Malware analysis 0831efb251956eeeeab59e8a7e5ab03e Malicious activity

Add for printing

File name:	0831efb251956eeeeab59e8a7e5ab03e
Full analysis:	https://app.any.run/tasks/dca8bfe0-d3de-4c8b-92c6-21bc63575627
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	August 01, 2024, 13:42:32
OS:	Ubuntu 22.04.2
Tags:	mirai botnet moobot
Indicators:
MIME:	application/x-executable
File info:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
MD5:	0831EFB251956EEEEAB59E8A7E5AB03E
SHA1:	DC680B6138AF67F03E05BF0861A0BB5C00A5376B
SHA256:	2BCA5C9778DF8FC6FB6DE5811F12DA27F8769ED466C6B629C4613DC023B870A3
SSDEEP:	3072:VUusEUESrjpqNxPPoYevueShYK12PDZ1DiO87BEsc7wp:VUusEUESPpqNxP2HShX2PDZ1Dimwp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Connects to the CnC server
  - busybox (PID: 12931)
- MIRAI has been detected (SURICATA)
  - busybox (PID: 12931)
SUSPICIOUS
- Executes commands using command-line interpreter
  - 0831efb251956eeeeab59e8a7e5ab03e.o (PID: 12924)
- Modifies file or directory owner
  - sudo (PID: 12920)
- Executes the "rm" command to delete files or directories
  - sh (PID: 12926)
- Connects to unusual port
  - busybox (PID: 12931)
- Contacting a server suspected of hosting an CnC
  - busybox (PID: 12931)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture:	32 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	i386

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

234

Monitored processes

21

Malicious processes

4

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12919	/bin/sh -c "sudo chown user /tmp/0831efb251956eeeeab59e8a7e5ab03e\.o && chmod +x /tmp/0831efb251956eeeeab59e8a7e5ab03e\.o && DISPLAY=:0 sudo -iu user /tmp/0831efb251956eeeeab59e8a7e5ab03e\.o "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
12920	sudo chown user /tmp/0831efb251956eeeeab59e8a7e5ab03e.o	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
12921	chown user /tmp/0831efb251956eeeeab59e8a7e5ab03e.o	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
12922	chmod +x /tmp/0831efb251956eeeeab59e8a7e5ab03e.o	/usr/bin/chmod	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
12923	sudo -iu user /tmp/0831efb251956eeeeab59e8a7e5ab03e.o	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
12924	/tmp/0831efb251956eeeeab59e8a7e5ab03e.o	/tmp/0831efb251956eeeeab59e8a7e5ab03e.o	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
12925	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	0831efb251956eeeeab59e8a7e5ab03e.o
User: user Integrity Level: UNKNOWN Exit code: 0
12926	/bin/sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/0831efb251956eeeeab59e8a7e5ab03e\.o bin/busybox; chmod 777 bin/busybox"	/bin/sh	—	0831efb251956eeeeab59e8a7e5ab03e.o
User: user Integrity Level: UNKNOWN Exit code: 0
12927	rm -rf bin/busybox	/usr/bin/rm	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0
12928	mkdir bin	/usr/bin/mkdir	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

13

DNS requests

18

Threats

26

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	185.125.190.17:80	http://connectivity-check.ubuntu.com/	GB	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.18:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	91.189.91.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	unknown
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	138.199.37.25:443	odrs.gnome.org	Datacamp Limited	DE	unknown
12931	busybox	103.238.235.163:56999	khongphaibotnet.servehttp.com	—	—	malicious
485	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
485	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
485	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.18 91.189.91.48 185.125.190.17 185.125.190.97 91.189.91.96 185.125.190.98 185.125.190.49 91.189.91.98 185.125.190.48 91.189.91.49 185.125.190.96 91.189.91.97 2620:2d:4000:1::2a 2620:2d:4000:1::2b 2620:2d:4002:1::196 2620:2d:4000:1::96 2001:67c:1562::23 2620:2d:4000:1::97 2620:2d:4000:1::23 2620:2d:4000:1::22 2620:2d:4000:1::98 2620:2d:4002:1::197 2620:2d:4002:1::198 2001:67c:1562::24	whitelisted
google.com	142.250.74.206 2a00:1450:4001:831::200e	whitelisted
odrs.gnome.org	138.199.37.25 195.181.170.18 138.199.37.38 212.102.56.179 195.181.175.41 138.199.37.41 156.146.33.14 2a02:6ea0:c700::112 2a02:6ea0:c700::11 2a02:6ea0:c700::18 2a02:6ea0:c700::107 2a02:6ea0:c700::21 2a02:6ea0:c700::19 2a02:6ea0:c700::101	whitelisted
khongphaibotnet.servehttp.com	103.238.235.163	unknown
api.snapcraft.io	185.125.188.54 185.125.188.59 185.125.188.58 185.125.188.55	whitelisted
52.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
12931	busybox	Potentially Bad Traffic	ET POLICY DNS Query to DynDNS Domain *.servehttp .com
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
12931	busybox	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response

Add for printing

No debug info

General Info

0831efb251956eeeeab59e8a7e5ab03e

0831EFB251956EEEEAB59E8A7E5AB03E

DC680B6138AF67F03E05BF0861A0BB5C00A5376B

2BCA5C9778DF8FC6FB6DE5811F12DA27F8769ED466C6B629C4613DC023B870A3

3072:VUusEUESrjpqNxPPoYevueShYK12PDZ1DiO87BEsc7wp:VUusEUESPpqNxP2HShX2PDZ1Dimwp

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Connects to the CnC server

MIRAI has been detected (SURICATA)

SUSPICIOUS

Executes commands using command-line interpreter

Modifies file or directory owner

Executes the "rm" command to delete files or directories

Connects to unusual port

Contacting a server suspected of hosting an CnC

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings