Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
linux_mips64_softfloat.elf

Overview

General Information

Sample name:linux_mips64_softfloat.elf
Analysis ID:1562740
MD5:bddfa0887299e801b369b67bd5c6e61a
SHA1:ed03b66e769e7a5711f2b98c6433c63a7989e244
SHA256:095ab50f4779c214a51bb5d22a29a7c747cc61293aa57ac95dcec7f13c3efbf3
Tags:elfuser-abuse_ch
Infos:

Detection

Chaos
Score:56
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Chaos
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1562740
Start date and time:2024-11-25 23:54:42 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 42s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:linux_mips64_softfloat.elf
Detection:MAL
Classification:mal56.troj.linELF@0/4@0/0

Warnings

  • VT rate limit hit for: linux_mips64_softfloat.elf

Runtime Messages

Command:/tmp/linux_mips64_softfloat.elf
PID:5590
Exit Code:2
Exit Code Info:
Killed:False
Standard Output:

Standard Error:fatal error: sigaction failed

runtime stack:
runtime.throw({0x39ae60, 0x10})
/usr/lib/go-1.18/src/runtime/panic.go:992 +0x6c
runtime.sysSigaction.func1()
/usr/lib/go-1.18/src/runtime/os_linux.go:529 +0x4c
runtime.sysSigaction(0x41, 0x4000800bb0, 0x0)
/usr/lib/go-1.18/src/runtime/os_linux.go:528 +0x88
runtime.sigaction(0x41, 0x4000800bb0, 0x0)
/usr/lib/go-1.18/src/runtime/sigaction.go:15 +0x28
runtime.setsig(0x41, 0x6ed10)
/usr/lib/go-1.18/src/runtime/os_linux.go:478 +0xb0
runtime.initsig(0x0)
/usr/lib/go-1.18/src/runtime/signal_unix.go:147 +0x348
runtime.mstartm0()
/usr/lib/go-1.18/src/runtime/proc.go:1442 +0x78
runtime.mstart1()
/usr/lib/go-1.18/src/runtime/proc.go:1414 +0x94
runtime.mstart0()
/usr/lib/go-1.18/src/runtime/proc.go:1376 +0x74
runtime.mstart()
/usr/lib/go-1.18/src/runtime/asm_mips64x.s:88 +0x10

goroutine 1 [runnable]:
runtime.main()
/usr/lib/go-1.18/src/runtime/proc.go:145
runtime.goexit()
/usr/lib/go-1.18/src/runtime/asm_mips64x.s:617 +0x4

Process Tree

  • system is lnxubuntu20
  • linux_mips64_softfloat.elf (PID: 5590, Parent: 5515, MD5: 801a06b4e0ed2dca89cbfa1f900a483d) Arguments: /tmp/linux_mips64_softfloat.elf
  • sshd New Fork (PID: 5599, Parent: 933)
  • sshd (PID: 5599, Parent: 933, MD5: dbca7a6bbf7bf57fedac243d4b2cb340) Arguments: /usr/sbin/sshd -D -R
  • sshd New Fork (PID: 5606, Parent: 933)
  • sshd (PID: 5606, Parent: 933, MD5: dbca7a6bbf7bf57fedac243d4b2cb340) Arguments: /usr/sbin/sshd -D -R
    • sshd New Fork (PID: 5607, Parent: 5606)
  • sshd New Fork (PID: 5608, Parent: 933)
  • sshd (PID: 5608, Parent: 933, MD5: dbca7a6bbf7bf57fedac243d4b2cb340) Arguments: /usr/sbin/sshd -D -R
    • sshd New Fork (PID: 5609, Parent: 5608)
  • sshd New Fork (PID: 5612, Parent: 933)
  • sshd (PID: 5612, Parent: 933, MD5: dbca7a6bbf7bf57fedac243d4b2cb340) Arguments: /usr/sbin/sshd -D -R
  • sshd New Fork (PID: 5613, Parent: 933)
  • sshd (PID: 5613, Parent: 933, MD5: dbca7a6bbf7bf57fedac243d4b2cb340) Arguments: /usr/sbin/sshd -D -R
    • sshd New Fork (PID: 5614, Parent: 5613)
  • sshd New Fork (PID: 5634, Parent: 933)
  • sshd (PID: 5634, Parent: 933, MD5: dbca7a6bbf7bf57fedac243d4b2cb340) Arguments: /usr/sbin/sshd -D -R
    • sshd New Fork (PID: 5635, Parent: 5634)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
ChaosMulti-functional malware written in Go, targeting both Linux and Windows, evolved from elf.kaiji.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.chaos

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
linux_mips64_softfloat.elfJoeSecurity_ChaosGoYara detected ChaosJoe Security

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: linux_mips64_softfloat.elfReversingLabs: Detection: 39%
    Source: linux_mips64_softfloat.elfString found in binary or memory: http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing connectionhttp: message cannot contain multiple Content-Length headers; got %qpadding bytes must all be zeros unless AllowIllegalWrites is enabledreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)tls: handshake message of length %d bytes exceeds maximum of %d bytestls: peer doesn't support the certificate custom signature algorithmsbytes.Buffer: UnreadByte: previous operation was not a successful readcannot convert slice with length %y to pointer to array with length %xgot %s for stream %d; expected CONTINUATION following %s for stream %dx509: PKCS#8 wrapping contained private key with unknown algorithm: %vx509: certificate relies on legacy Common Name field, use SANs insteadMozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)Sogou Pic Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)dynamic table size update MUST occur at the beginning of a header blockssh: no common algorithm for %s; client offered: %v, server offered: %vtls: peer doesn't support any of the certificate's signature algorithmstoo many concurrent operations on a single file or socket (max 1048575)x509: issuer has name constraints but leaf doesn't have a SAN extensionMozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)tls: server's certificate contains an unsupported type of public key: %Ttls: received unexpected handshake message of type %T when waiting for %T91289437fa036b34da55d57af6192768c27bd433fa012169d626d934e0051b24dd67dd3cf49d7cc827bc012d259d7ac226e70829239d7ac226e7082968de60d520eb433722c07fd236f6crypto/elliptic: internal error: Unmarshal rejected a valid point encodingmalformed response from server: malformed non-numeric status pseudo headernet/http: server replied with more than declared Content-Length; truncatedtls: certificate RSA key size too small for supported signature algorithmsUnsolicited response received on idle HTTP channel starting with %q; err=%vtls: internal error: attempted to read record with pending application datatls: failed to send closeNotify alert (but connection was closed anyway): %wtls: server certificate contains incorrect key type for selected ciphersuite((2(5[0-5]|[0-4]\d))|[0-1]?\d{1,2})(\.((2(5[0-5]|[0-4]\d))|[0-1]?\d{1,2})){3}MapIter.Next called on an iterator that does not have an associated map Valuecrypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabled115792089210356248762697446949407573529996955224135760342422259061068512044369115792089210356248762697446949407573530086143415290314195533631308867097853951ssh: internal error: algorithmSignerWrapper invoked with non-default algorithmssh: unable to authenticate, attempted methods %v, no supported methods remainx509: signature check attempt
    Source: linux_mips64_softfloat.elfString found in binary or memory: http: RoundTripper implementation (%T) returned a nil *Response with a nil errortls: either ServerName or InsecureSkipVerify must be specified in the tls.Configx509: invalid signature: parent certificate cannot sign this kind of certificaterefusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxyx509: a root or intermediate certificate is not authorized to sign for this name: (possibly because of %q while trying to verify candidate authority certificate %q)Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)x509: issuer has name constraints but leaf contains unknown or unconstrained name: tls: downgrade attempt detected, possibly due to a MitM attack or a broken middleboxx509: signature algorithm specifies an %s public key, but have public key of type %Treflect.Value.Interface: cannot return value obtained from unexported field or methodx509: failed to parse private key (use ParseECPrivateKey instead for this key format)Mozilla/5.0 (compatible; YoudaoBot/1.0; http://www.youdao.com/help/webmaster/spider/;)reflect: New of type that may not be allocated in heap (possibly undefined cgo C type)x509: a root or intermediate certificate is not authorized for an extended key usage: fxfzUc6gtMGc/i26ld3KydGKy1k7QqyMMyxjbU1Rlk+F9LQxnaTeCHGHsDUpaBeOWDeY6l+2kHlB7EWTLcGwfg==whv+Kf1cEtOXzr+zuvmef2as0WfbUDm8l2LMWBMel10NDnbShg9CsMUt327VJhOTbXLoPYJVTKy8MBPCVwoT8A==x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)x509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format)Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)http2: server sent GOAWAY and closed the connection; LastStreamID=%v, ErrCode=%v, debug=%qapplication/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5tls: handshake hash for a client certificate requested after discarding the handshake buffertls: unsupported certificate: private key is *ed25519.PrivateKey, expected ed25519.PrivateKey3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5faa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7b3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefhttp: RoundTripper implementation (%T) returned a *Response with content length %d but a nil BodyNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertcipher: the nonce can't have zero length, or the security of the key will be immediately compromisedssh<<RMS>> equals www.yahoo.com (Yahoo)
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)x509:
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://search.msn.com/msnbot.htm
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.baidu.com/search/spider.html)Mozilla/5.0
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.baidu.com/search/spider.html)http2:
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.entireweb.com/about/search_tech/speedy_spider/)text/html
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.google.com/mobile/adsbot.html)
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.haosou.com/help/help_3_2.htmlMozilla/5.0
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://www.youdao.com/help/webmaster/spider/;)reflect:
    Source: linux_mips64_softfloat.elfString found in binary or memory: http://yandex.com/bots)http:
    Source: linux_mips64_softfloat.elfString found in binary or memory: https://search.yahoo.com/search?p=illegal
    Source: linux_mips64_softfloat.elfString found in binary or memory: https://www.baidu.com/s?wd=insufficient
    Source: linux_mips64_softfloat.elfString found in binary or memory: https://www.so.com/s?q=index
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: classification engineClassification label: mal56.troj.linELF@0/4@0/0
    Source: ELF file sectionSubmission: linux_mips64_softfloat.elf
    Source: /tmp/linux_mips64_softfloat.elf (PID: 5590)Queries kernel information via 'uname': Jump to behavior
    Source: linux_mips64_softfloat.elf, 5590.1.00007ffca5912000.00007ffca5933000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips64
    Source: linux_mips64_softfloat.elf, 5590.1.000055eab2bcd000.000055eab2f41000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mips641RelativeDistinguishedName
    Source: linux_mips64_softfloat.elf, 5590.1.00007ffca5912000.00007ffca5933000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mips64/tmp/linux_mips64_softfloat.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/linux_mips64_softfloat.elf
    Source: linux_mips64_softfloat.elf, 5590.1.000055eab2bcd000.000055eab2f41000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips64

    Stealing of Sensitive Information

    barindex
    Yara detected Chaos
    Source: Yara matchFile source: linux_mips64_softfloat.elf, type: SAMPLE

    Remote Access Functionality

    barindex
    Yara detected Chaos
    Source: Yara matchFile source: linux_mips64_softfloat.elf, type: SAMPLE

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
    Security Software Discovery    		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1562740 Sample: linux_mips64_softfloat.elf Startdate: 25/11/2024 Architecture: LINUX Score: 56 22 Multi AV Scanner detection for submitted file 2->22 24 Yara detected Chaos 2->24 6 sshd sshd 2->6         started        8 sshd sshd 2->8         started        10 sshd sshd 2->10         started        12 4 other processes 2->12 process3 process4 14 sshd 6->14         started        16 sshd 8->16         started        18 sshd 10->18         started        20 sshd 12->20         started       

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    linux_mips64_softfloat.elf39%ReversingLabsLinux.Trojan.Multiverze

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://www.baidu.com/search/spider.html)linux_mips64_softfloat.elffalse
      		high
      http://search.msn.com/msnbot.htmlinux_mips64_softfloat.elffalse
        		high
        http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829linux_mips64_softfloat.elffalse
          		high
          https://www.so.com/s?q=indexlinux_mips64_softfloat.elffalse
            		high
            http://help.yahoo.com/help/us/ysearch/slurp)x509:linux_mips64_softfloat.elffalse
              		high
              http://www.google.com/mobile/adsbot.html)linux_mips64_softfloat.elffalse
                		high
                http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0linux_mips64_softfloat.elffalse
                  		high
                  http://www.baidu.com/search/spider.html)http2:linux_mips64_softfloat.elffalse
                    		high
                    http://yandex.com/bots)http:linux_mips64_softfloat.elffalse
                      		high
                      http://www.baidu.com/search/spider.html)Mozilla/5.0linux_mips64_softfloat.elffalse
                        		high
                        http://www.entireweb.com/about/search_tech/speedy_spider/)text/htmllinux_mips64_softfloat.elffalse
                          		high
                          http://www.haosou.com/help/help_3_2.htmlMozilla/5.0linux_mips64_softfloat.elffalse
                            		high
                            https://www.baidu.com/s?wd=insufficientlinux_mips64_softfloat.elffalse
                              		high
                              http://www.youdao.com/help/webmaster/spider/;)reflect:linux_mips64_softfloat.elffalse
                                		high
                                https://search.yahoo.com/search?p=illegallinux_mips64_softfloat.elffalse
                                  		high

                                  World Map of Contacted IPs

                                  ⊘No contacted IP infos

                                  Joe Sandbox View / Context

                                  IPs

                                  ⊘No context

                                  Domains

                                  ⊘No context

                                  ASNs

                                  ⊘No context

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  /var/log/btmp

                                  Download File
                                  Process:/usr/sbin/sshd
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):384
                                  Entropy (8bit):0.8426406362528688
                                  Encrypted:false
                                  SSDEEP:3:U/aDLwbXWX0md2/l:UWMbGEm4/
                                  MD5:79EFB232B2BF31A8C11816E4A01C70AC
                                  SHA1:9BABCE79EBB88A8214C97A6B6A9E1A1BBE9F819D
                                  SHA-256:2F32BD4D2AE035792F741B3A001317F616F9AC36FD5CCFDD1AF9C5B8359E33E0
                                  SHA-512:8B333B9A52C08B4CD18034117E0607D0CB6D4F27EAD01EFEBA947918030F98C2F110369BBFA40C80818C9908A971E032AD437D085092C53837107C1FBC6D67E8
                                  Malicious:false
                                  Reputation:low
                                  Preview:........ssh:notty...........................root............................192.168.2.23..............................................................................................................................................................................................................................................................Eg........................................

                                  Static File Info

                                  General

                                  File type:ELF 64-bit MSB executable, MIPS, MIPS-III version 1 (SYSV), statically linked, Go BuildID=531EpRgthPZPt3knqoKK/ayf51kNy_prNzbkXr_MN/zxjogFIOCYVVIxufPI04/tQgJURn6GO8NPfNwspcu, stripped
                                  Entropy (8bit):5.3760576886776645
                                  TrID:
                                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                  File name:linux_mips64_softfloat.elf
                                  File size:5'963'776 bytes
                                  MD5:bddfa0887299e801b369b67bd5c6e61a
                                  SHA1:ed03b66e769e7a5711f2b98c6433c63a7989e244
                                  SHA256:095ab50f4779c214a51bb5d22a29a7c747cc61293aa57ac95dcec7f13c3efbf3
                                  SHA512:87ad4efabfc60551d59a9fa61128b70220e443a75c6c4840ff9e97ab6bd0b8fd334844958806e218f2f5833b24154bb20de49dd42b1d9a893517fe093178aed3
                                  SSDEEP:49152:XralYsYZ/MjJ7fhl2pCQLg1xbnZdY3MniUj0E/GiV:Xr9lMjJ7f+jWjV/P
                                  TLSH:0F560912BF58ED2FD25421308BB7C23433D53D1482E16533AA56F71E2EBA2B5991BDC8
                                  File Content Preview:.ELF...................................@........ ....@.8...@...................@.......@.......@...............................................................d.......d.............................................0.......0.......................1.......2.

                                  Static ELF Info

                                  ELF header

                                  Class:ELF64
                                  Data:2's complement, big endian
                                  Version:1 (current)
                                  Machine:MIPS R3000
                                  Version Number:0x1
                                  Type:EXEC (Executable file)
                                  OS/ABI:UNIX - System V
                                  ABI Version:0
                                  Entry Point Address:0x90000
                                  Flags:0x20000004
                                  ELF Header Size:64
                                  Program Header Offset:64
                                  Program Header Size:56
                                  Number of Program Headers:7
                                  Section Header Offset:456
                                  Section Header Size:64
                                  Number of Section Headers:14
                                  Header String Table Index:3

                                  Sections

                                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                  NULL0x00x00x00x00x0000
                                  .textPROGBITS0x110000x10000x30dbf00x00x6AX008
                                  .rodataPROGBITS0x3200000x3100000xf91340x00x2A0032
                                  .shstrtabSTRTAB0x00x4091400xa50x00x0001
                                  .typelinkPROGBITS0x4192000x4092000x17c80x00x2A0032
                                  .itablinkPROGBITS0x41a9e00x40a9e00x9480x00x2A0032
                                  .gosymtabPROGBITS0x41b3280x40b3280x00x00x2A001
                                  .gopclntabPROGBITS0x41b3400x40b3400x14bcb80x00x2A0032
                                  .go.buildinfoPROGBITS0x5700000x5600000xf00x00x3WA0016
                                  .noptrdataPROGBITS0x5701000x5601000x31e180x00x3WA0032
                                  .dataPROGBITS0x5a1f200x591f200xfe800x00x3WA0032
                                  .bssNOBITS0x5b1da00x5a1da00x301000x00x3WA0032
                                  .noptrbssNOBITS0x5e1ea00x5d1ea00xf5700x00x3WA0032
                                  .note.go.buildidNOTE0x10f9c0xf9c0x640x00x2A004

                                  Program Segments

                                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                  PHDR0x400x100400x100400x1880x1881.50300x4R 0x10000
                                  NOTE0xf9c0x10f9c0x10f9c0x640x645.31720x4R 0x4.note.go.buildid
                                  LOAD0x00x100000x100000x30ebf00x30ebf05.13710x5R E0x10000.text .note.go.buildid
                                  LOAD0x3100000x3200000x3200000x246ff80x246ff85.40300x4R 0x10000.rodata .typelink .itablink .gosymtab .gopclntab
                                  LOAD0x5600000x5700000x5700000x41da00x814105.04930x6RW 0x10000.go.buildinfo .noptrdata .data .bss .noptrbss
                                  GNU_STACK0x00x00x00x00x00.00000x6RW 0x8
                                  LOOS+50415800x00x00x00x00x00.00000x2a00 0x8

                                  Network Behavior

                                  ⊘No network behavior found

                                  System Behavior

                                  General

                                  Start time (UTC):22:55:45
                                  Start date (UTC):25/11/2024
                                  Path:/tmp/linux_mips64_softfloat.elf
                                  Arguments:/tmp/linux_mips64_softfloat.elf
                                  File size:5830456 bytes
                                  MD5 hash:801a06b4e0ed2dca89cbfa1f900a483d

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:55:59
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:55:59
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:/usr/sbin/sshd -D -R
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:55:59
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:55:59
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:/usr/sbin/sshd -D -R
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:55:59
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:03
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:03
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:/usr/sbin/sshd -D -R
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:04
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:04
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:04
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:/usr/sbin/sshd -D -R
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:05
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:05
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:/usr/sbin/sshd -D -R
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:05
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:09
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:09
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:/usr/sbin/sshd -D -R
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities


                                  General

                                  Start time (UTC):22:56:09
                                  Start date (UTC):25/11/2024
                                  Path:/usr/sbin/sshd
                                  Arguments:-
                                  File size:876328 bytes
                                  MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

                                  Chronological Activities