Overview

overview

10

Static

static

1

real.sh

ubuntu-18.04-amd64

10

real.sh

debian-9-armhf

10

real.sh

debian-9-mips

10

real.sh

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    real.sh

  • Size

    2KB

  • Sample

    241227-lvf44stpcy

  • MD5

    3c80f90e2189bbcb7dfaa459d3a98882

  • SHA1

    f523a037d1cb6f1333e082a4e702b565ddf6f8e7

  • SHA256

    48f59527a700f3e75a01be9f0cf94f058e9a28a549864856116300f58cc93e13

  • SHA512

    7b35ddc719c140ae3807f8514a84eef890b47cde8777d53c9e933d61dade32b8e51683b6ca58f46e6a3c71e1aea04cb8954c16258367e563bef9529cc1352f37

Score
10/10
miraiantivmbotnetdefense_evasiondiscoverylinux

Malware Config

Targets

    • Target

      real.sh

    • Size

      2KB

    • MD5

      3c80f90e2189bbcb7dfaa459d3a98882

    • SHA1

      f523a037d1cb6f1333e082a4e702b565ddf6f8e7

    • SHA256

      48f59527a700f3e75a01be9f0cf94f058e9a28a549864856116300f58cc93e13

    • SHA512

      7b35ddc719c140ae3807f8514a84eef890b47cde8777d53c9e933d61dade32b8e51683b6ca58f46e6a3c71e1aea04cb8954c16258367e563bef9529cc1352f37

    Score
    10/10
    miraibotnetdefense_evasiondiscoveryantivm

    • Mirai

      Mirai is a prevalent Linux malware infecting exposed network devices.

      botnetmirai

    • Mirai family

      mirai

    • Contacts a large (226065) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks