mirai | 02791c8e66fd555038e212af232ae33dea2aa32149e34ad6b05247ed9d42bf9a

Analysis

max time kernel
147s
max time network
149s
platform
debian-9_mips
resource
debian9-mipsbe-20250619-en
resource tags

arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
21/08/2025, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
morte.mips.elf
Size 40KB
Sample250821-e6shysfl7s
SHA256 02791c8e66fd555038e212af232ae33dea2aa32149e34ad6b05247ed9d42bf9a
MD5 fa367dec1ee22ce2e621bcf8fbe4d342
SHA1 4cafc6ac11eef7f1093726ae71e2f4e2705797d3
SHA512 ed23092823180e7357df6d3f347a02d32ba25774f976047b86ca5376a509f61b318d9d7ee60f70485e06dae2320f366cbf3cb17c9064aba6621a0b2ed89c47fa
SSDEEP 768:ngGilyrG5sGtLIsuY34zPjiA2Qt9SJrStLAqM7ExLy4/tNKiBBc5JgGlzDpbuR1O:zrdMIs5keA2S9qrStkqtxLbWiCVJui
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mirai botnet credential_access discovery persistence upx

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

Deletes itself 1 IoCs

pid	Process
722	morte.mips.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	morte.mips.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/sysd	morte.mips.elf

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	morte.mips.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/.sh	cp

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/15/maps	morte.mips.elf
File opened for reading	/proc/19/maps	morte.mips.elf
File opened for reading	/proc/176/maps	morte.mips.elf
File opened for reading	/proc/74/maps	morte.mips.elf
File opened for reading	/proc/163/maps	morte.mips.elf
File opened for reading	/proc/384/maps	morte.mips.elf
File opened for reading	/proc/683/maps	morte.mips.elf
File opened for reading	/proc/718/maps	morte.mips.elf
File opened for reading	/proc/9/maps	morte.mips.elf
File opened for reading	/proc/69/maps	morte.mips.elf
File opened for reading	/proc/127/maps	morte.mips.elf
File opened for reading	/proc/6/maps	morte.mips.elf
File opened for reading	/proc/17/maps	morte.mips.elf
File opened for reading	/proc/7/maps	morte.mips.elf
File opened for reading	/proc/22/maps	morte.mips.elf
File opened for reading	/proc/24/maps	morte.mips.elf
File opened for reading	/proc/111/maps	morte.mips.elf
File opened for reading	/proc/679/maps	morte.mips.elf
File opened for reading	/proc/705/maps	morte.mips.elf
File opened for reading	/proc/723/maps	morte.mips.elf
File opened for reading	/proc/3/maps	morte.mips.elf
File opened for reading	/proc/72/maps	morte.mips.elf
File opened for reading	/proc/76/maps	morte.mips.elf
File opened for reading	/proc/82/maps	morte.mips.elf
File opened for reading	/proc/2/maps	morte.mips.elf
File opened for reading	/proc/8/maps	morte.mips.elf
File opened for reading	/proc/14/maps	morte.mips.elf
File opened for reading	/proc/36/maps	morte.mips.elf
File opened for reading	/proc/11/maps	morte.mips.elf
File opened for reading	/proc/20/maps	morte.mips.elf
File opened for reading	/proc/77/maps	morte.mips.elf
File opened for reading	/proc/79/maps	morte.mips.elf
File opened for reading	/proc/37/maps	morte.mips.elf
File opened for reading	/proc/71/maps	morte.mips.elf
File opened for reading	/proc/75/maps	morte.mips.elf
File opened for reading	/proc/339/maps	morte.mips.elf
File opened for reading	/proc/675/maps	morte.mips.elf
File opened for reading	/proc/684/maps	morte.mips.elf
File opened for reading	/proc/23/maps	morte.mips.elf
File opened for reading	/proc/336/maps	morte.mips.elf
File opened for reading	/proc/388/maps	morte.mips.elf
File opened for reading	/proc/704/maps	morte.mips.elf
File opened for reading	/proc/16/maps	morte.mips.elf
File opened for reading	/proc/73/maps	morte.mips.elf
File opened for reading	/proc/369/maps	morte.mips.elf
File opened for reading	/proc/710/maps	morte.mips.elf
File opened for reading	/proc/18/maps	morte.mips.elf
File opened for reading	/proc/21/maps	morte.mips.elf
File opened for reading	/proc/84/maps	morte.mips.elf
File opened for reading	/proc/128/maps	morte.mips.elf
File opened for reading	/proc/155/maps	morte.mips.elf
File opened for reading	/proc/335/maps	morte.mips.elf
File opened for reading	/proc/663/maps	morte.mips.elf
File opened for reading	/proc/724/maps	morte.mips.elf
File opened for reading	/proc/10/maps	morte.mips.elf
File opened for reading	/proc/81/maps	morte.mips.elf
File opened for reading	/proc/250/maps	morte.mips.elf
File opened for reading	/proc/429/maps	morte.mips.elf
File opened for reading	/proc/711/maps	morte.mips.elf
File opened for reading	/proc/5/maps	morte.mips.elf
File opened for reading	/proc/13/maps	morte.mips.elf
File opened for reading	/proc/383/maps	morte.mips.elf
File opened for reading	/proc/4/maps	morte.mips.elf
File opened for reading	/proc/12/maps	morte.mips.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	init	715	morte.mips.elf

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp6	morte.mips.elf
File opened for reading	/proc/net/tcp	morte.mips.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/155/fd	morte.mips.elf
File opened for reading	/proc/384/fd	morte.mips.elf
File opened for reading	/proc/388/fd	morte.mips.elf
File opened for reading	/proc/429/fd	morte.mips.elf
File opened for reading	/proc/79/cmdline	morte.mips.elf
File opened for reading	/proc/336/cmdline	morte.mips.elf
File opened for reading	/proc/705/cmdline	morte.mips.elf
File opened for reading	/proc/79/comm	morte.mips.elf
File opened for reading	/proc/723/comm	morte.mips.elf
File opened for reading	/proc/7/fd	morte.mips.elf
File opened for reading	/proc/9/fd	morte.mips.elf
File opened for reading	/proc/11/fd	morte.mips.elf
File opened for reading	/proc/128/cmdline	morte.mips.elf
File opened for reading	/proc/15/comm	morte.mips.elf
File opened for reading	/proc/22/comm	morte.mips.elf
File opened for reading	/proc/75/comm	morte.mips.elf
File opened for reading	/proc/84/comm	morte.mips.elf
File opened for reading	/proc/2/fd	morte.mips.elf
File opened for reading	/proc/13/fd	morte.mips.elf
File opened for reading	/proc/16/fd	morte.mips.elf
File opened for reading	/proc/8/cmdline	morte.mips.elf
File opened for reading	/proc/9/cmdline	morte.mips.elf
File opened for reading	/proc/10/cmdline	morte.mips.elf
File opened for reading	/proc/675/cmdline	morte.mips.elf
File opened for reading	/proc/19/comm	morte.mips.elf
File opened for reading	/proc/335/fd	morte.mips.elf
File opened for reading	/proc/704/fd	morte.mips.elf
File opened for reading	/proc/710/fd	morte.mips.elf
File opened for reading	/proc/1/cmdline	morte.mips.elf
File opened for reading	/proc/111/comm	morte.mips.elf
File opened for reading	/proc/704/comm	morte.mips.elf
File opened for reading	/proc/22/fd	morte.mips.elf
File opened for reading	/proc/84/fd	morte.mips.elf
File opened for reading	/proc/684/cmdline	morte.mips.elf
File opened for reading	/proc/704/cmdline	morte.mips.elf
File opened for reading	/proc/721/cmdline	morte.mips.elf
File opened for reading	/proc/24/comm	morte.mips.elf
File opened for reading	/proc/176/fd	morte.mips.elf
File opened for reading	/proc/7/cmdline	morte.mips.elf
File opened for reading	/proc/17/cmdline	morte.mips.elf
File opened for reading	/proc/21/cmdline	morte.mips.elf
File opened for reading	/proc/709/cmdline	morte.mips.elf
File opened for reading	/proc/76/comm	morte.mips.elf
File opened for reading	/proc/429/comm	morte.mips.elf
File opened for reading	/proc/723/cmdline	morte.mips.elf
File opened for reading	/proc/10/fd	morte.mips.elf
File opened for reading	/proc/4/cmdline	morte.mips.elf
File opened for reading	/proc/69/cmdline	morte.mips.elf
File opened for reading	/proc/75/cmdline	morte.mips.elf
File opened for reading	/proc/718/cmdline	morte.mips.elf
File opened for reading	/proc/4/comm	morte.mips.elf
File opened for reading	/proc/13/comm	morte.mips.elf
File opened for reading	/proc/23/comm	morte.mips.elf
File opened for reading	/proc/20/fd	morte.mips.elf
File opened for reading	/proc/429/cmdline	morte.mips.elf
File opened for reading	/proc/710/cmdline	morte.mips.elf
File opened for reading	/proc/10/comm	morte.mips.elf
File opened for reading	/proc/5/fd	morte.mips.elf
File opened for reading	/proc/75/fd	morte.mips.elf
File opened for reading	/proc/128/fd	morte.mips.elf
File opened for reading	/proc/6/cmdline	morte.mips.elf
File opened for reading	/proc/17/comm	morte.mips.elf
File opened for reading	/proc/18/comm	morte.mips.elf
File opened for reading	/proc/69/comm	morte.mips.elf

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
713	morte.mips.elf
717	sh
719	cp

/tmp/morte.mips.elf
/tmp/morte.mips.elf
1⤵
- Deletes itself
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:713
- /bin/sh
  sh -c "cp /tmp/morte.mips.elf /usr/bin/.sh"
  2⤵
  - System Network Configuration Discovery
  PID:717
- - /bin/cp
    cp /tmp/morte.mips.elf /usr/bin/.sh
    3⤵
    - Write file to user bin folder
    - System Network Configuration Discovery
    PID:719

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysd

Path /etc/init.d/sysd
Size 25B
SHA256 ba1d50d125344f273c249426ccd744d5a12e560ace41cca4bc55bd2d4a718d8f
MD5 997cb34ff6e6cded70b841c0d16c0938
SHA1 cc85c16e2fb441d86aa668f376ca7fb4b181f1ab
SHA512 1e775ca8513f2841b6a8e369071b28c48489ab6462d06525f9b6b2bf97e9c043562bd7e0217307ed64a95217a76a94a08189616831c9d3127c6b91b7544570c8
MD5 SHA1 SHA512

Submit Download

.sh

Path /usr/bin/.sh
Size 40KB
SHA256 02791c8e66fd555038e212af232ae33dea2aa32149e34ad6b05247ed9d42bf9a
MD5 fa367dec1ee22ce2e621bcf8fbe4d342
SHA1 4cafc6ac11eef7f1093726ae71e2f4e2705797d3
SHA512 ed23092823180e7357df6d3f347a02d32ba25774f976047b86ca5376a509f61b318d9d7ee60f70485e06dae2320f366cbf3cb17c9064aba6621a0b2ed89c47fa
SSDEEP 768:ngGilyrG5sGtLIsuY34zPjiA2Qt9SJrStLAqM7ExLy4/tNKiBBc5JgGlzDpbuR1O:zrdMIs5keA2S9qrStkqtxLbWiCVJui
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads