mirai | 57a4487a6f882b2448048164a1b0ea71c104aa94e9ad6aca8d3f8d2c60401ed4

General

Target
net.mpsl
Size 246KB
Sample260916-pr7dnsbl7v
SHA256 57a4487a6f882b2448048164a1b0ea71c104aa94e9ad6aca8d3f8d2c60401ed4
MD5 2db76c5b95869ab829c92e20f4ff7c47
SHA1 7cbd63977788fac53ef6f331c11aec5f8c19c90c
SHA512 1b0916f9264861519ff4fd61a11a059740e35ba899d1957c4ffb7b83c25c7f7841952c7c0cc42355ca07dfaf39f5b469238b2b4d018040ae40981957fa18dec5
SSDEEP 3072:XlwuMbAimylr+eep2HzqZUDtp0zhQWRjTVxR6Az+KzAL:XlwuMbHXekTqCtpwQOVxRDpzA
TLSH
T16F34D60AAF610EF7E8AFCD3706E90B4529CC651721A83F357974D918F54A64B0AE3CB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet credential_access defense_evasion discovery execution mirai persistence privilege_escalation

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
815	chmod
813	sh

Deletes itself 1 IoCs

pid	Process
806	net.mpsl

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	net.mpsl
File opened for modification	/dev/misc/watchdog	net.mpsl

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/netupd	net.mpsl

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/sys_daemon	net.mpsl

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/netd.service	net.mpsl

Reads process memory 1 TTPs 33 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/13/maps	net.mpsl
File opened for reading	/proc/18/maps	net.mpsl
File opened for reading	/proc/14/maps	net.mpsl
File opened for reading	/proc/4/maps	net.mpsl
File opened for reading	/proc/10/maps	net.mpsl
File opened for reading	/proc/11/maps	net.mpsl
File opened for reading	/proc/15/maps	net.mpsl
File opened for reading	/proc/24/maps	net.mpsl
File opened for reading	/proc/30/maps	net.mpsl
File opened for reading	/proc/32/maps	net.mpsl
File opened for reading	/proc/21/maps	net.mpsl
File opened for reading	/proc/22/maps	net.mpsl
File opened for reading	/proc/23/maps	net.mpsl
File opened for reading	/proc/27/maps	net.mpsl
File opened for reading	/proc/29/maps	net.mpsl
File opened for reading	/proc/1/maps	net.mpsl
File opened for reading	/proc/8/maps	net.mpsl
File opened for reading	/proc/17/maps	net.mpsl
File opened for reading	/proc/3/maps	net.mpsl
File opened for reading	/proc/19/maps	net.mpsl
File opened for reading	/proc/12/maps	net.mpsl
File opened for reading	/proc/7/maps	net.mpsl
File opened for reading	/proc/31/maps	net.mpsl
File opened for reading	/proc/33/maps	net.mpsl
File opened for reading	/proc/20/maps	net.mpsl
File opened for reading	/proc/25/maps	net.mpsl
File opened for reading	/proc/26/maps	net.mpsl
File opened for reading	/proc/5/maps	net.mpsl
File opened for reading	/proc/6/maps	net.mpsl
File opened for reading	/proc/16/maps	net.mpsl
File opened for reading	/proc/28/maps	net.mpsl
File opened for reading	/proc/2/maps	net.mpsl
File opened for reading	/proc/9/maps	net.mpsl

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	806	net.mpsl

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/maps	net.mpsl
File opened for reading	/proc/self/exe	net.mpsl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl

/tmp/net.mpsl
/tmp/net.mpsl
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Reads process memory
- Changes its process name
- Reads runtime system information
PID:806
- /bin/sh
  sh -c "chmod +x /var/tmp/.sys_recovery.sh"
  2⤵
  - File and Directory Permissions Modification
  PID:813
- - /usr/bin/chmod
    chmod +x /var/tmp/.sys_recovery.sh
    3⤵
    - File and Directory Permissions Modification
    PID:815
- /bin/sh
  sh -c "systemctl disable .networkd.service 2>/dev/null"
  2⤵
  PID:818
- - /usr/bin/systemctl
    systemctl disable .networkd.service
    3⤵
    - Reads runtime system information
    PID:821
- /bin/sh
  sh -c "update-rc.d sys_daemon defaults 2>/dev/null"
  2⤵
  PID:832
- - /usr/sbin/update-rc.d
    update-rc.d sys_daemon defaults
    3⤵
    PID:834
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:842
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:842
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:842
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:842
- /bin/sh
  sh -c "chkconfig --add sys_daemon 2>/dev/null"
  2⤵
  PID:862
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null"
  2⤵
  PID:863
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:864
- /bin/sh
  sh -c "systemctl enable netd.service 2>/dev/null"
  2⤵
  PID:880
- - /usr/bin/systemctl
    systemctl enable netd.service
    3⤵
    - Reads runtime system information
    PID:883
- /bin/sh
  sh -c "systemctl start netd.service 2>/dev/null"
  2⤵
  PID:899
- - /usr/bin/systemctl
    systemctl start netd.service
    3⤵
    - Reads runtime system information
    PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

XDG Autostart Entries

1

T1547.013

Boot or Logon Initialization Scripts

1

T1037

RC Scripts

1

T1037.004

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

Impair Defenses

Credential Access

OS Credential Dumping

1

T1003

Proc Filesystem

1

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netupd

Path /etc/cron.d/netupd
Size 49B
SHA256 6f50f3c70491721be9a36ce4fd3cfcac66dba6fe7b3af969b9aae67b71bc2435
MD5 4ed2963e9d81315709b84dfe14f74fd0
SHA1 3b33da5d9f8c5a091ce3183e85cc9f1b4017a566
SHA512 15382aec41e41c09d96199fd83caf84ee475bc6442bef7e608952fd188ec5b871d90a4438287f9be39a676cc9c01141fa43890d43d150f0948e6bcab67569789
MD5 SHA1 SHA512

Submit Download

sys_daemon

Path /etc/init.d/sys_daemon
Size 282B
SHA256 c277627bfbdac903b0229ad7417771294a3135aa01cc6300cd7b0df09f54cc97
MD5 e6a107234365ee6b813c8dc0030a570a
SHA1 f94968be4439fafb09cadee7a8e3cc1d546eebcc
SHA512 02d0f12a9b4a9754403b4f444a2061db802bcc5f5af1ca474f4f508fbe933f4e560023ebc103e8a7d61bac53de3e2aa147b56b2e88f8c2efd79008d02cf6035c
TLSH
T126D09E45F44585B52ECA4179A71DB25975C10057C4253412FF6E3BF2DF55392606A1B0
MD5 SHA1 SHA512 TLSH

Submit Download

netd.service

Path /etc/systemd/system/netd.service
Size 241B
SHA256 cee909cdcda744de562e43a98c9d5d6ef26f2ebe194bee98696043274de026a8
MD5 3c94a0f2e307c750f3ece842fa65575b
SHA1 fdcc673dd4a6e7be66f63f9ac1d1d5c134366aaa
SHA512 7de8c2cc91284aa1ecf6ea4c3c05f76c82df7790077720bad5bb43950a24f34ecf5a8e4046b6979503fca647788fd8db7a58ec81dfd1e12125036d785c51bb8a
TLSH
T150D09712363424E9D8CF1172CF796F808F000080888F2331CBF0AFA28AE268691264BE
MD5 SHA1 SHA512 TLSH

Submit Download

.sys_recovery.sh

Path /var/tmp/.sys_recovery.sh
Size 142B
SHA256 efd98610c6312641ed49a0858a765618dad001db0de4e27ca8c8ca090f996c98
MD5 b50ad0df295a8c055ba9008d49cfc2dd
SHA1 78248b02f7468bc07b0893e7ef5cfd8020cbb33a
SHA512 d4df2e6c3ccaad0a6a7664096f6cfb5af09f457a45a552ebf4cb515ce7e071b3c9115a778c5c3c255e470ff9ed309ab3b99f109100a4606651bb92f89083e121
TLSH
T165C02B13E1204C316F1000F955ED7008A283C00B5F4F1CB0308AE1703F2E21DB66332D
MD5 SHA1 SHA512 TLSH

Submit Download

.t2ayxgh5

Path /var/tmp/.t2ayxgh5
Size 246KB
SHA256 57a4487a6f882b2448048164a1b0ea71c104aa94e9ad6aca8d3f8d2c60401ed4
MD5 2db76c5b95869ab829c92e20f4ff7c47
SHA1 7cbd63977788fac53ef6f331c11aec5f8c19c90c
SHA512 1b0916f9264861519ff4fd61a11a059740e35ba899d1957c4ffb7b83c25c7f7841952c7c0cc42355ca07dfaf39f5b469238b2b4d018040ae40981957fa18dec5
SSDEEP 3072:XlwuMbAimylr+eep2HzqZUDtp0zhQWRjTVxR6Az+KzAL:XlwuMbHXekTqCtpwQOVxRDpzA
TLSH
T16F34D60AAF610EF7E8AFCD3706E90B4529CC651721A83F357974D918F54A64B0AE3CB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads