Edit tour

Linux Analysis Report
xd.arc.elf

Overview

General Information

Sample name:xd.arc.elf
Analysis ID:1654416
MD5:aa33329149fb09fb2b1a807a10c2dfb7
SHA1:8a64206d02907312baaf9ea9807899ba1075f173
SHA256:27ffea72d6022d7164968df60edafb498d61c36035b67085d139d2df1ece696d
Tags:elfuser-abuse_ch
Infos:
Errors
  • No process behavior to analyse as no analysis process or sample was found

Detection

Mirai
Score:80
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample has stripped symbol table
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1654416
Start date and time:2025-04-02 10:56:34 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 30s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:xd.arc.elf
Detection:MAL
Classification:mal80.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
  • No process behavior to analyse as no analysis process or sample was found
  • Max analysis timeout: 600s exceeded, the analysis took too long
Command:/tmp/xd.arc.elf
PID:5583
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
xd.arc.elfJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    xd.arc.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      xd.arc.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x101d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x101e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x101fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1024c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1029c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x102ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1033c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      xd.arc.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0x109e8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      xd.arc.elfMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
      • 0x10184:$x1: POST /cdn-cgi/
      • 0x10fdc:$s1: LCOGQGPTGP
      No Suricata rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: xd.arc.elfAvira: detected
      Source: xd.arc.elfVirustotal: Detection: 60%Perma Link
      Source: xd.arc.elfReversingLabs: Detection: 63%
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com

      System Summary

      barindex
      Source: xd.arc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: xd.arc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: xd.arc.elf, type: SAMPLEMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: xd.arc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: xd.arc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: xd.arc.elf, type: SAMPLEMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: classification engineClassification label: mal80.troj.linELF@0/0@2/0

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: xd.arc.elf, type: SAMPLE

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: xd.arc.elf, type: SAMPLE
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
      Non-Application Layer Protocol
      Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Application Layer Protocol
      Exfiltration Over BluetoothNetwork Denial of Service
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654416 Sample: xd.arc.elf Startdate: 02/04/2025 Architecture: LINUX Score: 80 6 daisy.ubuntu.com 2->6 8 Malicious sample detected (through community Yara rule) 2->8 10 Antivirus / Scanner detection for submitted sample 2->10 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected Mirai 2->14 signatures3
      SourceDetectionScannerLabelLink
      xd.arc.elf61%VirustotalBrowse
      xd.arc.elf64%ReversingLabsLinux.Backdoor.Mirai
      xd.arc.elf100%AviraLINUX/Mirai.bonb
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches

      Download Network PCAP: filteredfull

      NameIPActiveMaliciousAntivirus DetectionReputation
      daisy.ubuntu.com
      162.213.35.24
      truefalse
        high
        No contacted IP infos
        No context
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        daisy.ubuntu.commpsl.elfGet hashmaliciousUnknownBrowse
        • 162.213.35.24
        sh4.elfGet hashmaliciousUnknownBrowse
        • 162.213.35.24
        s-h.4-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 162.213.35.24
        x-8.6-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 162.213.35.24
        arm.elfGet hashmaliciousMiraiBrowse
        • 162.213.35.25
        FBI.arm.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 162.213.35.24
        FBI.sh4.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 162.213.35.24
        FBI.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 162.213.35.25
        FBI.mips.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 162.213.35.25
        FBI.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 162.213.35.24
        No context
        No context
        No context
        No created / dropped files found
        File type:ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, for GNU/Linux 4.8.0, stripped
        Entropy (8bit):6.435722787118864
        TrID:
        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
        File name:xd.arc.elf
        File size:75'136 bytes
        MD5:aa33329149fb09fb2b1a807a10c2dfb7
        SHA1:8a64206d02907312baaf9ea9807899ba1075f173
        SHA256:27ffea72d6022d7164968df60edafb498d61c36035b67085d139d2df1ece696d
        SHA512:bc97bc8a394798f503ed53edbdcf105448c08a86856fa8288948dcf547efc5bcf8439bebff4d28add0f5b10129dcb18814530e00e461c7ab3d888a3f1f2b0eff
        SSDEEP:1536:nUT/rafZZVUDpRdD3pMYZfJGk+DhaFLFw2Dp:UT/rcZIhD3pZu2N
        TLSH:DF7319746986F23CE9F61079E0862AD629620B483FDDE1E335D3503AFF71748A16CD49
        File Content Preview:.ELF..............].........4...."......4. ...(.........4...4...4.......................4...4...4................................................ ......D...D?..D?.......E....... ......T...T?..T?......................H...H...H... ... ...........Q.td.......

        ELF header

        Class:ELF32
        Data:2's complement, little endian
        Version:1 (current)
        Machine:<unknown>
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:UNIX - System V
        ABI Version:0
        Entry Point Address:0x10cf4
        Flags:0x403
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:8
        Section Header Offset:74256
        Section Header Size:40
        Number of Section Headers:22
        Header String Table Index:21
        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
        NULL0x00x00x00x00x0000
        .interpPROGBITS0x101340x1340x140x00x2A001
        .note.ABI-tagNOTE0x101480x1480x200x00x2A004
        .hashHASH0x101680x1680x1780x40x2A404
        .dynsymDYNSYM0x102e00x2e00x3700x100x2A514
        .dynstrSTRTAB0x106500x6500x1a00x00x2A001
        .rela.pltRELA0x107f00x7f00x2640xc0x42AI4164
        .initPROGBITS0x10a540xa540x220x00x6AX001
        .pltPROGBITS0x10a780xa780x27c0x00x6AX004
        .textPROGBITS0x10cf40xcf40xf3cc0x00x6AX004
        .finiPROGBITS0x200c00x100c00x160x00x6AX001
        .rodataPROGBITS0x200d80x100d80x16ac0x00x2A004
        .eh_framePROGBITS0x217840x117840x40x00x2A004
        .ctorsPROGBITS0x23f440x11f440x80x00x3WA004
        .dtorsPROGBITS0x23f4c0x11f4c0x80x00x3WA004
        .dynamicDYNAMIC0x23f540x11f540xa80x80x3WA504
        .got.pltPROGBITS0x23ffc0x11ffc0xd80x00x3WA004
        .dataPROGBITS0x240d40x120d40x200x00x3WA004
        .bssNOBITS0x240f40x120f40x44040x00x3WA004
        .commentPROGBITS0x00x120f40x430x10x30MS001
        .ARC.attributes<unknown>0x00x121370x300x00x0001
        .shstrtabSTRTAB0x00x121670xa90x00x0001
        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        PHDR0x340x100340x100340x1000x1002.55930x5R E0x4
        INTERP0x1340x101340x101340x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
        LOAD0x00x100000x100000x117880x117886.55540x5R E0x2000.interp .note.ABI-tag .hash .dynsym .dynstr .rela.plt .init .plt .text .fini .rodata .eh_frame
        LOAD0x11f440x23f440x23f440x1b00x45b42.70190x6RW 0x2000.ctors .dtors .dynamic .got.plt .data .bss
        DYNAMIC0x11f540x23f540x23f540xa80xa81.99440x6RW 0x4.dynamic
        NOTE0x1480x101480x101480x200x201.49880x4R 0x4.note.ABI-tag
        GNU_STACK0x00x00x00x00x00.00000x6RW 0x10
        GNU_RELRO0x11f440x23f440x23f440xbc0xbc2.17970x4R 0x1.ctors .dtors .dynamic
        TypeMetaValueTag
        DT_NEEDEDsharedliblibc.so.00x1
        DT_INITvalue0x10a580xc
        DT_FINIvalue0x200c40xd
        DT_HASHvalue0x101680x4
        DT_STRTABvalue0x106500x5
        DT_SYMTABvalue0x102e00x6
        DT_STRSZbytes4160xa
        DT_SYMENTbytes160xb
        DT_INITvalue0x10a580xc
        DT_FINIvalue0x200c40xd
        DT_DEBUGvalue0x00x15
        DT_PLTGOTvalue0x10a780x3
        DT_PLTRELSZbytes6120x2
        DT_PLTRELpltrelDT_RELA0x14
        DT_JMPRELvalue0x107f00x17
        DT_NULLvalue0x00x0
        NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
        .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __bss_start.dynsym0x240f40NOTYPE<unknown>DEFAULT18
        __errno_location.dynsym0x10c640FUNC<unknown>DEFAULTSHN_UNDEF
        __uClibc_main.dynsym0x10c040FUNC<unknown>DEFAULTSHN_UNDEF
        _edata.dynsym0x240f40NOTYPE<unknown>DEFAULT17
        _end.dynsym0x284f80NOTYPE<unknown>DEFAULT18
        atoi.dynsym0x10c7c0FUNC<unknown>DEFAULTSHN_UNDEF
        bind.dynsym0x10b740FUNC<unknown>DEFAULTSHN_UNDEF
        calloc.dynsym0x10b500FUNC<unknown>DEFAULTSHN_UNDEF
        clock.dynsym0x10c940FUNC<unknown>DEFAULTSHN_UNDEF
        close.dynsym0x10cc40FUNC<unknown>DEFAULTSHN_UNDEF
