Overview

overview

10

Static

static

1

Ares.sh

ubuntu-18.04-amd64

10

Ares.sh

debian-9-armhf

10

Ares.sh

debian-9-mips

10

Ares.sh

debian-9-mipsel

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Ares.sh

  • Size

    2KB

  • Sample

    240725-vnp8watajk

  • MD5

    984a5fb6a5ed826486c777dced1853a9

  • SHA1

    3acb7663131c3e461a0de71e631e16262273edb5

  • SHA256

    0fa2991176c797ba081b23ad323b83c97302bbffef40d4fcf95f08bf313437b5

  • SHA512

    845f784e12a3ca304dc2e6eb34f8dbf818938eb37ca896be0653a3268bd28388de69bbfdb5100d24367ded086a68474551773485e9e1f3db60e00f94965d2b24

Score
10/10
miraiantivmbotnetdiscoverylinux

Malware Config

Targets

    • Target

      Ares.sh

    • Size

      2KB

    • MD5

      984a5fb6a5ed826486c777dced1853a9

    • SHA1

      3acb7663131c3e461a0de71e631e16262273edb5

    • SHA256

      0fa2991176c797ba081b23ad323b83c97302bbffef40d4fcf95f08bf313437b5

    • SHA512

      845f784e12a3ca304dc2e6eb34f8dbf818938eb37ca896be0653a3268bd28388de69bbfdb5100d24367ded086a68474551773485e9e1f3db60e00f94965d2b24

    Score
    10/10
    miraibotnetdiscoveryantivm

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Contacts a large (748814) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks