mirai | e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/05/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c
Size 77KB
Sample260523-wlf3vsaz3v
SHA256 e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c
MD5 f129fa69f9297af6ed0be8b3b749ac3e
SHA1 aa6d8317cfb2ead302c65759f89fb9842b9c3f4e
SHA512 627d804901f790c21dd1515206dde51dd6abe64348bcd412734fc3be0ef93b72be3394dba0dd70c5750275ddfa5a0eb92f585118c3bd9c3c0ef5bce8ae9a77b8
SSDEEP 1536:XeS3Bt8Z1k1QzRjEMG/5BmqDNEjPc0mJQf+WeIWLEMf8BLULWJ:uSj8Z1k1QNo/5BmWqbc3YPWLvUVOA
TLSH
T1C57329C4FA8B81F5E81709304067F23FCF31E9794071866DEF6A9E35DE27A41A316299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet mirai defense_evasion discovery mirai persistence privilege_escalation

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Detects suspicious XORed keyword - Mozilla/5.0 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	SUSP_XORed_Mozilla

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1495	sh
1496	chmod
1468	sh
1469	chmod
1474	sh
1475	chmod
1489	sh
1490	chmod

Deletes itself 1 IoCs

pid	Process
1465	e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c

Executes dropped EXE 1 IoCs

ioc	pid	Process
/usr/bin/byxl	1478	e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c

Attempts to change immutable files 8 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1500	chattr
1539	chattr
1471	chattr
1477	chattr
1491	sh
1492	chattr
1498	chattr
1499	sh

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-kernel-monitor.service	byxl

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/byxl	cp

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		1464	e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c
Changes the process name, possibly in an attempt to hide itself	kworker/3dee2406	1465	e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c
Changes the process name, possibly in an attempt to hide itself		1478	byxl
Changes the process name, possibly in an attempt to hide itself	kworker/6fee691a	1478	byxl

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/status	e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c
File opened for reading	/proc/self/status	byxl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl

/tmp/e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c
/tmp/e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c
1⤵
- Deletes itself
- Executes dropped EXE
- Changes its process name
- Reads runtime system information
PID:1464
- /bin/sh
  sh -c "mkdir -p /usr/lib 2>/dev/null"
  2⤵
  PID:1466
- - /bin/mkdir
    mkdir -p /usr/lib
    3⤵
    - Reads runtime system information
    PID:1467
- /bin/sh
  sh -c "chmod 755 /usr/lib 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:1468
- - /bin/chmod
    chmod 755 /usr/lib
    3⤵
    - File and Directory Permissions Modification
    PID:1469
- /bin/sh
  sh -c "chattr -i /usr/bin/byxl 2>/dev/null"
  2⤵
  PID:1470
- - /usr/bin/chattr
    chattr -i /usr/bin/byxl
    3⤵
    - Attempts to change immutable files
    PID:1471
- /bin/sh
  sh -c "cp -f /tmp/e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c /usr/bin/byxl"
  2⤵
  PID:1472
- - /bin/cp
    cp -f /tmp/e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c /usr/bin/byxl
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1473
- /bin/sh
  sh -c "chmod +x /usr/bin/byxl"
  2⤵
  - File and Directory Permissions Modification
  PID:1474
- - /bin/chmod
    chmod +x /usr/bin/byxl
    3⤵
    - File and Directory Permissions Modification
    PID:1475
- /bin/sh
  sh -c "chattr +i /usr/bin/byxl"
  2⤵
  PID:1476
- - /usr/bin/chattr
    chattr +i /usr/bin/byxl
    3⤵
    - Attempts to change immutable files
    PID:1477
- /usr/bin/byxl
  /usr/bin/byxl
  2⤵
  - Modifies systemd
  - Changes its process name
  - Reads runtime system information
  PID:1478
- - /bin/sh
    sh -c "mkdir -p /usr/lib 2>/dev/null"
    3⤵
    PID:1487
  - - /bin/mkdir
      mkdir -p /usr/lib
      4⤵
      Reads runtime system information
      PID:1488
- - /bin/sh
    sh -c "chmod 755 /usr/lib 2>/dev/null"
    3⤵
    - File and Directory Permissions Modification
    PID:1489
  - - /bin/chmod
      chmod 755 /usr/lib
      4⤵
      File and Directory Permissions Modification
      PID:1490
- - /bin/sh
    sh -c "chattr -i /usr/bin/byxl 2>/dev/null"
    3⤵
    - Attempts to change immutable files
    PID:1491
  - - /usr/bin/chattr
      chattr -i /usr/bin/byxl
      4⤵
      Attempts to change immutable files
      PID:1492
- - /bin/sh
    sh -c "cp -f /usr/bin/byxl /usr/bin/byxl"
    3⤵
    PID:1493
  - - /bin/cp
      cp -f /usr/bin/byxl /usr/bin/byxl
      4⤵
      Reads runtime system information
      PID:1494
- - /bin/sh
    sh -c "chmod +x /usr/bin/byxl"
    3⤵
    - File and Directory Permissions Modification
    PID:1495
  - - /bin/chmod
      chmod +x /usr/bin/byxl
      4⤵
      File and Directory Permissions Modification
      PID:1496
- - /bin/sh
    sh -c "chattr +i /usr/bin/byxl"
    3⤵
    PID:1497
  - - /usr/bin/chattr
      chattr +i /usr/bin/byxl
      4⤵
      Attempts to change immutable files
      PID:1498
- - /bin/sh
    sh -c "chattr -i /etc/systemd/system/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    - Attempts to change immutable files
    PID:1499
  - - /usr/bin/chattr
      chattr -i /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      Attempts to change immutable files
      PID:1500
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system 2>/dev/null"
    3⤵
    PID:1501
  - - /bin/mkdir
      mkdir -p /etc/systemd/system
      4⤵
      Reads runtime system information
      PID:1502
- - /bin/sh
    sh -c "chmod 644 /etc/systemd/system/systemd-kernel-monitor.service"
    3⤵
    PID:1503
  - - /bin/chmod
      chmod 644 /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      PID:1504
- - /bin/sh
    sh -c "systemctl daemon-reload 2>/dev/null"
    3⤵
    PID:1505
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:1506
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system/multi-user.target.wants 2>/dev/null"
    3⤵
    PID:1527
  - - /bin/mkdir
      mkdir -p /etc/systemd/system/multi-user.target.wants
      4⤵
      Reads runtime system information
      PID:1528
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system/sysinit.target.wants 2>/dev/null"
    3⤵
    PID:1529
  - - /bin/mkdir
      mkdir -p /etc/systemd/system/sysinit.target.wants
      4⤵
      Reads runtime system information
      PID:1530
- - /bin/sh
    sh -c "ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/multi-user.target.wants/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1531
  - - /bin/ln
      ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/multi-user.target.wants/systemd-kernel-monitor.service
      4⤵
      PID:1532
- - /bin/sh
    sh -c "ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/sysinit.target.wants/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1533
  - - /bin/ln
      ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/sysinit.target.wants/systemd-kernel-monitor.service
      4⤵
      PID:1534
- - /bin/sh
    sh -c "systemctl start systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1535
  - - /bin/systemctl
      systemctl start systemd-kernel-monitor.service
      4⤵
      Reads runtime system information
      PID:1536
- - /bin/sh
    sh -c "chattr +i /etc/systemd/system/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1538
  - - /usr/bin/chattr
      chattr +i /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      Attempts to change immutable files
      PID:1539

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemd-kernel-monitor.service

Path /etc/systemd/system/systemd-kernel-monitor.service
Size 453B
SHA256 981ab9a653efdbfd384a72f33a6834b89869dd1bb46db6a7f528f86001195090
MD5 4b25dbb7b4c78de7a2ca94a7a7f06713
SHA1 48180f6bf9217f1c3b35ade546d80cf2d5b87eeb
SHA512 66ab43ccb9dc8429b52db858816336c96f038a4ac0994e2b9d8a2cd91410af117f26183d8e95f3f1a3efbce16bfe3d75eb02d8fcd708e480245f7ace12204a2a
TLSH
T14FF0D460A736306CDB02789B475B27580D3513436D8AB3302DF42501F9C5F3EE0A112E
MD5 SHA1 SHA512 TLSH

Submit Download

byxl

Path /usr/bin/byxl
Size 77KB
SHA256 e5eb61152a3c2e16713477cddd3eab1a04dcaf17121530c9f73170812416c44c
MD5 f129fa69f9297af6ed0be8b3b749ac3e
SHA1 aa6d8317cfb2ead302c65759f89fb9842b9c3f4e
SHA512 627d804901f790c21dd1515206dde51dd6abe64348bcd412734fc3be0ef93b72be3394dba0dd70c5750275ddfa5a0eb92f585118c3bd9c3c0ef5bce8ae9a77b8
SSDEEP 1536:XeS3Bt8Z1k1QzRjEMG/5BmqDNEjPc0mJQf+WeIWLEMf8BLULWJ:uSj8Z1k1QNo/5BmWqbc3YPWLvUVOA
TLSH
T1C57329C4FA8B81F5E81709304067F23FCF31E9794071866DEF6A9E35DE27A41A316299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads