c1cb713bf6a8edf4a2e3798bba08e0980dc20f6cbcb0ba96e6e534bca415cff4

execution persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/ld.so.preload	mips.elf

Deletes itself 1 IoCs

pid	Process
731	mips.elf

Deletes system logs 1 TTPs 2 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/syslog	mips.elf
File truncated	/var/log/messages	mips.elf

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	mips.elf

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

description	ioc	Process
File opened for modification	/etc/cron.d/killer-helper	mips.elf
File opened for modification	/etc/cron.d/sys-network-helper	mips.elf

Deletes log files 1 TTPs 6 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/btmp	mips.elf
File truncated	/var/log/lastlog	mips.elf
File truncated	/var/log/faillog	mips.elf
File truncated	/var/log/kern.log	mips.elf
File truncated	/var/log/auth.log	mips.elf
File truncated	/var/log/wtmp	mips.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

persistence privilege_escalation

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	mips.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	mips.elf

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/killer-helper.service	mips.elf
File opened for modification	/etc/systemd/system/sys-network-helper.service	mips.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-7.dat	upx

Changes its process name 10 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	orimhhh	731	mips.elf
Changes the process name, possibly in an attempt to hide itself	orimhhh	731	mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:5]	733	mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	738	mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	739	mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	739	mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:2]	740	mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	738	mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:3]	845	mips.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:4]	846	mips.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	mips.elf

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	mips.elf
File opened for reading	/proc/net/tcp6	mips.elf

Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
827	sh
868	sh
799	sh

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/782/exe	mips.elf
File opened for reading	/proc/813/cmdline	mips.elf
File opened for reading	/proc/344/exe	mips.elf
File opened for reading	/proc/886/exe	mips.elf
File opened for reading	/proc/254/comm	mips.elf
File opened for reading	/proc/762/comm	mips.elf
File opened for reading	/proc/826/comm	mips.elf
File opened for reading	/proc/877/cmdline	mips.elf
File opened for reading	/proc/754/comm	mips.elf
File opened for reading	/proc/791/comm	mips.elf
File opened for reading	/proc/833/cmdline	mips.elf
File opened for reading	/proc/883/exe	mips.elf
File opened for reading	/proc/893/cmdline	mips.elf
File opened for reading	/proc/2/exe	mips.elf
File opened for reading	/proc/8/exe	mips.elf
File opened for reading	/proc/75/cmdline	mips.elf
File opened for reading	/proc/122/cmdline	mips.elf
File opened for reading	/proc/757/exe	mips.elf
File opened for reading	/proc/852/exe	mips.elf
File opened for reading	/proc/908/exe	mips.elf
File opened for reading	/proc/910/comm	mips.elf
File opened for reading	/proc/736/comm	mips.elf
File opened for reading	/proc/19/exe	mips.elf
File opened for reading	/proc/79/exe	mips.elf
File opened for reading	/proc/720/exe	mips.elf
File opened for reading	/proc/785/comm	mips.elf
File opened for reading	/proc/844/exe	mips.elf
File opened for reading	/proc/873/comm	mips.elf
File opened for reading	/proc/908/comm	mips.elf
File opened for reading	/proc/74/exe	mips.elf
File opened for reading	/proc/713/exe	mips.elf
File opened for reading	/proc/254/cmdline	mips.elf
File opened for reading	/proc/751/cmdline	mips.elf
File opened for reading	/proc/776/cmdline	mips.elf
File opened for reading	/proc/851/comm	mips.elf
File opened for reading	/proc/722/comm	mips.elf
File opened for reading	/proc/687/exe	mips.elf
File opened for reading	/proc/847/comm	mips.elf
File opened for reading	/proc/901/cmdline	mips.elf
File opened for reading	/proc/75/comm	mips.elf
File opened for reading	/proc/782/cmdline	mips.elf
File opened for reading	/proc/807/exe	mips.elf
File opened for reading	/proc/880/comm	mips.elf
File opened for reading	/proc/904/cmdline	mips.elf
File opened for reading	/proc/18/cmdline	mips.elf
File opened for reading	/proc/760/cmdline	mips.elf
File opened for reading	/proc/767/cmdline	mips.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/805/cmdline	mips.elf
File opened for reading	/proc/866/cmdline	mips.elf
File opened for reading	/proc/896/cmdline	mips.elf
File opened for reading	/proc/77/cmdline	mips.elf
File opened for reading	/proc/752/exe	mips.elf
File opened for reading	/proc/765/comm	mips.elf
File opened for reading	/proc/793/comm	mips.elf
File opened for reading	/proc/841/exe	mips.elf
File opened for reading	/proc/851/exe	mips.elf
File opened for reading	/proc/889/exe	mips.elf
File opened for reading	/proc/906/exe	mips.elf
File opened for reading	/proc/176/comm	mips.elf
File opened for reading	/proc/758/comm	mips.elf
File opened for reading	/proc/784/exe	mips.elf
File opened for reading	/proc/826/cmdline	mips.elf
File opened for reading	/proc/852/cmdline	mips.elf

System Network Configuration Discovery 1 TTPs 9 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
836	as
836	as
771	iptables-restore
772	iptables-restore
772	iptables-restore
836	as
836	as
725	mips.elf
771	iptables-restore

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.sh7f3a.tmp.740	mips.elf

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.sh7f3a_ps.c	mips.elf
File opened for modification	/tmp/ccm2vh3u.o	as
File opened for modification	/tmp/cc6HxXqB.le	collect2
File opened for modification	/tmp/ccnZ5i9h.s	gcc
File opened for modification	/tmp/ccnZ5i9h.s	cc1
File opened for modification	/tmp/ccm2vh3u.o	gcc
File opened for modification	/tmp/cc1MhZL3.res	gcc
File opened for modification	/tmp/cc7gvxQL.c	collect2
File opened for modification	/tmp/ccU4QOnn.o	collect2
File opened for modification	/tmp/ccHILynZ.ld	collect2

/tmp/mips.elf
/tmp/mips.elf
1⤵
- Modifies the dynamic linker configuration file
- Deletes itself
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Creates/modifies Cron job
- Deletes log files
- Enumerates active TCP sockets
- Modifies rc script
- Modifies systemd
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to shm directory
- Writes file to tmp directory
PID:725
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable killer-helper.service 2>/dev/null"
  2⤵
  PID:742
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    PID:745
- - /bin/systemctl
    systemctl enable killer-helper.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:781
- /usr/sbin/iptables
  iptables -n -L LK_sh7f3a
  2⤵
  PID:764
- /sbin/iptables
  iptables -n -L LK_sh7f3a
  2⤵
  PID:764
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:771
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:771
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:772
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:772
- /bin/sh
  /bin/sh -c "systemctl daemon-reload 2>/dev/null;systemctl enable sys-network-helper 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:799
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:800
- - /bin/systemctl
    systemctl enable sys-network-helper
    3⤵
    - Enumerates kernel/hardware configuration
    PID:814
- /bin/sh
  /bin/sh -c "gcc -shared -fPIC -nostartfiles -o /usr/lib/.sh7f3a.so /tmp/.sh7f3a_ps.c 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:827
- - /usr/bin/gcc
    gcc -shared -fPIC -nostartfiles -o /usr/lib/.sh7f3a.so /tmp/.sh7f3a_ps.c
    3⤵
    - Writes file to tmp directory
    PID:828
  - - /usr/lib/gcc/mips-linux-gnu/6/cc1
      /usr/lib/gcc/mips-linux-gnu/6/cc1 -quiet -imultiarch mips-linux-gnu /tmp/.sh7f3a_ps.c -meb -quiet -dumpbase .sh7f3a_ps.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mips32r2 "-mabi=32" -auxbase .sh7f3a_ps -fPIC -o /tmp/ccnZ5i9h.s
      4⤵
      Writes file to tmp directory
      PID:829
  - - /usr/local/sbin/as
      as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccm2vh3u.o /tmp/ccnZ5i9h.s
      4⤵
      System Network Configuration Discovery
      PID:836
  - - /usr/local/bin/as
      as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccm2vh3u.o /tmp/ccnZ5i9h.s
      4⤵
      System Network Configuration Discovery
      PID:836
  - - /usr/sbin/as
      as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccm2vh3u.o /tmp/ccnZ5i9h.s
      4⤵
      System Network Configuration Discovery
      PID:836
  - - /usr/bin/as
      as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccm2vh3u.o /tmp/ccnZ5i9h.s
      4⤵
      System Network Configuration Discovery
      Writes file to tmp directory
      PID:836
  - - /usr/lib/gcc/mips-linux-gnu/6/collect2
      /usr/lib/gcc/mips-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cc1MhZL3.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -shared -melf32btsmip -o /usr/lib/.sh7f3a.so -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccm2vh3u.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed
      4⤵
      Writes file to tmp directory
      PID:838
    - - /usr/bin/ld
        
        /usr/bin/ld -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cc1MhZL3.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -shared -melf32btsmip -o /usr/lib/.sh7f3a.so -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccm2vh3u.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed
        5⤵
        
        PID:840
- /bin/sh
  /bin/sh -c "journalctl --rotate --vacuum-time=1s 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:868
- - /bin/journalctl
    journalctl --rotate "--vacuum-time=1s"
    3⤵
    PID:870

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Dynamic Linker Hijacking