mirai | 190be0efc2d9727289bd74c4cba38ba52890ebfb20d7539f47d17575807c53de

Analysis

max time kernel
3s
max time network
133s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/03/2024, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

190be0efc2d9727289bd74c4cba38ba52890ebfb20d7539f47d17575807c53de.elf
Size

53KB
MD5

3f471655836f641059bc2da85eaf3aee
SHA1

b4339e8c1b20145e2814724fc24606b5a3014a63
SHA256

190be0efc2d9727289bd74c4cba38ba52890ebfb20d7539f47d17575807c53de
SHA512

56f8c266648910fd0262bd4021468daf82c2103cc93ee46d6bb1cb0edf280d9e1b736be5e98bb6079a332e9bf832dd885b481f91e49986c7b2f796665a8429a1
SSDEEP

1536:ogVYnH4HZrV9wm3FcFSmP9NvWZL+LEiIp7:op8ZrVJ30qB7

Score

10^/10

mirai mirai botnet persistence rootkit

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

z.hxhk.cc

y.hxhk.cc

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Changes its process name 1 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1745

Executes dropped EXE 1 IoCs

ioc	pid	Process
/etc/dars.sh	1817	dars.sh

Flushes firewall rules 64 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

pid	Process
1696	ip6tables
1702	ip6tables
1597	iptables
1641	iptables
1660	iptables
1666	ip6tables
1667	ip6tables
1632	iptables
1633	iptables
1730	ip6tables
1537	iptables
1551	iptables
1588	iptables
1628	iptables
1629	iptables
1697	ip6tables
1721	ip6tables
1728	ip6tables
1555	iptables
1599	iptables
1605	iptables
1637	iptables
1675	ip6tables
1720	ip6tables
1740	ip6tables
1664	ip6tables
1673	ip6tables
1685	ip6tables
1714	ip6tables
1716	ip6tables
1727	ip6tables
1734	ip6tables
1738	ip6tables
1602	iptables
1603	iptables
1611	iptables
1690	ip6tables
1691	ip6tables
1741	ip6tables
1658	iptables
1548	iptables
1583	iptables
1625	iptables
1669	ip6tables
1699	ip6tables
1731	ip6tables
1585	iptables
1610	iptables
1735	ip6tables
1623	iptables
1631	iptables
1645	iptables
1732	ip6tables
1733	ip6tables
1587	iptables
1636	iptables
1709	ip6tables
1712	ip6tables
1535	iptables
1626	iptables
1643	iptables
1683	ip6tables
1559	iptables
1606	iptables

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/net/ipv6/netfilter/ip6_tables.ko	1577	modprobe

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/sedkRiD5J	sed

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/x_tables/initstate	modprobe
File opened for reading	/sys/module/ip6_tables/initstate	modprobe

Reads runtime system information 49 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/mounts	grep
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/modprobe	ip6tables
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	modprobe
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl

/tmp/190be0efc2d9727289bd74c4cba38ba52890ebfb20d7539f47d17575807c53de.elf
/tmp/190be0efc2d9727289bd74c4cba38ba52890ebfb20d7539f47d17575807c53de.elf
1⤵
PID:1529
- /bin/sh
  sh -c "iptables -F >/dev/null 2>&1"
  2⤵
  PID:1530
- - /sbin/iptables
    iptables -F
    3⤵
    PID:1531
- /bin/sh
  sh -c "iptables -X >/dev/null 2>&1"
  2⤵
  PID:1534
- - /sbin/iptables
    iptables -X
    3⤵
    - Flushes firewall rules
    PID:1535
- /bin/sh
  sh -c "iptables -t nat -F >/dev/null 2>&1"
  2⤵
  PID:1536
- - /sbin/iptables
    iptables -t nat -F
    3⤵
    - Flushes firewall rules
    PID:1537
- /bin/sh
  sh -c "iptables -t nat -X >/dev/null 2>&1"
  2⤵
  PID:1547
- - /sbin/iptables
    iptables -t nat -X
    3⤵
    - Flushes firewall rules
    PID:1548
- /bin/sh
  sh -c "iptables -t mangle -F >/dev/null 2>&1"
  2⤵
  PID:1549
- - /sbin/iptables
    iptables -t mangle -F
    3⤵
    - Flushes firewall rules
    PID:1551
- /bin/sh
  sh -c "iptables -t mangle -X >/dev/null 2>&1"
  2⤵
  PID:1554
- - /sbin/iptables
    iptables -t mangle -X
    3⤵
    - Flushes firewall rules
    PID:1555
- /bin/sh
  sh -c "iptables -P INPUT ACCEPT >/dev/null 2>&1"
  2⤵
  PID:1556
- - /sbin/iptables
    iptables -P INPUT ACCEPT
    3⤵
    PID:1557
- /bin/sh
  sh -c "iptables -P FORWARD ACCEPT >/dev/null 2>&1"
  2⤵
  PID:1558
- - /sbin/iptables
    iptables -P FORWARD ACCEPT
    3⤵
    - Flushes firewall rules
    PID:1559
- /bin/sh
  sh -c "service iptables save >/dev/null 2>&1"
  2⤵
  PID:1560
- - /usr/sbin/service
    service iptables save
    3⤵
    PID:1561
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1562
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1563
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Reads runtime system information
      PID:1564
- /bin/sh
  sh -c "systemctl stop firewalld >/dev/null 2>&1"
  2⤵
  PID:1568
- - /bin/systemctl
    systemctl stop firewalld
    3⤵
    - Reads runtime system information
    PID:1569
- /bin/sh
  sh -c "systemctl disable firewalld >/dev/null 2>&1"
  2⤵
  PID:1570
- - /bin/systemctl
    systemctl disable firewalld
    3⤵
    - Reads runtime system information
    PID:1571
- /bin/sh
  sh -c "ufw disable >/dev/null 2>&1"
  2⤵
  PID:1572
- - /usr/sbin/ufw
    ufw disable
    3⤵
    PID:1573
  - - /sbin/iptables
      /sbin/iptables -V
      4⤵
      PID:1574
  - - /lib/ufw/ufw-init
      /lib/ufw/ufw-init force-stop
      4⤵
      PID:1575
    - - /sbin/ip6tables
        
        ip6tables -L INPUT -n
        5⤵
        Reads runtime system information
        
        PID:1576
      - /sbin/modprobe
        
        /sbin/modprobe ip6_tables
        6⤵
        Loads a kernel module
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:1577
    - - /sbin/iptables
        
        iptables -F ufw-logging-deny
        5⤵
        
        PID:1581
    - - /sbin/iptables
        
        iptables -F ufw-logging-allow
        5⤵
        
        PID:1582
    - - /sbin/iptables
        
        iptables -F ufw-not-local
        5⤵
        Flushes firewall rules
        
        PID:1583
    - - /sbin/iptables
        
        iptables -F ufw-user-logging-input
        5⤵
        
        PID:1584
    - - /sbin/iptables
        
        iptables -F ufw-user-limit-accept
        5⤵
        Flushes firewall rules
        
        PID:1585
    - - /sbin/iptables
        
        iptables -F ufw-user-limit
        5⤵
        
        PID:1586
    - - /sbin/iptables
        
        iptables -F ufw-skip-to-policy-input
        5⤵
        Flushes firewall rules
        
        PID:1587
    - - /sbin/iptables
        
        iptables -F ufw-reject-input
        5⤵
        Flushes firewall rules
        
        PID:1588
    - - /sbin/iptables
        
        iptables -F ufw-after-logging-input
        5⤵
        
        PID:1589
    - - /sbin/iptables
        
        iptables -F ufw-after-input
        5⤵
        
        PID:1590
    - - /sbin/iptables
        
        iptables -F ufw-user-input
        5⤵
        
        PID:1591
    - - /sbin/iptables
        
        iptables -F ufw-before-input
        5⤵
        
        PID:1592
    - - /sbin/iptables
        
        iptables -F ufw-before-logging-input
        5⤵
        
        PID:1593
    - - /sbin/iptables
        
        iptables -F ufw-skip-to-policy-forward
        5⤵
        
        PID:1594
    - - /sbin/iptables
        
        iptables -F ufw-reject-forward
        5⤵
        
        PID:1595
    - - /sbin/iptables
        
        iptables -F ufw-after-logging-forward
        5⤵
        
        PID:1596
    - - /sbin/iptables
        
        iptables -F ufw-after-forward
        5⤵
        Flushes firewall rules
        
        PID:1597
    - - /sbin/iptables
        
        iptables -F ufw-user-logging-forward
        5⤵
        
        PID:1598
    - - /sbin/iptables
        
        iptables -F ufw-user-forward
        5⤵
        Flushes firewall rules
        
        PID:1599
    - - /sbin/iptables
        
        iptables -F ufw-before-forward
        5⤵
        
        PID:1600
    - - /sbin/iptables
        
        iptables -F ufw-before-logging-forward
        5⤵
        
        PID:1601
    - - /sbin/iptables
        
        iptables -F ufw-track-forward
        5⤵
        Flushes firewall rules
        
        PID:1602
    - - /sbin/iptables
        
        iptables -F ufw-track-output
        5⤵
        Flushes firewall rules
        
        PID:1603
    - - /sbin/iptables
        
        iptables -F ufw-track-input
        5⤵
        
        PID:1604
    - - /sbin/iptables
        
        iptables -F ufw-skip-to-policy-output
        5⤵
        Flushes firewall rules
        
        PID:1605
    - - /sbin/iptables
        
        iptables -F ufw-reject-output
        5⤵
        Flushes firewall rules
        
        PID:1606
    - - /sbin/iptables
        
        iptables -F ufw-after-logging-output
        5⤵
        
        PID:1607
    - - /sbin/iptables
        
        iptables -F ufw-after-output
        5⤵
        
        PID:1608
    - - /sbin/iptables
        
        iptables -F ufw-user-logging-output
        5⤵
        
        PID:1609
    - - /sbin/iptables
        
        iptables -F ufw-user-output
        5⤵
        Flushes firewall rules
        
        PID:1610
    - - /sbin/iptables
        
        iptables -F ufw-before-output
        5⤵
        Flushes firewall rules
        
        PID:1611
    - - /sbin/iptables
        
        iptables -F ufw-before-logging-output
        5⤵
        
        PID:1612
    - - /sbin/iptables
        
        iptables -Z ufw-logging-deny
        5⤵
        
        PID:1613
    - - /sbin/iptables
        
        iptables -Z ufw-logging-allow
        5⤵
        
        PID:1614
    - - /sbin/iptables
        
        iptables -Z ufw-not-local
        5⤵
        
        PID:1615
    - - /sbin/iptables
        
        iptables -Z ufw-user-logging-input
        5⤵
        
        PID:1616
    - - /sbin/iptables
        
        iptables -Z ufw-user-limit-accept
        5⤵
        
        PID:1617
    - - /sbin/iptables
        
        iptables -Z ufw-user-limit
        5⤵
        
        PID:1618
    - - /sbin/iptables
        
        iptables -Z ufw-skip-to-policy-input
        5⤵
        
        PID:1619
    - - /sbin/iptables
        
        iptables -Z ufw-reject-input
        5⤵
        
        PID:1620
    - - /sbin/iptables
        
        iptables -Z ufw-after-logging-input
        5⤵
        
        PID:1621
    - - /sbin/iptables
        
        iptables -Z ufw-after-input
        5⤵
        
        PID:1622
    - - /sbin/iptables
        
        iptables -Z ufw-user-input
        5⤵
        Flushes firewall rules
        
        PID:1623
    - - /sbin/iptables
        
        iptables -Z ufw-before-input
        5⤵
        
        PID:1624
    - - /sbin/iptables
        
        iptables -Z ufw-before-logging-input
        5⤵
        Flushes firewall rules
        
        PID:1625
    - - /sbin/iptables
        
        iptables -Z ufw-skip-to-policy-forward
        5⤵
        Flushes firewall rules
        
        PID:1626
    - - /sbin/iptables
        
        iptables -Z ufw-reject-forward
        5⤵
        
        PID:1627
    - - /sbin/iptables
        
        iptables -Z ufw-after-logging-forward
        5⤵
        Flushes firewall rules
        
        PID:1628
    - - /sbin/iptables
        
        iptables -Z ufw-after-forward
        5⤵
        Flushes firewall rules
        
        PID:1629
    - - /sbin/iptables
        
        iptables -Z ufw-user-logging-forward
        5⤵
        
        PID:1630
    - - /sbin/iptables
        
        iptables -Z ufw-user-forward
        5⤵
        Flushes firewall rules
        
        PID:1631
    - - /sbin/iptables
        
        iptables -Z ufw-before-forward
        5⤵
        Flushes firewall rules
        
        PID:1632
    - - /sbin/iptables
        
        iptables -Z ufw-before-logging-forward
        5⤵
        Flushes firewall rules
        
        PID:1633
    - - /sbin/iptables
        
        iptables -Z ufw-track-forward
        5⤵
        
        PID:1634
    - - /sbin/iptables
        
        iptables -Z ufw-track-output
        5⤵
        
