Edit tour

Linux Analysis Report
arm5.elf

Overview

General Information

Sample name:arm5.elf
Analysis ID:1649610
MD5:cb1c98e25db55b816bbc22ee2a2af69b
SHA1:3a2d868675d35d1108afbeb86a638a8484292ca5
SHA256:2fe73469585483a503006d519deaa40b780cc4874a583d7e568173bc4bece315
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Connects to many ports of the same IP (likely port scanning)
Uses STUN server to do NAT traversial
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1649610
Start date and time:2025-03-26 23:48:20 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 42s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm5.elf
Detection:MAL
Classification:mal48.troj.linELF@0/2@3/0
Command:/tmp/arm5.elf
PID:6257
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 6219, Parent: 4331)
  • rm (PID: 6219, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ckvO8ue2Vq /tmp/tmp.UXFU2rU6dQ /tmp/tmp.TjfG7Y2vJO
  • dash New Fork (PID: 6220, Parent: 4331)
  • cat (PID: 6220, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.ckvO8ue2Vq
  • dash New Fork (PID: 6221, Parent: 4331)
  • head (PID: 6221, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6222, Parent: 4331)
  • tr (PID: 6222, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6223, Parent: 4331)
  • cut (PID: 6223, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6224, Parent: 4331)
  • cat (PID: 6224, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.ckvO8ue2Vq
  • dash New Fork (PID: 6225, Parent: 4331)
  • head (PID: 6225, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6226, Parent: 4331)
  • tr (PID: 6226, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6227, Parent: 4331)
  • cut (PID: 6227, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6228, Parent: 4331)
  • rm (PID: 6228, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ckvO8ue2Vq /tmp/tmp.UXFU2rU6dQ /tmp/tmp.TjfG7Y2vJO
  • arm5.elf (PID: 6257, Parent: 6151, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm5.elf
    • arm5.elf New Fork (PID: 6259, Parent: 6257)
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

Networking

barindex
Source: global trafficTCP traffic: 154.205.155.243 ports 5102,35086,0,3,5,6,8
Source: unknownDNS query: name: stun.l.google.com
Source: global trafficTCP traffic: 192.168.2.23:42250 -> 154.205.155.243:35086
Source: global trafficTCP traffic: 192.168.2.23:39476 -> 154.205.155.97:46164
Source: global trafficUDP traffic: 192.168.2.23:57491 -> 74.125.250.129:19302
Source: /tmp/arm5.elf (PID: 6259)Socket: 127.0.0.1:22448Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.243
Source: unknownUDP traffic detected without corresponding DNS query: 208.67.220.220
Source: unknownUDP traffic detected without corresponding DNS query: 208.67.222.222
Source: unknownUDP traffic detected without corresponding DNS query: 208.67.222.222
Source: global trafficDNS traffic detected: DNS query: stun.l.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.troj.linELF@0/2@3/0
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1582/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/3088/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/230/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/110/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/231/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/111/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/232/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1579/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/112/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/233/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1699/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/113/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/234/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1335/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1698/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/114/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/235/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1334/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1576/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/2302/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/115/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/236/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/116/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/237/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/117/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/118/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/910/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/119/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/912/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/5812/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/10/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/2307/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/11/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/918/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/12/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/13/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/14/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/15/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/16/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/17/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/18/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1594/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/120/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/121/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1349/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1/mapsJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/122/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/243/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/123/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/2/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/124/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/3/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/4/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/125/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/126/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1344/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1465/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1586/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/127/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/6/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/248/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/128/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/249/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1463/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/9/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/20/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/21/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1900/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/22/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/23/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/24/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/25/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/26/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/27/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/28/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/29/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/491/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/250/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/130/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/251/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/252/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/132/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/253/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/254/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/255/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/256/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1599/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/257/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1477/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/379/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/258/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1476/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/259/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1475/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/936/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/30/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/2208/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/35/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1809/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/1494/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/260/cmdlineJump to behavior
Source: /tmp/arm5.elf (PID: 6257)File opened: /proc/261/cmdlineJump to behavior
Source: /usr/bin/dash (PID: 6219)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ckvO8ue2Vq /tmp/tmp.UXFU2rU6dQ /tmp/tmp.TjfG7Y2vJOJump to behavior
Source: /usr/bin/dash (PID: 6228)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ckvO8ue2Vq /tmp/tmp.UXFU2rU6dQ /tmp/tmp.TjfG7Y2vJOJump to behavior
Source: /tmp/arm5.elf (PID: 6257)Queries kernel information via 'uname': Jump to behavior
Source: arm5.elf, 6257.1.00007ffcd61de000.00007ffcd61ff000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
Source: arm5.elf, 6257.1.00007fc890034000.00007fc89003a000.rw-.sdmpBinary or memory string: vmware
Source: arm5.elf, 6257.1.00007fc890034000.00007fc89003a000.rw-.sdmpBinary or memory string: qemu-arm
Source: arm5.elf, 6257.1.0000557ec7847000.0000557ec7996000.rw-.sdmpBinary or memory string: ~U!/etc/qemu-binfmt/arm
Source: arm5.elf, 6257.1.0000557ec7847000.0000557ec7996000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: arm5.elf, 6257.1.00007ffcd61de000.00007ffcd61ff000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: arm5.elf, 6257.1.00007ffcd61de000.00007ffcd61ff000.rw-.sdmpBinary or memory string: ~U/tmp/qemu-open.7edNwl:
Source: arm5.elf, 6257.1.00007ffcd61de000.00007ffcd61ff000.rw-.sdmpBinary or memory string: /tmp/qemu-open.7edNwl
Source: arm5.elf, 6257.1.00007fc890034000.00007fc89003a000.rw-.sdmpBinary or memory string: !!a1gAWFxuAXsFWUgBRQAA!!a1gAWFxuAXsAWUgKRXgA!!a1gAWFxuAXsAWEgJR3IA!!a10CWFxuAHsGWVcWQHAA!!a10CWFxuAHsGWVcWQHUA!!aFwAWF9uA3sGW0gLRgAA!!aFwAWFlpG2QBW0gJTwAA!!qemu-arm2QBW0gJTwAA!
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1649610 Sample: arm5.elf Startdate: 26/03/2025 Architecture: LINUX Score: 48 17 stun.l.google.com 2->17 19 154.205.155.243, 35086, 42250, 5102 IKGUL-26484US Seychelles 2->19 21 5 other IPs or domains 2->21 23 Connects to many ports of the same IP (likely port scanning) 2->23 7 dash rm arm5.elf 2->7         started        9 dash rm 2->9         started        11 dash cut 2->11         started        13 7 other processes 2->13 signatures3 25 Uses STUN server to do NAT traversial 17->25 process4 process5 15 arm5.elf 7->15         started       
SourceDetectionScannerLabelLink
arm5.elf11%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
stun.l.google.com
74.125.250.129
truefalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    154.205.155.243
    unknownSeychelles
    26484IKGUL-26484UStrue
    109.202.202.202
    unknownSwitzerland
    13030INIT7CHfalse
    154.205.155.97
    unknownSeychelles
    26484IKGUL-26484USfalse
    74.125.250.129
    stun.l.google.comUnited States
    15169GOOGLEUSfalse
    91.189.91.43
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    91.189.91.42
    unknownUnited Kingdom
    41231CANONICAL-ASGBfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    154.205.155.243mips.elfGet hashmaliciousUnknownBrowse
      ppc.elfGet hashmaliciousUnknownBrowse
        mips.elfGet hashmaliciousUnknownBrowse
          SecuriteInfo.com.ELF.Mirai-CXE.14004.27270.elfGet hashmaliciousUnknownBrowse
            aarch64.elfGet hashmaliciousUnknownBrowse
              nimips.elfGet hashmaliciousUnknownBrowse
                109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                154.205.155.97ppc.elfGet hashmaliciousUnknownBrowse
                  sh4.elfGet hashmaliciousUnknownBrowse
                    kmips.elfGet hashmaliciousUnknownBrowse
                      mips.elfGet hashmaliciousUnknownBrowse
                        arm7.elfGet hashmaliciousUnknownBrowse
                          arm6.elfGet hashmaliciousUnknownBrowse
                            nimips.elfGet hashmaliciousUnknownBrowse
                              mips.elfGet hashmaliciousUnknownBrowse
                                arm.elfGet hashmaliciousUnknownBrowse
                                  mpsl.elfGet hashmaliciousUnknownBrowse
                                    91.189.91.43arm5.elfGet hashmaliciousUnknownBrowse
                                      rjfe686.elfGet hashmaliciousUnknownBrowse
                                        mpsl.elfGet hashmaliciousUnknownBrowse
                                          .i.elfGet hashmaliciousUnknownBrowse
                                            eehah4.elfGet hashmaliciousUnknownBrowse
                                              na.elfGet hashmaliciousPrometeiBrowse
                                                vejfa5.elfGet hashmaliciousUnknownBrowse
                                                  xWgJI0PtLZ.elfGet hashmaliciousUnknownBrowse
                                                    arm.elfGet hashmaliciousUnknownBrowse
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                        No context
                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        IKGUL-26484USmips.elfGet hashmaliciousUnknownBrowse
                                                        • 154.205.155.243
                                                        ppc.elfGet hashmaliciousUnknownBrowse
                                                        • 154.205.155.97
                                                        boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                        • 156.238.135.139
                                                        boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                        • 156.251.85.203
                                                        boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                                        • 156.251.85.209
                                                        boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                        • 156.251.85.206
                                                        boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                        • 156.249.132.40
                                                        boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                        • 156.238.135.154
                                                        boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                        • 156.238.135.196
                                                        boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                                        • 156.238.135.163
                                                        IKGUL-26484USmips.elfGet hashmaliciousUnknownBrowse
                                                        • 154.205.155.243
                                                        ppc.elfGet hashmaliciousUnknownBrowse
                                                        • 154.205.155.97
                                                        boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                        • 156.238.135.139
                                                        boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                        • 156.251.85.203
                                                        boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                                        • 156.251.85.209
                                                        boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                        • 156.251.85.206
                                                        boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                        • 156.249.132.40
                                                        boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                        • 156.238.135.154
                                                        boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                        • 156.238.135.196
                                                        boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                                        • 156.238.135.163
                                                        INIT7CHna.elfGet hashmaliciousPrometeiBrowse
                                                        • 109.202.202.202
                                                        arm5.elfGet hashmaliciousUnknownBrowse
                                                        • 109.202.202.202
                                                        rjfe686.elfGet hashmaliciousUnknownBrowse
                                                        • 109.202.202.202
                                                        mpsl.elfGet hashmaliciousUnknownBrowse
                                                        • 109.202.202.202
                                                        .i.elfGet hashmaliciousUnknownBrowse
                                                        • 109.202.202.202
                                                        eehah4.elfGet hashmaliciousUnknownBrowse
                                                        • 109.202.202.202
                                                        na.elfGet hashmaliciousPrometeiBrowse
                                                        • 109.202.202.202
                                                        vejfa5.elfGet hashmaliciousUnknownBrowse
                                                        • 109.202.202.202
                                                        xWgJI0PtLZ.elfGet hashmaliciousUnknownBrowse
                                                        • 109.202.202.202
                                                        arm.elfGet hashmaliciousUnknownBrowse
                                                        • 109.202.202.202
                                                        No context
                                                        No context
                                                        Process:/tmp/arm5.elf
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):14
                                                        Entropy (8bit):3.521640636343319
                                                        Encrypted:false
                                                        SSDEEP:3:TggLAJ5:Tgg03
                                                        MD5:A737667E3E61E716C83359F35BC141DA
                                                        SHA1:E7C3DBC96B90E28F18CFB1CADE0C7AF673FFAA57
                                                        SHA-256:2D8A0F430A3339E16B223D653251534539D95B1DF7142834F68D9172B1656E37
                                                        SHA-512:0ACAFC3F3F40EDEF3D9F2F1CCE09BAF5004FD8488434F4903F18B9B7E77B4A6CDF7F84A47856CB2FDAA4B1B0F70FC2A3EDDE82BD29831FF54CB75F4E4C74FE74
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview:/tmp/arm5.elf.
                                                        Process:/tmp/arm5.elf
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):14
                                                        Entropy (8bit):3.521640636343319
                                                        Encrypted:false
                                                        SSDEEP:3:TggLAJ5:Tgg03
                                                        MD5:A737667E3E61E716C83359F35BC141DA
                                                        SHA1:E7C3DBC96B90E28F18CFB1CADE0C7AF673FFAA57
                                                        SHA-256:2D8A0F430A3339E16B223D653251534539D95B1DF7142834F68D9172B1656E37
                                                        SHA-512:0ACAFC3F3F40EDEF3D9F2F1CCE09BAF5004FD8488434F4903F18B9B7E77B4A6CDF7F84A47856CB2FDAA4B1B0F70FC2A3EDDE82BD29831FF54CB75F4E4C74FE74
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview:/tmp/arm5.elf.
                                                        File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                                                        Entropy (8bit):6.071455879383469
                                                        TrID:
                                                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                        File name:arm5.elf
                                                        File size:82'692 bytes
                                                        MD5:cb1c98e25db55b816bbc22ee2a2af69b
                                                        SHA1:3a2d868675d35d1108afbeb86a638a8484292ca5
                                                        SHA256:2fe73469585483a503006d519deaa40b780cc4874a583d7e568173bc4bece315
                                                        SHA512:d0cb0ead0499aab04ad9f0205414e7461bcdc06680f5e7a9fc2c8e7764f51653d7b24d6f0eeed492625f63ee8b7ed359bb2e0901df83be8466c3f09c7d4943d6
                                                        SSDEEP:1536:b/nXbQipIDAXjrtXjFabH+jitPYciYL3SuqtY+9bHOnsqorrAMrLYIvKzmdr:3raDAXjrtpYeyiYLCmnerrAOLhTh
                                                        TLSH:2D831756B8509B26D5D016BBFE1E428E33132FB8F2DA3203DD156B207BCE95A0E3B551
                                                        File Content Preview:.ELF..............(.....l...4...$A......4. ...(........p.<...........................................<...<...............@...@...@...... G..........Q.td.............................@-..@............/..@-.,@...0....S..... 0....S.........../..0...0...@..../

                                                        ELF header

                                                        Class:ELF32
                                                        Data:2's complement, little endian
                                                        Version:1 (current)
                                                        Machine:ARM
                                                        Version Number:0x1
                                                        Type:EXEC (Executable file)
                                                        OS/ABI:UNIX - System V
                                                        ABI Version:0
                                                        Entry Point Address:0x816c
                                                        Flags:0x4000002
                                                        ELF Header Size:52
                                                        Program Header Offset:52
                                                        Program Header Size:32
                                                        Number of Program Headers:4
                                                        Section Header Offset:82212
                                                        Section Header Size:40
                                                        Number of Section Headers:12
                                                        Header String Table Index:11
                                                        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                        NULL0x00x00x00x00x0000
                                                        .initPROGBITS0x80b40xb40x140x00x6AX001
                                                        .textPROGBITS0x80c80xc80x1282c0x00x6AX004
                                                        .finiPROGBITS0x1a8f40x128f40x140x00x6AX001
                                                        .rodataPROGBITS0x1a9080x129080x130c0x00x2A004
                                                        .ARM.exidxARM_EXIDX0x1bc140x13c140xc80x00x82AL204
                                                        .init_arrayINIT_ARRAY0x240040x140040x40x00x3WA004
                                                        .fini_arrayFINI_ARRAY0x240080x140080x40x00x3WA004
                                                        .gotPROGBITS0x240100x140100x280x40x3WA004
                                                        .dataPROGBITS0x240380x140380x940x00x3WA004
                                                        .bssNOBITS0x240d00x140cc0x46540x00x3WA008
                                                        .shstrtabSTRTAB0x00x140cc0x580x00x0001
                                                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                        EXIDX0x13c140x1bc140x1bc140xc80xc84.34880x4R 0x4.ARM.exidx
                                                        LOAD0x00x80000x80000x13cdc0x13cdc6.11770x5R E0x8000.init .text .fini .rodata .ARM.exidx
                                                        LOAD0x140040x240040x240040xc80x47203.57850x6RW 0x8000.init_array .fini_array .got .data .bss
                                                        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                        Download Network PCAP: filteredfull

                                                        • Total Packets: 42
                                                        • 46164 undefined
                                                        • 35086 undefined
                                                        • 19302 undefined
                                                        • 5102 undefined
                                                        • 443 (HTTPS)
                                                        • 80 (HTTP)
                                                        • 53 (DNS)
                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Mar 26, 2025 23:49:07.548362017 CET43928443192.168.2.2391.189.91.42
                                                        Mar 26, 2025 23:49:08.923063993 CET4225035086192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:09.081945896 CET3508642250154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:09.082048893 CET4225035086192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:09.240895033 CET3508642250154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:09.240978956 CET4225035086192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:09.399838924 CET3508642250154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:09.400006056 CET4225035086192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:10.288476944 CET4225035086192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:10.447506905 CET3508642250154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:10.447542906 CET3508642250154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:10.447760105 CET4225035086192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:10.606900930 CET3508642250154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:11.450846910 CET3947646164192.168.2.23154.205.155.97
                                                        Mar 26, 2025 23:49:11.610069990 CET4616439476154.205.155.97192.168.2.23
                                                        Mar 26, 2025 23:49:11.610485077 CET3947646164192.168.2.23154.205.155.97
                                                        Mar 26, 2025 23:49:11.769633055 CET4616439476154.205.155.97192.168.2.23
                                                        Mar 26, 2025 23:49:11.769908905 CET3947646164192.168.2.23154.205.155.97
                                                        Mar 26, 2025 23:49:11.929207087 CET4616439476154.205.155.97192.168.2.23
                                                        Mar 26, 2025 23:49:11.929583073 CET3947646164192.168.2.23154.205.155.97
                                                        Mar 26, 2025 23:49:12.791630030 CET3947646164192.168.2.23154.205.155.97
                                                        Mar 26, 2025 23:49:12.923810959 CET42836443192.168.2.2391.189.91.43
                                                        Mar 26, 2025 23:49:12.953887939 CET4616439476154.205.155.97192.168.2.23
                                                        Mar 26, 2025 23:49:12.953970909 CET4616439476154.205.155.97192.168.2.23
                                                        Mar 26, 2025 23:49:12.954282999 CET3947646164192.168.2.23154.205.155.97
                                                        Mar 26, 2025 23:49:13.113781929 CET4616439476154.205.155.97192.168.2.23
                                                        Mar 26, 2025 23:49:13.691534996 CET4251680192.168.2.23109.202.202.202
                                                        Mar 26, 2025 23:49:13.956825972 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:14.116780043 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:14.116978884 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:14.276072979 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:14.276298046 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:14.435276985 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:14.435539961 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:15.296896935 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:15.456285000 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:21.370511055 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:21.370657921 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:27.513736010 CET43928443192.168.2.2391.189.91.42
                                                        Mar 26, 2025 23:49:36.383754015 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:36.547092915 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:36.547373056 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:36.706309080 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:39.799850941 CET42836443192.168.2.2391.189.91.43
                                                        Mar 26, 2025 23:49:43.895395041 CET4251680192.168.2.23109.202.202.202
                                                        Mar 26, 2025 23:49:55.295803070 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:55.456510067 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:49:55.456902981 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:49:55.616373062 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:50:08.468034983 CET43928443192.168.2.2391.189.91.42
                                                        Mar 26, 2025 23:50:13.797569990 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:50:13.956425905 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:50:13.956710100 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:50:14.115561008 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:50:21.469470978 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:50:21.469610929 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:50:36.482455015 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:50:36.643356085 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:50:36.643688917 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:50:36.802836895 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:50:54.449956894 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:50:54.609343052 CET510251384154.205.155.243192.168.2.23
                                                        Mar 26, 2025 23:50:54.609958887 CET513845102192.168.2.23154.205.155.243
                                                        Mar 26, 2025 23:50:54.769129992 CET510251384154.205.155.243192.168.2.23
                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Mar 26, 2025 23:49:10.107670069 CET6028753192.168.2.23208.67.220.220
                                                        Mar 26, 2025 23:49:10.192991972 CET5360287208.67.220.220192.168.2.23
                                                        Mar 26, 2025 23:49:10.193479061 CET5749119302192.168.2.2374.125.250.129
                                                        Mar 26, 2025 23:49:10.287130117 CET193025749174.125.250.129192.168.2.23
                                                        Mar 26, 2025 23:49:12.613729954 CET4119853192.168.2.23208.67.222.222
                                                        Mar 26, 2025 23:49:12.698821068 CET5341198208.67.222.222192.168.2.23
                                                        Mar 26, 2025 23:49:12.699008942 CET3820519302192.168.2.2374.125.250.129
                                                        Mar 26, 2025 23:49:12.791208029 CET193023820574.125.250.129192.168.2.23
                                                        Mar 26, 2025 23:49:15.119268894 CET4868353192.168.2.23208.67.222.222
                                                        Mar 26, 2025 23:49:15.204355001 CET5348683208.67.222.222192.168.2.23
                                                        Mar 26, 2025 23:49:15.204660892 CET5982919302192.168.2.2374.125.250.129
                                                        Mar 26, 2025 23:49:15.296530008 CET193025982974.125.250.129192.168.2.23
                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Mar 26, 2025 23:49:10.107670069 CET192.168.2.23208.67.220.2200x69e5Standard query (0)stun.l.google.comA (IP address)IN (0x0001)false
                                                        Mar 26, 2025 23:49:12.613729954 CET192.168.2.23208.67.222.2220x2e18Standard query (0)stun.l.google.comA (IP address)IN (0x0001)false
                                                        Mar 26, 2025 23:49:15.119268894 CET192.168.2.23208.67.222.2220x7293Standard query (0)stun.l.google.comA (IP address)IN (0x0001)false
                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Mar 26, 2025 23:49:10.192991972 CET208.67.220.220192.168.2.230x69e5No error (0)stun.l.google.com74.125.250.129A (IP address)IN (0x0001)false
                                                        Mar 26, 2025 23:49:12.698821068 CET208.67.222.222192.168.2.230x2e18No error (0)stun.l.google.com74.125.250.129A (IP address)IN (0x0001)false
                                                        Mar 26, 2025 23:49:15.204355001 CET208.67.222.222192.168.2.230x7293No error (0)stun.l.google.com74.125.250.129A (IP address)IN (0x0001)false

                                                        System Behavior

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/rm
                                                        Arguments:rm -f /tmp/tmp.ckvO8ue2Vq /tmp/tmp.UXFU2rU6dQ /tmp/tmp.TjfG7Y2vJO
                                                        File size:72056 bytes
                                                        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/cat
                                                        Arguments:cat /tmp/tmp.ckvO8ue2Vq
                                                        File size:43416 bytes
                                                        MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/head
                                                        Arguments:head -n 10
                                                        File size:47480 bytes
                                                        MD5 hash:fd96a67145172477dd57131396fc9608

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/tr
                                                        Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                        File size:51544 bytes
                                                        MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/cut
                                                        Arguments:cut -c -80
                                                        File size:47480 bytes
                                                        MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/cat
                                                        Arguments:cat /tmp/tmp.ckvO8ue2Vq
                                                        File size:43416 bytes
                                                        MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/head
                                                        Arguments:head -n 10
                                                        File size:47480 bytes
                                                        MD5 hash:fd96a67145172477dd57131396fc9608

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/tr
                                                        Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                        File size:51544 bytes
                                                        MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:00
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/cut
                                                        Arguments:cut -c -80
                                                        File size:47480 bytes
                                                        MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                        Start time (UTC):22:49:01
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/dash
                                                        Arguments:-
                                                        File size:129816 bytes
                                                        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                        Start time (UTC):22:49:01
                                                        Start date (UTC):26/03/2025
                                                        Path:/usr/bin/rm
                                                        Arguments:rm -f /tmp/tmp.ckvO8ue2Vq /tmp/tmp.UXFU2rU6dQ /tmp/tmp.TjfG7Y2vJO
                                                        File size:72056 bytes
                                                        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                        Start time (UTC):22:49:08
                                                        Start date (UTC):26/03/2025
                                                        Path:/tmp/arm5.elf
                                                        Arguments:-
                                                        File size:4956856 bytes
                                                        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1