Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
j6XXqbYm7e.elf

Overview

General Information

Sample name:j6XXqbYm7e.elf
renamed because original name is a hash value
Original sample name:74385fdcc32a84eefe6e514023cd8d87.elf
Analysis ID:1433172
MD5:74385fdcc32a84eefe6e514023cd8d87
SHA1:c99f8966d596ac757a3fb3193ecff437b88f290c
SHA256:2dd0adbc6a7142d42c4efce47d5e9b4dee6c6b1716988b7a5c39081fa914d81f
Tags:32elfmirai
Infos:
Errors
  • No process behavior to analyse as no analysis process or sample was found

Detection

Score:48
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Found strings indicative of a multi-platform dropper
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Non-zero exit code suggests an error during the execution. Lookup the error code for hints.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1433172
Start date and time:2024-04-29 10:35:08 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 15s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:j6XXqbYm7e.elf
renamed because original name is a hash value
Original Sample Name:74385fdcc32a84eefe6e514023cd8d87.elf
Detection:MAL
Classification:mal48.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample

Errors

  • No process behavior to analyse as no analysis process or sample was found

Runtime Messages

Command:/tmp/j6XXqbYm7e.elf
PID:5436
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: j6XXqbYm7e.elfReversingLabs: Detection: 42%
Source: j6XXqbYm7e.elfVirustotal: Detection: 53%Perma Link
Source: j6XXqbYm7e.elfString: /root//tmp//dev//etc//boot//mnt//var//lib//lib64/wgettftpchmodcurl/proc/proc//exe/maps/proc/self/exe/cmdline76-21;-101-13;
Source: global trafficTCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: unknownNetwork traffic detected: HTTP traffic on port 48202 -> 443
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal48.linELF@0/0@2/0
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid AccountsWindows Management Instrumentation1
Scripting		Path InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Data Obfuscation		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
Application Layer Protocol		Traffic DuplicationData Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
j6XXqbYm7e.elf42%ReversingLabsLinux.Trojan.Mirai
j6XXqbYm7e.elf54%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.25
truefalse
    		high

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    185.125.190.26
    		unknownUnited Kingdom
    		41231CANONICAL-ASGBfalse

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    185.125.190.262IavS8ZiyR.elfGet hashmaliciousGafgyt, MiraiBrowse
      O8DWnp3hYL.elfGet hashmaliciousMiraiBrowse
        vlxx.arm-20240429-0621.elfGet hashmaliciousMirai, OkiruBrowse
          YUXmzSyx2w.elfGet hashmaliciousUnknownBrowse
            ZK22ZeetwQ.elfGet hashmaliciousGafgytBrowse
              klsF8gYFlY.elfGet hashmaliciousGafgytBrowse
                WWQ0qfXZlC.elfGet hashmaliciousGafgytBrowse
                  m-6.8-k.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                    ksN5I8VP6m.elfGet hashmaliciousMirai, OkiruBrowse
                      vlxx.x86_64.elfGet hashmaliciousMirai, OkiruBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        daisy.ubuntu.com4m7kJWbQrV.elfGet hashmaliciousMiraiBrowse
                        • 162.213.35.25
                        2IavS8ZiyR.elfGet hashmaliciousGafgyt, MiraiBrowse
                        • 162.213.35.25
                        vlxx.x86_64-20240429-0621.elfGet hashmaliciousMirai, OkiruBrowse
                        • 162.213.35.25
                        vlxx.arm-20240429-0621.elfGet hashmaliciousMirai, OkiruBrowse
                        • 162.213.35.25
                        vlxx.mips-20240429-0621.elfGet hashmaliciousMirai, OkiruBrowse
                        • 162.213.35.25
                        Y6amoUtoJ4.elfGet hashmaliciousUnknownBrowse
                        • 162.213.35.24
                        Et1RwED4Cr.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.25
                        LJeE3iligi.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.24
                        5YyCE97ILe.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.25
                        9GBdDTh7d2.elfGet hashmaliciousGafgytBrowse
                        • 162.213.35.24

                        ASNs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        CANONICAL-ASGB2IavS8ZiyR.elfGet hashmaliciousGafgyt, MiraiBrowse
                        • 185.125.190.26
                        HZunb4SzHx.elfGet hashmaliciousGafgyt, MiraiBrowse
                        • 91.189.91.42
                        RtqxMaf7FC.elfGet hashmaliciousMiraiBrowse
                        • 91.189.91.42
                        nro1YIsjcS.elfGet hashmaliciousMiraiBrowse
                        • 91.189.91.42
                        O8DWnp3hYL.elfGet hashmaliciousMiraiBrowse
                        • 185.125.190.26
                        vlxx.arm5-20240429-0621.elfGet hashmaliciousMirai, OkiruBrowse
                        • 91.189.91.42
                        vlxx.arm-20240429-0621.elfGet hashmaliciousMirai, OkiruBrowse
                        • 185.125.190.26
                        vlxx.mpsl-20240429-0621.elfGet hashmaliciousMirai, OkiruBrowse
                        • 91.189.91.42
                        skid.x86.elfGet hashmaliciousUnknownBrowse
                        • 91.189.91.42
                        arm6.elfGet hashmaliciousUnknownBrowse
                        • 91.189.91.42

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        ⊘No created / dropped files found

                        Static File Info

                        General

                        File type:ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, for GNU/Linux 4.8.0, stripped
                        Entropy (8bit):6.130466993104767
                        TrID:
                        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                        File name:j6XXqbYm7e.elf
                        File size:58'828 bytes
                        MD5:74385fdcc32a84eefe6e514023cd8d87
                        SHA1:c99f8966d596ac757a3fb3193ecff437b88f290c
                        SHA256:2dd0adbc6a7142d42c4efce47d5e9b4dee6c6b1716988b7a5c39081fa914d81f
                        SHA512:37f2f444d7e674909be299a5a06b460097dcbfab073f4d9a9e51845e79223dcb64cbc6889c552bf081425f8cec1c79b57ebe79a6006ad6aeb0726909683bdd1c
                        SSDEEP:768:k1z/Q9ZuIzf2PQls24aySfuqKMmiKDpwK2K/tC5THFu0tzI2PshmHHHHHH:k1jwuIzf2PasYySGs21yRWzInnn
                        TLSH:084319685E81B67CF7B510BCF02322A654B22F1C2B9DA6F3A4C2783EEF54684567CD44
                        File Content Preview:.ELF..............].........4...4.......4. ...(.........4...4...4.......................4...4...4................................................ ......$...$...$................ ......,...,...,.......................H...H...H... ... ...........Q.td.......

                        Static ELF Info

                        ELF header

                        Class:ELF32
                        Data:2's complement, little endian
                        Version:1 (current)
                        Machine:<unknown>
                        Version Number:0x1
                        Type:EXEC (Executable file)
                        OS/ABI:UNIX - System V
                        ABI Version:0
                        Entry Point Address:0x11014
                        Flags:0x403
                        ELF Header Size:52
                        Program Header Offset:52
                        Program Header Size:32
                        Number of Program Headers:8
                        Section Header Offset:57908
                        Section Header Size:40
                        Number of Section Headers:23
                        Header String Table Index:22

                        Sections

                        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                        NULL0x00x00x00x00x0000
                        .interpPROGBITS0x101340x1340x140x00x2A001
                        .note.ABI-tagNOTE0x101480x1480x200x00x2A004
                        .hashHASH0x101680x1680x1940x40x2A504
                        .gnu.hashGNU_HASH0x102fc0x2fc0x1d80x40x2A504
                        .dynsymDYNSYM0x104d40x4d40x3e00x100x2A614
                        .dynstrSTRTAB0x108b40x8b40x1ca0x00x2A001
                        .rela.pltRELA0x10a800xa800x2b80xc0x42AI5174
                        .initPROGBITS0x10d380xd380xa0x00x6AX001
                        .pltPROGBITS0x10d440xd440x2d00x00x6AX004
                        .textPROGBITS0x110140x10140xb34c0x00x6AX004
                        .finiPROGBITS0x1c3600xc3600xa0x00x6AX001
                        .rodataPROGBITS0x1c36c0xc36c0x10200x00x2A004
                        .eh_framePROGBITS0x1d38c0xd38c0x40x00x2A004
                        .init_arrayINIT_ARRAY0x1ff240xdf240x40x40x3WA004
                        .fini_arrayFINI_ARRAY0x1ff280xdf280x40x40x3WA004
                        .dynamicDYNAMIC0x1ff2c0xdf2c0xd00x80x3WA604
                        .got.pltPROGBITS0x1fffc0xdffc0xf40x00x3WA004
                        .dataPROGBITS0x200f00xe0f00x1c0x00x3WA004
                        .bssNOBITS0x2010c0xe10c0x12240x00x3WA004
                        .commentPROGBITS0x00xe10c0x3f0x10x30MS001
                        .ARC.attributes<unknown>0x00xe14b0x300x00x0001
                        .shstrtabSTRTAB0x00xe17b0xb70x00x0001

                        Program Segments

                        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                        PHDR0x340x100340x100340x1000x1002.42110x4R 0x4
                        INTERP0x1340x101340x101340x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                        LOAD0x00x100000x100000xd3900xd3906.35100x5R E0x2000.interp .note.ABI-tag .hash .gnu.hash .dynsym .dynstr .rela.plt .init .plt .text .fini .rodata .eh_frame
                        LOAD0xdf240x1ff240x1ff240x1e80x140c2.77790x6RW 0x2000.init_array .fini_array .dynamic .got.plt .data .bss
                        DYNAMIC0xdf2c0x1ff2c0x1ff2c0xd00xd02.44730x6RW 0x4.dynamic
                        NOTE0x1480x101480x101480x200x201.49880x4R 0x4.note.ABI-tag
                        GNU_STACK0x00x00x00x00x00.00000x6RW 0x10
                        GNU_RELRO0xdf240x1ff240x1ff240xdc0xdc2.58550x4R 0x1.init_array .fini_array .dynamic

                        Dynamic Tags

                        TypeMetaValueTag
                        DT_NEEDEDsharedliblibc.so.00x1
                        DT_INITvalue0x10d3c0xc
                        DT_FINIvalue0x1c3640xd
                        DT_INIT_ARRAYvalue0x1ff240x19
                        DT_INIT_ARRAYSZbytes40x1b
                        DT_FINI_ARRAYvalue0x1ff280x1a
                        DT_FINI_ARRAYSZbytes40x1c
                        DT_HASHvalue0x101680x4
                        DT_GNU_HASHvalue0x102fc0x6ffffef5
                        DT_STRTABvalue0x108b40x5
                        DT_SYMTABvalue0x104d40x6
                        DT_STRSZbytes4580xa
                        DT_SYMENTbytes160xb
                        DT_INITvalue0x10d3c0xc
                        DT_FINIvalue0x1c3640xd
                        DT_DEBUGvalue0x00x15
                        DT_PLTGOTvalue0x10d440x3
                        DT_PLTRELSZbytes6960x2
                        DT_PLTRELpltrelDT_RELA0x14
                        DT_JMPRELvalue0x10a800x17
                        DT_NULLvalue0x00x0

                        Symbols

                        NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                        .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                        __bss_start.dynsym0x2010c0NOTYPE<unknown>DEFAULT19
                        __errno_location.dynsym0x10f840FUNC<unknown>DEFAULTSHN_UNDEF
                        __uClibc_main.dynsym0x10f240FUNC<unknown>DEFAULTSHN_UNDEF
                        _edata.dynsym0x2010c0NOTYPE<unknown>DEFAULT18
                        _end.dynsym0x213300NOTYPE<unknown>DEFAULT19
                        accept.dynsym0x10e580FUNC<unknown>DEFAULTSHN_UNDEF
                        atoi.dynsym0x10f9c0FUNC<unknown>DEFAULTSHN_UNDEF
                        bind.dynsym0x10e880FUNC<unknown>DEFAULTSHN_UNDEF
                        calloc.dynsym0x10e640FUNC<unknown>DEFAULTSHN_UNDEF
                        chdir.dynsym0x10eac0FUNC<unknown>DEFAULTSHN_UNDEF
                        clock.dynsym0x10fb40FUNC<unknown>DEFAULTSHN_UNDEF
                        close.dynsym0x10fe40FUNC<unknown>DEFAULTSHN_UNDEF
                        closedir.dynsym0x10fcc0FUNC<unknown>DEFAULTSHN_UNDEF
                        connect.dynsym0x10d800FUNC<unknown>DEFAULTSHN_UNDEF
                        exit.dynsym0x10f900FUNC<unknown>DEFAULTSHN_UNDEF
                        fcntl.dynsym0x10fd80FUNC<unknown>DEFAULTSHN_UNDEF
                        fork.dynsym0x10f180FUNC<unknown>DEFAULTSHN_UNDEF
                        free.dynsym0x10ff00FUNC<unknown>DEFAULTSHN_UNDEF
                        getpid.dynsym0x10db00FUNC<unknown>DEFAULTSHN_UNDEF
                        getppid.dynsym0x10f480FUNC<unknown>DEFAULTSHN_UNDEF
                        getsockname.dynsym0x110080FUNC<unknown>DEFAULTSHN_UNDEF
                        getsockopt.dynsym0x10f6c0FUNC<unknown>DEFAULTSHN_UNDEF
                        htonl.dynsym0x10ee80FUNC<unknown>DEFAULTSHN_UNDEF
                        htons.dynsym0x10f780FUNC<unknown>DEFAULTSHN_UNDEF
                        inet_addr.dynsym0x10e940FUNC<unknown>DEFAULTSHN_UNDEF
                        ioctl.dynsym0x10d680FUNC<unknown>DEFAULTSHN_UNDEF
                        kill.dynsym0x10e7c0FUNC<unknown>DEFAULTSHN_UNDEF
                        listen.dynsym0x10f0c0FUNC<unknown>DEFAULTSHN_UNDEF
                        malloc.dynsym0x10dec0FUNC<unknown>DEFAULTSHN_UNDEF
                        memcpy.dynsym0x10dc80FUNC<unknown>DEFAULTSHN_UNDEF
                        memmove.dynsym0x10d980FUNC<unknown>DEFAULTSHN_UNDEF
                        memset.dynsym0x10f300FUNC<unknown>DEFAULTSHN_UNDEF
                        mmap.dynsym0x10e400FUNC<unknown>DEFAULTSHN_UNDEF
                        ntohl.dynsym0x10ea00FUNC<unknown>DEFAULTSHN_UNDEF
                        ntohs.dynsym0x10f3c0FUNC<unknown>DEFAULTSHN_UNDEF
                        open.dynsym0x10fa80FUNC<unknown>DEFAULTSHN_UNDEF
                        opendir.dynsym0x10f600FUNC<unknown>DEFAULTSHN_UNDEF
                        prctl.dynsym0x10dbc0FUNC<unknown>DEFAULTSHN_UNDEF
                        rand.dynsym0x10ec40FUNC<unknown>DEFAULTSHN_UNDEF
                        read.dynsym0x10edc0FUNC<unknown>DEFAULTSHN_UNDEF
                        readdir.dynsym0x10e280FUNC<unknown>DEFAULTSHN_UNDEF
                        readlink.dynsym0x10dd40FUNC<unknown>DEFAULTSHN_UNDEF
                        realloc.dynsym0x10f000FUNC<unknown>DEFAULTSHN_UNDEF
                        recv.dynsym0x10d740FUNC<unknown>DEFAULTSHN_UNDEF
                        recvfrom.dynsym0x10e040FUNC<unknown>DEFAULTSHN_UNDEF
                        rewinddir.dynsym0x10de00FUNC<unknown>DEFAULTSHN_UNDEF
                        select.dynsym0x10e1c0FUNC<unknown>DEFAULTSHN_UNDEF
                        send.dynsym0x10e4c0FUNC<unknown>DEFAULTSHN_UNDEF
                        sendto.dynsym0x10ef40FUNC<unknown>DEFAULTSHN_UNDEF
                        setsid.dynsym0x10fc00FUNC<unknown>DEFAULTSHN_UNDEF
                        setsockopt.dynsym0x10eb80FUNC<unknown>DEFAULTSHN_UNDEF
                        sigaddset.dynsym0x10e340FUNC<unknown>DEFAULTSHN_UNDEF
                        sigemptyset.dynsym0x10d8c0FUNC<unknown>DEFAULTSHN_UNDEF
                        signal.dynsym0x10ed00FUNC<unknown>DEFAULTSHN_UNDEF
                        sigprocmask.dynsym0x10ffc0FUNC<unknown>DEFAULTSHN_UNDEF
                        sleep.dynsym0x10df80FUNC<unknown>DEFAULTSHN_UNDEF
                        socket.dynsym0x10e100FUNC<unknown>DEFAULTSHN_UNDEF
                        strcpy.dynsym0x10d5c0FUNC<unknown>DEFAULTSHN_UNDEF
                        time.dynsym0x10f540FUNC<unknown>DEFAULTSHN_UNDEF
                        usleep.dynsym0x10da40FUNC<unknown>DEFAULTSHN_UNDEF
                        write.dynsym0x10e700FUNC<unknown>DEFAULTSHN_UNDEF

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Apr 29, 2024 10:35:59.987253904 CEST48202443192.168.2.13185.125.190.26
                        Apr 29, 2024 10:36:30.707247019 CEST48202443192.168.2.13185.125.190.26

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Apr 29, 2024 10:38:33.620798111 CEST3351753192.168.2.131.1.1.1
                        Apr 29, 2024 10:38:33.620861053 CEST5966853192.168.2.131.1.1.1
                        Apr 29, 2024 10:38:33.731000900 CEST53596681.1.1.1192.168.2.13
                        Apr 29, 2024 10:38:33.731439114 CEST53335171.1.1.1192.168.2.13

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        Apr 29, 2024 10:38:33.620798111 CEST192.168.2.131.1.1.10x5395Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                        Apr 29, 2024 10:38:33.620861053 CEST192.168.2.131.1.1.10x8183Standard query (0)daisy.ubuntu.com28IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        Apr 29, 2024 10:38:33.731439114 CEST1.1.1.1192.168.2.130x5395No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                        Apr 29, 2024 10:38:33.731439114 CEST1.1.1.1192.168.2.130x5395No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                        System Behavior