mirai | c3eb3129e2e726e3adb37785c3799ee79a44e51edcd3467ee305d30f596596d9

Analysis

max time kernel
144s
max time network
145s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
17/05/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
i686
Size 81KB
Sample260517-wtgpcsby71
SHA256 c3eb3129e2e726e3adb37785c3799ee79a44e51edcd3467ee305d30f596596d9
MD5 c5e8cf509e07121a82549b108a16360b
SHA1 39c54e24c957f92466f23d9201c1a945f35ccb8e
SHA512 1421fbc726440ff4e54e2e7246323e4456c5ffba1c98fc84ac0122f18092109b2a6477e20fac26f1c93c09d3e5261ffcd0ac84591eb5219c98b6c66988855442
SSDEEP 1536:zxe/A97rFwfBrlTjz/MGfdAlHq1aZ9G6/2jULWJGoWCQ1JJRcYPeKbzm:zxea7rFwfB5TP/fdAlTn5/2A2kX1J3Fo
TLSH
T11D833A80F987C4F5E95B083040A7F23FCF31E9699070C66DEF9ADE35DA67640931A299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet mirai defense_evasion discovery mirai persistence privilege_escalation

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1502	chmod
1473	sh
1474	chmod
1479	sh
1480	chmod
1495	sh
1496	chmod
1501	sh

Deletes itself 1 IoCs

pid	Process
1470	i686

Executes dropped EXE 1 IoCs

ioc	pid	Process
/usr/lib/.libc.so.6	1483	i686

Attempts to change immutable files 8 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1476	chattr
1482	chattr
1497	sh
1498	chattr
1504	chattr
1505	sh
1506	chattr
1545	chattr

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-kernel-monitor.service	.libc.so.6

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		1469	i686
Changes the process name, possibly in an attempt to hide itself	kworker/2827e9ce	1470	i686
Changes the process name, possibly in an attempt to hide itself		1483	.libc.so.6
Changes the process name, possibly in an attempt to hide itself	kworker/599db265	1483	.libc.so.6

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/status	.libc.so.6
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/status	i686
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl

/tmp/i686
/tmp/i686
1⤵
- Deletes itself
- Executes dropped EXE
- Changes its process name
- Reads runtime system information
PID:1469
- /bin/sh
  sh -c "mkdir -p /usr/lib 2>/dev/null"
  2⤵
  PID:1471
- - /bin/mkdir
    mkdir -p /usr/lib
    3⤵
    - Reads runtime system information
    PID:1472
- /bin/sh
  sh -c "chmod 755 /usr/lib 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:1473
- - /bin/chmod
    chmod 755 /usr/lib
    3⤵
    - File and Directory Permissions Modification
    PID:1474
- /bin/sh
  sh -c "chattr -i /usr/lib/.libc.so.6 2>/dev/null"
  2⤵
  PID:1475
- - /usr/bin/chattr
    chattr -i /usr/lib/.libc.so.6
    3⤵
    - Attempts to change immutable files
    PID:1476
- /bin/sh
  sh -c "cp -f /tmp/i686 /usr/lib/.libc.so.6"
  2⤵
  PID:1477
- - /bin/cp
    cp -f /tmp/i686 /usr/lib/.libc.so.6
    3⤵
    - Reads runtime system information
    PID:1478
- /bin/sh
  sh -c "chmod +x /usr/lib/.libc.so.6"
  2⤵
  - File and Directory Permissions Modification
  PID:1479
- - /bin/chmod
    chmod +x /usr/lib/.libc.so.6
    3⤵
    - File and Directory Permissions Modification
    PID:1480
- /bin/sh
  sh -c "chattr +i /usr/lib/.libc.so.6"
  2⤵
  PID:1481
- - /usr/bin/chattr
    chattr +i /usr/lib/.libc.so.6
    3⤵
    - Attempts to change immutable files
    PID:1482
- /usr/lib/.libc.so.6
  /usr/lib/.libc.so.6
  2⤵
  - Modifies systemd
  - Changes its process name
  - Reads runtime system information
  PID:1483
- - /bin/sh
    sh -c "mkdir -p /usr/lib 2>/dev/null"
    3⤵
    PID:1493
  - - /bin/mkdir
      mkdir -p /usr/lib
      4⤵
      Reads runtime system information
      PID:1494
- - /bin/sh
    sh -c "chmod 755 /usr/lib 2>/dev/null"
    3⤵
    - File and Directory Permissions Modification
    PID:1495
  - - /bin/chmod
      chmod 755 /usr/lib
      4⤵
      File and Directory Permissions Modification
      PID:1496
- - /bin/sh
    sh -c "chattr -i /usr/lib/.libc.so.6 2>/dev/null"
    3⤵
    - Attempts to change immutable files
    PID:1497
  - - /usr/bin/chattr
      chattr -i /usr/lib/.libc.so.6
      4⤵
      Attempts to change immutable files
      PID:1498
- - /bin/sh
    sh -c "cp -f /usr/lib/.libc.so.6 /usr/lib/.libc.so.6"
    3⤵
    PID:1499
  - - /bin/cp
      cp -f /usr/lib/.libc.so.6 /usr/lib/.libc.so.6
      4⤵
      Reads runtime system information
      PID:1500
- - /bin/sh
    sh -c "chmod +x /usr/lib/.libc.so.6"
    3⤵
    - File and Directory Permissions Modification
    PID:1501
  - - /bin/chmod
      chmod +x /usr/lib/.libc.so.6
      4⤵
      File and Directory Permissions Modification
      PID:1502
- - /bin/sh
    sh -c "chattr +i /usr/lib/.libc.so.6"
    3⤵
    PID:1503
  - - /usr/bin/chattr
      chattr +i /usr/lib/.libc.so.6
      4⤵
      Attempts to change immutable files
      PID:1504
- - /bin/sh
    sh -c "chattr -i /etc/systemd/system/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    - Attempts to change immutable files
    PID:1505
  - - /usr/bin/chattr
      chattr -i /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      Attempts to change immutable files
      PID:1506
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system 2>/dev/null"
    3⤵
    PID:1507
  - - /bin/mkdir
      mkdir -p /etc/systemd/system
      4⤵
      Reads runtime system information
      PID:1508
- - /bin/sh
    sh -c "chmod 644 /etc/systemd/system/systemd-kernel-monitor.service"
    3⤵
    PID:1509
  - - /bin/chmod
      chmod 644 /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      PID:1510
- - /bin/sh
    sh -c "systemctl daemon-reload 2>/dev/null"
    3⤵
    PID:1511
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:1512
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system/multi-user.target.wants 2>/dev/null"
    3⤵
    PID:1533
  - - /bin/mkdir
      mkdir -p /etc/systemd/system/multi-user.target.wants
      4⤵
      Reads runtime system information
      PID:1534
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system/sysinit.target.wants 2>/dev/null"
    3⤵
    PID:1535
  - - /bin/mkdir
      mkdir -p /etc/systemd/system/sysinit.target.wants
      4⤵
      Reads runtime system information
      PID:1536
- - /bin/sh
    sh -c "ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/multi-user.target.wants/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1537
  - - /bin/ln
      ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/multi-user.target.wants/systemd-kernel-monitor.service
      4⤵
      PID:1538
- - /bin/sh
    sh -c "ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/sysinit.target.wants/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1539
  - - /bin/ln
      ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/sysinit.target.wants/systemd-kernel-monitor.service
      4⤵
      PID:1540
- - /bin/sh
    sh -c "systemctl start systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1541
  - - /bin/systemctl
      systemctl start systemd-kernel-monitor.service
      4⤵
      Reads runtime system information
      PID:1542
- - /bin/sh
    sh -c "chattr +i /etc/systemd/system/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1544
  - - /usr/bin/chattr
      chattr +i /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      Attempts to change immutable files
      PID:1545

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemd-kernel-monitor.service

Path /etc/systemd/system/systemd-kernel-monitor.service
Size 459B
SHA256 15499d498a8e7b83d01c54491a502455f2ddaadcd1f4577a719761c616ff0497
MD5 daa285555ff14f0b370995f90246c6e7
SHA1 5a7abeec57c327fdadad9009b497b2b46652d635
SHA512 54e7ea0c11e875fa0659486409a4c0bdd588f45d48180b831a5673d3ae058a19cf47e9b6a5b718c1b4c47eb0a8ef0f611e3f0907991f38b988d2c8013c449272
TLSH
T133F09E605736316CE602789B475A175C497523426D89B3202DB42501F9C1F2EE0A052E
MD5 SHA1 SHA512 TLSH

Submit Download

.libc.so.6

Path /usr/lib/.libc.so.6
Size 81KB
SHA256 c3eb3129e2e726e3adb37785c3799ee79a44e51edcd3467ee305d30f596596d9
MD5 c5e8cf509e07121a82549b108a16360b
SHA1 39c54e24c957f92466f23d9201c1a945f35ccb8e
SHA512 1421fbc726440ff4e54e2e7246323e4456c5ffba1c98fc84ac0122f18092109b2a6477e20fac26f1c93c09d3e5261ffcd0ac84591eb5219c98b6c66988855442
SSDEEP 1536:zxe/A97rFwfBrlTjz/MGfdAlHq1aZ9G6/2jULWJGoWCQ1JJRcYPeKbzm:zxea7rFwfB5TP/fdAlTn5/2A2kX1J3Fo
TLSH
T11D833A80F987C4F5E95B083040A7F23FCF31E9699070C66DEF9ADE35DA67640931A299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads