Edit tour

Linux Analysis Report
most-arm5.elf

Overview

General Information

Sample name:most-arm5.elf
Analysis ID:1653737
MD5:f64bb639d4976d9619142099c36575eb
SHA1:a1bb9a65cb0290fb92683af20333c11e0b16c4bc
SHA256:457ac3463c32393c1ca5b86684c1aaa30f883746ca5e42cd5b41d5b0d85fb94e
Tags:elfuser-abuse_ch
Infos:

Detection

Score:56
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1653737
Start date and time:2025-04-01 15:47:11 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 43s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:most-arm5.elf
Detection:MAL
Classification:mal56.linELF@0/0@0/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
Command:/tmp/most-arm5.elf
PID:6226
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory
  • system is lnxubuntu20
  • most-arm5.elf (PID: 6226, Parent: 6149, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/most-arm5.elf
  • dash New Fork (PID: 6287, Parent: 4331)
  • rm (PID: 6287, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.W59ZJ0nwFs /tmp/tmp.jSioS4r1x7 /tmp/tmp.R4qkCERNrr
  • dash New Fork (PID: 6288, Parent: 4331)
  • rm (PID: 6288, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.W59ZJ0nwFs /tmp/tmp.jSioS4r1x7 /tmp/tmp.R4qkCERNrr
  • cleanup
SourceRuleDescriptionAuthorStrings
most-arm5.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x8114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x813c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x818c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x822c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x827c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x82a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
SourceRuleDescriptionAuthorStrings
6226.1.00007f9cc8017000.00007f9cc8020000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x8114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x813c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x818c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x81f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x822c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x827c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x8290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x82a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: most-arm5.elf PID: 6226Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x3f9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3fae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3fc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3fd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3fea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3ffe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x4012:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x4026:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x403a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x404e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x4062:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x4076:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x408a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x409e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x40b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x40c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x40da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x40ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x4102:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x4116:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x412a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: most-arm5.elfVirustotal: Detection: 33%Perma Link
Source: most-arm5.elfReversingLabs: Detection: 41%
Source: most-arm5.elfString: nh con../dvr_gui./upnp_server./dvr_app./pkillkillallwgetbusyboxtopcurlrebootpsftptftppgrepgrepxargsawktoyboxsuT
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 39250
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 39250 -> 443

System Summary

barindex
Source: most-arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.00007f9cc8017000.00007f9cc8020000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: most-arm5.elf PID: 6226, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Initial sampleString containing 'busybox' found: busybox
Source: Initial sampleString containing 'busybox' found: nh con../dvr_gui./upnp_server./dvr_app./pkillkillallwgetbusyboxtopcurlrebootpsftptftppgrepgrepxargsawktoyboxsuT
Source: ELF static info symbol of initial sample.symtab present: no
Source: most-arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.00007f9cc8017000.00007f9cc8020000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: most-arm5.elf PID: 6226, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engineClassification label: mal56.linELF@0/0@0/0
Source: /usr/bin/dash (PID: 6287)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.W59ZJ0nwFs /tmp/tmp.jSioS4r1x7 /tmp/tmp.R4qkCERNrrJump to behavior
Source: /usr/bin/dash (PID: 6288)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.W59ZJ0nwFs /tmp/tmp.jSioS4r1x7 /tmp/tmp.R4qkCERNrrJump to behavior
Source: /tmp/most-arm5.elf (PID: 6226)Queries kernel information via 'uname': Jump to behavior
Source: most-arm5.elf, 6226.1.00007ffc95aaf000.00007ffc95ad0000.rw-.sdmpBinary or memory string: ux86_64/usr/bin/qemu-arm/tmp/most-arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/most-arm5.elf
Source: most-arm5.elf, 6226.1.00005598df22f000.00005598df35d000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: most-arm5.elf, 6226.1.00007ffc95aaf000.00007ffc95ad0000.rw-.sdmpBinary or memory string: qemu: %s: %s
Source: most-arm5.elf, 6226.1.00007ffc95aaf000.00007ffc95ad0000.rw-.sdmpBinary or memory string: leqemu: %s: %s
Source: most-arm5.elf, 6226.1.00005598df22f000.00005598df35d000.rw-.sdmpBinary or memory string: Urg.qemu.gdb.arm.sys.regs">
Source: most-arm5.elf, 6226.1.00005598df22f000.00005598df35d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: most-arm5.elf, 6226.1.00007ffc95aaf000.00007ffc95ad0000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: most-arm5.elf, 6226.1.00005598df22f000.00005598df35d000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting
Valid AccountsWindows Management Instrumentation1
Scripting
Path Interception1
File Deletion
OS Credential Dumping11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1653737 Sample: most-arm5.elf Startdate: 01/04/2025 Architecture: LINUX Score: 56 12 109.202.202.202, 80 INIT7CH Switzerland 2->12 14 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->14 16 2 other IPs or domains 2->16 18 Malicious sample detected (through community Yara rule) 2->18 20 Multi AV Scanner detection for submitted file 2->20 6 dash rm 2->6         started        8 dash rm 2->8         started        10 most-arm5.elf 2->10         started        signatures3 process4

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
most-arm5.elf34%VirustotalBrowse
most-arm5.elf42%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPDomainCountryFlagASNASN NameMalicious
34.249.145.219
unknownUnited States
16509AMAZON-02USfalse
109.202.202.202
unknownSwitzerland
13030INIT7CHfalse
91.189.91.43
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
91.189.91.42
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
34.249.145.219na.elfGet hashmaliciousPrometeiBrowse
    na.elfGet hashmaliciousPrometeiBrowse
      na.elfGet hashmaliciousPrometeiBrowse
        main_m68k.elfGet hashmaliciousMiraiBrowse
          na.elfGet hashmaliciousPrometeiBrowse
            most-x86_64.elfGet hashmaliciousMiraiBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                      91.189.91.43na.elfGet hashmaliciousPrometeiBrowse
                        na.elfGet hashmaliciousPrometeiBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            main_x86.elfGet hashmaliciousMiraiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                main_mips.elfGet hashmaliciousMiraiBrowse
                                  main_m68k.elfGet hashmaliciousMiraiBrowse
                                    main_mpsl.elfGet hashmaliciousMiraiBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          91.189.91.42na.elfGet hashmaliciousPrometeiBrowse
                                            na.elfGet hashmaliciousPrometeiBrowse
                                              na.elfGet hashmaliciousPrometeiBrowse
                                                main_x86.elfGet hashmaliciousMiraiBrowse
                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                    main_mips.elfGet hashmaliciousMiraiBrowse
                                                      main_m68k.elfGet hashmaliciousMiraiBrowse
                                                        main_mpsl.elfGet hashmaliciousMiraiBrowse
                                                          na.elfGet hashmaliciousPrometeiBrowse
                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                              No context
                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              tftp.elfGet hashmaliciousUnknownBrowse
                                                              • 185.125.190.26
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              main_x86.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              main_ppc.elfGet hashmaliciousMiraiBrowse
                                                              • 185.125.190.26
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              main_mips.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              main_m68k.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              main_mpsl.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              tftp.elfGet hashmaliciousUnknownBrowse
                                                              • 185.125.190.26
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              main_x86.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              main_ppc.elfGet hashmaliciousMiraiBrowse
                                                              • 185.125.190.26
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 91.189.91.42
                                                              main_mips.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              main_m68k.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              main_mpsl.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              INIT7CHna.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              main_x86.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              main_mips.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              main_m68k.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              main_mpsl.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              AMAZON-02UShttps://personalinjuryhehe.eversign.com/document/fa37b4043dd04552b8cdfbfaa049dbbf-feca2a09aaa242c5b6a068e3a46fb7d1/signGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                              • 108.139.47.37
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 34.249.145.219
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 13.213.51.196
                                                              OC-8563 PURCHASE ORDER.exeGet hashmaliciousFormBookBrowse
                                                              • 13.248.169.48
                                                              Revised - Ohio police & fire pension fund 2025 Handbook18663.docGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                              • 99.83.148.19
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 13.213.51.196
                                                              https://forms.fillout.com/t/nQmGcyH7HnusGet hashmaliciousUnknownBrowse
                                                              • 13.35.93.107
                                                              FA-43-02-2025.pdfGet hashmaliciousUnknownBrowse
                                                              • 13.225.63.72
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 34.249.145.219
                                                              https://bvs36.sharefile.com/public/share/web-s382e175427a44399b98bd891fdf5920fGet hashmaliciousHTMLPhisher, ReCaptcha PhishBrowse
                                                              • 76.223.1.166
                                                              No context
                                                              No context
                                                              No created / dropped files found
                                                              File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
                                                              Entropy (8bit):6.017565420862735
                                                              TrID:
                                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                              File name:most-arm5.elf
                                                              File size:38'248 bytes
                                                              MD5:f64bb639d4976d9619142099c36575eb
                                                              SHA1:a1bb9a65cb0290fb92683af20333c11e0b16c4bc
                                                              SHA256:457ac3463c32393c1ca5b86684c1aaa30f883746ca5e42cd5b41d5b0d85fb94e
                                                              SHA512:dee0b9f85fedb27716027fcb08be64d9d3c52a7dbf274b4c3816d5cbf34aa608cb7e78f339d9b36a556e05633d6d3d3984c3507e7f00835b47b6a5627511ac1f
                                                              SSDEEP:768:fOvZdQTF962Bn2sG5J9Kg4J0XSH2HE0sol1Hw3:fbF46nxG5JrCCE0E3
                                                              TLSH:2103E855B8839A2BC1D1137ABB6E9B4D376173D4D2CF7713EA2407903ACA51F0C62E85
                                                              File Content Preview:.ELF...a..........(.........4...p.......4. ...(.........4...4...4...................................................................................................................................................Q.td............................/lib/ld-uCl

                                                              ELF header

                                                              Class:ELF32
                                                              Data:2's complement, little endian
                                                              Version:1 (current)
                                                              Machine:ARM
                                                              Version Number:0x1
                                                              Type:EXEC (Executable file)
                                                              OS/ABI:ARM - ABI
                                                              ABI Version:0
                                                              Entry Point Address:0x91c8
                                                              Flags:0x2
                                                              ELF Header Size:52
                                                              Program Header Offset:52
                                                              Program Header Size:32
                                                              Number of Program Headers:6
                                                              Section Header Offset:37488
                                                              Section Header Size:40
                                                              Number of Section Headers:19
                                                              Header String Table Index:18
                                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                              NULL0x00x00x00x00x0000
                                                              .interpPROGBITS0x80f40xf40x140x00x2A001
                                                              .hashHASH0x81080x1080x2740x40x2A304
                                                              .dynsymDYNSYM0x837c0x37c0x5800x100x2A414
                                                              .dynstrSTRTAB0x88fc0x8fc0x2df0x00x2A001
                                                              .rel.dynREL0x8bdc0xbdc0x80x80x2A304
                                                              .rel.pltREL0x8be40xbe40x1f00x80x2A384
                                                              .initPROGBITS0x8dd40xdd40x180x00x6AX004
                                                              .pltPROGBITS0x8dec0xdec0x2fc0x40x6AX004
                                                              .textPROGBITS0x90e80x10e80x6f3c0x00x6AX004
                                                              .finiPROGBITS0x100240x80240x140x00x6AX004
                                                              .rodataPROGBITS0x100380x80380xebc0x00x2A004
                                                              .ctorsPROGBITS0x190000x90000x80x00x3WA004
                                                              .dtorsPROGBITS0x190080x90080x80x00x3WA004
                                                              .dynamicDYNAMIC0x190140x90140xb80x80x3WA404
                                                              .gotPROGBITS0x190cc0x90cc0x1040x40x3WA004
                                                              .dataPROGBITS0x191d00x91d00x240x00x3WA004
                                                              .bssNOBITS0x191f40x91f40xd00x00x3WA004
                                                              .shstrtabSTRTAB0x00x91f40x7c0x00x0001
                                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                              PHDR0x340x80340x80340xc00xc02.12660x5R E0x4
                                                              INTERP0xf40x80f40x80f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                                                              LOAD0x00x80000x80000x8ef40x8ef46.10610x5R E0x8000.interp .hash .dynsym .dynstr .rel.dyn .rel.plt .init .plt .text .fini .rodata
                                                              LOAD0x90000x190000x190000x1f40x2c42.28740x6RW 0x8000.ctors .dtors .dynamic .got .data .bss
                                                              DYNAMIC0x90140x190140x190140xb80xb81.98040x6RW 0x4.dynamic
                                                              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                                              TypeMetaValueTag
                                                              DT_NEEDEDsharedliblibpthread.so.00x1
                                                              DT_NEEDEDsharedliblibc.so.00x1
                                                              DT_INITvalue0x8dd40xc
                                                              DT_FINIvalue0x100240xd
                                                              DT_HASHvalue0x81080x4
                                                              DT_STRTABvalue0x88fc0x5
                                                              DT_SYMTABvalue0x837c0x6
                                                              DT_STRSZbytes7350xa
                                                              DT_SYMENTbytes160xb
                                                              DT_DEBUGvalue0x00x15
                                                              DT_PLTGOTvalue0x190cc0x3
                                                              DT_PLTRELSZbytes4960x2
                                                              DT_PLTRELpltrelDT_REL0x14
                                                              DT_JMPRELvalue0x8be40x17
                                                              DT_RELvalue0x8bdc0x11
                                                              DT_RELSZbytes80x12
                                                              DT_RELENTbytes80x13
                                                              DT_NULLvalue0x00x0
                                                              NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                                              .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                              _Jv_RegisterClasses.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                              __aeabi_idiv0.dynsym0xff944FUNC<unknown>DEFAULT9
                                                              __aeabi_ldiv0.dynsym0xff944FUNC<unknown>DEFAULT9
                                                              __aeabi_uidiv.dynsym0xfcd40FUNC<unknown>DEFAULT9
                                                              __aeabi_uidivmod.dynsym0xfdcc24FUNC<unknown>DEFAULT9
                                                              __bss_end__.dynsym0x192c40NOTYPE<unknown>DEFAULTSHN_ABS
                                                              __bss_start.dynsym0x191f40NOTYPE<unknown>DEFAULTSHN_ABS
                                                              __bss_start__.dynsym0x191f40NOTYPE<unknown>DEFAULTSHN_ABS
                                                              __ctype_b.dynsym0x191f44OBJECT<unknown>DEFAULT19
                                                              __data_start.dynsym0x191d00NOTYPE<unknown>DEFAULT18
                                                              __deregister_frame_info.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                              __div0.dynsym0xff944FUNC<unknown>DEFAULT9
                                                              __end__.dynsym0x192c40NOTYPE<unknown>DEFAULTSHN_ABS
                                                              __errno_location.dynsym0x903416FUNC<unknown>DEFAULTSHN_UNDEF
                                                              __modsi3.dynsym0xfeb0228FUNC<unknown>DEFAULT9
                                                              __muldi3.dynsym0xff9880FUNC<unknown>DEFAULT9
                                                              __register_frame_info.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                              __uClibc_main.dynsym0x8fb0488FUNC<unknown>DEFAULTSHN_UNDEF
                                                              __udivsi3.dynsym0xfcd4248FUNC<unknown>DEFAULT9
                                                              __umodsi3.dynsym0xfde4204FUNC<unknown>DEFAULT9
                                                              _bss_end__.dynsym0x192c40NOTYPE<unknown>DEFAULTSHN_ABS
                                                              _edata.dynsym0x191f40NOTYPE<unknown>DEFAULTSHN_ABS
                                                              _end.dynsym0x192c40NOTYPE<unknown>DEFAULTSHN_ABS
                                                              _exit.dynsym0x905840FUNC<unknown>DEFAULTSHN_UNDEF
                                                              _fini.dynsym0x100244FUNC<unknown>DEFAULT10
                                                              _init.dynsym0x8dd44FUNC<unknown>DEFAULT7
                                                              _start.dynsym0x91c880FUNC<unknown>DEFAULT9
                                                              abort.dynsym0x8ee4352FUNC<unknown>DEFAULTSHN_UNDEF
                                                              accept.dynsym0x8ef076FUNC<unknown>DEFAULTSHN_UNDEF
                                                              atoi.dynsym0x904c12FUNC<unknown>DEFAULTSHN_UNDEF
                                                              bind.dynsym0x8f2044FUNC<unknown>DEFAULTSHN_UNDEF
                                                              calloc.dynsym0x8efc88FUNC<unknown>DEFAULTSHN_UNDEF
                                                              clock.dynsym0x907c52FUNC<unknown>DEFAULTSHN_UNDEF
                                                              close.dynsym0x90c460FUNC<unknown>DEFAULTSHN_UNDEF
                                                              closedir.dynsym0x9094196FUNC<unknown>DEFAULTSHN_UNDEF
                                                              connect.dynsym0x8e1876FUNC<unknown>DEFAULTSHN_UNDEF
                                                              exit.dynsym0x9040172FUNC<unknown>DEFAULTSHN_UNDEF
                                                              fclose.dynsym0x8fd4448FUNC<unknown>DEFAULTSHN_UNDEF
                                                              fcntl.dynsym0x90a088FUNC<unknown>DEFAULTSHN_UNDEF
                                                              fgets.dynsym0x8e48164FUNC<unknown>DEFAULTSHN_UNDEF
                                                              fopen.dynsym0x8fbc12FUNC<unknown>DEFAULTSHN_UNDEF
                                                              fork.dynsym0x8fa4452FUNC<unknown>DEFAULTSHN_UNDEF
                                                              free.dynsym0x90d0288FUNC<unknown>DEFAULTSHN_UNDEF
                                                              getpid.dynsym0x8e3c44FUNC<unknown>DEFAULTSHN_UNDEF
                                                              getppid.dynsym0x8fe044FUNC<unknown>DEFAULTSHN_UNDEF
                                                              getsockname.dynsym0x90dc44FUNC<unknown>DEFAULTSHN_UNDEF
                                                              getsockopt.dynsym0x901c48FUNC<unknown>DEFAULTSHN_UNDEF
                                                              inet_addr.dynsym0x8f2c36FUNC<unknown>DEFAULTSHN_UNDEF
                                                              kill.dynsym0x8f1444FUNC<unknown>DEFAULTSHN_UNDEF
                                                              listen.dynsym0x8f9844FUNC<unknown>DEFAULTSHN_UNDEF
                                                              malloc.dynsym0x8e84400FUNC<unknown>DEFAULTSHN_UNDEF
                                                              memcpy.dynsym0x8e604FUNC<unknown>DEFAULTSHN_UNDEF
                                                              memmove.dynsym0x04FUNC<unknown>DEFAULTSHN_UNDEF
                                                              memset.dynsym0x8fc8156FUNC<unknown>DEFAULTSHN_UNDEF
                                                              open.dynsym0x907088FUNC<unknown>DEFAULTSHN_UNDEF
                                                              opendir.dynsym0x8ff8264FUNC<unknown>DEFAULTSHN_UNDEF
                                                              prctl.dynsym0x8e5448FUNC<unknown>DEFAULTSHN_UNDEF
                                                              printf.dynsym0x8e0076FUNC<unknown>DEFAULTSHN_UNDEF
                                                              pthread_create.dynsym0x8e24208FUNC<unknown>DEFAULTSHN_UNDEF
                                                              pthread_exit.dynsym0x8e308FUNC<unknown>DEFAULTSHN_UNDEF
                                                              pthread_join.dynsym0x90b8508FUNC<unknown>DEFAULTSHN_UNDEF
                                                              puts.dynsym0x8e78200FUNC<unknown>DEFAULTSHN_UNDEF
                                                              rand.dynsym0x8f504FUNC<unknown>DEFAULTSHN_UNDEF
                                                              read.dynsym0x8f5c76FUNC<unknown>DEFAULTSHN_UNDEF
                                                              readdir.dynsym0x8ecc224FUNC<unknown>DEFAULTSHN_UNDEF
                                                              readlink.dynsym0x8e6c44FUNC<unknown>DEFAULTSHN_UNDEF
                                                              realloc.dynsym0x8f80312FUNC<unknown>DEFAULTSHN_UNDEF
                                                              recv.dynsym0x8e0c84FUNC<unknown>DEFAULTSHN_UNDEF
                                                              recvfrom.dynsym0x8ea8100FUNC<unknown>DEFAULTSHN_UNDEF
                                                              remove.dynsym0x8e9072FUNC<unknown>DEFAULTSHN_UNDEF
                                                              sched_yield.dynsym0x90ac44FUNC<unknown>DEFAULTSHN_UNDEF
                                                              select.dynsym0x8ec048FUNC<unknown>DEFAULTSHN_UNDEF
                                                              send.dynsym0x8ed884FUNC<unknown>DEFAULTSHN_UNDEF
                                                              sendto.dynsym0x8f74100FUNC<unknown>DEFAULTSHN_UNDEF
                                                              setsid.dynsym0x908844FUNC<unknown>DEFAULTSHN_UNDEF
                                                              setsockopt.dynsym0x8f3848FUNC<unknown>DEFAULTSHN_UNDEF
                                                              sleep.dynsym0x8e9c420FUNC<unknown>DEFAULTSHN_UNDEF
                                                              socket.dynsym0x8eb444FUNC<unknown>DEFAULTSHN_UNDEF
                                                              sprintf.dynsym0x901052FUNC<unknown>DEFAULTSHN_UNDEF
                                                              stat.dynsym0x902880FUNC<unknown>DEFAULTSHN_UNDEF
                                                              strcmp.dynsym0x900428FUNC<unknown>DEFAULTSHN_UNDEF
                                                              strlen.dynsym0x906496FUNC<unknown>DEFAULTSHN_UNDEF
                                                              strstr.dynsym0x8f44248FUNC<unknown>DEFAULTSHN_UNDEF
                                                              strtok.dynsym0x8f8c36FUNC<unknown>DEFAULTSHN_UNDEF
                                                              time.dynsym0x8fec44FUNC<unknown>DEFAULTSHN_UNDEF
                                                              unlink.dynsym0x8f6844FUNC<unknown>DEFAULTSHN_UNDEF
                                                              write.dynsym0x8f0876FUNC<unknown>DEFAULTSHN_UNDEF

                                                              Download Network PCAP: filteredfull

                                                              • Total Packets: 11
                                                              • 443 (HTTPS)
                                                              • 80 (HTTP)
                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Apr 1, 2025 15:47:58.576495886 CEST43928443192.168.2.2391.189.91.42
                                                              Apr 1, 2025 15:48:04.207731962 CEST42836443192.168.2.2391.189.91.43
                                                              Apr 1, 2025 15:48:05.487653017 CEST4251680192.168.2.23109.202.202.202
                                                              Apr 1, 2025 15:48:18.797696114 CEST43928443192.168.2.2391.189.91.42
                                                              Apr 1, 2025 15:48:19.962529898 CEST39250443192.168.2.2334.249.145.219
                                                              Apr 1, 2025 15:48:19.962580919 CEST4433925034.249.145.219192.168.2.23
                                                              Apr 1, 2025 15:48:19.962639093 CEST39250443192.168.2.2334.249.145.219
                                                              Apr 1, 2025 15:48:19.962965012 CEST39250443192.168.2.2334.249.145.219
                                                              Apr 1, 2025 15:48:19.962975979 CEST4433925034.249.145.219192.168.2.23
                                                              Apr 1, 2025 15:48:31.084008932 CEST42836443192.168.2.2391.189.91.43
                                                              Apr 1, 2025 15:48:35.179439068 CEST4251680192.168.2.23109.202.202.202
                                                              Apr 1, 2025 15:48:59.752279043 CEST43928443192.168.2.2391.189.91.42
                                                              Apr 1, 2025 15:49:19.954735994 CEST39250443192.168.2.2334.249.145.219
                                                              Apr 1, 2025 15:49:19.996268988 CEST4433925034.249.145.219192.168.2.23

                                                              System Behavior

                                                              Start time (UTC):13:47:58
                                                              Start date (UTC):01/04/2025
                                                              Path:/tmp/most-arm5.elf
                                                              Arguments:/tmp/most-arm5.elf
                                                              File size:4956856 bytes
                                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                              Start time (UTC):13:49:19
                                                              Start date (UTC):01/04/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):13:49:19
                                                              Start date (UTC):01/04/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.W59ZJ0nwFs /tmp/tmp.jSioS4r1x7 /tmp/tmp.R4qkCERNrr
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                              Start time (UTC):13:49:19
                                                              Start date (UTC):01/04/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):13:49:19
                                                              Start date (UTC):01/04/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.W59ZJ0nwFs /tmp/tmp.jSioS4r1x7 /tmp/tmp.R4qkCERNrr
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b