Edit tour

Linux Analysis Report
arm.elf

Overview

General Information

Sample name:arm.elf
Analysis ID:1654181
MD5:f56d6a876b9bfafd2a8f38341445d895
SHA1:ad6fd8c2bb1ac5d5bbbb8fbb3629c0cc8d121d67
SHA256:3d630b1a40a96b505a9ab440d07319bf9f71b5ea81aa43915e2455d0824cc72b
Tags:elfuser-abuse_ch
Infos:

Detection

Score:52
Range:0 - 100

Signatures

Connects to many ports of the same IP (likely port scanning)
Performs DNS TXT record lookups
Uses STUN server to do NAT traversial
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1654181
Start date and time:2025-04-02 03:04:21 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 51s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm.elf
Detection:MAL
Classification:mal52.troj.evad.linELF@0/2@8/0
  • VT rate limit hit for: kamru.ru
Command:/tmp/arm.elf
PID:5510
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
For God so loved the world
Standard Error:
  • system is lnxubuntu20
  • arm.elf (PID: 5510, Parent: 5434, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm.elf
    • arm.elf New Fork (PID: 5518, Parent: 5510)
  • dash New Fork (PID: 5568, Parent: 3633)
  • rm (PID: 5568, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.KeSvVAywbE /tmp/tmp.p7k30mcTOH /tmp/tmp.WK44Lxrseq
  • dash New Fork (PID: 5569, Parent: 3633)
  • cat (PID: 5569, Parent: 3633, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.KeSvVAywbE
  • dash New Fork (PID: 5570, Parent: 3633)
  • head (PID: 5570, Parent: 3633, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5571, Parent: 3633)
  • tr (PID: 5571, Parent: 3633, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5572, Parent: 3633)
  • cut (PID: 5572, Parent: 3633, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5573, Parent: 3633)
  • cat (PID: 5573, Parent: 3633, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.KeSvVAywbE
  • dash New Fork (PID: 5574, Parent: 3633)
  • head (PID: 5574, Parent: 3633, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5575, Parent: 3633)
  • tr (PID: 5575, Parent: 3633, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5576, Parent: 3633)
  • cut (PID: 5576, Parent: 3633, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5577, Parent: 3633)
  • rm (PID: 5577, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.KeSvVAywbE /tmp/tmp.p7k30mcTOH /tmp/tmp.WK44Lxrseq
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

Networking

barindex
Source: global trafficTCP traffic: 154.205.155.97 ports 41763,1,3,4,6,7
Source: unknownDNS query: name: stun.l.google.com
Source: global trafficTCP traffic: 192.168.2.14:48906 -> 156.244.44.239:46164
Source: global trafficTCP traffic: 192.168.2.14:45536 -> 104.245.241.61:7679
Source: global trafficTCP traffic: 192.168.2.14:39672 -> 154.205.155.97:41763
Source: global trafficUDP traffic: 192.168.2.14:53589 -> 74.125.250.129:19302
Source: /tmp/arm.elf (PID: 5518)Socket: 127.0.0.1:22448Jump to behavior
Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 156.244.44.239
Source: unknownTCP traffic detected without corresponding DNS query: 104.245.241.61
Source: unknownTCP traffic detected without corresponding DNS query: 104.245.241.61
Source: unknownTCP traffic detected without corresponding DNS query: 104.245.241.61
Source: unknownTCP traffic detected without corresponding DNS query: 104.245.241.61
Source: unknownTCP traffic detected without corresponding DNS query: 104.245.241.61
Source: unknownTCP traffic detected without corresponding DNS query: 104.245.241.61
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownTCP traffic detected without corresponding DNS query: 154.205.155.97
Source: unknownUDP traffic detected without corresponding DNS query: 208.67.220.220
Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/noneAccept: */*Accept-Encoding: identityHost: motd.ubuntu.comConnection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: kamru.ru
Source: global trafficDNS traffic detected: DNS query: stun.l.google.com
Source: arm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpString found in binary or memory: http://17365637265742070617373776F7264206D656D6F721/t/wget.sh
Source: arm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpString found in binary or memory: https://motd.ubuntu.com
Source: arm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpString found in binary or memory: https://motd.ubuntu.comhe
Source: unknownNetwork traffic detected: HTTP traffic on port 43408 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 59330 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 43408
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.troj.evad.linELF@0/2@8/0
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/1583/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/2672/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/110/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/111/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/112/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/113/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/234/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/1577/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/114/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/235/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/115/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/116/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/117/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/118/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/119/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/3633/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/10/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/3758/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/11/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/12/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/13/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/14/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/15/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/16/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/17/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/18/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/19/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/1593/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/240/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/120/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/3094/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/121/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/242/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/3406/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/122/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/243/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/2/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/123/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/244/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/1589/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/3/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/124/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/245/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/125/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/4/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/246/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/3402/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/126/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/5/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/247/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/127/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/6/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/248/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/128/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/7/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/249/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/8/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/129/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/9/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/803/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/20/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/806/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/21/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/807/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/928/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/22/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/23/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/24/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/25/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/26/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/27/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/28/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/29/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/3420/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/250/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/130/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/251/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/131/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/252/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/132/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/253/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/254/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/255/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/135/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/256/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/1599/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/257/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/378/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/258/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/3412/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/259/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/30/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/35/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/1371/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/260/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/261/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/262/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/142/cmdlineJump to behavior
Source: /tmp/arm.elf (PID: 5510)File opened: /proc/263/cmdlineJump to behavior
Source: /usr/bin/dash (PID: 5568)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.KeSvVAywbE /tmp/tmp.p7k30mcTOH /tmp/tmp.WK44LxrseqJump to behavior
Source: /usr/bin/dash (PID: 5577)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.KeSvVAywbE /tmp/tmp.p7k30mcTOH /tmp/tmp.WK44LxrseqJump to behavior
Source: /tmp/arm.elf (PID: 5510)Queries kernel information via 'uname': Jump to behavior
Source: arm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpBinary or memory string: vmwarem
Source: arm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpBinary or memory string: vmware
Source: arm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpBinary or memory string: qemu-arm
Source: arm.elf, 5510.1.0000556353aa6000.0000556353c16000.rw-.sdmpBinary or memory string: ScU!/etc/qemu-binfmt/arm
Source: arm.elf, 5510.1.00007ffcd481d000.00007ffcd483e000.rw-.sdmpBinary or memory string: /tmp/qemu-open.H5MclO
Source: arm.elf, 5510.1.00007ffcd481d000.00007ffcd483e000.rw-.sdmpBinary or memory string: OcU/tmp/qemu-open.H5MclO:
Source: arm.elf, 5510.1.00007ffcd481d000.00007ffcd483e000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.elf
Source: arm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpBinary or memory string: qemu-arm)Zm6vnZ5U4mf8vApyWcDwXR44ZAkzslsN)
Source: arm.elf, 5510.1.0000556353aa6000.0000556353c16000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: arm.elf, 5510.1.00007ffcd481d000.00007ffcd483e000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

HIPS / PFW / Operating System Protection Evasion

barindex
Source: TrafficDNS traffic detected: queries for: kamru.ru
Source: TrafficDNS traffic detected: queries for: kamru.ru
Source: TrafficDNS traffic detected: queries for: kamru.ru
Source: TrafficDNS traffic detected: queries for: kamru.ru
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
File Deletion
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Application Layer Protocol
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsInternet Connection DiscoverySSHKeylogging1
Ingress Tool Transfer
Scheduled TransferData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654181 Sample: arm.elf Startdate: 02/04/2025 Architecture: LINUX Score: 52 17 kamru.ru 2->17 19 stun.l.google.com 2->19 21 6 other IPs or domains 2->21 23 Connects to many ports of the same IP (likely port scanning) 2->23 7 arm.elf 2->7         started        9 dash rm 2->9         started        11 dash cut 2->11         started        13 8 other processes 2->13 signatures3 25 Performs DNS TXT record lookups 17->25 27 Uses STUN server to do NAT traversial 19->27 process4 process5 15 arm.elf 7->15         started       
SourceDetectionScannerLabelLink
arm.elf11%ReversingLabsLinux.Trojan.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
stun.l.google.com
74.125.250.129
truefalse
    high
    kamru.ru
    unknown
    unknowntrue
      unknown
      NameMaliciousAntivirus DetectionReputation
      https://motd.ubuntu.com/false
        high
        NameSourceMaliciousAntivirus DetectionReputation
        https://motd.ubuntu.comarm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpfalse
          high
          https://motd.ubuntu.comhearm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpfalse
            high
            http://17365637265742070617373776F7264206D656D6F721/t/wget.sharm.elf, 5510.1.00007fe6e8032000.00007fe6e803b000.rw-.sdmpfalse
              high
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              34.254.182.186
              unknownUnited States
              16509AMAZON-02USfalse
              104.245.241.61
              unknownUnited States
              8100ASN-QUADRANET-GLOBALUSfalse
              154.205.155.97
              unknownSeychelles
              26484IKGUL-26484UStrue
              74.125.250.129
              stun.l.google.comUnited States
              15169GOOGLEUSfalse
              54.247.62.1
              unknownUnited States
              16509AMAZON-02USfalse
              156.244.44.239
              unknownSeychelles
              132839POWERLINE-AS-APPOWERLINEDATACENTERHKfalse
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              34.254.182.186efea6.elfGet hashmaliciousUnknownBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    ub8ehJSePAfc9FYqZIT6.arm.elfGet hashmaliciousMiraiBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        na.elfGet hashmaliciousPrometeiBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            mips.elfGet hashmaliciousUnknownBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                bin.powerpc-440fp.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  104.245.241.61arm5.elfGet hashmaliciousUnknownBrowse
                                    mips.elfGet hashmaliciousUnknownBrowse
                                      ppc.elfGet hashmaliciousUnknownBrowse
                                        kmips.elfGet hashmaliciousUnknownBrowse
                                          arm7.elfGet hashmaliciousUnknownBrowse
                                            mips.elfGet hashmaliciousUnknownBrowse
                                              154.205.155.97arm5.elfGet hashmaliciousUnknownBrowse
                                                ppc.elfGet hashmaliciousUnknownBrowse
                                                  sh4.elfGet hashmaliciousUnknownBrowse
                                                    kmips.elfGet hashmaliciousUnknownBrowse
                                                      mips.elfGet hashmaliciousUnknownBrowse
                                                        arm7.elfGet hashmaliciousUnknownBrowse
                                                          arm6.elfGet hashmaliciousUnknownBrowse
                                                            nimips.elfGet hashmaliciousUnknownBrowse
                                                              mips.elfGet hashmaliciousUnknownBrowse
                                                                arm.elfGet hashmaliciousUnknownBrowse
                                                                  54.247.62.1na.elfGet hashmaliciousPrometeiBrowse
                                                                    parm6.elfGet hashmaliciousMiraiBrowse
                                                                      rjfe686.elfGet hashmaliciousUnknownBrowse
                                                                        na.elfGet hashmaliciousPrometeiBrowse
                                                                          sh4.elfGet hashmaliciousMiraiBrowse
                                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                                                boatnet.x86_64.elfGet hashmaliciousMiraiBrowse
                                                                                  arm5.elfGet hashmaliciousUnknownBrowse
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                      No context
                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                      AMAZON-02UShttps://snu2i.mjt.lu/lnk/AVUAAGf9XKgAAAAAAAAAA9xrFsMAAYKJjLUAAAAAAC68kgBn7Bfqac3lXyTWRGaDtKriXw3emQAq56U/1/cdW9bHmcUWqJ_AB7I3vlvw/aHR0cHM6Ly9jb25zdC5mb3Jtc3RhY2suY29tL2Zvcm1zL2l0ZgGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                      • 54.231.166.192
                                                                                      arm5.elfGet hashmaliciousUnknownBrowse
                                                                                      • 34.249.145.219
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 34.249.145.219
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 54.171.230.55
                                                                                      https://notifications.copilot.app/i/dNpLl6hHRGet hashmaliciousUnknownBrowse
                                                                                      • 44.234.198.184
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 34.249.145.219
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 34.249.145.219
                                                                                      http://free-calendar.suGet hashmaliciousUnknownBrowse
                                                                                      • 18.246.119.221
                                                                                      https://www.pdfskillsapp.comGet hashmaliciousUnknownBrowse
                                                                                      • 18.238.55.96
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 13.213.51.196
                                                                                      AMAZON-02UShttps://snu2i.mjt.lu/lnk/AVUAAGf9XKgAAAAAAAAAA9xrFsMAAYKJjLUAAAAAAC68kgBn7Bfqac3lXyTWRGaDtKriXw3emQAq56U/1/cdW9bHmcUWqJ_AB7I3vlvw/aHR0cHM6Ly9jb25zdC5mb3Jtc3RhY2suY29tL2Zvcm1zL2l0ZgGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                      • 54.231.166.192
                                                                                      arm5.elfGet hashmaliciousUnknownBrowse
                                                                                      • 34.249.145.219
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 34.249.145.219
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 54.171.230.55
                                                                                      https://notifications.copilot.app/i/dNpLl6hHRGet hashmaliciousUnknownBrowse
                                                                                      • 44.234.198.184
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 34.249.145.219
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 34.249.145.219
                                                                                      http://free-calendar.suGet hashmaliciousUnknownBrowse
                                                                                      • 18.246.119.221
                                                                                      https://www.pdfskillsapp.comGet hashmaliciousUnknownBrowse
                                                                                      • 18.238.55.96
                                                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                                                      • 13.213.51.196
                                                                                      IKGUL-26484USarm5.elfGet hashmaliciousUnknownBrowse
                                                                                      • 154.205.155.243
                                                                                      .i.elfGet hashmaliciousMiraiBrowse
                                                                                      • 154.205.157.45
                                                                                      m68k.elfGet hashmaliciousUnknownBrowse
                                                                                      • 154.219.20.172
                                                                                      weje64.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                      • 156.233.39.216
                                                                                      arm5.elfGet hashmaliciousUnknownBrowse
                                                                                      • 154.205.155.97
                                                                                      mips.elfGet hashmaliciousUnknownBrowse
                                                                                      • 154.205.155.243
                                                                                      ppc.elfGet hashmaliciousUnknownBrowse
                                                                                      • 154.205.155.97
                                                                                      boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                      • 156.238.135.139
                                                                                      boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                                                      • 156.251.85.203
                                                                                      boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                                                                      • 156.251.85.209
                                                                                      ASN-QUADRANET-GLOBALUSarm5.elfGet hashmaliciousUnknownBrowse
                                                                                      • 104.245.241.61
                                                                                      Revised - Periskop ag 2025 Handbook17834.docGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                      • 104.245.240.188
                                                                                      CELL_REC0_RPLY_MV.xhtmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 185.174.100.76
                                                                                      http://adp.kikibasket.shop/graFe5BM2Fe5dy9s3Rallanx0qs3Rybgdy9s3RWO3BM2Get hashmaliciousUnknownBrowse
                                                                                      • 45.66.218.107
                                                                                      #Ud83d#Udd0aAudio_Msg56 tsitouch.com.......xhtmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 185.174.100.76
                                                                                      #Ud83d#Udd0aAudio_Msg56 camsmgt.com.......xhtmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 185.174.100.76
                                                                                      https://www.google.com/url?q=https%3A%2F%2Fdryneedleinstitute.org%2F874jsu9&sa=D&sntz=1&usg=AOvVaw3kE5QygjqqKl28m257UzveGet hashmaliciousUnknownBrowse
                                                                                      • 104.245.240.188
                                                                                      https://www.google.com/url?q=https%3A%2F%2Flisachubb.com%2Fjsuhsks%2F&sa=D&sntz=1&usg=AOvVaw0F2q7kVD-KIPGQS9mKbD8h#?AynbDClvCqs9djvzki8kdrm19expwx==j8If1EgPfB7jihNIp005uIzL8bVQdPW2iYEqZ~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~LnJusWbClYIbJ4IuevwUc1s1rzg==CHHbFZTEMTyV0CrlRZJA4WrAlGrGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                      • 104.245.240.188
                                                                                      #Ud83d#Udd0aAudio_Msg Pharma.xhtmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 185.174.100.76
                                                                                      #Ud83d#Udd0aAudio_Msg Pharma.xhtmlGet hashmaliciousHTMLPhisherBrowse
                                                                                      • 185.174.100.76
                                                                                      No context
                                                                                      No context
                                                                                      Process:/tmp/arm.elf
                                                                                      File Type:ASCII text, with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):13
                                                                                      Entropy (8bit):3.3927474104487847
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:Tg7G:Tgy
                                                                                      MD5:060C950602AE5DFAF583473721C0D328
                                                                                      SHA1:91D13B439729088DC17F1E0519970D82C56F2B07
                                                                                      SHA-256:F8D4586FDF6230A2D5F431EF44BABDF37F6D7CEDBB3560702B0DC8493DD44EE3
                                                                                      SHA-512:000D50E0A5736B0AB3B1BF61F55911914808FA197365B10F61F24096E2959ADAC2C3FF0D9ED226AD99934093F9FDD1C7035A22EEB5091DF75402A0A26E7A84AC
                                                                                      Malicious:false
                                                                                      Reputation:moderate, very likely benign file
                                                                                      Preview:/tmp/arm.elf.
                                                                                      Process:/tmp/arm.elf
                                                                                      File Type:ASCII text, with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):13
                                                                                      Entropy (8bit):3.3927474104487847
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:Tg7G:Tgy
                                                                                      MD5:060C950602AE5DFAF583473721C0D328
                                                                                      SHA1:91D13B439729088DC17F1E0519970D82C56F2B07
                                                                                      SHA-256:F8D4586FDF6230A2D5F431EF44BABDF37F6D7CEDBB3560702B0DC8493DD44EE3
                                                                                      SHA-512:000D50E0A5736B0AB3B1BF61F55911914808FA197365B10F61F24096E2959ADAC2C3FF0D9ED226AD99934093F9FDD1C7035A22EEB5091DF75402A0A26E7A84AC
                                                                                      Malicious:false
                                                                                      Reputation:moderate, very likely benign file
                                                                                      Preview:/tmp/arm.elf.
                                                                                      File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                                                                                      Entropy (8bit):6.103208997259613
                                                                                      TrID:
                                                                                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                                      File name:arm.elf
                                                                                      File size:75'796 bytes
                                                                                      MD5:f56d6a876b9bfafd2a8f38341445d895
                                                                                      SHA1:ad6fd8c2bb1ac5d5bbbb8fbb3629c0cc8d121d67
                                                                                      SHA256:3d630b1a40a96b505a9ab440d07319bf9f71b5ea81aa43915e2455d0824cc72b
                                                                                      SHA512:c2cac4e52316bac8cb9f2ae03abb1b2500d99ef24cc152849e739fd4ca927f29a38ac981e935e00d82e6f7925838b9d006d74b783d4371a7ccad96b3071992ff
                                                                                      SSDEEP:1536:QaeAeIbGBrmZPsqdn8tpv3p8dJczfKreCyDHvZ2jZerVWFGw2B8H5lVvti:Qave6GBrmZPsqdn833ffKrePDHvcF2Uy
                                                                                      TLSH:51730845BD429B16C6D1067BFB1F828D3326239CE2EE7613DA259F21378F56A0E7B041
                                                                                      File Content Preview:.ELF...a..........(.........4....&......4. ...(.....................P#..P#..............T#..T#..T#.......g..........Q.td..................................-...L."....B..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                                                                                      ELF header

                                                                                      Class:ELF32
                                                                                      Data:2's complement, little endian
                                                                                      Version:1 (current)
                                                                                      Machine:ARM
                                                                                      Version Number:0x1
                                                                                      Type:EXEC (Executable file)
                                                                                      OS/ABI:ARM - ABI
                                                                                      ABI Version:0
                                                                                      Entry Point Address:0x8190
                                                                                      Flags:0x202
                                                                                      ELF Header Size:52
                                                                                      Program Header Offset:52
                                                                                      Program Header Size:32
                                                                                      Number of Program Headers:3
                                                                                      Section Header Offset:75396
                                                                                      Section Header Size:40
                                                                                      Number of Section Headers:10
                                                                                      Header String Table Index:9
                                                                                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                                      NULL0x00x00x00x00x0000
                                                                                      .initPROGBITS0x80940x940x180x00x6AX004
                                                                                      .textPROGBITS0x80b00xb00x10b600x00x6AX0016
                                                                                      .finiPROGBITS0x18c100x10c100x140x00x6AX004
                                                                                      .rodataPROGBITS0x18c240x10c240x172c0x00x2A004
                                                                                      .ctorsPROGBITS0x223540x123540x80x00x3WA004
                                                                                      .dtorsPROGBITS0x2235c0x1235c0x80x00x3WA004
                                                                                      .dataPROGBITS0x223680x123680x2dc0x00x3WA004
                                                                                      .bssNOBITS0x226440x126440x64a00x00x3WA004
                                                                                      .shstrtabSTRTAB0x00x126440x3e0x00x0001
                                                                                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                                      LOAD0x00x80000x80000x123500x123506.12390x5R E0x8000.init .text .fini .rodata
                                                                                      LOAD0x123540x223540x223540x2f00x67903.74340x6RW 0x8000.ctors .dtors .data .bss
                                                                                      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                                                      Download Network PCAP: filteredfull

                                                                                      • Total Packets: 61
                                                                                      • 56190 undefined
                                                                                      • 46164 undefined
                                                                                      • 41763 undefined
                                                                                      • 19302 undefined
                                                                                      • 7679 undefined
                                                                                      • 443 (HTTPS)
                                                                                      • 53 (DNS)
                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                      Apr 2, 2025 03:05:11.350842953 CEST59330443192.168.2.1434.254.182.186
                                                                                      Apr 2, 2025 03:05:15.128103971 CEST4890646164192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:15.284056902 CEST4616448906156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:15.284415960 CEST4890646164192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:15.440352917 CEST4616448906156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:15.440540075 CEST4890646164192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:15.595556974 CEST4616448906156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:15.595726013 CEST4890646164192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:16.488457918 CEST4890646164192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:16.643482924 CEST4616448906156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:16.643513918 CEST4616448906156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:16.644002914 CEST4890646164192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:16.800509930 CEST4616448906156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:17.746192932 CEST5605256190192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:17.901118994 CEST5619056052156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:17.901213884 CEST5605256190192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:18.059030056 CEST5619056052156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:18.059192896 CEST5605256190192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:18.217941046 CEST5619056052156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:18.218066931 CEST5605256190192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:19.099934101 CEST5605256190192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:19.256319046 CEST5619056052156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:19.256330013 CEST5619056052156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:19.260443926 CEST5605256190192.168.2.14156.244.44.239
                                                                                      Apr 2, 2025 03:05:19.415329933 CEST5619056052156.244.44.239192.168.2.14
                                                                                      Apr 2, 2025 03:05:20.358320951 CEST455367679192.168.2.14104.245.241.61
                                                                                      Apr 2, 2025 03:05:20.746876001 CEST767945536104.245.241.61192.168.2.14
                                                                                      Apr 2, 2025 03:05:20.747670889 CEST455367679192.168.2.14104.245.241.61
                                                                                      Apr 2, 2025 03:05:21.139000893 CEST767945536104.245.241.61192.168.2.14
                                                                                      Apr 2, 2025 03:05:21.139185905 CEST455367679192.168.2.14104.245.241.61
                                                                                      Apr 2, 2025 03:05:21.527673960 CEST767945536104.245.241.61192.168.2.14
                                                                                      Apr 2, 2025 03:05:21.527812004 CEST455367679192.168.2.14104.245.241.61
                                                                                      Apr 2, 2025 03:05:21.947647095 CEST455367679192.168.2.14104.245.241.61
                                                                                      Apr 2, 2025 03:05:22.339909077 CEST767945536104.245.241.61192.168.2.14
                                                                                      Apr 2, 2025 03:05:22.340159893 CEST767945536104.245.241.61192.168.2.14
                                                                                      Apr 2, 2025 03:05:22.340630054 CEST455367679192.168.2.14104.245.241.61
                                                                                      Apr 2, 2025 03:05:22.731199980 CEST767945536104.245.241.61192.168.2.14
                                                                                      Apr 2, 2025 03:05:23.445600033 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:23.602647066 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:05:23.602829933 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:23.759509087 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:05:23.759635925 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:23.917474031 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:05:23.917604923 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:24.809668064 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:24.965492010 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:05:39.823708057 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:39.903577089 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:39.903630972 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:39.903704882 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:39.904968977 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:39.904988050 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:39.979255915 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:05:39.979376078 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:40.143250942 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.434799910 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.434909105 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.435096979 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.435106993 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.436475039 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.436537027 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.437119961 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.437180996 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.437222958 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.437228918 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.437273026 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.607435942 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.607587099 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.607601881 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.607650042 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.607716084 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.607848883 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:40.607870102 CEST4434340854.247.62.1192.168.2.14
                                                                                      Apr 2, 2025 03:05:40.607918024 CEST43408443192.168.2.1454.247.62.1
                                                                                      Apr 2, 2025 03:05:59.313822031 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:59.489451885 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:05:59.489581108 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:05:59.645828962 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:06:13.127201080 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:06:13.128285885 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:06:28.142592907 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:06:28.300200939 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:06:28.300535917 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:06:28.462246895 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:06:45.678071976 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:06:45.834297895 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:06:45.834383011 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:06:45.991353035 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:07:03.016516924 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:07:03.171837091 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:07:03.171952009 CEST3967241763192.168.2.14154.205.155.97
                                                                                      Apr 2, 2025 03:07:03.327208996 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:07:19.902039051 CEST4176339672154.205.155.97192.168.2.14
                                                                                      Apr 2, 2025 03:07:19.902319908 CEST3967241763192.168.2.14154.205.155.97
                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                      Apr 2, 2025 03:05:15.020481110 CEST4647353192.168.2.14208.67.220.220
                                                                                      Apr 2, 2025 03:05:15.115526915 CEST5346473208.67.220.220192.168.2.14
                                                                                      Apr 2, 2025 03:05:16.286307096 CEST3481853192.168.2.14208.67.222.222
                                                                                      Apr 2, 2025 03:05:16.390053988 CEST5334818208.67.222.222192.168.2.14
                                                                                      Apr 2, 2025 03:05:16.390562057 CEST5358919302192.168.2.1474.125.250.129
                                                                                      Apr 2, 2025 03:05:16.487072945 CEST193025358974.125.250.129192.168.2.14
                                                                                      Apr 2, 2025 03:05:17.645836115 CEST5490153192.168.2.148.8.8.8
                                                                                      Apr 2, 2025 03:05:17.745352030 CEST53549018.8.8.8192.168.2.14
                                                                                      Apr 2, 2025 03:05:18.902517080 CEST5734453192.168.2.148.8.8.8
                                                                                      Apr 2, 2025 03:05:19.000029087 CEST53573448.8.8.8192.168.2.14
                                                                                      Apr 2, 2025 03:05:19.000224113 CEST5860619302192.168.2.1474.125.250.129
                                                                                      Apr 2, 2025 03:05:19.096352100 CEST193025860674.125.250.129192.168.2.14
                                                                                      Apr 2, 2025 03:05:20.262041092 CEST3755353192.168.2.148.8.8.8
                                                                                      Apr 2, 2025 03:05:20.357343912 CEST53375538.8.8.8192.168.2.14
                                                                                      Apr 2, 2025 03:05:21.749047041 CEST5834353192.168.2.14208.67.222.222
                                                                                      Apr 2, 2025 03:05:21.851353884 CEST5358343208.67.222.222192.168.2.14
                                                                                      Apr 2, 2025 03:05:21.851560116 CEST4402519302192.168.2.1474.125.250.129
                                                                                      Apr 2, 2025 03:05:21.947232008 CEST193024402574.125.250.129192.168.2.14
                                                                                      Apr 2, 2025 03:05:23.341907024 CEST5848753192.168.2.148.8.8.8
                                                                                      Apr 2, 2025 03:05:23.444284916 CEST53584878.8.8.8192.168.2.14
                                                                                      Apr 2, 2025 03:05:24.604413986 CEST4707353192.168.2.14208.67.220.220
                                                                                      Apr 2, 2025 03:05:24.712358952 CEST5347073208.67.220.220192.168.2.14
                                                                                      Apr 2, 2025 03:05:24.712552071 CEST3913119302192.168.2.1474.125.250.129
                                                                                      Apr 2, 2025 03:05:24.809338093 CEST193023913174.125.250.129192.168.2.14
                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                      Apr 2, 2025 03:05:15.020481110 CEST192.168.2.14208.67.220.2200xe3b5Standard query (0)kamru.ru16IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:16.286307096 CEST192.168.2.14208.67.222.2220xd684Standard query (0)stun.l.google.comA (IP address)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:17.645836115 CEST192.168.2.148.8.8.80xcfc6Standard query (0)kamru.ru16IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:18.902517080 CEST192.168.2.148.8.8.80x2972Standard query (0)stun.l.google.comA (IP address)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:20.262041092 CEST192.168.2.148.8.8.80x79c9Standard query (0)kamru.ru16IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:21.749047041 CEST192.168.2.14208.67.222.2220xe163Standard query (0)stun.l.google.comA (IP address)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:23.341907024 CEST192.168.2.148.8.8.80x3e83Standard query (0)kamru.ru16IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:24.604413986 CEST192.168.2.14208.67.220.2200x30aaStandard query (0)stun.l.google.comA (IP address)IN (0x0001)false
                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                      Apr 2, 2025 03:05:15.115526915 CEST208.67.220.220192.168.2.140xe3b5No error (0)kamru.ruTXT (Text strings)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:16.390053988 CEST208.67.222.222192.168.2.140xd684No error (0)stun.l.google.com74.125.250.129A (IP address)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:17.745352030 CEST8.8.8.8192.168.2.140xcfc6No error (0)kamru.ruTXT (Text strings)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:19.000029087 CEST8.8.8.8192.168.2.140x2972No error (0)stun.l.google.com74.125.250.129A (IP address)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:20.357343912 CEST8.8.8.8192.168.2.140x79c9No error (0)kamru.ruTXT (Text strings)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:21.851353884 CEST208.67.222.222192.168.2.140xe163No error (0)stun.l.google.com74.125.250.129A (IP address)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:23.444284916 CEST8.8.8.8192.168.2.140x3e83No error (0)kamru.ruTXT (Text strings)IN (0x0001)false
                                                                                      Apr 2, 2025 03:05:24.712358952 CEST208.67.220.220192.168.2.140x30aaNo error (0)stun.l.google.com74.125.250.129A (IP address)IN (0x0001)false
                                                                                      • motd.ubuntu.com
                                                                                      Session IDSource IPSource PortDestination IPDestination Port
                                                                                      0192.168.2.144340854.247.62.1443
                                                                                      TimestampBytes transferredDirectionData
                                                                                      2025-04-02 01:05:40 UTC249OUTGET / HTTP/1.1
                                                                                      User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none
                                                                                      Accept: */*
                                                                                      Accept-Encoding: identity
                                                                                      Host: motd.ubuntu.com
                                                                                      Connection: Keep-Alive
                                                                                      2025-04-02 01:05:40 UTC271INHTTP/1.1 200 OK
                                                                                      Date: Wed, 02 Apr 2025 01:05:40 GMT
                                                                                      Server: Apache/2.4.18 (Ubuntu)
                                                                                      Last-Modified: Tue, 01 Apr 2025 23:01:00 GMT
                                                                                      ETag: "d8-631bf82a3c95e"
                                                                                      Accept-Ranges: bytes
                                                                                      Content-Length: 216
                                                                                      Vary: Accept-Encoding
                                                                                      Connection: close
                                                                                      Content-Type: text/plain
                                                                                      2025-04-02 01:05:40 UTC216INData Raw: 20 2a 20 53 74 72 69 63 74 6c 79 20 63 6f 6e 66 69 6e 65 64 20 4b 75 62 65 72 6e 65 74 65 73 20 6d 61 6b 65 73 20 65 64 67 65 20 61 6e 64 20 49 6f 54 20 73 65 63 75 72 65 2e 20 4c 65 61 72 6e 20 68 6f 77 20 4d 69 63 72 6f 4b 38 73 0a 20 20 20 6a 75 73 74 20 72 61 69 73 65 64 20 74 68 65 20 62 61 72 20 66 6f 72 20 65 61 73 79 2c 20 72 65 73 69 6c 69 65 6e 74 20 61 6e 64 20 73 65 63 75 72 65 20 4b 38 73 20 63 6c 75 73 74 65 72 20 64 65 70 6c 6f 79 6d 65 6e 74 2e 0a 0a 20 20 20 68 74 74 70 73 3a 2f 2f 75 62 75 6e 74 75 2e 63 6f 6d 2f 65 6e 67 61 67 65 2f 73 65 63 75 72 65 2d 6b 75 62 65 72 6e 65 74 65 73 2d 61 74 2d 74 68 65 2d 65 64 67 65 0a
                                                                                      Data Ascii: * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge


                                                                                      System Behavior

                                                                                      Start time (UTC):01:05:14
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/tmp/arm.elf
                                                                                      Arguments:-
                                                                                      File size:4956856 bytes
                                                                                      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/rm
                                                                                      Arguments:rm -f /tmp/tmp.KeSvVAywbE /tmp/tmp.p7k30mcTOH /tmp/tmp.WK44Lxrseq
                                                                                      File size:72056 bytes
                                                                                      MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/cat
                                                                                      Arguments:cat /tmp/tmp.KeSvVAywbE
                                                                                      File size:43416 bytes
                                                                                      MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/head
                                                                                      Arguments:head -n 10
                                                                                      File size:47480 bytes
                                                                                      MD5 hash:fd96a67145172477dd57131396fc9608

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/tr
                                                                                      Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                                                      File size:51544 bytes
                                                                                      MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/cut
                                                                                      Arguments:cut -c -80
                                                                                      File size:47480 bytes
                                                                                      MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/cat
                                                                                      Arguments:cat /tmp/tmp.KeSvVAywbE
                                                                                      File size:43416 bytes
                                                                                      MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/head
                                                                                      Arguments:head -n 10
                                                                                      File size:47480 bytes
                                                                                      MD5 hash:fd96a67145172477dd57131396fc9608

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/tr
                                                                                      Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                                                      File size:51544 bytes
                                                                                      MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/cut
                                                                                      Arguments:cut -c -80
                                                                                      File size:47480 bytes
                                                                                      MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/dash
                                                                                      Arguments:-
                                                                                      File size:129816 bytes
                                                                                      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                      Start time (UTC):01:05:40
                                                                                      Start date (UTC):02/04/2025
                                                                                      Path:/usr/bin/rm
                                                                                      Arguments:rm -f /tmp/tmp.KeSvVAywbE /tmp/tmp.p7k30mcTOH /tmp/tmp.WK44Lxrseq
                                                                                      File size:72056 bytes
                                                                                      MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b