfZ6rYZi*~*XpqUQYOHR1KUiJS11Z/0T2qVjY4XRZcYgpc9i5uJWYR7g20EjL0/YM46gJCqg7mLRrm6jJc4gn5DVr69X0OQV6WNfKt6Z1h7XJOYhqWIX20v3pR/S20XfZm6f1WH4qtBZKWOY6Wx4rKpZ0Onh80BSLOY4Mh83r/3ZsWx36GrQYOHS2SniIWZV507V1OzioqTfo0xY7S5jJhCSsiRhLiZZI4L35OUYZm*~*hJ/*~*js4tfpuWh5qOiIJ9fMm8gK0CTM04fsiv4555ipVyRpOyTY0xjK0AT1mQYYOfW5uUS842iqiCjr4qXIJ73o0Sg80RRoqYjI0*~*j0uN1qiWWpmz3sJBS6Z701OyRrSBfH5DWpWo3oSC02OW1JKCi5/DRsSt4KS/RImw1KZyRp49hsi*~*f6uZRsioj2uZR2mUg0KsQYOHiEK6RJ0/W8SoQYOHXZuJSoGRTMqP3rS2gr/t01xD4MF70sSmSLOOZ64Xh1/fi7bCW6G9f5OMVsGNgYW8XIqsSMq*~*TJR8RJxBgKq0XE09hr/5jqmJZ6mxR2STVryCZpC3WrcNf0JESsVDZM35QYOLRs0GRZc44pm4jYKUQYOLfM0xZ2W8X8iMf04SQYOLWIG7jpOt2EWBf1mNj1iTZ5NBhoqX4qhB4IV5Y5W7QYOHZZ/zgLb60KGB4sOxWZyqWqKnj1u01pWE3YOEiJms1MhB08uJjLiDZZBC00WSjMmq1ImDX6mPVYS0X0KYZ7yL4sKD3oGL4Jh912KMW2FDY0tBYEVE315DYZ65XZ4uTZiKXYixi6SOS5VDSZC5WsmSfKG5R53BjL6xfEKwSKuG12SX0KGAZ8W7R5WBSLl812iWf1Kq3r0vTLqHX5/LR50UWZ06TYKNRrcVd*~*FG88JcGJ/FGF88986aFHbKbb/JIIK/89KHGK8IHaG/I8KIcbba6c7cKI68GGKI7?h=6&fru;n=6&fru;ithx=6___.YzJlOmdhbmdzdGVyOmM6bzpiMTVjN2QxOWQyYmUwNTY1NzUzNWNiMjU5MjdlZDQxYTo3OjBjYTc6YjUxOGI0N2MzNmJhYjUzNGU2MzNkZWE3MDBkNGExYmIwNzljNzhmMDU2MmNkNzkwZDBhMjM3MDE5NjU0YTZkNTpoOlQ6VAGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                      • 13.249.91.12
                      https://business.peppercontent.io/items/1EeoNExLmk9Get hashmaliciousUnknownBrowse
                      • 13.226.34.21
                      file.exeGet hashmaliciousFormBookBrowse
                      • 13.248.243.5
                      na.elfGet hashmaliciousPrometeiBrowse
                      • 54.170.242.139
                      na.elfGet hashmaliciousPrometeiBrowse
                      • 34.254.182.186

                      JA3 Fingerprints

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      fb4726d465c5f28b84cd6d14cedd13a7mips.elfGet hashmaliciousMiraiBrowse
                      • 34.254.182.186
                      boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                      • 34.254.182.186
                      na.elfGet hashmaliciousPrometeiBrowse
                      • 34.254.182.186
                      arm.elfGet hashmaliciousMiraiBrowse
                      • 34.254.182.186
                      na.elfGet hashmaliciousPrometeiBrowse
                      • 34.254.182.186
                      na.elfGet hashmaliciousPrometeiBrowse
                      • 34.254.182.186
                      arm5.elfGet hashmaliciousUnknownBrowse
                      • 34.254.182.186
                      na.elfGet hashmaliciousPrometeiBrowse
                      • 34.254.182.186
                      ppc.fkunigr.elfGet hashmaliciousMiraiBrowse
                      • 34.254.182.186
                      armv5l.elfGet hashmaliciousMiraiBrowse
                      • 34.254.182.186

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      ⊘No created / dropped files found

                      Static File Info

                      General

                      File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
                      Entropy (8bit):6.220134277898976
                      TrID:
                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                      File name:ppc.elf
                      File size:71'240 bytes
                      MD5:87a837c8894e13465775fa888d37a85d
                      SHA1:c2b9b59ed1ca0ae8fa605f17f36b7b1ed5e29648
                      SHA256:360231c0d3cbcb4ba6b67ffecd3bd728afce759584739cf89274629104629b87
                      SHA512:592e885e2c8a29fe3951b5484bc65be9c7bac0e092c397292634e90a8893a2de3b52d3c742cd176097c8e710109659bafe0014222844d713f2dde5c6ae3b7a73
                      SSDEEP:1536:P6xgNWkXll7ekPSMMtu53YIP5DWtu1tJAFch:PJJ68YINW+2ch
                      TLSH:9B633B02B30C0947C1635EF03A3F17E193AAE99121E4F685651EEB4A92B6E335586FCD
                      File Content Preview:.ELF...........................4...h.....4. ...(.......................................................t..S.........dt.Q.............................!..|......$H...H......$8!. |...N.. .!..|.......?.............../...@..\?........+../...A..$8...})......N..

                      Static ELF Info

                      ELF header

                      Class:ELF32
                      Data:2's complement, big endian
                      Version:1 (current)
                      Machine:PowerPC
                      Version Number:0x1
                      Type:EXEC (Executable file)
                      OS/ABI:UNIX - System V
                      ABI Version:0
                      Entry Point Address:0x100001f0
                      Flags:0x0
                      ELF Header Size:52
                      Program Header Offset:52
                      Program Header Size:32
                      Number of Program Headers:3
                      Section Header Offset:70760
                      Section Header Size:40
                      Number of Section Headers:12
                      Header String Table Index:11

                      Sections

                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                      NULL0x00x00x00x00x0000
                      .initPROGBITS0x100000940x940x240x00x6AX004
                      .textPROGBITS0x100000b80xb80xf82c0x00x6AX004
                      .finiPROGBITS0x1000f8e40xf8e40x200x00x6AX004
                      .rodataPROGBITS0x1000f9080xf9080x179c0x00x2A008
                      .ctorsPROGBITS0x100210a80x110a80x80x00x3WA004
                      .dtorsPROGBITS0x100210b00x110b00x80x00x3WA004
                      .dataPROGBITS0x100210c00x110c00x31c0x00x3WA008
                      .sdataPROGBITS0x100213dc0x113dc0x400x00x3WA004
                      .sbssNOBITS0x1002141c0x1141c0x740x00x3WA004
                      .bssNOBITS0x100214900x1141c0x4fec0x00x3WA004
                      .shstrtabSTRTAB0x00x1141c0x4b0x00x0001

                      Program Segments

                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                      LOAD0x00x100000000x100000000x110a40x110a46.26360x5R E0x10000.init .text .fini .rodata
                      LOAD0x110a80x100210a80x100210a80x3740x53d42.79690x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
                      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                      Network Behavior

                      Download Network PCAP: filtered – full

                      TimestampSource PortDest PortSource IPDest IP
                      Mar 25, 2025 21:28:19.458240032 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:19.644330025 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:19.644474030 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:19.645508051 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:19.827256918 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:20.789196014 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:20.789261103 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:20.789287090 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:20.789304018 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:20.789365053 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:20.789365053 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:20.790160894 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:20.967983961 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:20.970408916 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:20.970458984 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:20.970628023 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:21.173331022 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:21.173471928 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:21.174489021 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:21.350755930 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:21.350842953 CET44522443192.168.2.1534.254.182.186
                      Mar 25, 2025 21:28:21.350889921 CET4434452234.254.182.186192.168.2.15
                      Mar 25, 2025 21:28:21.350934029 CET44522443192.168.2.1534.254.182.186

                      HTTPS Connections

                      TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                      Mar 25, 2025 21:28:20.789304018 CET34.254.182.186443192.168.2.1544522CN=motd.ubuntu.com CN=R10, O=Let's Encrypt, C=USCN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USSat Mar 22 09:18:05 CET 2025 Wed Mar 13 01:00:00 CET 2024Fri Jun 20 10:18:04 CEST 2025 Sat Mar 13 00:59:59 CET 2027771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2fb4726d465c5f28b84cd6d14cedd13a7
                      CN=R10, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USWed Mar 13 01:00:00 CET 2024Sat Mar 13 00:59:59 CET 2027

                      System Behavior

                      General

                      Start time (UTC):20:28:19
                      Start date (UTC):25/03/2025
                      Path:/tmp/ppc.elf
                      Arguments:/tmp/ppc.elf
                      File size:5388968 bytes
                      MD5 hash:ae65271c943d3451b7f026d1fadccea6

                      File Activities

                      Process Activities

                      System Activities


                      General

                      Start time (UTC):20:28:19
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:19
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/rm
                      Arguments:rm -f /tmp/tmp.eu0hmobyOx /tmp/tmp.LrryTfgW6y /tmp/tmp.dOLKuqFKfi
                      File size:72056 bytes
                      MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/cat
                      Arguments:cat /tmp/tmp.eu0hmobyOx
                      File size:43416 bytes
                      MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/head
                      Arguments:head -n 10
                      File size:47480 bytes
                      MD5 hash:fd96a67145172477dd57131396fc9608

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/tr
                      Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                      File size:51544 bytes
                      MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/cut
                      Arguments:cut -c -80
                      File size:47480 bytes
                      MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/cat
                      Arguments:cat /tmp/tmp.eu0hmobyOx
                      File size:43416 bytes
                      MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/head
                      Arguments:head -n 10
                      File size:47480 bytes
                      MD5 hash:fd96a67145172477dd57131396fc9608

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/tr
                      Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                      File size:51544 bytes
                      MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/cut
                      Arguments:cut -c -80
                      File size:47480 bytes
                      MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                      File Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/dash
                      Arguments:-
                      File size:129816 bytes
                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                      Process Activities


                      General

                      Start time (UTC):20:28:20
                      Start date (UTC):25/03/2025
                      Path:/usr/bin/rm
                      Arguments:rm -f /tmp/tmp.eu0hmobyOx /tmp/tmp.LrryTfgW6y /tmp/tmp.dOLKuqFKfi
                      File size:72056 bytes
                      MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                      File Activities