        PID:1635
    - - /sbin/iptables
        
        iptables -Z ufw-track-input
        5⤵
        Flushes firewall rules
        
        PID:1636
    - - /sbin/iptables
        
        iptables -Z ufw-skip-to-policy-output
        5⤵
        Flushes firewall rules
        
        PID:1637
    - - /sbin/iptables
        
        iptables -Z ufw-reject-output
        5⤵
        
        PID:1638
    - - /sbin/iptables
        
        iptables -Z ufw-after-logging-output
        5⤵
        
        PID:1639
    - - /sbin/iptables
        
        iptables -Z ufw-after-output
        5⤵
        
        PID:1640
    - - /sbin/iptables
        
        iptables -Z ufw-user-logging-output
        5⤵
        Flushes firewall rules
        
        PID:1641
    - - /sbin/iptables
        
        iptables -Z ufw-user-output
        5⤵
        
        PID:1642
    - - /sbin/iptables
        
        iptables -Z ufw-before-output
        5⤵
        Flushes firewall rules
        
        PID:1643
    - - /sbin/iptables
        
        iptables -Z ufw-before-logging-output
        5⤵
        
        PID:1644
    - - /sbin/iptables
        
        iptables -X ufw-logging-deny
        5⤵
        Flushes firewall rules
        
        PID:1645
    - - /sbin/iptables
        
        iptables -X ufw-logging-allow
        5⤵
        
        PID:1646
    - - /sbin/iptables
        
        iptables -X ufw-not-local
        5⤵
        
        PID:1647
    - - /sbin/iptables
        
        iptables -X ufw-user-logging-input
        5⤵
        
        PID:1648
    - - /sbin/iptables
        
        iptables -X ufw-user-logging-output
        5⤵
        
        PID:1649
    - - /sbin/iptables
        
        iptables -X ufw-user-logging-forward
        5⤵
        
        PID:1650
    - - /sbin/iptables
        
        iptables -X ufw-user-limit-accept
        5⤵
        
        PID:1651
    - - /sbin/iptables
        
        iptables -X ufw-user-limit
        5⤵
        
        PID:1652
    - - /sbin/iptables
        
        iptables -X ufw-user-input
        5⤵
        
        PID:1653
    - - /sbin/iptables
        
        iptables -X ufw-user-forward
        5⤵
        
        PID:1654
    - - /sbin/iptables
        
        iptables -X ufw-user-output
        5⤵
        
        PID:1655
    - - /sbin/iptables
        
        iptables -X ufw-skip-to-policy-input
        5⤵
        
        PID:1656
    - - /sbin/iptables
        
        iptables -X ufw-skip-to-policy-output
        5⤵
        
        PID:1657
    - - /sbin/iptables
        
        iptables -X ufw-skip-to-policy-forward
        5⤵
        Flushes firewall rules
        
        PID:1658
    - - /sbin/iptables
        
        iptables -P INPUT ACCEPT
        5⤵
        
        PID:1659
    - - /sbin/iptables
        
        iptables -P OUTPUT ACCEPT
        5⤵
        Flushes firewall rules
        
        PID:1660
    - - /sbin/iptables
        
        iptables -P FORWARD ACCEPT
        5⤵
        
        PID:1661
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-logging-deny
        5⤵
        
        PID:1662
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-logging-allow
        5⤵
        
        PID:1663
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-not-local
        5⤵
        Flushes firewall rules
        
        PID:1664
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-user-logging-input
        5⤵
        
        PID:1665
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-user-limit-accept
        5⤵
        Flushes firewall rules
        
        PID:1666
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-user-limit
        5⤵
        Flushes firewall rules
        
        PID:1667
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-skip-to-policy-input
        5⤵
        
        PID:1668
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-reject-input
        5⤵
        Flushes firewall rules
        
        PID:1669
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-after-logging-input
        5⤵
        
        PID:1670
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-after-input
        5⤵
        
        PID:1671
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-user-input
        5⤵
        
        PID:1672
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-before-input
        5⤵
        Flushes firewall rules
        
        PID:1673
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-before-logging-input
        5⤵
        
        PID:1674
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-skip-to-policy-forward
        5⤵
        Flushes firewall rules
        
        PID:1675
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-reject-forward
        5⤵
        
        PID:1676
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-after-logging-forward
        5⤵
        
        PID:1677
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-after-forward
        5⤵
        
        PID:1678
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-user-logging-forward
        5⤵
        
        PID:1679
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-user-forward
        5⤵
        
        PID:1680
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-before-forward
        5⤵
        
        PID:1681
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-before-logging-forward
        5⤵
        
        PID:1682
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-track-forward
        5⤵
        Flushes firewall rules
        
        PID:1683
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-track-output
        5⤵
        
        PID:1684
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-track-input
        5⤵
        Flushes firewall rules
        
        PID:1685
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-skip-to-policy-output
        5⤵
        
        PID:1686
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-reject-output
        5⤵
        
        PID:1687
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-after-logging-output
        5⤵
        
        PID:1688
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-after-output
        5⤵
        
        PID:1689
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-user-logging-output
        5⤵
        Flushes firewall rules
        
        PID:1690
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-user-output
        5⤵
        Flushes firewall rules
        
        PID:1691
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-before-output
        5⤵
        
        PID:1692
    - - /sbin/ip6tables
        
        ip6tables -F ufw6-before-logging-output
        5⤵
        
        PID:1693
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-logging-deny
        5⤵
        
        PID:1694
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-logging-allow
        5⤵
        
        PID:1695
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-not-local
        5⤵
        Flushes firewall rules
        
        PID:1696
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-user-logging-input
        5⤵
        Flushes firewall rules
        
        PID:1697
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-user-limit-accept
        5⤵
        
        PID:1698
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-user-limit
        5⤵
        Flushes firewall rules
        
        PID:1699
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-skip-to-policy-input
        5⤵
        
        PID:1700
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-reject-input
        5⤵
        
        PID:1701
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-after-logging-input
        5⤵
        Flushes firewall rules
        
        PID:1702
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-after-input
        5⤵
        
        PID:1703
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-user-input
        5⤵
        
        PID:1704
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-before-input
        5⤵
        
        PID:1705
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-before-logging-input
        5⤵
        
        PID:1706
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-skip-to-policy-forward
        5⤵
        
        PID:1707
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-reject-forward
        5⤵
        
        PID:1708
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-after-logging-forward
        5⤵
        Flushes firewall rules
        
        PID:1709
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-after-forward
        5⤵
        
        PID:1710
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-user-logging-forward
        5⤵
        
        PID:1711
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-user-forward
        5⤵
        Flushes firewall rules
        
        PID:1712
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-before-forward
        5⤵
        
        PID:1713
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-before-logging-forward
        5⤵
        Flushes firewall rules
        
        PID:1714
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-track-forward
        5⤵
        
        PID:1715
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-track-output
        5⤵
        Flushes firewall rules
        
        PID:1716
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-track-input
        5⤵
        
        PID:1717
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-skip-to-policy-output
        5⤵
        
        PID:1718
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-reject-output
        5⤵
        
        PID:1719
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-after-logging-output
        5⤵
        Flushes firewall rules
        
        PID:1720
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-after-output
        5⤵
        Flushes firewall rules
        
        PID:1721
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-user-logging-output
        5⤵
        
        PID:1722
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-user-output
        5⤵
        
        PID:1723
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-before-output
        5⤵
        
        PID:1724
    - - /sbin/ip6tables
        
        ip6tables -Z ufw6-before-logging-output
        5⤵
        
        PID:1725
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-logging-deny
        5⤵
        
        PID:1726
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-logging-allow
        5⤵
        Flushes firewall rules
        
        PID:1727
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-not-local
        5⤵
        Flushes firewall rules
        
        PID:1728
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-user-logging-input
        5⤵
        
        PID:1729
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-user-logging-output
        5⤵
        Flushes firewall rules
        
        PID:1730
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-user-logging-forward
        5⤵
        Flushes firewall rules
        
        PID:1731
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-user-limit-accept
        5⤵
        Flushes firewall rules
        
        PID:1732
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-user-limit
        5⤵
        Flushes firewall rules
        
        PID:1733
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-user-input
        5⤵
        Flushes firewall rules
        
        PID:1734
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-user-forward
        5⤵
        Flushes firewall rules
        
        PID:1735
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-user-output
        5⤵
        
        PID:1736
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-skip-to-policy-input
        5⤵
        
        PID:1737
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-skip-to-policy-output
        5⤵
        Flushes firewall rules
        
        PID:1738
    - - /sbin/ip6tables
        
        ip6tables -X ufw6-skip-to-policy-forward
        5⤵
        
        PID:1739
    - - /sbin/ip6tables
        
        ip6tables -P INPUT ACCEPT
        5⤵
        Flushes firewall rules
        
        PID:1740
    - - /sbin/ip6tables
        
        ip6tables -P OUTPUT ACCEPT
        5⤵
        Flushes firewall rules
        
        PID:1741
    - - /sbin/ip6tables
        
        ip6tables -P FORWARD ACCEPT
        5⤵
        
        PID:1742
- /bin/sh
  sh -c "systemctl disable ufw >/dev/null 2>&1"
  2⤵
  PID:1743
- - /bin/systemctl
    systemctl disable ufw
    3⤵
    - Reads runtime system information
    PID:1744
  - - /lib/systemd/systemd-sysv-install
      /lib/systemd/systemd-sysv-install disable ufw
      4⤵
      PID:1745
    - - /usr/bin/getopt
        
        getopt -o r: --long root: -- disable ufw
        5⤵
        
        PID:1746
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d ufw defaults
        5⤵
        
        PID:1747
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1748
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1748
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1748
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1748
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1748
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        Reads runtime system information
        
        PID:1748
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d ufw disable
        5⤵
        
        PID:1769
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1770
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1770
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1770
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1770
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1770
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        Reads runtime system information
        
        PID:1770
- /bin/sh
  sh -c "systemctl stop ufw >/dev/null 2>&1"
  2⤵
  PID:1811
- - /bin/systemctl
    systemctl stop ufw
    3⤵
    - Reads runtime system information
    PID:1812
- /bin/sh
  sh -c "chmod 777 -R /etc/dars.sh;"
  2⤵
  PID:1814
- - /bin/chmod
    chmod 777 -R /etc/dars.sh
    3⤵
    PID:1815
- /bin/sh
  sh -c "/etc/dars.sh /dev/null 2>&1"
  2⤵
  PID:1816
- - /etc/dars.sh
    /etc/dars.sh /dev/null
    3⤵
    - Executes dropped EXE
    PID:1817
  - - /bin/chmod
      chmod 777 -R /etc/init.d/cron
      4⤵
      PID:1821
  - - /bin/chmod
      chmod 777 -R /etc/crontab
      4⤵
      PID:1822
  - - /bin/sed
      sed -i "/\\/lib\\/system-mark/d" /etc/init.d/cron
      4⤵
      Modifies init.d
      Reads runtime system information
      PID:1823
  - - /bin/sed
      sed -i "/^*/1 * * * * root /.mod/d" /etc/crontab
      4⤵
      Reads runtime system information
      PID:1824
  - - /bin/chmod
      chmod 777 -R /etc/init.d/acpid /etc/init.d/alsa-utils /etc/init.d/anacron /etc/init.d/apparmor /etc/init.d/apport /etc/init.d/atd /etc/init.d/auditd /etc/init.d/avahi-daemon /etc/init.d/bluetooth /etc/init.d/console-setup.sh /etc/init.d/cron /etc/init.d/cups /etc/init.d/cups-browsed /etc/init.d/dbus /etc/init.d/dns-clean /etc/init.d/gdm3 /etc/init.d/grub-common /etc/init.d/hwclock.sh /etc/init.d/irqbalance /etc/init.d/kerneloops /etc/init.d/keyboard-setup.sh /etc/init.d/kmod /etc/init.d/networking /etc/init.d/network-manager /etc/init.d/plymouth /etc/init.d/plymouth-log /etc/init.d/pppd-dns /etc/init.d/procps /etc/init.d/rsync /etc/init.d/rsyslog /etc/init.d/saned /etc/init.d/selinux-autorelabel /etc/init.d/speech-dispatcher /etc/init.d/spice-vdagent /etc/init.d/ssh /etc/init.d/udev /etc/init.d/ufw /etc/init.d/unattended-upgrades /etc/init.d/uuidd /etc/init.d/whoopsie /etc/init.d/x11-common
      4⤵
      PID:1825
  - - /bin/rm
      rm -rf /.mod
      4⤵
      PID:1826
  - - /bin/rm
      rm -rf /etc/.walk
      4⤵
      PID:1827
  - - /bin/rm
      rm -rf /etc/32675
      4⤵
      PID:1828
  - - /bin/rm
      rm -rf /etc/rc.local
      4⤵
      PID:1830
  - - /bin/rm
      rm -rf /etc/init.d/acpid
      4⤵
      PID:1831
  - - /bin/rm
      rm -rf /etc/init.d/alsa-utils
      4⤵
      PID:1832
  - - /bin/rm
      rm -rf /etc/init.d/anacron
      4⤵
      PID:1833
  - - /bin/rm
      rm -rf /etc/init.d/apache-htcacheclean
      4⤵
      PID:1834
  - - /bin/rm
      rm -rf /etc/init.d/apache2
      4⤵
      PID:1835
  - - /bin/rm
      rm -rf /etc/init.d/apparmor
      4⤵
      PID:1836
  - - /bin/rm
      rm -rf /etc/init.d/apport
      4⤵
      PID:1837
  - - /bin/rm
      rm -rf /etc/init.d/avahi-daemon
      4⤵
      PID:1838
  - - /bin/rm
      rm -rf /etc/init.d/bluetooth
      4⤵
      PID:1839
  - - /bin/rm
      rm -rf /etc/init.d/console-setup.sh
      4⤵
      PID:1840
  - - /bin/rm
      rm -rf /etc/init.d/cups
      4⤵
      PID:1841
  - - /bin/rm
      rm -rf /etc/init.d/cups-browsed
      4⤵
      PID:1842
  - - /bin/rm
      rm -rf /etc/init.d/dbus
      4⤵
      PID:1843
  - - /bin/rm
      rm -rf /etc/init.d/hwclock.sh
      4⤵
      PID:1844
  - - /bin/rm
      rm -rf /etc/init.d/irqbalance
      4⤵
      PID:1845
  - - /bin/rm
      rm -rf /etc/init.d/keyboard-setup.sh
      4⤵
      PID:1846
  - - /bin/rm
      rm -rf /etc/init.d/kmod
      4⤵
      PID:1847
  - - /bin/rm
      rm -rf /etc/init.d/lightdm
      4⤵
      PID:1848
  - - /bin/rm
      rm -rf /etc/init.d/networking
      4⤵
      PID:1849
  - - /bin/rm
      rm -rf /etc/init.d/openvpn
      4⤵
      PID:1850
  - - /bin/rm
      rm -rf /etc/init.d/plymouth
      4⤵
      PID:1851
  - - /bin/rm
      rm -rf /etc/init.d/plymouth-log
      4⤵
      PID:1852
  - - /bin/rm
      rm -rf /etc/init.d/procps
      4⤵
      PID:1853
  - - /bin/rm
      rm -rf /etc/init.d/resolvconf
      4⤵
      PID:1854
  - - /bin/rm
      rm -rf /etc/init.d/rsync
      4⤵
      PID:1855
  - - /bin/rm
      rm -rf /etc/init.d/rsyslog
      4⤵
      PID:1856
  - - /bin/rm
      rm -rf /etc/init.d/saned
      4⤵
      PID:1857
  - - /bin/rm
      rm -rf /etc/init.d/speech-dispatcher
      4⤵
      PID:1858
  - - /bin/rm
      rm -rf /etc/init.d/ssh
      4⤵
      PID:1859
  - - /bin/rm
      rm -rf /etc/init.d/udev
      4⤵
      PID:1860
  - - /bin/rm
      rm -rf /etc/init.d/ufw
      4⤵
      PID:1861
  - - /bin/rm
      rm -rf /etc/init.d/uml-utilities
      4⤵
      PID:1862
  - - /bin/rm
      rm -rf /etc/init.d/unattended-upgrades
      4⤵
      PID:1863
  - - /bin/rm
      rm -rf /etc/init.d/uuidd
      4⤵
      PID:1864
  - - /bin/rm
      rm -rf /etc/init.d/x11-common
      4⤵
      PID:1865
  - - /bin/rm
      rm -rf /etc/profile.d/bash_cfg.sh
      4⤵
      PID:1866
  - - /bin/rm
      rm -rf /etc/profile.d/gateway.sh
      4⤵
      PID:1867
  - - /bin/rm
      rm -rf /usr/bin/include/find
      4⤵
      PID:1868
  - - /bin/rm
      rm -rf /usr/bin/include/lsof
      4⤵
      PID:1869
  - - /bin/rm
      rm -rf /boot/System.mod
      4⤵
      PID:1870
  - - /bin/rm
      rm -rf /etc/opt.services.cfg
      4⤵
      PID:1871
  - - /bin/rm
      rm -rf /etc/profile.d/bash_cfg
      4⤵
      PID:1872
  - - /bin/rm
      rm -rf /lib/system-mark
      4⤵
      PID:1873
  - - /bin/rm
      rm -rf /usr/lib/libgdi.so.0.8.1
      4⤵
      PID:1874
  - - /bin/rm
      rm -rf /usr/sbin/ifconfig.cfg
      4⤵
      PID:1875
  - - /bin/rm
      rm -rf /etc/init.d/acpid
      4⤵
      PID:1876
  - - /bin/rm
      rm -rf /etc/init.d/alsa-utils
      4⤵
      PID:1877
  - - /bin/rm
      rm -rf /etc/init.d/anacron
      4⤵
      PID:1878
  - - /bin/rm
      rm -rf /etc/init.d/apparmor
      4⤵
      PID:1879
  - - /bin/rm
      rm -rf /etc/init.d/apport
      4⤵
      PID:1880
  - - /bin/rm
      rm -rf /etc/init.d/avahi-daemon
      4⤵
      PID:1881
  - - /bin/rm
      rm -rf /etc/init.d/binfmt-support
      4⤵
      PID:1882
  - - /bin/rm
      rm -rf /etc/init.d/bluetooth
      4⤵
      PID:1883
  - - /bin/rm
      rm -rf /etc/init.d/console-setup.sh
      4⤵
      PID:1884
  - - /bin/rm
      rm -rf /etc/init.d/cryptdisks
      4⤵
      PID:1885
  - - /bin/rm
      rm -rf /etc/init.d/cryptdisks-early
      4⤵
      PID:1886
  - - /bin/rm
      rm -rf /etc/init.d/cups
      4⤵
      PID:1887
  - - /bin/rm
      rm -rf /etc/init.d/cups-browsed
      4⤵
      PID:1888
  - - /bin/rm
      rm -rf /etc/init.d/dbus
      4⤵
      PID:1889
  - - /bin/rm
      rm -rf /etc/init.d/gdm3
      4⤵
      PID:1890
  - - /bin/rm
      rm -rf /etc/init.d/hddtemp
      4⤵
      PID:1891
  - - /bin/rm
      rm -rf /etc/init.d/hwclock.sh
      4⤵
      PID:1892
  - - /bin/rm
      rm -rf /etc/init.d/irqbalance
      4⤵
      PID:1893
  - - /bin/rm
      rm -rf /etc/init.d/iscsid
      4⤵
      PID:1894
  - - /bin/rm
      rm -rf /etc/init.d/keyboard-setup.sh
      4⤵
      PID:1895
  - - /bin/rm
      rm -rf /etc/init.d/kmod
      4⤵
      PID:1896
  - - /bin/rm
      rm -rf /etc/init.d/lightdm
      4⤵
      PID:1897
  - - /bin/rm
      rm -rf /etc/init.d/lm-sensors
      4⤵
      PID:1898
  - - /bin/rm
      rm -rf /etc/init.d/lvm2-lvmpolld
      4⤵
      PID:1899
  - - /bin/rm
      rm -rf /etc/init.d/mono-xsp4
      4⤵
      PID:1900
  - - /bin/rm
      rm -rf /etc/init.d/multipath-tools
      4⤵
      PID:1901
  - - /bin/rm
      rm -rf /etc/init.d/open-iscsi
      4⤵
      PID:1902
  - - /bin/rm
      rm -rf /etc/init.d/open-vm-tools
      4⤵
      PID:1903
  - - /bin/rm
      rm -rf /etc/init.d/plymouth
      4⤵
      PID:1904
  - - /bin/rm
      rm -rf /etc/init.d/plymouth-log
      4⤵
      PID:1905
  - - /bin/rm
      rm -rf /etc/init.d/procps
      4⤵
      PID:1906
  - - /bin/rm
      rm -rf /etc/init.d/rsync
      4⤵
      PID:1907
  - - /bin/rm
      rm -rf /etc/init.d/rsyslog
      4⤵
      PID:1908
  - - /bin/rm
      rm -rf /etc/init.d/saned
      4⤵
      PID:1909
  - - /bin/rm
      rm -rf /etc/init.d/screen-cleanup
      4⤵
      PID:1910
  - - /bin/rm
      rm -rf /etc/init.d/spice-vdagent
      4⤵
      PID:1911
  - - /bin/rm
      rm -rf /etc/init.d/ssh
      4⤵
      PID:1912
  - - /bin/rm
      rm -rf /etc/init.d/udev
      4⤵
      PID:1913
  - - /bin/rm
      rm -rf /etc/init.d/ufw
      4⤵
      PID:1914
  - - /bin/rm
      rm -rf /etc/init.d/uuidd
      4⤵
      PID:1915
  - - /bin/rm
      rm -rf /etc/init.d/x11-common
      4⤵
      PID:1916
  - - /bin/rm
      rm -rf /etc/profile.d/bash_cfg.sh
      4⤵
      PID:1917
  - - /bin/rm
      rm -rf /etc/profile.d/gateway.sh
      4⤵
      PID:1918
  - - /bin/rm
      rm -rf /proc/3434/loginuid
      4⤵
      PID:1919
  - - /bin/rm
      rm -rf /run/crond.pid
      4⤵
      PID:1920
  - - /bin/rm
      rm -rf /usr/lib/systemd/system/quotaoff.service
      4⤵
      PID:1921

/usr/bin/awk
awk "{print \$2}"
1⤵
- Reads runtime system information
PID:1820

/bin/grep
grep -e " /proc/[0-9]* " /proc/mounts
1⤵
- Reads runtime system information
PID:1819

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/dars.sh

Filesize
3KB

MD5
99c7a64e10b688132a7144d4ee60f924

SHA1
36b0329c7de613edd25eee40ef5e7d3502500c18

SHA256
31730a51bf6d7521725634228099ca12dff7af6651add4260414f1f9c579c263

SHA512
4bc2029540c35800177d9042c268ae4d86c41439aceb23f8d12c88eab2342c7bdb839325b6d9a048396801144cbc1d7fb673e7f44e685043f9b009a27cb22eb9

Download Submit
/etc/init.d/sedkRiD5J

Filesize
2KB

MD5
85d7a3783889ea93dcda2fb488420c1c

SHA1
8edf95b211ad7e8df3ee2a331c4e658e9b746e5c

SHA256
2df15277374dedbff7fb792f22e42a72c75fbfc73414ccc87e07f49d377ad9d0

SHA512
9abf28183e952b372423ec48c3b20cd218cfd76b50138ced0dd1969f7be66e0697cbcaee28d71984c46369ea14f9a62a8061ee992ddc2ca2b186c87b689dc3e9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads