Edit tour

Linux Analysis Report
parm6.elf

Overview

General Information

Sample name:parm6.elf
Analysis ID:1653180
MD5:0accb2c3555b8132fcc190f849fa1db4
SHA1:54c7c4fa2860226b4c77e13e7b161c44691201ea
SHA256:c55271b67ee64194f255925228d2f4532b460e85ae894602d442d528bff30a39
Tags:user-elfdigest
Infos:

Detection

Mirai
Score:60
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "rm" command used to delete files or directories
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1653180
Start date and time:2025-03-31 21:32:18 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 21s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:parm6.elf
Detection:MAL
Classification:mal60.troj.evad.linELF@0/0@2/0
Command:/tmp/parm6.elf
PID:5517
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • parm6.elf (PID: 5517, Parent: 5440, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/parm6.elf
  • dash New Fork (PID: 5556, Parent: 3674)
  • rm (PID: 5556, Parent: 3674, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.XVeM6DY7h2 /tmp/tmp.ycfqjEWycv /tmp/tmp.tnIzXfMMsI
  • dash New Fork (PID: 5557, Parent: 3674)
  • cat (PID: 5557, Parent: 3674, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.XVeM6DY7h2
  • dash New Fork (PID: 5558, Parent: 3674)
  • head (PID: 5558, Parent: 3674, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5559, Parent: 3674)
  • tr (PID: 5559, Parent: 3674, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5560, Parent: 3674)
  • cut (PID: 5560, Parent: 3674, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5561, Parent: 3674)
  • cat (PID: 5561, Parent: 3674, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.XVeM6DY7h2
  • dash New Fork (PID: 5562, Parent: 3674)
  • head (PID: 5562, Parent: 3674, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5563, Parent: 3674)
  • tr (PID: 5563, Parent: 3674, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5564, Parent: 3674)
  • cut (PID: 5564, Parent: 3674, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5565, Parent: 3674)
  • rm (PID: 5565, Parent: 3674, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.XVeM6DY7h2 /tmp/tmp.ycfqjEWycv /tmp/tmp.tnIzXfMMsI
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
5517.1.00007f7314017000.00007f731402a000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    No Suricata rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: parm6.elfVirustotal: Detection: 38%Perma Link
    Source: parm6.elfReversingLabs: Detection: 38%
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
    Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
    Source: parm6.elfString found in binary or memory: http://upx.sf.net
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 52466
    Source: unknownNetwork traffic detected: HTTP traffic on port 52466 -> 443
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: classification engineClassification label: mal60.troj.evad.linELF@0/0@2/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /usr/bin/dash (PID: 5556)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.XVeM6DY7h2 /tmp/tmp.ycfqjEWycv /tmp/tmp.tnIzXfMMsIJump to behavior
    Source: /usr/bin/dash (PID: 5565)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.XVeM6DY7h2 /tmp/tmp.ycfqjEWycv /tmp/tmp.tnIzXfMMsIJump to behavior
    Source: parm6.elfSubmission file: segment LOAD with 7.9656 entropy (max. 8.0)
    Source: /tmp/parm6.elf (PID: 5517)Queries kernel information via 'uname': Jump to behavior
    Source: parm6.elf, 5517.1.0000563dd5f6f000.0000563dd619d000.rw-.sdmpBinary or memory string: =V!/etc/qemu-binfmt/arm
    Source: parm6.elf, 5517.1.00007ffc3462f000.00007ffc34650000.rw-.sdmpBinary or memory string: hx86_64/usr/bin/qemu-arm/tmp/parm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/parm6.elf
    Source: parm6.elf, 5517.1.0000563dd5f6f000.0000563dd619d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: parm6.elf, 5517.1.00007ffc3462f000.00007ffc34650000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
    Source: parm6.elf, 5517.1.00007ffc3462f000.00007ffc34650000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: 5517.1.00007f7314017000.00007f731402a000.r-x.sdmp, type: MEMORY

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: 5517.1.00007f7314017000.00007f731402a000.r-x.sdmp, type: MEMORY
    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
    Obfuscated Files or Information
    OS Credential Dumping11
    Security Software Discovery
    Remote ServicesData from Local System1
    Encrypted Channel
    Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
    File Deletion
    LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
    Non-Application Layer Protocol
    Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
    Application Layer Protocol
    Automated ExfiltrationData Encrypted for Impact
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1653180 Sample: parm6.elf Startdate: 31/03/2025 Architecture: LINUX Score: 60 14 54.247.62.1, 443, 52466 AMAZON-02US United States 2->14 16 daisy.ubuntu.com 2->16 18 Multi AV Scanner detection for submitted file 2->18 20 Yara detected Mirai 2->20 22 Sample is packed with UPX 2->22 6 dash rm 2->6         started        8 dash cut 2->8         started        10 dash tr 2->10         started        12 8 other processes 2->12 signatures3 process4

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    parm6.elf38%VirustotalBrowse
    parm6.elf39%ReversingLabsLinux.Trojan.Mirai
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches

    Download Network PCAP: filteredfull

    NameIPActiveMaliciousAntivirus DetectionReputation
    daisy.ubuntu.com
    162.213.35.24
    truefalse
      high
      NameSourceMaliciousAntivirus DetectionReputation
      http://upx.sf.netparm6.elffalse
        high
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        54.247.62.1
        unknownUnited States
        16509AMAZON-02USfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        54.247.62.1rjfe686.elfGet hashmaliciousUnknownBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            sh4.elfGet hashmaliciousMiraiBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  boatnet.x86_64.elfGet hashmaliciousMiraiBrowse
                    arm5.elfGet hashmaliciousUnknownBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        na.elfGet hashmaliciousPrometeiBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            daisy.ubuntu.comeehah4.elfGet hashmaliciousUnknownBrowse
                            • 162.213.35.24
                            weje64.elfGet hashmaliciousUnknownBrowse
                            • 162.213.35.25
                            arm6.elfGet hashmaliciousUnknownBrowse
                            • 162.213.35.24
                            x86.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            sh4.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.25
                            l7vmra.elfGet hashmaliciousUnknownBrowse
                            • 162.213.35.25
                            boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.25
                            boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            boatnet.spc.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.24
                            boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                            • 162.213.35.25
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            AMAZON-02UShttps://ja.cat/7Nv3SGet hashmaliciousUnknownBrowse
                            • 13.224.214.87
                            na.elfGet hashmaliciousPrometeiBrowse
                            • 52.26.80.133
                            Remittance Doc #200033312025.svgGet hashmaliciousUnknownBrowse
                            • 13.225.63.87
                            https://trimmer.to/utXRpGet hashmaliciousUnknownBrowse
                            • 13.50.120.28
                            Aviso de transfer.exeGet hashmaliciousFormBookBrowse
                            • 13.248.169.48
                            https://pushman.online/price-page35.htmlGet hashmaliciousUnknownBrowse
                            • 108.138.128.122
                            March_00027290_7729.exeGet hashmaliciousFormBookBrowse
                            • 13.248.169.48
                            https://cornerstoneresidentialmgt.tixio.io/share/wiki/67ead15b7241d7dc926633dfGet hashmaliciousUnknownBrowse
                            • 52.58.163.166
                            https://www.paypal.com/ncp/payment/8WZ9YML5GJWNSGet hashmaliciousUnknownBrowse
                            • 13.249.39.28
                            https://protect.checkpoint.com/v2/r01/___https:/en.brunner.bi/measurekiller___.YzJ1OmhzYnNvbG9tb25hc3NvY2lhdGVzMTpjOm86ZTMyZDRjYWQwODkxYzI5MTY2MmFjZjE0NzU4YWIzYTE6Nzo4NjkxOjNlZjYzODUxNjZjMGRmNDFiOTE3Y2JjNmMwNmNkMzNkYjZjZjFmNTRiZDU4MDEwODZiODg3M2EwZTYyYmEyMDY6aDpUOk4Get hashmaliciousUnknownBrowse
                            • 18.202.131.124
                            No context
                            No context
                            No created / dropped files found
                            File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
                            Entropy (8bit):7.963228420666546
                            TrID:
                            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                            File name:parm6.elf
                            File size:37'240 bytes
                            MD5:0accb2c3555b8132fcc190f849fa1db4
                            SHA1:54c7c4fa2860226b4c77e13e7b161c44691201ea
                            SHA256:c55271b67ee64194f255925228d2f4532b460e85ae894602d442d528bff30a39
                            SHA512:295d9e8a439f61c472ca6513f1d62b690ac7c8e41e0c9488b24211b8921a27d4d1154039f1848103fcb59fcb25d8f9d3a1812fc62485c958a5c9994935ee8299
                            SSDEEP:768:eKiQ47RQVbztSW6r18+fA8WQ8b6a1lxxb3ZWOBKN9wHCu3F9q3UEL6U:Ax72bxb6rK8q73xx8bxuoLN
                            TLSH:7BF2E134940E9C2AC9354C379C4980C705490B2DC9EFEA79F9481BB8ADCF9895EB8CC3
                            File Content Preview:.ELF..............(.....`...4...........4. ...(.....................M...M................X..........................Q.td............................>. NUPX!.........5...5......T..........?.E.h;....#..$..1)...d:.B*..K.....E...%.C+H.(.^..KT..A......S...;...

                            ELF header

                            Class:ELF32
                            Data:2's complement, little endian
                            Version:1 (current)
                            Machine:ARM
                            Version Number:0x1
                            Type:EXEC (Executable file)
                            OS/ABI:UNIX - Linux
                            ABI Version:0
                            Entry Point Address:0xfe60
                            Flags:0x4000002
                            ELF Header Size:52
                            Program Header Offset:52
                            Program Header Size:32
                            Number of Program Headers:3
                            Section Header Offset:0
                            Section Header Size:40
                            Number of Section Headers:0
                            Header String Table Index:0
                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                            LOAD0x00x80000x80000x904d0x904d7.96560x5R E0x8000
                            LOAD0x58a40x2d8a40x2d8a40x00x00.00000x6RW 0x8000
                            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                            Download Network PCAP: filteredfull

                            • Total Packets: 15
                            • 443 (HTTPS)
                            • 53 (DNS)
                            TimestampSource PortDest PortSource IPDest IP
                            Mar 31, 2025 21:33:09.930196047 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:09.930361986 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:10.133675098 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:10.133831978 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:10.334017992 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:10.334045887 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:10.334292889 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:10.334316969 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:10.528764963 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:10.529011011 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:10.530004978 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:10.728421926 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:10.753698111 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:10.753932953 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:10.754137039 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:10.990654945 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:11.056405067 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:11.056433916 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:11.056641102 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:11.056680918 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:11.058161974 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:11.262639046 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:11.262707949 CEST4435246654.247.62.1192.168.2.15
                            Mar 31, 2025 21:33:11.262777090 CEST52466443192.168.2.1554.247.62.1
                            Mar 31, 2025 21:33:11.262777090 CEST52466443192.168.2.1554.247.62.1
                            TimestampSource PortDest PortSource IPDest IP
                            Mar 31, 2025 21:33:00.846863985 CEST5665253192.168.2.158.8.8.8
                            Mar 31, 2025 21:33:00.846863985 CEST4593253192.168.2.158.8.8.8
                            Mar 31, 2025 21:33:00.940066099 CEST53459328.8.8.8192.168.2.15
                            Mar 31, 2025 21:33:00.940084934 CEST53566528.8.8.8192.168.2.15
                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Mar 31, 2025 21:33:00.846863985 CEST192.168.2.158.8.8.80x7a65Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                            Mar 31, 2025 21:33:00.846863985 CEST192.168.2.158.8.8.80x9453Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Mar 31, 2025 21:33:00.940084934 CEST8.8.8.8192.168.2.150x7a65No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                            Mar 31, 2025 21:33:00.940084934 CEST8.8.8.8192.168.2.150x7a65No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                            TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                            Mar 31, 2025 21:33:10.753698111 CEST54.247.62.1443192.168.2.1552466CN=motd.ubuntu.com CN=R10, O=Let's Encrypt, C=USCN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USSat Mar 22 09:18:05 CET 2025 Wed Mar 13 01:00:00 CET 2024Fri Jun 20 10:18:04 CEST 2025 Sat Mar 13 00:59:59 CET 2027
                            CN=R10, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USWed Mar 13 01:00:00 CET 2024Sat Mar 13 00:59:59 CET 2027

                            System Behavior

                            Start time (UTC):19:32:58
                            Start date (UTC):31/03/2025
                            Path:/tmp/parm6.elf
                            Arguments:/tmp/parm6.elf
                            File size:4956856 bytes
                            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/rm
                            Arguments:rm -f /tmp/tmp.XVeM6DY7h2 /tmp/tmp.ycfqjEWycv /tmp/tmp.tnIzXfMMsI
                            File size:72056 bytes
                            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/cat
                            Arguments:cat /tmp/tmp.XVeM6DY7h2
                            File size:43416 bytes
                            MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/head
                            Arguments:head -n 10
                            File size:47480 bytes
                            MD5 hash:fd96a67145172477dd57131396fc9608

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/tr
                            Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                            File size:51544 bytes
                            MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:09
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/cut
                            Arguments:cut -c -80
                            File size:47480 bytes
                            MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/cat
                            Arguments:cat /tmp/tmp.XVeM6DY7h2
                            File size:43416 bytes
                            MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/head
                            Arguments:head -n 10
                            File size:47480 bytes
                            MD5 hash:fd96a67145172477dd57131396fc9608

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/tr
                            Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                            File size:51544 bytes
                            MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/cut
                            Arguments:cut -c -80
                            File size:47480 bytes
                            MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/dash
                            Arguments:-
                            File size:129816 bytes
                            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                            Start time (UTC):19:33:10
                            Start date (UTC):31/03/2025
                            Path:/usr/bin/rm
                            Arguments:rm -f /tmp/tmp.XVeM6DY7h2 /tmp/tmp.ycfqjEWycv /tmp/tmp.tnIzXfMMsI
                            File size:72056 bytes
                            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b