        closedir.dynsym0x10cac0FUNC<unknown>DEFAULTSHN_UNDEF
        connect.dynsym0x10aa80FUNC<unknown>DEFAULTSHN_UNDEF
        exit.dynsym0x10c700FUNC<unknown>DEFAULTSHN_UNDEF
        fcntl.dynsym0x10cb80FUNC<unknown>DEFAULTSHN_UNDEF
        fork.dynsym0x10bf80FUNC<unknown>DEFAULTSHN_UNDEF
        free.dynsym0x10cd00FUNC<unknown>DEFAULTSHN_UNDEF
        getpid.dynsym0x10acc0FUNC<unknown>DEFAULTSHN_UNDEF
        getppid.dynsym0x10c280FUNC<unknown>DEFAULTSHN_UNDEF
        getsockname.dynsym0x10ce80FUNC<unknown>DEFAULTSHN_UNDEF
        getsockopt.dynsym0x10c4c0FUNC<unknown>DEFAULTSHN_UNDEF
        htonl.dynsym0x10bd40FUNC<unknown>DEFAULTSHN_UNDEF
        htons.dynsym0x10c580FUNC<unknown>DEFAULTSHN_UNDEF
        inet_addr.dynsym0x10b800FUNC<unknown>DEFAULTSHN_UNDEF
        ioctl.dynsym0x10a900FUNC<unknown>DEFAULTSHN_UNDEF
        kill.dynsym0x10b680FUNC<unknown>DEFAULTSHN_UNDEF
        malloc.dynsym0x10af00FUNC<unknown>DEFAULTSHN_UNDEF
        memcpy.dynsym0x10ad80FUNC<unknown>DEFAULTSHN_UNDEF
        memmove.dynsym0x10ac00FUNC<unknown>DEFAULTSHN_UNDEF
        memset.dynsym0x10c100FUNC<unknown>DEFAULTSHN_UNDEF
        ntohl.dynsym0x10b8c0FUNC<unknown>DEFAULTSHN_UNDEF
        ntohs.dynsym0x10c1c0FUNC<unknown>DEFAULTSHN_UNDEF
        open.dynsym0x10c880FUNC<unknown>DEFAULTSHN_UNDEF
        opendir.dynsym0x10c400FUNC<unknown>DEFAULTSHN_UNDEF
        rand.dynsym0x10ba40FUNC<unknown>DEFAULTSHN_UNDEF
        read.dynsym0x10bbc0FUNC<unknown>DEFAULTSHN_UNDEF
        readdir.dynsym0x10b2c0FUNC<unknown>DEFAULTSHN_UNDEF
        readlink.dynsym0x10ae40FUNC<unknown>DEFAULTSHN_UNDEF
        realloc.dynsym0x10bec0FUNC<unknown>DEFAULTSHN_UNDEF
        recv.dynsym0x10a9c0FUNC<unknown>DEFAULTSHN_UNDEF
        recvfrom.dynsym0x10b080FUNC<unknown>DEFAULTSHN_UNDEF
        select.dynsym0x10b200FUNC<unknown>DEFAULTSHN_UNDEF
        send.dynsym0x10b440FUNC<unknown>DEFAULTSHN_UNDEF
        sendto.dynsym0x10be00FUNC<unknown>DEFAULTSHN_UNDEF
        setsid.dynsym0x10ca00FUNC<unknown>DEFAULTSHN_UNDEF
        setsockopt.dynsym0x10b980FUNC<unknown>DEFAULTSHN_UNDEF
        sigaddset.dynsym0x10b380FUNC<unknown>DEFAULTSHN_UNDEF
        sigemptyset.dynsym0x10ab40FUNC<unknown>DEFAULTSHN_UNDEF
        signal.dynsym0x10bb00FUNC<unknown>DEFAULTSHN_UNDEF
        sigprocmask.dynsym0x10cdc0FUNC<unknown>DEFAULTSHN_UNDEF
        sleep.dynsym0x10afc0FUNC<unknown>DEFAULTSHN_UNDEF
        socket.dynsym0x10b140FUNC<unknown>DEFAULTSHN_UNDEF
        time.dynsym0x10c340FUNC<unknown>DEFAULTSHN_UNDEF
        unlink.dynsym0x10bc80FUNC<unknown>DEFAULTSHN_UNDEF
        write.dynsym0x10b5c0FUNC<unknown>DEFAULTSHN_UNDEF

        Download Network PCAP: filteredfull

        TimestampSource PortDest PortSource IPDest IP
        Apr 2, 2025 11:00:32.359368086 CEST3432553192.168.2.131.1.1.1
        Apr 2, 2025 11:00:32.359427929 CEST5419653192.168.2.131.1.1.1
        Apr 2, 2025 11:00:32.457226038 CEST53343251.1.1.1192.168.2.13
        Apr 2, 2025 11:00:32.457261086 CEST53541961.1.1.1192.168.2.13
        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Apr 2, 2025 11:00:32.359368086 CEST192.168.2.131.1.1.10x2d91Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
        Apr 2, 2025 11:00:32.359427929 CEST192.168.2.131.1.1.10x82d4Standard query (0)daisy.ubuntu.com28IN (0x0001)false
        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Apr 2, 2025 11:00:32.457226038 CEST1.1.1.1192.168.2.130x2d91No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
        Apr 2, 2025 11:00:32.457226038 CEST1.1.1.1192.168.2.130x2d91No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

        System Behavior