Edit tour

Linux Analysis Report
sshd.elf

Overview

General Information

Sample name:sshd.elf
Analysis ID:1652114
MD5:af93ec62fcb6664677c727136225a95c
SHA1:ed42990eb10635f0e8bc157c2bb86a0f0703f633
SHA256:3190b43fdda50d08971282c6d3702503192466510eb51a79b7405b5757f51435
Tags:elfuser-abuse_ch
Infos:

Detection

Score:48
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Creates hidden files and/or directories
Executes the "rm" command used to delete files or directories
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1652114
Start date and time:2025-03-30 10:09:19 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 36s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sshd.elf
Detection:MAL
Classification:mal48.linELF@0/6@2/0
Command:/tmp/sshd.elf
PID:5496
Exit Code:135
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • sshd.elf (PID: 5496, Parent: 5418, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/sshd.elf
  • fwupd New Fork (PID: 5529, Parent: 1)
  • gpgconf (PID: 5529, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --list-dirs
  • fwupd New Fork (PID: 5531, Parent: 1)
  • gpgconf (PID: 5531, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --list-components
  • fwupd New Fork (PID: 5533, Parent: 1)
  • gpg (PID: 5533, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: /usr/bin/gpg --version
  • fwupd New Fork (PID: 5535, Parent: 1)
  • gpgsm (PID: 5535, Parent: 1, MD5: 66be603a7085efc7ee3140d2ff597485) Arguments: /usr/bin/gpgsm --version
  • fwupd New Fork (PID: 5537, Parent: 1)
  • gpgconf (PID: 5537, Parent: 1, MD5: ddc6865fed36b9020dfd6fe9d360ebbb) Arguments: /usr/bin/gpgconf --version
  • fwupd New Fork (PID: 5539, Parent: 1)
  • gpg (PID: 5539, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: /usr/bin/gpg --version
  • fwupd New Fork (PID: 5541, Parent: 1)
  • gpg (PID: 5541, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27
  • fwupd New Fork (PID: 5543, Parent: 1)
  • gpg (PID: 5543, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27
  • fwupd New Fork (PID: 5545, Parent: 1)
  • gpg (PID: 5545, Parent: 1, MD5: 3c2e7402cc788b3a878a1d2bea56afbf) Arguments: gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28
  • systemd New Fork (PID: 5573, Parent: 1)
  • e2scrub_all (PID: 5573, Parent: 1, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /sbin/e2scrub_all
  • dash New Fork (PID: 5601, Parent: 3673)
  • rm (PID: 5601, Parent: 3673, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.FQv9eG7mx0 /tmp/tmp.mGkDwUA4f5 /tmp/tmp.HMHFk1EM24
  • dash New Fork (PID: 5602, Parent: 3673)
  • cat (PID: 5602, Parent: 3673, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.FQv9eG7mx0
  • dash New Fork (PID: 5603, Parent: 3673)
  • head (PID: 5603, Parent: 3673, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5604, Parent: 3673)
  • tr (PID: 5604, Parent: 3673, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5605, Parent: 3673)
  • cut (PID: 5605, Parent: 3673, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5606, Parent: 3673)
  • cat (PID: 5606, Parent: 3673, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.FQv9eG7mx0
  • dash New Fork (PID: 5607, Parent: 3673)
  • head (PID: 5607, Parent: 3673, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5608, Parent: 3673)
  • tr (PID: 5608, Parent: 3673, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5609, Parent: 3673)
  • cut (PID: 5609, Parent: 3673, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5610, Parent: 3673)
  • rm (PID: 5610, Parent: 3673, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.FQv9eG7mx0 /tmp/tmp.mGkDwUA4f5 /tmp/tmp.HMHFk1EM24
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: sshd.elfReversingLabs: Detection: 13%
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: unknownTCP traffic detected without corresponding DNS query: 151.101.46.49
Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/noneAccept: */*Accept-Encoding: identityHost: motd.ubuntu.comConnection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 36188
Source: unknownNetwork traffic detected: HTTP traffic on port 58088 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 58088
Source: unknownNetwork traffic detected: HTTP traffic on port 36188 -> 443
Source: classification engineClassification label: mal48.linELF@0/6@2/0
Source: /usr/bin/gpg (PID: 5541)File: /var/lib/fwupd/gnupg/.#lk0x00005609220c7b80.galassia.5541Jump to behavior
Source: /usr/bin/gpg (PID: 5543)File: /var/lib/fwupd/gnupg/.#lk0x00005624a0bc4b80.galassia.5543Jump to behavior
Source: /usr/bin/gpg (PID: 5545)File: /var/lib/fwupd/gnupg/.#lk0x0000562ec446db80.galassia.5545Jump to behavior
Source: /usr/bin/dash (PID: 5601)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FQv9eG7mx0 /tmp/tmp.mGkDwUA4f5 /tmp/tmp.HMHFk1EM24Jump to behavior
Source: /usr/bin/dash (PID: 5610)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FQv9eG7mx0 /tmp/tmp.mGkDwUA4f5 /tmp/tmp.HMHFk1EM24Jump to behavior
Source: /tmp/sshd.elf (PID: 5496)Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpg (PID: 5541)Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpg (PID: 5543)Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpg (PID: 5545)Queries kernel information via 'uname': Jump to behavior
Source: /sbin/e2scrub_all (PID: 5573)Queries kernel information via 'uname': Jump to behavior
Source: sshd.elf, 5496.1.00007ffdbb90a000.00007ffdbb92b000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/sshd.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sshd.elf
Source: sshd.elf, 5496.1.000055be36bbf000.000055be36ccb000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: sshd.elf, 5496.1.000055be36bbf000.000055be36ccb000.rw-.sdmpBinary or memory string: Urg.qemu.gdb.arm.sys.regs">
Source: sshd.elf, 5496.1.000055be36bbf000.000055be36ccb000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: sshd.elf, 5496.1.00007ffdbb90a000.00007ffdbb92b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: sshd.elf, 5496.1.000055be36bbf000.000055be36ccb000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
Hidden Files and Directories
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
File Deletion
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media2
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1652114 Sample: sshd.elf Startdate: 30/03/2025 Architecture: LINUX Score: 48 14 151.101.46.49, 443, 58088 FASTLYUS United States 2->14 16 34.243.160.129, 36188, 443 AMAZON-02US United States 2->16 18 daisy.ubuntu.com 2->18 20 Multi AV Scanner detection for submitted file 2->20 6 fwupd gpgconf 2->6         started        8 fwupd gpgconf 2->8         started        10 fwupd gpg 2->10         started        12 18 other processes 2->12 signatures3 process4

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
sshd.elf14%ReversingLabsLinux.Trojan.Generic
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.24
truefalse
    high
    NameMaliciousAntivirus DetectionReputation
    https://motd.ubuntu.com/false
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      34.243.160.129
      unknownUnited States
      16509AMAZON-02USfalse
      151.101.46.49
      unknownUnited States
      54113FASTLYUSfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      34.243.160.129na.elfGet hashmaliciousPrometeiBrowse
        boatnet.arm5.elfGet hashmaliciousMiraiBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            na.elfGet hashmaliciousPrometeiBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                SecuriteInfo.com.Linux.Mirai.2522.20371.24695.elfGet hashmaliciousUnknownBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      morte.arm6.elfGet hashmaliciousUnknownBrowse
                        jfeeps.elfGet hashmaliciousUnknownBrowse
                          151.101.46.49na.elfGet hashmaliciousPrometeiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  https://link.nl.technologyadvice.com/click/39172279.19086/aHR0cHM6Ly93d3cubWFsd2FyZWJ5dGVzLmNvbS9ibG9nL25ld3MvMjAyNS8wMy9mYWtlLWNhcHRjaGEtd2Vic2l0ZXMtaGlqYWNrLXlvdXItY2xpcGJvYXJkLXRvLWluc3RhbGwtaW5mb3JtYXRpb24tc3RlYWxlcnM/637803e0e276e2366b2a18eaB71f6de2eGet hashmaliciousUnknownBrowse
                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    daisy.ubuntu.comweje64.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.24
                                    bejv86.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.24
                                    hanoi.i686.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.24
                                    efea6.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.24
                                    .i.elfGet hashmaliciousMiraiBrowse
                                    • 162.213.35.24
                                    sshd.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.25
                                    rrrdsl.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.24
                                    rjfe686.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.25
                                    bin.sh.elfGet hashmaliciousMiraiBrowse
                                    • 162.213.35.24
                                    arm6.elfGet hashmaliciousMiraiBrowse
                                    • 162.213.35.24
                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    AMAZON-02USna.elfGet hashmaliciousPrometeiBrowse
                                    • 54.171.230.55
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 34.249.145.219
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 13.213.51.196
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 34.249.145.219
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 34.249.145.219
                                    hanoi.mips.elfGet hashmaliciousUnknownBrowse
                                    • 34.249.145.219
                                    hanoi.arc.elfGet hashmaliciousMirai, Okiru, XmrigBrowse
                                    • 34.249.145.219
                                    bejv86.elfGet hashmaliciousUnknownBrowse
                                    • 34.249.145.219
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 54.169.144.97
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 54.171.230.55
                                    FASTLYUSna.elfGet hashmaliciousPrometeiBrowse
                                    • 199.232.90.49
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 199.232.90.49
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 199.232.90.49
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 151.101.46.49
                                    hanoi.x86_64.elfGet hashmaliciousUnknownBrowse
                                    • 199.232.90.49
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 151.101.46.49
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 151.101.46.49
                                    na.elfGet hashmaliciousPrometeiBrowse
                                    • 151.101.46.49
                                    Archive.zipGet hashmaliciousAsyncRATBrowse
                                    • 151.101.46.172
                                    random.exeGet hashmaliciousCredential FlusherBrowse
                                    • 151.101.129.91
                                    No context
                                    No context
                                    Process:/usr/bin/gpg
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):20
                                    Entropy (8bit):3.0086949695628418
                                    Encrypted:false
                                    SSDEEP:3:N/h/vn://vn
                                    MD5:3C3227830571148F4BEC5D4209AE09AD
                                    SHA1:45902C09A15007B2E72275DB4069988DDF60D43E
                                    SHA-256:4182B45BCFA72A341E35A2FDBEDFC4F05159A9704F0CF31EB4C56D72704EDDFF
                                    SHA-512:67929F41F1EE8861E42C6012A494DEF96DCCDE35EF72171FC5A6EA3168E95AB123E44D13F6A8E65E12097E045D59B13DBF8DB56A170F99EC2A97AC69DE7BC9A6
                                    Malicious:false
                                    Reputation:low
                                    Preview: 5541.galassia.
                                    Process:/usr/bin/gpg
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):20
                                    Entropy (8bit):3.0086949695628418
                                    Encrypted:false
                                    SSDEEP:3:N/tEevn:Vvn
                                    MD5:11BFA7C2B43B4B637680F17FC419503D
                                    SHA1:8BE115D618DAC7782888DC45A1060EC4D04AFC71
                                    SHA-256:DADCA4CEA3627A849F0C8D5B673AF8399DE8D4A87C138D355B49201B894C36AD
                                    SHA-512:2395DCDB63EA404F37B768B99DD0315547F1B32F4CC1BA378C95AD19C9889B53CD123E4E6EF980EA6D025EA6271046E44ADFBC54948DBC1D9F52023B95B6E61D
                                    Malicious:false
                                    Reputation:low
                                    Preview: 5543.galassia.
                                    Process:/usr/bin/gpg
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):20
                                    Entropy (8bit):2.8709505944546683
                                    Encrypted:false
                                    SSDEEP:3:N/MIvn:uIvn
                                    MD5:0D3239F1EAA0EBC6892B39AF01F5302D
                                    SHA1:523EF838DE53A4DBACBE4DA37CEA093CBB682D8B
                                    SHA-256:DB6B1FFDEF65FD09DC92E0C6BC38477CCA382AA24F0C3B66F983F554F939E614
                                    SHA-512:2004AB9629937FBC55D18846D69A7423786EDD1EC73BFA0D6243C29C0039947DD06A17843206175C42207A5BBB31BB6AB50E208F77302755E79C8F013B959B47
                                    Malicious:false
                                    Reputation:low
                                    Preview: 5545.galassia.
                                    Process:/usr/bin/gpg
                                    File Type:GPG keybox database version 1, created-at Tue Aug 17 14:04:41 2021, last-maintained Sun Mar 30 08:10:07 2025
                                    Category:dropped
                                    Size (bytes):2534
                                    Entropy (8bit):7.619819146219476
                                    Encrypted:false
                                    SSDEEP:48:s4Z3Buh7g8ZMUfN1i9N+EvbYJYv20hIhoRU3h0LJv9ARRt:dUc8ZM+Y+AbcoRU3CARRt
                                    MD5:0943974EC9392517499909BE5FEAAA9B
                                    SHA1:82101FAAB4CF908906FB62028424FE8F284A9718
                                    SHA-256:70B464AFB990C98AF011E38C60B0BEEFC01B53F3A42D272D41C23680AD5A8E93
                                    SHA-512:5392F395411CF0CC92C2D25006769CA8C7C29BE6EA5323A85F7FF3EDFE1B6EDE0D1FD7D77E1C953249B251921453328317B9F1AC0C00D66666B9ECE79853F21C
                                    Malicious:false
                                    Reputation:low
                                    Preview:... ....KBXf....a...g.._...................^........?..A..../.H...E8..... .............~............................a...........U.........T.*x8.sU....K'....F....l...K....cL.`Y......=....^~.5|.%.......2..../.h..O..*T........'.6E....HV..?.6l.......e..1o.O.,Y3....1,..a4..|..s.w......f2......gaIK..i...x.T...~..W..N."..Z..ia!..V..so.....<.6j..........3C&..t1..Gf...j..z...U.........gpg.........Linux Vendor Firmware Service <sign@fwupd.org>....gpg.........7.....!..U..................................H...E8..c....d.....d.....3....a..y..?...........l...1/...)......T.f....-..UoxT... .v...|...7.....d..PB..>..W{...-..R....&S.....~..2.ps.8:...{..^{?..@.?..e6....y...c.Rw.SK.F.;U)...A..S> an....W.?.|.{.dB....x~B...V....O....'./!...|;...Xw.:.!.p,n.A.H\..\...).....gpg......z.......D<............~...$......B.Y..A...n.m...o=.... ......8>4.G8E..L...+G..Z...<.................Z............................a...........[.......I....DR:....!._.P..`.1..6.9..G....O.y.?.......
                                    File type:ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, missing section headers at 1110264
                                    Entropy (8bit):6.187056683807139
                                    TrID:
                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                    File name:sshd.elf
                                    File size:693'539 bytes
                                    MD5:af93ec62fcb6664677c727136225a95c
                                    SHA1:ed42990eb10635f0e8bc157c2bb86a0f0703f633
                                    SHA256:3190b43fdda50d08971282c6d3702503192466510eb51a79b7405b5757f51435
                                    SHA512:f71711505b5efb74e17629726af3f99f324ba70d5770ee84a205301ae7aad035d2e0e5fe57b8410df4fd7d97d1913a27fa021e865c57332c6be6ae360f5bf26a
                                    SSDEEP:12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9Kbst:00BnRED/TwOjX0t
                                    TLSH:E2E43B66F8808AB6C6D45BBBBB5DC75833131779D7DE7002CD045B2437EB84A0E6B982
                                    File Content Preview:.ELF..............(......d..4...p.......4. ...(........pl...l...l.......................4...4...4... ... ...............T...T...T...................................x...x...........................0....m..........................(...(...............p...p..

                                    Download Network PCAP: filteredfull

                                    • Total Packets: 77
                                    • 443 (HTTPS)
                                    • 53 (DNS)
                                    TimestampSource PortDest PortSource IPDest IP
                                    Mar 30, 2025 10:10:03.276401997 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.307554960 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.307571888 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.307758093 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.373776913 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.373795033 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.374023914 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.407455921 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.407509089 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.407820940 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.475032091 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.475049973 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.475174904 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.514115095 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.514128923 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.514398098 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.576849937 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.576868057 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.576947927 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.614039898 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.614062071 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.614255905 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.646147013 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.677118063 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.677131891 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.677187920 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.711208105 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.711344957 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.711370945 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.760451078 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.779416084 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.779433012 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.779510975 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.878848076 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.879039049 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:03.982912064 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:03.983006001 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.009278059 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.009346962 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.084150076 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.084279060 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.096842051 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.097908974 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.187688112 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.188786030 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.204827070 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.205888033 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.293236971 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.293327093 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.646894932 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.647037029 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.748112917 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.748169899 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.851058960 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.851109028 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.851114035 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.851154089 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.952047110 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.952102900 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:04.976792097 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:04.976836920 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.053977013 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.054032087 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.068027020 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.068064928 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.094373941 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.094419003 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.161240101 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.161299944 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.197429895 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.197602987 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.259934902 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.260004044 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.298233986 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.298317909 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.358973980 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.359132051 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.401896000 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.401938915 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.479948997 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.480010033 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.502290964 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.502343893 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.573190928 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.573240995 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.588476896 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.588618040 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.673813105 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.691884041 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.691937923 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.792340040 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.808796883 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.808840036 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.838027000 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.888679028 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.906615973 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.921896935 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:05.921968937 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:05.992002964 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.023081064 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.023156881 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.038549900 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.104712009 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.124783039 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.141798019 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.141855955 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.208153963 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.208170891 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.208276987 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.245222092 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.245240927 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.245296955 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.302118063 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.302133083 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.302185059 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.344738960 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.344753027 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.344800949 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.401618958 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.401631117 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.401707888 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.447252989 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.447266102 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.447310925 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.469835997 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.502777100 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.502811909 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.502877951 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.548485994 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.548502922 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.548582077 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.588758945 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.603935957 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.603949070 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.604052067 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.619820118 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.621467113 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.624794960 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:06.725472927 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.725486040 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.735483885 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:06.735579967 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:08.955800056 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:08.955800056 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:09.055186033 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:09.055207014 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:09.055224895 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:09.055279016 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:09.055438995 CEST44358088151.101.46.49192.168.2.15
                                    Mar 30, 2025 10:10:09.055479050 CEST58088443192.168.2.15151.101.46.49
                                    Mar 30, 2025 10:10:31.197282076 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:31.197391033 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:31.197567940 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:31.198833942 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:31.198868990 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:58.833652973 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:58.833874941 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:58.834377050 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:58.834403992 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:58.836625099 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:58.836735010 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:58.838732004 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:58.838831902 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:58.838932037 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:58.838949919 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:58.839010000 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:59.071265936 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:59.071652889 CEST4433618834.243.160.129192.168.2.15
                                    Mar 30, 2025 10:10:59.071741104 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:59.072419882 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:59.072419882 CEST36188443192.168.2.1534.243.160.129
                                    Mar 30, 2025 10:10:59.072503090 CEST4433618834.243.160.129192.168.2.15
                                    TimestampSource PortDest PortSource IPDest IP
                                    Mar 30, 2025 10:10:06.050740004 CEST4580153192.168.2.151.1.1.1
                                    Mar 30, 2025 10:10:06.050802946 CEST3514653192.168.2.151.1.1.1
                                    Mar 30, 2025 10:10:06.150820971 CEST53351461.1.1.1192.168.2.15
                                    Mar 30, 2025 10:10:06.150859118 CEST53458011.1.1.1192.168.2.15
                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                    Mar 30, 2025 10:10:06.050740004 CEST192.168.2.151.1.1.10xadc4Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                    Mar 30, 2025 10:10:06.050802946 CEST192.168.2.151.1.1.10x4c3fStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                    Mar 30, 2025 10:10:06.150859118 CEST1.1.1.1192.168.2.150xadc4No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                                    Mar 30, 2025 10:10:06.150859118 CEST1.1.1.1192.168.2.150xadc4No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                    • motd.ubuntu.com
                                    Session IDSource IPSource PortDestination IPDestination Port
                                    0192.168.2.153618834.243.160.129443
                                    TimestampBytes transferredDirectionData
                                    2025-03-30 08:10:58 UTC249OUTGET / HTTP/1.1
                                    User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none
                                    Accept: */*
                                    Accept-Encoding: identity
                                    Host: motd.ubuntu.com
                                    Connection: Keep-Alive
                                    2025-03-30 08:10:59 UTC271INHTTP/1.1 200 OK
                                    Date: Sun, 30 Mar 2025 08:10:58 GMT
                                    Server: Apache/2.4.18 (Ubuntu)
                                    Last-Modified: Sun, 30 Mar 2025 08:00:32 GMT
                                    ETag: "d8-6318ab2a5bdfc"
                                    Accept-Ranges: bytes
                                    Content-Length: 216
                                    Vary: Accept-Encoding
                                    Connection: close
                                    Content-Type: text/plain
                                    2025-03-30 08:10:59 UTC216INData Raw: 20 2a 20 53 74 72 69 63 74 6c 79 20 63 6f 6e 66 69 6e 65 64 20 4b 75 62 65 72 6e 65 74 65 73 20 6d 61 6b 65 73 20 65 64 67 65 20 61 6e 64 20 49 6f 54 20 73 65 63 75 72 65 2e 20 4c 65 61 72 6e 20 68 6f 77 20 4d 69 63 72 6f 4b 38 73 0a 20 20 20 6a 75 73 74 20 72 61 69 73 65 64 20 74 68 65 20 62 61 72 20 66 6f 72 20 65 61 73 79 2c 20 72 65 73 69 6c 69 65 6e 74 20 61 6e 64 20 73 65 63 75 72 65 20 4b 38 73 20 63 6c 75 73 74 65 72 20 64 65 70 6c 6f 79 6d 65 6e 74 2e 0a 0a 20 20 20 68 74 74 70 73 3a 2f 2f 75 62 75 6e 74 75 2e 63 6f 6d 2f 65 6e 67 61 67 65 2f 73 65 63 75 72 65 2d 6b 75 62 65 72 6e 65 74 65 73 2d 61 74 2d 74 68 65 2d 65 64 67 65 0a
                                    Data Ascii: * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge


                                    System Behavior

                                    Start time (UTC):08:10:04
                                    Start date (UTC):30/03/2025
                                    Path:/tmp/sshd.elf
                                    Arguments:/tmp/sshd.elf
                                    File size:4956856 bytes
                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpgconf
                                    Arguments:/usr/bin/gpgconf --list-dirs
                                    File size:178848 bytes
                                    MD5 hash:ddc6865fed36b9020dfd6fe9d360ebbb

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpgconf
                                    Arguments:/usr/bin/gpgconf --list-components
                                    File size:178848 bytes
                                    MD5 hash:ddc6865fed36b9020dfd6fe9d360ebbb

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpg
                                    Arguments:/usr/bin/gpg --version
                                    File size:1066992 bytes
                                    MD5 hash:3c2e7402cc788b3a878a1d2bea56afbf

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpgsm
                                    Arguments:/usr/bin/gpgsm --version
                                    File size:519416 bytes
                                    MD5 hash:66be603a7085efc7ee3140d2ff597485

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:06
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpgconf
                                    Arguments:/usr/bin/gpgconf --version
                                    File size:178848 bytes
                                    MD5 hash:ddc6865fed36b9020dfd6fe9d360ebbb

                                    Start time (UTC):08:10:07
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:07
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpg
                                    Arguments:/usr/bin/gpg --version
                                    File size:1066992 bytes
                                    MD5 hash:3c2e7402cc788b3a878a1d2bea56afbf

                                    Start time (UTC):08:10:07
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:07
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpg
                                    Arguments:gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27
                                    File size:1066992 bytes
                                    MD5 hash:3c2e7402cc788b3a878a1d2bea56afbf

                                    Start time (UTC):08:10:07
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:07
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpg
                                    Arguments:gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 24 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 26 --import -- -&27
                                    File size:1066992 bytes
                                    MD5 hash:3c2e7402cc788b3a878a1d2bea56afbf

                                    Start time (UTC):08:10:07
                                    Start date (UTC):30/03/2025
                                    Path:/usr/libexec/fwupd/fwupd
                                    Arguments:-
                                    File size:260616 bytes
                                    MD5 hash:9baeed1d7c56e92aea5277bdf8b4373f

                                    Start time (UTC):08:10:07
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/gpg
                                    Arguments:gpg --enable-special-filenames --batch --no-sk-comments --homedir /var/lib/fwupd/gnupg --status-fd 23 --no-tty --charset utf8 --enable-progress-filter --exit-on-status-write-error --logger-fd 25 --verify -- -&26 -&28
                                    File size:1066992 bytes
                                    MD5 hash:3c2e7402cc788b3a878a1d2bea56afbf

                                    Start time (UTC):08:10:28
                                    Start date (UTC):30/03/2025
                                    Path:/usr/lib/systemd/systemd
                                    Arguments:-
                                    File size:1620224 bytes
                                    MD5 hash:9b2bec7092a40488108543f9334aab75

                                    Start time (UTC):08:10:28
                                    Start date (UTC):30/03/2025
                                    Path:/sbin/e2scrub_all
                                    Arguments:/sbin/e2scrub_all
                                    File size:1183448 bytes
                                    MD5 hash:7063c3930affe123baecd3b340f1ad2c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/rm
                                    Arguments:rm -f /tmp/tmp.FQv9eG7mx0 /tmp/tmp.mGkDwUA4f5 /tmp/tmp.HMHFk1EM24
                                    File size:72056 bytes
                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/cat
                                    Arguments:cat /tmp/tmp.FQv9eG7mx0
                                    File size:43416 bytes
                                    MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/head
                                    Arguments:head -n 10
                                    File size:47480 bytes
                                    MD5 hash:fd96a67145172477dd57131396fc9608

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/tr
                                    Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                    File size:51544 bytes
                                    MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/cut
                                    Arguments:cut -c -80
                                    File size:47480 bytes
                                    MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/cat
                                    Arguments:cat /tmp/tmp.FQv9eG7mx0
                                    File size:43416 bytes
                                    MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/head
                                    Arguments:head -n 10
                                    File size:47480 bytes
                                    MD5 hash:fd96a67145172477dd57131396fc9608

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/tr
                                    Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                    File size:51544 bytes
                                    MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/cut
                                    Arguments:cut -c -80
                                    File size:47480 bytes
                                    MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/dash
                                    Arguments:-
                                    File size:129816 bytes
                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                    Start time (UTC):08:10:58
                                    Start date (UTC):30/03/2025
                                    Path:/usr/bin/rm
                                    Arguments:rm -f /tmp/tmp.FQv9eG7mx0 /tmp/tmp.mGkDwUA4f5 /tmp/tmp.HMHFk1EM24
                                    File size:72056 bytes
                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b