mirai | f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e

Analysis

max time kernel
139s
max time network
144s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/05/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e
Size 73KB
Sample260523-wlf3vsaz3w
SHA256 f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e
MD5 e6a6a939c582e9322eb718f7aab3f403
SHA1 a26075359418d1c627c6fcfcc64d5cb36630b34e
SHA512 97069cc2bf2e779c373c188d40037ad4bdb64b98b14015b80af3284d68fdeba9a1cdb40fc8ad232d2a4f9b1b343a08ea82fb3dcfabbf0d60cb0617dbb45e556b
SSDEEP 1536:lz8fjybdbUttEGwRlIVuSNBe6KpWk7jXPYt9H+v1P3:lAfjybdbC6GyUFBeZWknYrKJ
TLSH
T15B736AC9BA83D8F5FC1205326132BB335AB7F53B1078DA43DB69AA36DC42601E52635D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet mirai defense_evasion discovery mirai persistence privilege_escalation

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Detects suspicious XORed keyword - Mozilla/5.0 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	SUSP_XORed_Mozilla

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1507	sh
1508	chmod
1513	sh
1514	chmod
1525	sh
1526	chmod
1531	sh
1532	chmod

Deletes itself 1 IoCs

pid	Process
1504	f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e

Executes dropped EXE 1 IoCs

ioc	pid	Process
/usr/bin/byxl	1517	f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e

Attempts to change immutable files 8 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1510	chattr
1516	chattr
1527	sh
1528	chattr
1534	chattr
1535	sh
1536	chattr
1575	chattr

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-kernel-monitor.service	byxl

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/byxl	cp

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		1503	f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e
Changes the process name, possibly in an attempt to hide itself	migration/3df024f5	1504	f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e
Changes the process name, possibly in an attempt to hide itself		1517	byxl
Changes the process name, possibly in an attempt to hide itself	migration/6fa8191f	1517	byxl

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/status	f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/status	byxl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/stat	systemctl

/tmp/f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e
/tmp/f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e
1⤵
- Deletes itself
- Executes dropped EXE
- Changes its process name
- Reads runtime system information
PID:1503
- /bin/sh
  sh -c "mkdir -p /usr/lib 2>/dev/null"
  2⤵
  PID:1505
- - /bin/mkdir
    mkdir -p /usr/lib
    3⤵
    - Reads runtime system information
    PID:1506
- /bin/sh
  sh -c "chmod 755 /usr/lib 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:1507
- - /bin/chmod
    chmod 755 /usr/lib
    3⤵
    - File and Directory Permissions Modification
    PID:1508
- /bin/sh
  sh -c "chattr -i /usr/bin/byxl 2>/dev/null"
  2⤵
  PID:1509
- - /usr/bin/chattr
    chattr -i /usr/bin/byxl
    3⤵
    - Attempts to change immutable files
    PID:1510
- /bin/sh
  sh -c "cp -f /tmp/f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e /usr/bin/byxl"
  2⤵
  PID:1511
- - /bin/cp
    cp -f /tmp/f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e /usr/bin/byxl
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1512
- /bin/sh
  sh -c "chmod +x /usr/bin/byxl"
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- - /bin/chmod
    chmod +x /usr/bin/byxl
    3⤵
    - File and Directory Permissions Modification
    PID:1514
- /bin/sh
  sh -c "chattr +i /usr/bin/byxl"
  2⤵
  PID:1515
- - /usr/bin/chattr
    chattr +i /usr/bin/byxl
    3⤵
    - Attempts to change immutable files
    PID:1516
- /usr/bin/byxl
  /usr/bin/byxl
  2⤵
  - Modifies systemd
  - Changes its process name
  - Reads runtime system information
  PID:1517
- - /bin/sh
    sh -c "mkdir -p /usr/lib 2>/dev/null"
    3⤵
    PID:1523
  - - /bin/mkdir
      mkdir -p /usr/lib
      4⤵
      Reads runtime system information
      PID:1524
- - /bin/sh
    sh -c "chmod 755 /usr/lib 2>/dev/null"
    3⤵
    - File and Directory Permissions Modification
    PID:1525
  - - /bin/chmod
      chmod 755 /usr/lib
      4⤵
      File and Directory Permissions Modification
      PID:1526
- - /bin/sh
    sh -c "chattr -i /usr/bin/byxl 2>/dev/null"
    3⤵
    - Attempts to change immutable files
    PID:1527
  - - /usr/bin/chattr
      chattr -i /usr/bin/byxl
      4⤵
      Attempts to change immutable files
      PID:1528
- - /bin/sh
    sh -c "cp -f /usr/bin/byxl /usr/bin/byxl"
    3⤵
    PID:1529
  - - /bin/cp
      cp -f /usr/bin/byxl /usr/bin/byxl
      4⤵
      Reads runtime system information
      PID:1530
- - /bin/sh
    sh -c "chmod +x /usr/bin/byxl"
    3⤵
    - File and Directory Permissions Modification
    PID:1531
  - - /bin/chmod
      chmod +x /usr/bin/byxl
      4⤵
      File and Directory Permissions Modification
      PID:1532
- - /bin/sh
    sh -c "chattr +i /usr/bin/byxl"
    3⤵
    PID:1533
  - - /usr/bin/chattr
      chattr +i /usr/bin/byxl
      4⤵
      Attempts to change immutable files
      PID:1534
- - /bin/sh
    sh -c "chattr -i /etc/systemd/system/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    - Attempts to change immutable files
    PID:1535
  - - /usr/bin/chattr
      chattr -i /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      Attempts to change immutable files
      PID:1536
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system 2>/dev/null"
    3⤵
    PID:1537
  - - /bin/mkdir
      mkdir -p /etc/systemd/system
      4⤵
      Reads runtime system information
      PID:1538
- - /bin/sh
    sh -c "chmod 644 /etc/systemd/system/systemd-kernel-monitor.service"
    3⤵
    PID:1539
  - - /bin/chmod
      chmod 644 /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      PID:1540
- - /bin/sh
    sh -c "systemctl daemon-reload 2>/dev/null"
    3⤵
    PID:1541
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:1542
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system/multi-user.target.wants 2>/dev/null"
    3⤵
    PID:1563
  - - /bin/mkdir
      mkdir -p /etc/systemd/system/multi-user.target.wants
      4⤵
      Reads runtime system information
      PID:1564
- - /bin/sh
    sh -c "mkdir -p /etc/systemd/system/sysinit.target.wants 2>/dev/null"
    3⤵
    PID:1565
  - - /bin/mkdir
      mkdir -p /etc/systemd/system/sysinit.target.wants
      4⤵
      Reads runtime system information
      PID:1566
- - /bin/sh
    sh -c "ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/multi-user.target.wants/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1567
  - - /bin/ln
      ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/multi-user.target.wants/systemd-kernel-monitor.service
      4⤵
      PID:1568
- - /bin/sh
    sh -c "ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/sysinit.target.wants/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1569
  - - /bin/ln
      ln -sf /etc/systemd/system/systemd-kernel-monitor.service /etc/systemd/system/sysinit.target.wants/systemd-kernel-monitor.service
      4⤵
      PID:1570
- - /bin/sh
    sh -c "systemctl start systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1571
  - - /bin/systemctl
      systemctl start systemd-kernel-monitor.service
      4⤵
      Reads runtime system information
      PID:1572
- - /bin/sh
    sh -c "chattr +i /etc/systemd/system/systemd-kernel-monitor.service 2>/dev/null"
    3⤵
    PID:1574
  - - /usr/bin/chattr
      chattr +i /etc/systemd/system/systemd-kernel-monitor.service
      4⤵
      Attempts to change immutable files
      PID:1575

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemd-kernel-monitor.service

Path /etc/systemd/system/systemd-kernel-monitor.service
Size 453B
SHA256 981ab9a653efdbfd384a72f33a6834b89869dd1bb46db6a7f528f86001195090
MD5 4b25dbb7b4c78de7a2ca94a7a7f06713
SHA1 48180f6bf9217f1c3b35ade546d80cf2d5b87eeb
SHA512 66ab43ccb9dc8429b52db858816336c96f038a4ac0994e2b9d8a2cd91410af117f26183d8e95f3f1a3efbce16bfe3d75eb02d8fcd708e480245f7ace12204a2a
TLSH
T14FF0D460A736306CDB02789B475B27580D3513436D8AB3302DF42501F9C5F3EE0A112E
MD5 SHA1 SHA512 TLSH

Submit Download

byxl

Path /usr/bin/byxl
Size 73KB
SHA256 f76e03fb0571b51739ad104b9f4d35c62137fa00b2830d5d556cdc294317939e
MD5 e6a6a939c582e9322eb718f7aab3f403
SHA1 a26075359418d1c627c6fcfcc64d5cb36630b34e
SHA512 97069cc2bf2e779c373c188d40037ad4bdb64b98b14015b80af3284d68fdeba9a1cdb40fc8ad232d2a4f9b1b343a08ea82fb3dcfabbf0d60cb0617dbb45e556b
SSDEEP 1536:lz8fjybdbUttEGwRlIVuSNBe6KpWk7jXPYt9H+v1P3:lAfjybdbC6GyUFBeZWknYrKJ
TLSH
T15B736AC9BA83D8F5FC1205326132BB335AB7F53B1078DA43DB69AA36DC42601E52635D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads