Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
dPOYR1HYAD.elf

Overview

General Information

Sample name:dPOYR1HYAD.elf
renamed because original name is a hash value
Original sample name:41d3ee7390ce39e60f95c0144128fc45.elf
Analysis ID:1432064
MD5:41d3ee7390ce39e60f95c0144128fc45
SHA1:3c5e22a7c783a22f3de39b448911ab294847532b
SHA256:2fa1aa901170e3b67af6006da325523b38bd610ac387cfeeac3dc55ea9e9aa55
Tags:32elfmipsmirai
Infos:

Detection

Okiru
Score:60
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Okiru
Sample is packed with UPX
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "rm" command used to delete files or directories
Reads CPU information from /proc indicative of miner or evasive malware
Reads system information from the proc file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1432064
Start date and time:2024-04-26 11:16:56 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 57s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:dPOYR1HYAD.elf
renamed because original name is a hash value
Original Sample Name:41d3ee7390ce39e60f95c0144128fc45.elf
Detection:MAL
Classification:mal60.troj.evad.linELF@0/0@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/tmp/dPOYR1HYAD.elf
PID:6205
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • dash New Fork (PID: 6247, Parent: 4331)
  • rm (PID: 6247, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.RsMkx57hJx /tmp/tmp.br4Wgx1gNE /tmp/tmp.pUQWfyOGYi
  • dash New Fork (PID: 6248, Parent: 4331)
  • cat (PID: 6248, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.RsMkx57hJx
  • dash New Fork (PID: 6249, Parent: 4331)
  • head (PID: 6249, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6250, Parent: 4331)
  • tr (PID: 6250, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6251, Parent: 4331)
  • cut (PID: 6251, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6252, Parent: 4331)
  • cat (PID: 6252, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.RsMkx57hJx
  • dash New Fork (PID: 6253, Parent: 4331)
  • head (PID: 6253, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 6254, Parent: 4331)
  • tr (PID: 6254, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 6255, Parent: 4331)
  • cut (PID: 6255, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 6256, Parent: 4331)
  • rm (PID: 6256, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.RsMkx57hJx /tmp/tmp.br4Wgx1gNE /tmp/tmp.pUQWfyOGYi
  • cleanup

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
6205.1.00007f25c4400000.00007f25c4426000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
    6209.1.00007f25c4400000.00007f25c4426000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      6211.1.00007f25c4400000.00007f25c4426000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
        6294.1.00007f25c4400000.00007f25c4426000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
          Process Memory Space: dPOYR1HYAD.elf PID: 6205JoeSecurity_OkiruYara detected OkiruJoe Security
            Click to see the 3 entries

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: dPOYR1HYAD.elfReversingLabs: Detection: 15%
            Source: dPOYR1HYAD.elfVirustotal: Detection: 13%Perma Link
            Source: /tmp/dPOYR1HYAD.elf (PID: 6211)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
            Source: dPOYR1HYAD.elfString found in binary or memory: http://upx.sf.net
            Source: LOAD without section mappingsProgram segment: 0x400000
            Source: /tmp/dPOYR1HYAD.elf (PID: 6211)SIGKILL sent: pid: -6209, result: unknownJump to behavior
            Source: /tmp/dPOYR1HYAD.elf (PID: 6294)SIGKILL sent: pid: 6294, result: unknownJump to behavior
            Source: classification engineClassification label: mal60.troj.evad.linELF@0/0@0/0

            Data Obfuscation

            barindex
            Sample is packed with UPX
            Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
            Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
            Source: initial sampleString containing UPX found: $Id: UPX 4.30 Copyright (C) 1996-2024 the UPX Team. All Rights Reserved. $
            Source: /usr/bin/dash (PID: 6247)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.RsMkx57hJx /tmp/tmp.br4Wgx1gNE /tmp/tmp.pUQWfyOGYiJump to behavior
            Source: /usr/bin/dash (PID: 6256)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.RsMkx57hJx /tmp/tmp.br4Wgx1gNE /tmp/tmp.pUQWfyOGYiJump to behavior
            Source: /tmp/dPOYR1HYAD.elf (PID: 6211)Reads from proc file: /proc/cpuinfoJump to behavior
            Source: /tmp/dPOYR1HYAD.elf (PID: 6211)Reads from proc file: /proc/meminfoJump to behavior
            Source: dPOYR1HYAD.elfSubmission file: segment LOAD with 7.5156 entropy (max. 8.0)
            Source: dPOYR1HYAD.elfSubmission file: segment LOAD with 7.6806 entropy (max. 8.0)
            Source: /tmp/dPOYR1HYAD.elf (PID: 6211)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
            Source: /tmp/dPOYR1HYAD.elf (PID: 6205)Queries kernel information via 'uname': Jump to behavior
            Source: dPOYR1HYAD.elf, 6205.1.000055f11acfa000.000055f11ad81000.rw-.sdmp, dPOYR1HYAD.elf, 6209.1.000055f11acfa000.000055f11ad81000.rw-.sdmp, dPOYR1HYAD.elf, 6211.1.000055f11acfa000.000055f11ad81000.rw-.sdmp, dPOYR1HYAD.elf, 6294.1.000055f11acfa000.000055f11ad81000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
            Source: dPOYR1HYAD.elf, 6205.1.000055f11acfa000.000055f11ad81000.rw-.sdmp, dPOYR1HYAD.elf, 6209.1.000055f11acfa000.000055f11ad81000.rw-.sdmp, dPOYR1HYAD.elf, 6211.1.000055f11acfa000.000055f11ad81000.rw-.sdmp, dPOYR1HYAD.elf, 6294.1.000055f11acfa000.000055f11ad81000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
            Source: dPOYR1HYAD.elf, 6205.1.00007ffc8cd5a000.00007ffc8cd7b000.rw-.sdmp, dPOYR1HYAD.elf, 6209.1.00007ffc8cd5a000.00007ffc8cd7b000.rw-.sdmp, dPOYR1HYAD.elf, 6211.1.00007ffc8cd5a000.00007ffc8cd7b000.rw-.sdmp, dPOYR1HYAD.elf, 6294.1.00007ffc8cd5a000.00007ffc8cd7b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel
            Source: dPOYR1HYAD.elf, 6205.1.00007ffc8cd5a000.00007ffc8cd7b000.rw-.sdmp, dPOYR1HYAD.elf, 6209.1.00007ffc8cd5a000.00007ffc8cd7b000.rw-.sdmp, dPOYR1HYAD.elf, 6211.1.00007ffc8cd5a000.00007ffc8cd7b000.rw-.sdmp, dPOYR1HYAD.elf, 6294.1.00007ffc8cd5a000.00007ffc8cd7b000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/dPOYR1HYAD.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dPOYR1HYAD.elf

            Stealing of Sensitive Information

            barindex
            Yara detected Okiru
            Source: Yara matchFile source: 6205.1.00007f25c4400000.00007f25c4426000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6209.1.00007f25c4400000.00007f25c4426000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6211.1.00007f25c4400000.00007f25c4426000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6294.1.00007f25c4400000.00007f25c4426000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: dPOYR1HYAD.elf PID: 6205, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dPOYR1HYAD.elf PID: 6209, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dPOYR1HYAD.elf PID: 6211, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dPOYR1HYAD.elf PID: 6294, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected Okiru
            Source: Yara matchFile source: 6205.1.00007f25c4400000.00007f25c4426000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6209.1.00007f25c4400000.00007f25c4426000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6211.1.00007f25c4400000.00007f25c4426000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 6294.1.00007f25c4400000.00007f25c4426000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: dPOYR1HYAD.elf PID: 6205, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dPOYR1HYAD.elf PID: 6209, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dPOYR1HYAD.elf PID: 6211, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: dPOYR1HYAD.elf PID: 6294, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
            Obfuscated Files or Information            		OS Credential Dumping11
            Security Software Discovery            		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
            File Deletion            		LSASS Memory2
            System Information Discovery            		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service

            Malware Configuration

            ⊘No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1432064 Sample: dPOYR1HYAD.elf Startdate: 26/04/2024 Architecture: LINUX Score: 60 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected Okiru 2->26 28 Sample is packed with UPX 2->28 8 dPOYR1HYAD.elf 2->8         started        10 dash rm 2->10         started        12 dash cat 2->12         started        14 8 other processes 2->14 process3 process4 16 dPOYR1HYAD.elf 8->16         started        18 dPOYR1HYAD.elf 8->18         started        process5 20 dPOYR1HYAD.elf 16->20         started        process6 22 dPOYR1HYAD.elf 20->22         started       

