Edit tour

Linux Analysis Report
FBI.arm5.elf

Overview

General Information

Sample name:FBI.arm5.elf
Analysis ID:1654263
MD5:887fae07beb01f337b53776198441974
SHA1:08b3cb75ab96468e4636c14a8c4f8706a14e3faa
SHA256:4be5f84fc3d3200c27b3973dda8fd79fa0824fa85c946f01533a2ea287ef55c9
Tags:elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai
Score:80
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1654263
Start date and time:2025-04-02 08:26:09 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 17s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:FBI.arm5.elf
Detection:MAL
Classification:mal80.troj.linELF@0/0@0/0
Command:/tmp/FBI.arm5.elf
PID:6242
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  • system is lnxubuntu20
  • dash New Fork (PID: 6334, Parent: 4331)
  • rm (PID: 6334, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.NZBPdjMDsK /tmp/tmp.tQz0NYR6lg /tmp/tmp.maQnsYWZaE
  • dash New Fork (PID: 6335, Parent: 4331)
  • rm (PID: 6335, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.NZBPdjMDsK /tmp/tmp.tQz0NYR6lg /tmp/tmp.maQnsYWZaE
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
FBI.arm5.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    FBI.arm5.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      FBI.arm5.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x1532c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1537c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x153a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x153b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x153cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x153e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x153f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1541c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1546c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x15494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x154a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x154bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      FBI.arm5.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0x152dc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      SourceRuleDescriptionAuthorStrings
      6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
        6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x1532c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1537c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x153a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x153b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x153cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x153e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x153f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1541c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1546c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x15494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x154a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x154bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
          • 0x152dc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
          6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmpJoeSecurity_GafgytYara detected GafgytJoe Security
            Click to see the 9 entries
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: FBI.arm5.elfAvira: detected
            Source: FBI.arm5.elfReversingLabs: Detection: 63%
            Source: FBI.arm5.elfVirustotal: Detection: 62%Perma Link
            Source: global trafficTCP traffic: 192.168.2.23:36250 -> 176.65.144.18:1337
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
            Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
            Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: unknownTCP traffic detected without corresponding DNS query: 176.65.144.18
            Source: FBI.arm5.elfString found in binary or memory: http://fast.no/support/crawler.asp)
            Source: FBI.arm5.elfString found in binary or memory: http://feedback.redkolibri.com/
            Source: FBI.arm5.elfString found in binary or memory: http://www.baidu.com/search/spider.htm)
            Source: FBI.arm5.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
            Source: FBI.arm5.elfString found in binary or memory: http://www.billybobbot.com/crawler/)
            Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 39258
            Source: unknownNetwork traffic detected: HTTP traffic on port 39258 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

            System Summary

            barindex
            Source: FBI.arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: FBI.arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: 6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: 6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: Process Memory Space: FBI.arm5.elf PID: 6242, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: FBI.arm5.elf PID: 6242, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: Process Memory Space: FBI.arm5.elf PID: 6244, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: FBI.arm5.elf PID: 6244, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
            Source: Initial sampleString containing 'busybox' found: busybox
            Source: Initial sampleString containing 'busybox' found: BusyBox
            Source: Initial sampleString containing 'busybox' found: 20+!g}]/proc/self/maps/proc//maps/root//tmp//var/run/mnt/BinsameccountoginnterhraseordeyshellsystemenablebusyboxBusyBoxBuilt-in107.182.129.217
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: FBI.arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: FBI.arm5.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: 6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: 6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: Process Memory Space: FBI.arm5.elf PID: 6242, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: FBI.arm5.elf PID: 6242, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: Process Memory Space: FBI.arm5.elf PID: 6244, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: FBI.arm5.elf PID: 6244, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
            Source: classification engineClassification label: mal80.troj.linELF@0/0@0/0
            Source: /usr/bin/dash (PID: 6334)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.NZBPdjMDsK /tmp/tmp.tQz0NYR6lg /tmp/tmp.maQnsYWZaEJump to behavior
            Source: /usr/bin/dash (PID: 6335)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.NZBPdjMDsK /tmp/tmp.tQz0NYR6lg /tmp/tmp.maQnsYWZaEJump to behavior
            Source: submitted sampleStderr: qemu: uncaught target signal 11 (Segmentation fault) - core dumped: exit code = 0
            Source: /tmp/FBI.arm5.elf (PID: 6242)Queries kernel information via 'uname': Jump to behavior
            Source: FBI.arm5.elf, 6242.1.00005592ce6cd000.00005592ce7fb000.rw-.sdmp, FBI.arm5.elf, 6244.1.00005592ce6cd000.00005592ce7fb000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
            Source: FBI.arm5.elf, 6242.1.00005592ce6cd000.00005592ce7fb000.rw-.sdmp, FBI.arm5.elf, 6244.1.00005592ce6cd000.00005592ce7fb000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
            Source: FBI.arm5.elf, 6242.1.00007ffe304bb000.00007ffe304dc000.rw-.sdmp, FBI.arm5.elf, 6244.1.00007ffe304bb000.00007ffe304dc000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
            Source: FBI.arm5.elf, 6242.1.00007ffe304bb000.00007ffe304dc000.rw-.sdmp, FBI.arm5.elf, 6244.1.00007ffe304bb000.00007ffe304dc000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/FBI.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/FBI.arm5.elf
            Source: FBI.arm5.elf, 6244.1.00007ffe304bb000.00007ffe304dc000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: FBI.arm5.elf, type: SAMPLE
            Source: Yara matchFile source: 6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: FBI.arm5.elf, type: SAMPLE
            Source: Yara matchFile source: 6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: FBI.arm5.elf PID: 6242, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: FBI.arm5.elf PID: 6244, type: MEMORYSTR
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
            Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
            Source: Initial sampleUser agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: FBI.arm5.elf, type: SAMPLE
            Source: Yara matchFile source: 6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: FBI.arm5.elf, type: SAMPLE
            Source: Yara matchFile source: 6242.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6244.1.00007f6c94017000.00007f6c94030000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: FBI.arm5.elf PID: 6242, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: FBI.arm5.elf PID: 6244, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
            File Deletion
            OS Credential Dumping11
            Security Software Discovery
            Remote ServicesData from Local System1
            Data Obfuscation
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
            Encrypted Channel
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
            Non-Standard Port
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
            Application Layer Protocol
            Traffic DuplicationData Destruction
            No configs have been found
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654263 Sample: FBI.arm5.elf Startdate: 02/04/2025 Architecture: LINUX Score: 80 30 176.65.144.18, 1337, 36250, 36252 PALTEL-ASPALTELAutonomousSystemPS Germany 2->30 32 109.202.202.202, 80 INIT7CH Switzerland 2->32 34 3 other IPs or domains 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus / Scanner detection for submitted sample 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 2 other signatures 2->42 10 FBI.arm5.elf 2->10         started        12 dash rm 2->12         started        14 dash rm 2->14         started        signatures3 process4 process5 16 FBI.arm5.elf 10->16         started        18 FBI.arm5.elf 10->18         started        process6 20 FBI.arm5.elf 16->20         started        22 FBI.arm5.elf 16->22         started        process7 24 FBI.arm5.elf 20->24         started        26 FBI.arm5.elf 22->26         started        process8 28 FBI.arm5.elf 24->28         started       
            SourceDetectionScannerLabelLink
            FBI.arm5.elf64%ReversingLabsLinux.Trojan.Gafgyt
            FBI.arm5.elf62%VirustotalBrowse
            FBI.arm5.elf100%AviraEXP/ELF.Mirai.Z
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches

            Download Network PCAP: filteredfull

            No contacted domains info
            NameSourceMaliciousAntivirus DetectionReputation
            http://www.baidu.com/search/spider.html)FBI.arm5.elffalse
              high
              http://www.billybobbot.com/crawler/)FBI.arm5.elffalse
                high
                http://fast.no/support/crawler.asp)FBI.arm5.elffalse
                  high
                  http://feedback.redkolibri.com/FBI.arm5.elffalse
                    high
                    http://www.baidu.com/search/spider.htm)FBI.arm5.elffalse
                      high
                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs
                      IPDomainCountryFlagASNASN NameMalicious
                      34.249.145.219
                      unknownUnited States
                      16509AMAZON-02USfalse
                      176.65.144.18
                      unknownGermany
                      12975PALTEL-ASPALTELAutonomousSystemPSfalse
                      109.202.202.202
                      unknownSwitzerland
                      13030INIT7CHfalse
                      91.189.91.43
                      unknownUnited Kingdom
                      41231CANONICAL-ASGBfalse
                      91.189.91.42
                      unknownUnited Kingdom
                      41231CANONICAL-ASGBfalse
                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      34.249.145.219na.elfGet hashmaliciousPrometeiBrowse
                        na.elfGet hashmaliciousPrometeiBrowse
                          efefa7.elfGet hashmaliciousMiraiBrowse
                            sh4.elfGet hashmaliciousUnknownBrowse
                              arm5.elfGet hashmaliciousUnknownBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          176.65.144.18FBI.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                                            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                                            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                                            91.189.91.43na.elfGet hashmaliciousPrometeiBrowse
                                              na.elfGet hashmaliciousPrometeiBrowse
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                  arm5.elfGet hashmaliciousUnknownBrowse
                                                    rjfe686.elfGet hashmaliciousUnknownBrowse
                                                      aarch64.elfGet hashmaliciousMiraiBrowse
                                                        sh4.elfGet hashmaliciousUnknownBrowse
                                                          efefa7.elfGet hashmaliciousMiraiBrowse
                                                            mips.elfGet hashmaliciousUnknownBrowse
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                                91.189.91.42na.elfGet hashmaliciousPrometeiBrowse
                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                      arm5.elfGet hashmaliciousUnknownBrowse
                                                                        rjfe686.elfGet hashmaliciousUnknownBrowse
                                                                          aarch64.elfGet hashmaliciousMiraiBrowse
                                                                            sh4.elfGet hashmaliciousUnknownBrowse
                                                                              efefa7.elfGet hashmaliciousMiraiBrowse
                                                                                mips.elfGet hashmaliciousUnknownBrowse
                                                                                  na.elfGet hashmaliciousPrometeiBrowse
                                                                                    No context
                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    PALTEL-ASPALTELAutonomousSystemPSFBI.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                    • 176.65.144.18
                                                                                    clip64.dllGet hashmaliciousAmadeyBrowse
                                                                                    • 176.65.137.193
                                                                                    clip64.dllGet hashmaliciousAmadeyBrowse
                                                                                    • 176.65.137.193
                                                                                    cred64.dll.dllGet hashmaliciousAmadeyBrowse
                                                                                    • 176.65.137.193
                                                                                    gLLOqKC.exeGet hashmaliciousAmadeyBrowse
                                                                                    • 176.65.137.193
                                                                                    boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                                                                                    • 176.65.137.13
                                                                                    boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                    • 176.65.137.13
                                                                                    boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                                                                    • 176.65.137.13
                                                                                    boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                                                                    • 176.65.137.13
                                                                                    boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                    • 176.65.137.13
                                                                                    CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 91.189.91.42
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 91.189.91.42
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 91.189.91.42
                                                                                    arm5.elfGet hashmaliciousUnknownBrowse
                                                                                    • 91.189.91.42
                                                                                    rjfe686.elfGet hashmaliciousUnknownBrowse
                                                                                    • 91.189.91.42
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 185.125.190.26
                                                                                    aarch64.elfGet hashmaliciousMiraiBrowse
                                                                                    • 91.189.91.42
                                                                                    vejfa5.elfGet hashmaliciousUnknownBrowse
                                                                                    • 185.125.190.26
                                                                                    sh4.elfGet hashmaliciousUnknownBrowse
                                                                                    • 91.189.91.42
                                                                                    efefa7.elfGet hashmaliciousMiraiBrowse
                                                                                    • 91.189.91.42
                                                                                    INIT7CHna.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 109.202.202.202
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 109.202.202.202
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 109.202.202.202
                                                                                    arm5.elfGet hashmaliciousUnknownBrowse
                                                                                    • 109.202.202.202
                                                                                    rjfe686.elfGet hashmaliciousUnknownBrowse
                                                                                    • 109.202.202.202
                                                                                    aarch64.elfGet hashmaliciousMiraiBrowse
                                                                                    • 109.202.202.202
                                                                                    sh4.elfGet hashmaliciousUnknownBrowse
                                                                                    • 109.202.202.202
                                                                                    efefa7.elfGet hashmaliciousMiraiBrowse
                                                                                    • 109.202.202.202
                                                                                    mips.elfGet hashmaliciousUnknownBrowse
                                                                                    • 109.202.202.202
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 109.202.202.202
                                                                                    AMAZON-02USna.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 34.249.145.219
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 34.249.145.219
                                                                                    arm6.elfGet hashmaliciousUnknownBrowse
                                                                                    • 54.247.62.1
                                                                                    full folder details request quotation.exeGet hashmaliciousFormBookBrowse
                                                                                    • 13.248.169.48
                                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                                    • 54.247.62.1
                                                                                    Payment Remittance.pdfGet hashmaliciousUnknownBrowse
                                                                                    • 3.168.73.96
                                                                                    OC-8563 PURCHASE ORDER.exeGet hashmaliciousFormBookBrowse
                                                                                    • 13.248.169.48
                                                                                    SHIPPING DOCUMENT.exeGet hashmaliciousFormBookBrowse
                                                                                    • 13.248.169.48
                                                                                    vejfa5.elfGet hashmaliciousUnknownBrowse
                                                                                    • 34.243.160.129
                                                                                    efefa7.elfGet hashmaliciousMiraiBrowse
                                                                                    • 34.249.145.219
                                                                                    No context
                                                                                    No context
                                                                                    No created / dropped files found
                                                                                    File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
                                                                                    Entropy (8bit):6.252061066211188
                                                                                    TrID:
                                                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                                    File name:FBI.arm5.elf
                                                                                    File size:104'276 bytes
                                                                                    MD5:887fae07beb01f337b53776198441974
                                                                                    SHA1:08b3cb75ab96468e4636c14a8c4f8706a14e3faa
                                                                                    SHA256:4be5f84fc3d3200c27b3973dda8fd79fa0824fa85c946f01533a2ea287ef55c9
                                                                                    SHA512:f38cce980d6b529ec39c507632f79f189f42913f042ae9b6cbb725695be6e2465b4e16deb51d35df21a0b9fcf950ad8e962a33caa85b20c1f0b2fece0ac25d1c
                                                                                    SSDEEP:1536:HGuY5rX339swaBmti+dqFRBBYZF3C2or/OQrW+sbGI4q6yPx85hlpMVq:HGx5H9RMNf/YZLoRc/4rAy5hlpMVq
                                                                                    TLSH:5FA32A26BD018F43C2C315F3BB9F47887B2667F9D2EF3203E925AFA027564D60926950
                                                                                    File Content Preview:.ELF...a..........(.........4...L.......4. ...(..........................................................j..........Q.td..................................-...L."...'M..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

                                                                                    ELF header

                                                                                    Class:ELF32
                                                                                    Data:2's complement, little endian
                                                                                    Version:1 (current)
                                                                                    Machine:ARM
                                                                                    Version Number:0x1
                                                                                    Type:EXEC (Executable file)
                                                                                    OS/ABI:ARM - ABI
                                                                                    ABI Version:0
                                                                                    Entry Point Address:0x8190
                                                                                    Flags:0x2
                                                                                    ELF Header Size:52
                                                                                    Program Header Offset:52
                                                                                    Program Header Size:32
                                                                                    Number of Program Headers:3
                                                                                    Section Header Offset:103756
                                                                                    Section Header Size:40
                                                                                    Number of Section Headers:13
                                                                                    Header String Table Index:12
                                                                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                                    NULL0x00x00x00x00x0000
                                                                                    .initPROGBITS0x80940x940x180x00x6AX004
                                                                                    .textPROGBITS0x80b00xb00x134d40x00x6AX0016
                                                                                    .finiPROGBITS0x1b5840x135840x140x00x6AX004
                                                                                    .rodataPROGBITS0x1b5980x135980x4cf00x00x2A004
                                                                                    .eh_framePROGBITS0x202880x182880x40x00x2A004
                                                                                    .ctorsPROGBITS0x2828c0x1828c0x80x00x3WA004
                                                                                    .dtorsPROGBITS0x282940x182940x80x00x3WA004
                                                                                    .jcrPROGBITS0x2829c0x1829c0x40x00x3WA004
                                                                                    .dataPROGBITS0x282a00x182a00x49c0x00x3WA004
                                                                                    .bssNOBITS0x2873c0x1873c0x65f00x00x3WA004
                                                                                    .commentPROGBITS0x00x1873c0xdba0x00x0001
                                                                                    .shstrtabSTRTAB0x00x194f60x560x00x0001
                                                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                                    LOAD0x00x80000x80000x1828c0x1828c6.24760x5R E0x8000.init .text .fini .rodata .eh_frame
                                                                                    LOAD0x1828c0x2828c0x2828c0x4b00x6aa03.14940x6RW 0x8000.ctors .dtors .jcr .data .bss
                                                                                    GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                                                    Download Network PCAP: filteredfull

                                                                                    • Total Packets: 95
                                                                                    • 1337 undefined
                                                                                    • 443 (HTTPS)
                                                                                    • 80 (HTTP)
                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                    Apr 2, 2025 08:27:02.020899057 CEST43928443192.168.2.2391.189.91.42
                                                                                    Apr 2, 2025 08:27:02.385139942 CEST362501337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:02.587039948 CEST133736250176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:04.425676107 CEST362521337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:04.627875090 CEST133736252176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:07.396296978 CEST42836443192.168.2.2391.189.91.43
                                                                                    Apr 2, 2025 08:27:07.593224049 CEST362541337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:07.796340942 CEST133736254176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:08.931967020 CEST4251680192.168.2.23109.202.202.202
                                                                                    Apr 2, 2025 08:27:09.629844904 CEST362561337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:09.832684994 CEST133736256176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:12.797447920 CEST362581337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:12.997689009 CEST133736258176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:14.833523989 CEST362601337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:15.036612034 CEST133736260176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:17.731647015 CEST39258443192.168.2.2334.249.145.219
                                                                                    Apr 2, 2025 08:27:17.731724024 CEST4433925834.249.145.219192.168.2.23
                                                                                    Apr 2, 2025 08:27:17.731820107 CEST39258443192.168.2.2334.249.145.219
                                                                                    Apr 2, 2025 08:27:17.732059002 CEST39258443192.168.2.2334.249.145.219
                                                                                    Apr 2, 2025 08:27:17.732081890 CEST4433925834.249.145.219192.168.2.23
                                                                                    Apr 2, 2025 08:27:17.998950958 CEST362641337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:18.201457977 CEST133736264176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:20.037975073 CEST362661337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:20.242562056 CEST133736266176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:22.502222061 CEST43928443192.168.2.2391.189.91.42
                                                                                    Apr 2, 2025 08:27:23.202795982 CEST362681337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:23.403330088 CEST133736268176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:25.244199991 CEST362701337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:25.447153091 CEST133736270176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:28.405034065 CEST362721337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:28.607187986 CEST133736272176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:30.448579073 CEST362741337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:30.651237965 CEST133736274176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:33.608966112 CEST362761337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:33.810883045 CEST133736276176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:34.784521103 CEST42836443192.168.2.2391.189.91.43
                                                                                    Apr 2, 2025 08:27:35.652731895 CEST362781337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:35.853471994 CEST133736278176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:38.811852932 CEST362801337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:38.879975080 CEST4251680192.168.2.23109.202.202.202
                                                                                    Apr 2, 2025 08:27:39.012564898 CEST133736280176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:40.854623079 CEST362821337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:41.056588888 CEST133736282176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:44.013853073 CEST362841337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:44.215902090 CEST133736284176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:46.057684898 CEST362861337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:46.263483047 CEST133736286176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:49.217843056 CEST362881337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:49.422074080 CEST133736288176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:51.265089989 CEST362901337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:51.467185020 CEST133736290176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:54.424217939 CEST362921337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:54.629447937 CEST133736292176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:56.468683958 CEST362941337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:56.671653986 CEST133736294176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:27:59.630898952 CEST362961337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:27:59.839049101 CEST133736296176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:01.673295021 CEST362981337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:01.880903959 CEST133736298176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:03.456713915 CEST43928443192.168.2.2391.189.91.42
                                                                                    Apr 2, 2025 08:28:04.841257095 CEST363001337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:05.044888973 CEST133736300176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:06.882632017 CEST363021337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:07.086771011 CEST133736302176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:10.047188044 CEST363041337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:10.248729944 CEST133736304176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:12.088294983 CEST363061337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:12.294306993 CEST133736306176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:15.251051903 CEST363081337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:15.451762915 CEST133736308176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:17.295928001 CEST363101337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:17.502971888 CEST133736310176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:17.724252939 CEST39258443192.168.2.2334.249.145.219
                                                                                    Apr 2, 2025 08:28:17.768295050 CEST4433925834.249.145.219192.168.2.23
                                                                                    Apr 2, 2025 08:28:20.454564095 CEST363121337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:20.655944109 CEST133736312176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:22.505301952 CEST363141337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:22.705683947 CEST133736314176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:25.658210993 CEST363161337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:25.859646082 CEST133736316176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:27.707365036 CEST363181337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:27.911979914 CEST133736318176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:30.861766100 CEST363201337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:31.067846060 CEST133736320176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:32.914396048 CEST363221337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:33.116728067 CEST133736322176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:36.071089983 CEST363241337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:36.273878098 CEST133736324176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:38.118354082 CEST363261337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:38.325603962 CEST133736326176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:41.275603056 CEST363281337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:41.480204105 CEST133736328176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:43.327271938 CEST363301337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:44.343488932 CEST363301337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:44.544939995 CEST133736330176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:46.484559059 CEST363321337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:46.711703062 CEST133736332176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:49.546504974 CEST363341337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:49.748977900 CEST133736334176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:51.713047981 CEST363361337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:51.914462090 CEST133736336176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:54.750746965 CEST363381337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:54.951854944 CEST133736338176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:56.917879105 CEST363401337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:28:57.123784065 CEST133736340176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:28:59.954118967 CEST363421337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:00.168206930 CEST133736342176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:02.127223969 CEST363441337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:02.337115049 CEST133736344176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:05.169877052 CEST363461337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:05.372598886 CEST133736346176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:07.339055061 CEST363481337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:07.543260098 CEST133736348176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:10.373735905 CEST363501337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:10.577552080 CEST133736350176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:12.544841051 CEST363521337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:12.752643108 CEST133736352176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:15.578725100 CEST363541337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:15.784421921 CEST133736354176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:17.753774881 CEST363561337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:17.953960896 CEST133736356176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:20.786369085 CEST363581337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:20.993204117 CEST133736358176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:22.956290007 CEST363601337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:23.165782928 CEST133736360176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:25.994929075 CEST363621337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:26.200027943 CEST133736362176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:28.167731047 CEST363641337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:28.370243073 CEST133736364176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:31.201451063 CEST363661337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:31.406754971 CEST133736366176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:33.372512102 CEST363681337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:33.577189922 CEST133736368176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:36.408392906 CEST363701337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:36.612026930 CEST133736370176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:38.579124928 CEST363721337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:38.781414032 CEST133736372176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:41.613662004 CEST363741337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:41.815226078 CEST133736374176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:43.783649921 CEST363761337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:43.990093946 CEST133736376176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:46.817759991 CEST363781337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:47.019381046 CEST133736378176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:48.992059946 CEST363801337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:49.192837000 CEST133736380176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:52.021226883 CEST363821337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:52.222876072 CEST133736382176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:54.194175959 CEST363841337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:54.399745941 CEST133736384176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:57.223944902 CEST363861337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:57.426179886 CEST133736386176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:29:59.400804043 CEST363881337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:29:59.603753090 CEST133736388176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:02.431385994 CEST363901337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:02.633853912 CEST133736390176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:04.604571104 CEST363921337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:04.812674999 CEST133736392176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:07.635688066 CEST363941337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:07.843044043 CEST133736394176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:09.814050913 CEST363961337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:10.014425993 CEST133736396176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:12.845114946 CEST363981337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:13.050259113 CEST133736398176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:15.015547991 CEST364001337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:15.221369028 CEST133736400176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:18.051965952 CEST364021337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:18.261821032 CEST133736402176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:20.222852945 CEST364041337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:20.428224087 CEST133736404176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:23.263447046 CEST364061337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:23.470136881 CEST133736406176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:25.429389954 CEST364081337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:25.633477926 CEST133736408176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:28.472615957 CEST364101337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:28.676938057 CEST133736410176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:30.634797096 CEST364121337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:30.839905024 CEST133736412176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:33.680417061 CEST364141337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:33.886261940 CEST133736414176.65.144.18192.168.2.23
                                                                                    Apr 2, 2025 08:30:35.841409922 CEST364161337192.168.2.23176.65.144.18
                                                                                    Apr 2, 2025 08:30:36.048002958 CEST133736416176.65.144.18192.168.2.23

                                                                                    System Behavior

                                                                                    Start time (UTC):06:27:01
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/tmp/FBI.arm5.elf
                                                                                    Arguments:/tmp/FBI.arm5.elf
                                                                                    File size:4956856 bytes
                                                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                    Start time (UTC):06:27:01
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/tmp/FBI.arm5.elf
                                                                                    Arguments:-
                                                                                    File size:4956856 bytes
                                                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                    Start time (UTC):06:27:01
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/tmp/FBI.arm5.elf
                                                                                    Arguments:-
                                                                                    File size:4956856 bytes
                                                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                    Start time (UTC):06:27:01
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/tmp/FBI.arm5.elf
                                                                                    Arguments:-
                                                                                    File size:4956856 bytes
                                                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                    Start time (UTC):06:27:01
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/tmp/FBI.arm5.elf
                                                                                    Arguments:-
                                                                                    File size:4956856 bytes
                                                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                    Start time (UTC):06:27:01
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/tmp/FBI.arm5.elf
                                                                                    Arguments:-
                                                                                    File size:4956856 bytes
                                                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                    Start time (UTC):06:27:03
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/tmp/FBI.arm5.elf
                                                                                    Arguments:-
                                                                                    File size:4956856 bytes
                                                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                    Start time (UTC):06:27:03
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/tmp/FBI.arm5.elf
                                                                                    Arguments:-
                                                                                    File size:4956856 bytes
                                                                                    MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                                                    Start time (UTC):06:28:17
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/usr/bin/dash
                                                                                    Arguments:-
                                                                                    File size:129816 bytes
                                                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                    Start time (UTC):06:28:17
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/usr/bin/rm
                                                                                    Arguments:rm -f /tmp/tmp.NZBPdjMDsK /tmp/tmp.tQz0NYR6lg /tmp/tmp.maQnsYWZaE
                                                                                    File size:72056 bytes
                                                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                                                    Start time (UTC):06:28:17
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/usr/bin/dash
                                                                                    Arguments:-
                                                                                    File size:129816 bytes
                                                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                                    Start time (UTC):06:28:17
                                                                                    Start date (UTC):02/04/2025
                                                                                    Path:/usr/bin/rm
                                                                                    Arguments:rm -f /tmp/tmp.NZBPdjMDsK /tmp/tmp.tQz0NYR6lg /tmp/tmp.maQnsYWZaE
                                                                                    File size:72056 bytes
                                                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b