Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
Lj7qNwy54U.elf

Overview

General Information

Sample name:Lj7qNwy54U.elf
renamed because original name is a hash value
Original sample name:92a059d069b3cbf607b1d1608f5f82b0.elf
Analysis ID:1438521
MD5:92a059d069b3cbf607b1d1608f5f82b0
SHA1:a5aafc90ede43ca636bf64d872bbe84bf5ee1495
SHA256:1d7d672b8e29a2043714b2d8c3c9ebb4601d5a69da274aa0ab78c4fa3d1b06da
Tags:32elfmiraimotorola
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1438521
Start date and time:2024-05-08 20:13:16 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 27s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Lj7qNwy54U.elf
renamed because original name is a hash value
Original Sample Name:92a059d069b3cbf607b1d1608f5f82b0.elf
Detection:MAL
Classification:mal52.troj.linELF@0/0@1/0

Warnings

  • VT rate limit hit for: Lj7qNwy54U.elf

Runtime Messages

Command:/tmp/Lj7qNwy54U.elf
PID:5534
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
xXxSlicexXxxVEGA.
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: Lj7qNwy54U.elfReversingLabs: Detection: 55%

Networking

barindex
Connects to many ports of the same IP (likely port scanning)
Source: global trafficTCP traffic: 91.92.244.58 ports 0,1,5,6,9,60195
Source: global trafficTCP traffic: 192.168.2.15:38228 -> 91.92.244.58:60195
Source: /tmp/Lj7qNwy54U.elf (PID: 5534)Socket: 127.0.0.1::63841Jump to behavior
Source: global trafficDNS traffic detected: DNS query: minuoddos.top
Source: ELF static info symbol of initial sample.symtab present: no
Source: classification engineClassification label: mal52.troj.linELF@0/0@1/0
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1185/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3241/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1732/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1730/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1333/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1695/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3235/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3234/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/911/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/515/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/914/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1617/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1615/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/917/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3255/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3253/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1591/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3252/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3251/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3250/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1623/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1588/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3249/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/764/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1585/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3246/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/766/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/800/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/888/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/802/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1509/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/803/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/804/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1867/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1484/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/490/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1514/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1634/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1479/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1875/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/654/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/655/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/656/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/777/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/931/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1595/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/657/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/812/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/779/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/658/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/933/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/418/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/419/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3275/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3274/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3273/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3272/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/782/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1762/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3027/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1486/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/789/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1806/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1660/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3044/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/793/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/794/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/674/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/796/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/675/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/676/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1498/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1497/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1496/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3157/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3278/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1659/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3210/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3298/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3052/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/680/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/681/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3292/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1701/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1666/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3205/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3047/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3201/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/723/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/724/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1704/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1669/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3060/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1440/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3222/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3188/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3220/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3064/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3062/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/3183/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1679/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/850/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1432/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1553/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5541)File opened: /proc/1431/mapsJump to behavior
Source: /tmp/Lj7qNwy54U.elf (PID: 5534)Queries kernel information via 'uname': Jump to behavior
Source: Lj7qNwy54U.elf, 5534.1.0000562a21a21000.0000562a21aa6000.rw-.sdmp, Lj7qNwy54U.elf, 5536.1.0000562a21a21000.0000562a21aa6000.rw-.sdmp, Lj7qNwy54U.elf, 5540.1.0000562a21a21000.0000562a21aa6000.rw-.sdmpBinary or memory string: !*V!/etc/qemu-binfmt/m68k
Source: Lj7qNwy54U.elf, 5534.1.00007ffdcc9c7000.00007ffdcc9e8000.rw-.sdmp, Lj7qNwy54U.elf, 5536.1.00007ffdcc9c7000.00007ffdcc9e8000.rw-.sdmp, Lj7qNwy54U.elf, 5540.1.00007ffdcc9c7000.00007ffdcc9e8000.rw-.sdmpBinary or memory string: Cx86_64/usr/bin/qemu-m68k/tmp/Lj7qNwy54U.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Lj7qNwy54U.elf
Source: Lj7qNwy54U.elf, 5534.1.00007ffdcc9c7000.00007ffdcc9e8000.rw-.sdmp, Lj7qNwy54U.elf, 5536.1.00007ffdcc9c7000.00007ffdcc9e8000.rw-.sdmp, Lj7qNwy54U.elf, 5540.1.00007ffdcc9c7000.00007ffdcc9e8000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
Source: Lj7qNwy54U.elf, 5534.1.0000562a21a21000.0000562a21aa6000.rw-.sdmp, Lj7qNwy54U.elf, 5536.1.0000562a21a21000.0000562a21aa6000.rw-.sdmp, Lj7qNwy54U.elf, 5540.1.0000562a21a21000.0000562a21aa6000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local System1
Non-Standard Port		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1438521 Sample: Lj7qNwy54U.elf Startdate: 08/05/2024 Architecture: LINUX Score: 52 18 minuoddos.top 91.92.244.58, 38228, 60195 THEZONEBG Bulgaria 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Connects to many ports of the same IP (likely port scanning) 2->22 8 Lj7qNwy54U.elf 2->8         started        signatures3 process4 process5 10 Lj7qNwy54U.elf 8->10         started        12 Lj7qNwy54U.elf 8->12         started        process6 14 Lj7qNwy54U.elf 10->14         started        16 Lj7qNwy54U.elf 10->16         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Lj7qNwy54U.elf55%ReversingLabsLinux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
minuoddos.top
91.92.244.58
truetrue
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    91.92.244.58
    		minuoddos.topBulgaria
    		34368THEZONEBGtrue

    Joe Sandbox View / Context

    IPs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    91.92.244.58g4jUx3nLmP.elfGet hashmaliciousUnknownBrowse
      JupQoUiGIu.elfGet hashmaliciousUnknownBrowse
        mg5TkCr4DY.elfGet hashmaliciousUnknownBrowse

          Domains

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          minuoddos.topg4jUx3nLmP.elfGet hashmaliciousUnknownBrowse
          • 91.92.244.58
          JupQoUiGIu.elfGet hashmaliciousUnknownBrowse
          • 91.92.244.58
          mg5TkCr4DY.elfGet hashmaliciousUnknownBrowse
          • 91.92.244.58

          ASNs

          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          THEZONEBGg4jUx3nLmP.elfGet hashmaliciousUnknownBrowse
          • 91.92.244.58
          JupQoUiGIu.elfGet hashmaliciousUnknownBrowse
          • 91.92.244.58
          mg5TkCr4DY.elfGet hashmaliciousUnknownBrowse
          • 91.92.244.58
          z51ComprobantedePago.exeGet hashmaliciousXenoRATBrowse
          • 91.92.243.131
          Comprobante.exeGet hashmaliciousXenoRATBrowse
          • 91.92.243.131
          SecuriteInfo.com.Trojan.PackedNET.2147.22278.5618.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
          • 91.92.253.28
          VT3czLymhe.exeGet hashmaliciousUnknownBrowse
          • 91.92.253.114
          Comprobante.exeGet hashmaliciousXenoRATBrowse
          • 91.92.243.131
          download.elfGet hashmaliciousUnknownBrowse
          • 91.92.245.104
          Odeme_belgesi.exeGet hashmaliciousXenoRATBrowse
          • 91.92.243.131

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
          Entropy (8bit):6.3342728969748245
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:Lj7qNwy54U.elf
          File size:62'472 bytes
          MD5:92a059d069b3cbf607b1d1608f5f82b0
          SHA1:a5aafc90ede43ca636bf64d872bbe84bf5ee1495
          SHA256:1d7d672b8e29a2043714b2d8c3c9ebb4601d5a69da274aa0ab78c4fa3d1b06da
          SHA512:6a5236457defb0fb4c167c59f5ed8f2cdf0b8c4d232346c31e26451870c4ea7028a1a8538e74188c5627f571c3f790f776027a244ecc4172b2aab273368188f3
          SSDEEP:1536:B41jh2OVyr34vo6oQbFQdPWwmPtRX9I8Rx:+jdyr+oKpoOtRtJ
          TLSH:B2531899B401AEBCF95FDAFA81264D0DF821B20161830F36677BFEC36C720A59D53946
          File Content Preview:.ELF.......................D...4...x.....4. ...(.................................. ....................(.......... .dt.Q............................NV..a....da.....N^NuNV..J9...8f>"y...( QJ.g.X.#....(N."y...( QJ.f.A.....J.g.Hy....N.X........8N^NuNV..N^NuN

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, big endian
          Version:1 (current)
          Machine:MC68000
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x80000144
          Flags:0x0
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:62072
          Section Header Size:40
          Number of Section Headers:10
          Header String Table Index:9

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x800000940x940x140x00x6AX002
          .textPROGBITS0x800000a80xa80xe5b60x00x6AX004
          .finiPROGBITS0x8000e65e0xe65e0xe0x00x6AX002
          .rodataPROGBITS0x8000e66c0xe66c0x99e0x00x2A002
          .ctorsPROGBITS0x800110100xf0100x80x00x3WA004
          .dtorsPROGBITS0x800110180xf0180x80x00x3WA004
          .dataPROGBITS0x800110240xf0240x2140x00x3WA004
          .bssNOBITS0x800112380xf2380x37c0x00x3WA004
          .shstrtabSTRTAB0x00xf2380x3e0x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x800000000x800000000xf00a0xf00a6.36590x5R E0x2000.init .text .fini .rodata
          LOAD0xf0100x800110100x800110100x2280x5a43.02690x6RW 0x2000.ctors .dtors .data .bss
          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

          Network Behavior

          Network Port Distribution

          TCP Packets

          TimestampSource PortDest PortSource IPDest IP
          May 8, 2024 20:13:58.989492893 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:13:59.291611910 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:13:59.291836023 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:13:59.292041063 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:13:59.594444990 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:13:59.594711065 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:13:59.897893906 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:14:09.301955938 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:14:09.604159117 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:14:09.604250908 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:14:09.604321957 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:14:24.932038069 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:14:24.932199955 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:14:40.235018969 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:14:40.235279083 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:14:55.236043930 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:14:55.236305952 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:15:09.663703918 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:15:09.967586994 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:15:09.967768908 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:15:25.316572905 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:15:25.316673040 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:15:40.620032072 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:15:40.620304108 CEST3822860195192.168.2.1591.92.244.58
          May 8, 2024 20:15:55.923012972 CEST601953822891.92.244.58192.168.2.15
          May 8, 2024 20:15:55.923214912 CEST3822860195192.168.2.1591.92.244.58

          UDP Packets

          TimestampSource PortDest PortSource IPDest IP
          May 8, 2024 20:13:58.712090015 CEST4501653192.168.2.158.8.8.8
          May 8, 2024 20:13:58.988728046 CEST53450168.8.8.8192.168.2.15

          DNS Queries

          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
          May 8, 2024 20:13:58.712090015 CEST192.168.2.158.8.8.80xbc59Standard query (0)minuoddos.topA (IP address)IN (0x0001)false

          DNS Answers

          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
          May 8, 2024 20:13:58.988728046 CEST8.8.8.8192.168.2.150xbc59No error (0)minuoddos.top91.92.244.58A (IP address)IN (0x0001)false

          System Behavior

          General

          Start time (UTC):18:13:57
          Start date (UTC):08/05/2024
          Path:/tmp/Lj7qNwy54U.elf
          Arguments:/tmp/Lj7qNwy54U.elf
          File size:4463432 bytes
          MD5 hash:cd177594338c77b895ae27c33f8f86cc

          Chronological Activities


          General

          Start time (UTC):18:13:57
          Start date (UTC):08/05/2024
          Path:/tmp/Lj7qNwy54U.elf
          Arguments:-
          File size:4463432 bytes
          MD5 hash:cd177594338c77b895ae27c33f8f86cc

          Chronological Activities


          General

          Start time (UTC):18:13:57
          Start date (UTC):08/05/2024
          Path:/tmp/Lj7qNwy54U.elf
          Arguments:-
          File size:4463432 bytes
          MD5 hash:cd177594338c77b895ae27c33f8f86cc

          Chronological Activities


          General

          Start time (UTC):18:13:57
          Start date (UTC):08/05/2024
          Path:/tmp/Lj7qNwy54U.elf
          Arguments:-
          File size:4463432 bytes
          MD5 hash:cd177594338c77b895ae27c33f8f86cc

          Chronological Activities


          General

          Start time (UTC):18:13:57
          Start date (UTC):08/05/2024
          Path:/tmp/Lj7qNwy54U.elf
          Arguments:-
          File size:4463432 bytes
          MD5 hash:cd177594338c77b895ae27c33f8f86cc

          Chronological Activities