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            dPOYR1HYAD.elf16%ReversingLabs
            dPOYR1HYAD.elf14%VirustotalBrowse

            Dropped Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://upx.sf.netdPOYR1HYAD.elffalse
              		high

              World Map of Contacted IPs

              ⊘No contacted IP infos

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              ⊘No created / dropped files found

              Static File Info

              General

              File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
              Entropy (8bit):7.6853364246940234
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:dPOYR1HYAD.elf
              File size:52'932 bytes
              MD5:41d3ee7390ce39e60f95c0144128fc45
              SHA1:3c5e22a7c783a22f3de39b448911ab294847532b
              SHA256:2fa1aa901170e3b67af6006da325523b38bd610ac387cfeeac3dc55ea9e9aa55
              SHA512:dde7e3e419a6b434c9dda7f84c6076112ba1daae0940a6f759a52bda2a93e6a9924751eb334b1b1074bc84cccd2d29554a3a1a1338c6123ad7c0e5ff5ddcda30
              SSDEEP:1536:HbTmBAy9bBzZOhgjR8MpZdfy2EVrOJ1BBUu5IL9vo:HbynRBFOh/gKrOJ135I5Q
              TLSH:873301579CACA7B4D71093F3F547243E7F511A5B50C453F702A6A6671BA38C052980EB
              File Content Preview:.ELF......................D.4...........4. ...................@...@......l....................D...D.................Q.td.............................5.. ...........h...@Y......n........?d..ELF.........@.....4........ ...(........&p...@....].d.M@.@Y..cc#..

              Static ELF Info

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:MIPS R3000
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:UNIX - System V
              ABI Version:0
              Entry Point Address:0x44bbc0
              Flags:0x1007
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:3
              Section Header Offset:0
              Section Header Size:0
              Number of Section Headers:0
              Header String Table Index:0

              Program Segments

              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x4000000x4000000x10000x36c047.51560x6RW 0x10000
              LOAD0x00x4400000x4400000xc6810xc6817.68060x5R E0x10000
              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

              Network Behavior

              ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

              System Behavior

              General

              Start time (UTC):09:17:35
              Start date (UTC):26/04/2024
              Path:/tmp/dPOYR1HYAD.elf
              Arguments:/tmp/dPOYR1HYAD.elf
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Chronological Activities


              General

              Start time (UTC):09:17:36
              Start date (UTC):26/04/2024
              Path:/tmp/dPOYR1HYAD.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Chronological Activities


              General

              Start time (UTC):09:17:36
              Start date (UTC):26/04/2024
              Path:/tmp/dPOYR1HYAD.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Chronological Activities


              General

              Start time (UTC):09:17:36
              Start date (UTC):26/04/2024
              Path:/tmp/dPOYR1HYAD.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Chronological Activities


              General

              Start time (UTC):09:18:43
              Start date (UTC):26/04/2024
              Path:/tmp/dPOYR1HYAD.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/rm
              Arguments:rm -f /tmp/tmp.RsMkx57hJx /tmp/tmp.br4Wgx1gNE /tmp/tmp.pUQWfyOGYi
              File size:72056 bytes
              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/cat
              Arguments:cat /tmp/tmp.RsMkx57hJx
              File size:43416 bytes
              MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/head
              Arguments:head -n 10
              File size:47480 bytes
              MD5 hash:fd96a67145172477dd57131396fc9608

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/tr
              Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
              File size:51544 bytes
              MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/cut
              Arguments:cut -c -80
              File size:47480 bytes
              MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/cat
              Arguments:cat /tmp/tmp.RsMkx57hJx
              File size:43416 bytes
              MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/head
              Arguments:head -n 10
              File size:47480 bytes
              MD5 hash:fd96a67145172477dd57131396fc9608

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/tr
              Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
              File size:51544 bytes
              MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:04
              Start date (UTC):26/04/2024
              Path:/usr/bin/cut
              Arguments:cut -c -80
              File size:47480 bytes
              MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

              Chronological Activities


              General

              Start time (UTC):09:18:05
              Start date (UTC):26/04/2024
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):09:18:05
              Start date (UTC):26/04/2024
              Path:/usr/bin/rm
              Arguments:rm -f /tmp/tmp.RsMkx57hJx /tmp/tmp.br4Wgx1gNE /tmp/tmp.pUQWfyOGYi
              File size:72056 bytes
              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

              Chronological Activities