Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
sora.arm7

Overview

General Information

Sample Name:sora.arm7
Analysis ID:626485
MD5:5af0f40eec19ef4da80207788a5b6a97
SHA1:b570d2ec88d6384d68885c4671537903bbd7e640
SHA256:64fada1edd66124152f083a8499411e0599bb5a005cc5b8cd31a89b97cb6c0a1
Infos:

Detection

Mirai
Score:56
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626485
Start date and time: 14/05/202204:36:242022-05-14 04:36:24 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 14s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:sora.arm7
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal56.troj.evad.linARM7@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100
  • VT rate limit hit for: sora.arm7
Command:/tmp/sora.arm7
PID:6237
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • sora.arm7 (PID: 6237, Parent: 6134, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/sora.arm7
  • cleanup
SourceRuleDescriptionAuthorStrings
sora.arm7SUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x7ccc:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x7d3b:$s2: $Id: UPX
  • 0x7cec:$s3: $Info: This file is packed with the UPX executable packer
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    Networking

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48628
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48632
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48636
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48642
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48644
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48646
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48648
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48650
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48656
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33518
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33524
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33532
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33554
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33570
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33582
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33598
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33612
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33626
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33630
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:45728 -> 104.131.58.204:1312
    Source: /tmp/sora.arm7 (PID: 6240)Socket: 0.0.0.0::0
    Source: /tmp/sora.arm7 (PID: 6246)Socket: 0.0.0.0::0
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 104.131.58.204
    Source: unknownTCP traffic detected without corresponding DNS query: 147.90.130.90
    Source: unknownTCP traffic detected without corresponding DNS query: 201.115.11.88
    Source: unknownTCP traffic detected without corresponding DNS query: 168.183.253.152
    Source: unknownTCP traffic detected without corresponding DNS query: 169.17.72.41
    Source: unknownTCP traffic detected without corresponding DNS query: 70.41.126.72
    Source: unknownTCP traffic detected without corresponding DNS query: 206.86.190.170
    Source: unknownTCP traffic detected without corresponding DNS query: 54.125.78.236
    Source: unknownTCP traffic detected without corresponding DNS query: 102.164.184.245
    Source: unknownTCP traffic detected without corresponding DNS query: 111.225.54.176
    Source: unknownTCP traffic detected without corresponding DNS query: 103.178.194.150
    Source: unknownTCP traffic detected without corresponding DNS query: 162.65.244.93
    Source: unknownTCP traffic detected without corresponding DNS query: 247.206.45.219
    Source: unknownTCP traffic detected without corresponding DNS query: 122.98.143.130
    Source: unknownTCP traffic detected without corresponding DNS query: 24.173.174.99
    Source: unknownTCP traffic detected without corresponding DNS query: 107.51.108.10
    Source: unknownTCP traffic detected without corresponding DNS query: 66.24.90.51
    Source: unknownTCP traffic detected without corresponding DNS query: 69.240.67.229
    Source: unknownTCP traffic detected without corresponding DNS query: 125.22.22.195
    Source: unknownTCP traffic detected without corresponding DNS query: 151.106.68.40
    Source: unknownTCP traffic detected without corresponding DNS query: 116.32.79.218
    Source: unknownTCP traffic detected without corresponding DNS query: 219.11.182.128
    Source: unknownTCP traffic detected without corresponding DNS query: 74.222.152.155
    Source: unknownTCP traffic detected without corresponding DNS query: 244.223.188.78
    Source: unknownTCP traffic detected without corresponding DNS query: 79.254.242.106
    Source: unknownTCP traffic detected without corresponding DNS query: 73.158.16.171
    Source: unknownTCP traffic detected without corresponding DNS query: 46.40.199.102
    Source: unknownTCP traffic detected without corresponding DNS query: 252.187.91.63
    Source: unknownTCP traffic detected without corresponding DNS query: 206.52.153.7
    Source: unknownTCP traffic detected without corresponding DNS query: 221.207.132.32
    Source: unknownTCP traffic detected without corresponding DNS query: 249.174.106.133
    Source: unknownTCP traffic detected without corresponding DNS query: 209.152.198.90
    Source: unknownTCP traffic detected without corresponding DNS query: 213.221.221.58
    Source: unknownTCP traffic detected without corresponding DNS query: 125.223.238.229
    Source: unknownTCP traffic detected without corresponding DNS query: 183.252.212.185
    Source: unknownTCP traffic detected without corresponding DNS query: 111.57.57.230
    Source: unknownTCP traffic detected without corresponding DNS query: 44.91.219.197
    Source: unknownTCP traffic detected without corresponding DNS query: 189.225.250.246
    Source: unknownTCP traffic detected without corresponding DNS query: 66.198.60.234
    Source: unknownTCP traffic detected without corresponding DNS query: 166.25.186.173
    Source: unknownTCP traffic detected without corresponding DNS query: 5.157.253.240
    Source: unknownTCP traffic detected without corresponding DNS query: 19.250.241.195
    Source: unknownTCP traffic detected without corresponding DNS query: 241.125.130.132
    Source: unknownTCP traffic detected without corresponding DNS query: 187.117.138.193
    Source: unknownTCP traffic detected without corresponding DNS query: 146.117.255.83
    Source: unknownTCP traffic detected without corresponding DNS query: 19.160.122.0
    Source: unknownTCP traffic detected without corresponding DNS query: 18.154.92.193
    Source: unknownTCP traffic detected without corresponding DNS query: 126.11.207.77
    Source: unknownTCP traffic detected without corresponding DNS query: 201.105.75.126
    Source: unknownTCP traffic detected without corresponding DNS query: 220.130.75.25
    Source: sora.arm7String found in binary or memory: http://upx.sf.net
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: sora.arm7, type: SAMPLEMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
    Source: /tmp/sora.arm7 (PID: 6240)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/sora.arm7 (PID: 6246)SIGKILL sent: pid: 936, result: successful
    Source: classification engineClassification label: mal56.troj.evad.linARM7@0/0@0/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/491/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/793/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/772/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/796/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/774/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/797/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/777/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/799/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/658/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/912/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/759/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/936/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/918/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/1/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/761/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/785/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/884/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/720/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/721/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/788/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/789/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/800/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/801/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/847/fd
    Source: /tmp/sora.arm7 (PID: 6240)File opened: /proc/904/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/491/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/793/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/772/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/796/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/774/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/797/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/777/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/799/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/658/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/912/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/759/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/936/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/918/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/1/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/761/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/785/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/884/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/720/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/721/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/788/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/789/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/800/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/801/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/847/fd
    Source: /tmp/sora.arm7 (PID: 6246)File opened: /proc/904/fd

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48628
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48632
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48636
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48642
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48644
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48646
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48648
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48650
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48656
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33518
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33524
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33532
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33554
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33570
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33582
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33598
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33612
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33626
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 33630
    Source: /tmp/sora.arm7 (PID: 6237)Queries kernel information via 'uname':
    Source: sora.arm7, 6237.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6240.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6344.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6358.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6351.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6241.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6341.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6247.1.0000000026c28b2d.000000007e79824a.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/sora.arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sora.arm7
    Source: sora.arm7, 6237.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6240.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6344.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6358.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6351.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6241.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6341.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6247.1.0000000002bd700b.00000000241738ea.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: sora.arm7, 6237.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6240.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6344.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6358.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6351.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6241.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6341.1.0000000026c28b2d.000000007e79824a.rw-.sdmp, sora.arm7, 6247.1.0000000026c28b2d.000000007e79824a.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
    Source: sora.arm7, 6237.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6240.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6344.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6358.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6351.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6241.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6341.1.0000000002bd700b.00000000241738ea.rw-.sdmp, sora.arm7, 6247.1.0000000002bd700b.00000000241738ea.rw-.sdmpBinary or memory string: &V!/etc/qemu-binfmt/arm

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information
    1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626485 Sample: sora.arm7 Startdate: 14/05/2022 Architecture: LINUX Score: 56 42 75.93.127.92 WINDSTREAMUS United States 2->42 44 2.203.114.132 VODANETInternationalIP-BackboneofVodafoneDE Germany 2->44 46 98 other IPs or domains 2->46 48 Yara detected Mirai 2->48 50 Uses known network protocols on non-standard ports 2->50 52 Sample is packed with UPX 2->52 10 sora.arm7 2->10         started        signatures3 process4 process5 12 sora.arm7 10->12         started        14 sora.arm7 10->14         started        16 sora.arm7 10->16         started        process6 18 sora.arm7 12->18         started        20 sora.arm7 12->20         started        22 sora.arm7 14->22         started        24 sora.arm7 14->24         started        26 sora.arm7 14->26         started        process7 28 sora.arm7 18->28         started        30 sora.arm7 18->30         started        32 sora.arm7 18->32         started        34 sora.arm7 22->34         started        36 sora.arm7 22->36         started        process8 38 sora.arm7 28->38         started        40 sora.arm7 28->40         started       
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No contacted domains info
    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netsora.arm7false
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      133.114.217.66
      unknownJapan2522PPP-EXPJapanNetworkInformationCenterJPfalse
      46.28.115.209
      unknownGermany
      197208MSGDEfalse
      184.103.203.160
      unknownUnited States
      209CENTURYLINK-US-LEGACY-QWESTUSfalse
      92.43.41.252
      unknownUnited Kingdom
      44366DATACASH-AS---Transitproviders---GBfalse
      145.94.118.127
      unknownNetherlands
      1128TUDELFT-NLDTOTUDELFTTheNetherlands-ASNLfalse
      203.120.137.165
      unknownSingapore
      4628PACIFICINTERNET-AS-APPacificInternetPteLtdSGfalse
      249.231.129.245
      unknownReserved
      unknownunknownfalse
      63.58.53.35
      unknownUnited States
      701UUNETUSfalse
      139.155.197.239
      unknownChina
      45090CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompafalse
      99.200.241.39
      unknownUnited States
      10507SPCSUSfalse
      94.100.184.232
      unknownRussian Federation
      47764MAILRU-ASMailRuRUfalse
      211.222.190.65
      unknownKorea Republic of
      4766KIXS-AS-KRKoreaTelecomKRfalse
      17.185.134.151
      unknownUnited States
      714APPLE-ENGINEERINGUSfalse
      180.185.41.108
      unknownChina
      38841KBRO-AS-TWkbroCOLtdTWfalse
      54.127.156.255
      unknownUnited States
      16509AMAZON-02USfalse
      2.203.114.132
      unknownGermany
      3209VODANETInternationalIP-BackboneofVodafoneDEfalse
      182.3.248.162
      unknownIndonesia
      23693TELKOMSEL-ASN-IDPTTelekomunikasiSelularIDfalse
      189.105.20.50
      unknownBrazil
      7738TelemarNorteLesteSABRfalse
      87.120.156.122
      unknownBulgaria
      57634SKAT-POPOVO-ASBGfalse
      44.176.136.240
      unknownUnited States
      7377UCSDUSfalse
      175.207.154.241
      unknownKorea Republic of
      4766KIXS-AS-KRKoreaTelecomKRfalse
      67.217.222.35
      unknownUnited States
      32592HT-HB32592USfalse
      99.118.2.125
      unknownUnited States
      7018ATT-INTERNET4USfalse
      66.139.153.125
      unknownUnited States
      7018ATT-INTERNET4USfalse
      176.80.242.243
      unknownSpain
      3352TELEFONICA_DE_ESPANAESfalse
      135.58.102.226
      unknownUnited States
      18676AVAYAUSfalse
      91.103.53.148
      unknownSpain
      31262EDICOMESfalse
      27.80.84.189
      unknownJapan2516KDDIKDDICORPORATIONJPfalse
      19.239.90.39
      unknownUnited States
      3MIT-GATEWAYSUSfalse
      254.198.97.121
      unknownReserved
      unknownunknownfalse
      199.91.27.186
      unknownSwitzerland
      6559NCIHUSfalse
      199.22.77.57
      unknownCanada
      16624HYDRO-QUEBECCAfalse
      187.17.198.240
      unknownBrazil
      28265ABCREDEPROVEDORDEINTERNETEIRELIBRfalse
      190.199.138.188
      unknownVenezuela
      8048CANTVServiciosVenezuelaVEfalse
      193.80.20.24
      unknownAustria
      1901EUNETAT-ASA1TelekomAustriaAGATfalse
      1.170.154.185
      unknownTaiwan; Republic of China (ROC)
      3462HINETDataCommunicationBusinessGroupTWfalse
      223.68.161.170
      unknownChina
      56046CMNET-JIANGSU-APChinaMobilecommunicationscorporationCNfalse
      116.150.242.34
      unknownChina
      4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      223.214.198.239
      unknownChina
      4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      107.154.14.207
      unknownUnited States
      19551INCAPSULAUSfalse
      84.174.185.109
      unknownGermany
      3320DTAGInternetserviceprovideroperationsDEfalse
      111.24.180.228
      unknownChina
      24444CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompanyfalse
      179.7.7.8
      unknownPeru
      12252AmericaMovilPeruSACPEfalse
      114.113.101.20
      unknownChina
      4808CHINA169-BJChinaUnicomBeijingProvinceNetworkCNfalse
      251.236.236.139
      unknownReserved
      unknownunknownfalse
      59.90.73.115
      unknownIndia
      9829BSNL-NIBNationalInternetBackboneINfalse
      93.166.29.7
      unknownDenmark
      3292TDCTDCASDKfalse
      98.28.31.235
      unknownUnited States
      10796TWC-10796-MIDWESTUSfalse
      59.250.167.248
      unknownChina
      2516KDDIKDDICORPORATIONJPfalse
      121.125.77.162
      unknownKorea Republic of
      9318SKB-ASSKBroadbandCoLtdKRfalse
      101.105.113.198
      unknownChina
      4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      91.164.4.176
      unknownFrance
      12322PROXADFRfalse
      62.153.147.180
      unknownGermany
      3320DTAGInternetserviceprovideroperationsDEfalse
      89.233.66.103
      unknownGermany
      9145EWETELCloppenburgerStrasse310DEfalse
      249.0.126.195
      unknownReserved
      unknownunknownfalse
      244.115.131.10
      unknownReserved
      unknownunknownfalse
      87.212.98.54
      unknownNetherlands
      13127VERSATELASfortheTrans-EuropeanTele2IPTransportbackbofalse
      44.167.120.72
      unknownUnited States
      7377UCSDUSfalse
      163.234.168.117
      unknownUnited States
      1761TDIR-CAPNETUSfalse
      167.200.186.215
      unknownUnited States
      2897GEORGIA-1USfalse
      181.205.49.118
      unknownColombia
      27831ColombiaMovilCOfalse
      63.89.37.125
      unknownUnited States
      701UUNETUSfalse
      114.53.185.40
      unknownKorea Republic of
      18302SKG_NW-AS-KRSKTelecomKRfalse
      158.66.138.51
      unknownPoland
      21111CISGCentrumInformacjiSpoleczno-GospodarczejPLfalse
      186.101.19.123
      unknownEcuador
      27947TelconetSAECfalse
      164.181.135.24
      unknownUnited States
      37717EL-KhawarizmiTNfalse
      47.67.85.177
      unknownUnited States
      3209VODANETInternationalIP-BackboneofVodafoneDEfalse
      144.98.168.164
      unknownUnited Kingdom
      2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
      68.87.145.173
      unknownUnited States
      7922COMCAST-7922USfalse
      75.93.127.92
      unknownUnited States
      7029WINDSTREAMUSfalse
      195.213.74.96
      unknownBelgium
      6871PLUSNETUKInternetServiceProviderGBfalse
      75.239.190.55
      unknownUnited States
      22394CELLCOUSfalse
      24.211.135.140
      unknownUnited States
      11426TWC-11426-CAROLINASUSfalse
      97.199.232.203
      unknownUnited States
      6167CELLCO-PARTUSfalse
      42.17.196.225
      unknownKorea Republic of
      9644SKTELECOM-NET-ASSKTelecomKRfalse
      207.245.252.211
      unknownCanada
      15290ALLST-15290CAfalse
      242.19.33.223
      unknownReserved
      unknownunknownfalse
      222.214.36.33
      unknownChina
      4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      91.200.1.49
      unknownUkraine
      43744ORIONCITY-ASUAfalse
      62.5.162.222
      unknownRussian Federation
      8359MTSRUfalse
      87.63.107.126
      unknownDenmark
      3292TDCTDCASDKfalse
      163.54.154.170
      unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
      60.16.195.190
      unknownChina
      4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      68.73.232.130
      unknownUnited States
      7018ATT-INTERNET4USfalse
      153.105.18.51
      unknownUnited States
      195SDSC-ASUSfalse
      154.205.78.154
      unknownSeychelles
      8100ASN-QUADRANET-GLOBALUSfalse
      213.109.189.165
      unknownRussian Federation
      9009M247GBfalse
      97.221.58.87
      unknownUnited States
      6167CELLCO-PARTUSfalse
      1.34.92.18
      unknownTaiwan; Republic of China (ROC)
      3462HINETDataCommunicationBusinessGroupTWfalse
      106.175.162.231
      unknownJapan2516KDDIKDDICORPORATIONJPfalse
      189.119.197.9
      unknownBrazil
      26615TIMSABRfalse
      183.179.52.112
      unknownHong Kong
      9269HKBN-AS-APHongKongBroadbandNetworkLtdHKfalse
      251.244.203.206
      unknownReserved
      unknownunknownfalse
      220.98.177.146
      unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
      202.22.122.49
      unknownJapan24183DTS-ISP-CORE1-APDTSLTDNZfalse
      183.71.157.94
      unknownChina
      4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      149.99.110.107
      unknownCanada
      3602AS3602-ROGERS-COMCAfalse
      86.145.153.40
      unknownUnited Kingdom
      2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
      84.85.120.24
      unknownNetherlands
      1136KPNKPNNationalEUfalse
      17.9.251.100
      unknownUnited States
      714APPLE-ENGINEERINGUSfalse
      No context
      No context
      No context
      No context
      No context
      No created / dropped files found
      File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, stripped
      Entropy (8bit):7.9746864641617945
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:sora.arm7
      File size:49000
      MD5:5af0f40eec19ef4da80207788a5b6a97
      SHA1:b570d2ec88d6384d68885c4671537903bbd7e640
      SHA256:64fada1edd66124152f083a8499411e0599bb5a005cc5b8cd31a89b97cb6c0a1
      SHA512:fe3a8b8410c8bccfe8ad8e6a11eedc894861339b595090f72203ccd48675fc164aef02f1d62b822992050f483d1003852cffb320cb7986578ba7944bcbbbe111
      SSDEEP:768:95lpPa7beMGLDtWFuCLImiVKb0rmekqlE2/9q3UELuyTQPvfaYvCinHpp:9JPa7bQ8BWr9+2uLNQPvDvCiJp
      TLSH:D42302A1F30EE0D3C227D8B6CCBF8780A82E5C5AD1EBB41A04DB7518639188F1B38157
      File Content Preview:.ELF..............(.........4...........4. ...(..........................................b...b...b..................Q.td...............................OUPX!....................j..........?.E.h;....#..$...o...!e:...mW......(.`.7&..1.;...7....8...v.....\F..

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:ARM
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - Linux
      ABI Version:0
      Entry Point Address:0xf1d8
      Flags:0x4000002
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0
      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x80000x80000x83c50x83c54.05060x5R E0x8000
      LOAD0x62cc0x262cc0x262cc0x00x00.00000x6RW 0x8000
      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
      TimestampSource PortDest PortSource IPDest IP
      May 14, 2022 04:37:15.897464991 CEST457281312192.168.2.23104.131.58.204
      May 14, 2022 04:37:15.903861046 CEST668123192.168.2.23147.90.130.90
      May 14, 2022 04:37:15.903903008 CEST668123192.168.2.23201.115.11.88
      May 14, 2022 04:37:15.903913021 CEST668123192.168.2.23168.183.253.152
      May 14, 2022 04:37:15.903954983 CEST668123192.168.2.23169.17.72.41
      May 14, 2022 04:37:15.903964043 CEST668123192.168.2.2370.41.126.72
      May 14, 2022 04:37:15.903975010 CEST668123192.168.2.23192.110.245.249
      May 14, 2022 04:37:15.903976917 CEST668123192.168.2.23206.86.190.170
      May 14, 2022 04:37:15.903990984 CEST668123192.168.2.2354.125.78.236
      May 14, 2022 04:37:15.904000044 CEST668123192.168.2.23102.164.184.245
      May 14, 2022 04:37:15.904016018 CEST668123192.168.2.23111.225.54.176
      May 14, 2022 04:37:15.904017925 CEST668123192.168.2.23103.178.194.150
      May 14, 2022 04:37:15.904036999 CEST668123192.168.2.23162.65.244.93
      May 14, 2022 04:37:15.904037952 CEST668123192.168.2.23247.206.45.219
      May 14, 2022 04:37:15.904042006 CEST668123192.168.2.23122.98.143.130
      May 14, 2022 04:37:15.904053926 CEST668123192.168.2.2324.173.174.99
      May 14, 2022 04:37:15.904058933 CEST668123192.168.2.23107.51.108.10
      May 14, 2022 04:37:15.904087067 CEST668123192.168.2.2366.24.90.51
      May 14, 2022 04:37:15.904089928 CEST668123192.168.2.2369.240.67.229
      May 14, 2022 04:37:15.904089928 CEST668123192.168.2.23125.22.22.195
      May 14, 2022 04:37:15.904102087 CEST668123192.168.2.23151.106.68.40
      May 14, 2022 04:37:15.904105902 CEST668123192.168.2.23116.32.79.218
      May 14, 2022 04:37:15.904109001 CEST668123192.168.2.23219.11.182.128
      May 14, 2022 04:37:15.904131889 CEST668123192.168.2.2374.222.152.155
      May 14, 2022 04:37:15.904140949 CEST668123192.168.2.23244.223.188.78
      May 14, 2022 04:37:15.904146910 CEST668123192.168.2.2379.254.242.106
      May 14, 2022 04:37:15.904162884 CEST668123192.168.2.2373.158.16.171
      May 14, 2022 04:37:15.904165030 CEST668123192.168.2.2346.40.199.102
      May 14, 2022 04:37:15.904165030 CEST668123192.168.2.23252.187.91.63
      May 14, 2022 04:37:15.904165030 CEST668123192.168.2.23206.52.153.7
      May 14, 2022 04:37:15.904170990 CEST668123192.168.2.23221.207.132.32
      May 14, 2022 04:37:15.904172897 CEST668123192.168.2.23249.174.106.133
      May 14, 2022 04:37:15.904171944 CEST668123192.168.2.23209.152.198.90
      May 14, 2022 04:37:15.904177904 CEST668123192.168.2.23213.221.221.58
      May 14, 2022 04:37:15.904179096 CEST668123192.168.2.23125.223.238.229
      May 14, 2022 04:37:15.904182911 CEST668123192.168.2.23183.252.212.185
      May 14, 2022 04:37:15.904185057 CEST668123192.168.2.23111.57.57.230
      May 14, 2022 04:37:15.904197931 CEST668123192.168.2.2344.91.219.197
      May 14, 2022 04:37:15.904198885 CEST668123192.168.2.23189.225.250.246
      May 14, 2022 04:37:15.904215097 CEST668123192.168.2.2366.198.60.234
      May 14, 2022 04:37:15.904215097 CEST668123192.168.2.23166.25.186.173
      May 14, 2022 04:37:15.904217005 CEST668123192.168.2.235.157.253.240
      May 14, 2022 04:37:15.904227972 CEST668123192.168.2.2319.250.241.195
      May 14, 2022 04:37:15.904233932 CEST668123192.168.2.23241.125.130.132
      May 14, 2022 04:37:15.904242992 CEST668123192.168.2.23187.117.138.193
      May 14, 2022 04:37:15.904249907 CEST668123192.168.2.23146.117.255.83
      May 14, 2022 04:37:15.904259920 CEST668123192.168.2.2319.160.122.0
      May 14, 2022 04:37:15.904268026 CEST668123192.168.2.2318.154.92.193
      May 14, 2022 04:37:15.904273987 CEST668123192.168.2.23126.11.207.77
      May 14, 2022 04:37:15.904283047 CEST668123192.168.2.23201.105.75.126
      May 14, 2022 04:37:15.904284954 CEST668123192.168.2.23220.130.75.25
      May 14, 2022 04:37:15.904294014 CEST668123192.168.2.23247.99.157.76
      May 14, 2022 04:37:15.904297113 CEST668123192.168.2.23180.0.83.210
      May 14, 2022 04:37:15.904299021 CEST668123192.168.2.2339.79.178.83
      May 14, 2022 04:37:15.904299974 CEST668123192.168.2.2398.216.6.25
      May 14, 2022 04:37:15.904299974 CEST668123192.168.2.2374.183.53.196
      May 14, 2022 04:37:15.904305935 CEST668123192.168.2.2396.1.222.52
      May 14, 2022 04:37:15.904311895 CEST668123192.168.2.23157.156.50.29
      May 14, 2022 04:37:15.904309988 CEST668123192.168.2.234.174.108.194
      May 14, 2022 04:37:15.904314995 CEST668123192.168.2.23111.220.38.11
      May 14, 2022 04:37:15.904321909 CEST668123192.168.2.2318.82.16.141
      May 14, 2022 04:37:15.904333115 CEST668123192.168.2.23195.173.241.79
      May 14, 2022 04:37:15.904335022 CEST668123192.168.2.23205.207.198.132
      May 14, 2022 04:37:15.904335976 CEST668123192.168.2.23141.100.69.69
      May 14, 2022 04:37:15.904345989 CEST668123192.168.2.2369.218.251.52
      May 14, 2022 04:37:15.904350042 CEST668123192.168.2.23156.251.130.207
      May 14, 2022 04:37:15.904351950 CEST668123192.168.2.23145.3.24.25
      May 14, 2022 04:37:15.904362917 CEST668123192.168.2.23255.150.143.251
      May 14, 2022 04:37:15.904364109 CEST668123192.168.2.2324.136.14.67
      May 14, 2022 04:37:15.904365063 CEST668123192.168.2.23125.145.43.46
      May 14, 2022 04:37:15.904365063 CEST668123192.168.2.2383.200.75.177
      May 14, 2022 04:37:15.904369116 CEST668123192.168.2.23179.229.201.191
      May 14, 2022 04:37:15.904371023 CEST668123192.168.2.23251.53.137.233
      May 14, 2022 04:37:15.904375076 CEST668123192.168.2.239.203.54.173
      May 14, 2022 04:37:15.904378891 CEST668123192.168.2.2385.107.172.6
      May 14, 2022 04:37:15.904386044 CEST668123192.168.2.23119.179.36.248
      May 14, 2022 04:37:15.904392958 CEST668123192.168.2.2379.27.176.240
      May 14, 2022 04:37:15.904397964 CEST668123192.168.2.23108.64.145.83
      May 14, 2022 04:37:15.904397964 CEST668123192.168.2.2359.122.12.176
      May 14, 2022 04:37:15.904400110 CEST668123192.168.2.2331.67.161.161
      May 14, 2022 04:37:15.904407024 CEST668123192.168.2.2373.155.212.250
      May 14, 2022 04:37:15.904407024 CEST668123192.168.2.2388.114.81.212
      May 14, 2022 04:37:15.904411077 CEST668123192.168.2.2365.113.214.94
      May 14, 2022 04:37:15.904414892 CEST668123192.168.2.2361.14.123.20
      May 14, 2022 04:37:15.904417038 CEST668123192.168.2.23252.101.40.238
      May 14, 2022 04:37:15.904432058 CEST668123192.168.2.23114.180.239.110
      May 14, 2022 04:37:15.904434919 CEST668123192.168.2.23175.139.242.70
      May 14, 2022 04:37:15.904438972 CEST668123192.168.2.23173.203.3.63
      May 14, 2022 04:37:15.904443979 CEST668123192.168.2.23159.28.173.51
      May 14, 2022 04:37:15.904450893 CEST668123192.168.2.23205.134.152.57
      May 14, 2022 04:37:15.904453993 CEST668123192.168.2.23216.227.190.187
      May 14, 2022 04:37:15.904469967 CEST668123192.168.2.2384.126.7.40
      May 14, 2022 04:37:15.904490948 CEST668123192.168.2.2397.140.136.59
      May 14, 2022 04:37:15.904503107 CEST668123192.168.2.23123.2.135.105
      May 14, 2022 04:37:15.904505014 CEST668123192.168.2.2385.251.115.35
      May 14, 2022 04:37:15.904509068 CEST668123192.168.2.2346.76.71.141
      May 14, 2022 04:37:15.904515982 CEST668123192.168.2.23143.7.90.34
      May 14, 2022 04:37:15.904531002 CEST668123192.168.2.2384.184.2.101
      May 14, 2022 04:37:15.904535055 CEST668123192.168.2.23249.107.64.30
      May 14, 2022 04:37:15.904556036 CEST668123192.168.2.23174.119.20.185

      System Behavior

      Start time:04:37:14
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:/tmp/sora.arm7
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:37:15
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:08
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:08
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:08
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:13
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:13
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:08
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:08
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:37:15
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:37:15
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:37:15
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:08
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:40:08
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:37:15
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
      Start time:04:37:15
      Start date:14/05/2022
      Path:/tmp/sora.arm7
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1