mirai | aaaa89488caf328bea8e56fa95cae69124a561ec97594b686c93cfdd24f13e96

Analysis

user interaction
yes
max time kernel
59s
max time network
48s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
08/07/2026, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Service Update.apk
Size 1.1MB
Sample260708-dl8trsh14s
SHA256 aaaa89488caf328bea8e56fa95cae69124a561ec97594b686c93cfdd24f13e96
MD5 01e909a65bc736be3c5fa49ca16c4cf8
SHA1 6af4ef79c4f733167f67d7d8e6dd77b174feb2fa
SHA512 ca354c69acc83bad4389287089fc1829ff5c1fa0bb46ebaaf13770a06417d9fab0c23655c36e5780a970df01ed4ddebb348e449f34de3744c362206452887cc2
SSDEEP 24576:kjmOO/9iY58t2CGr0ffGAotwuMgxBETxSC6EBUlh:kdOViAPvr0WAotwuVxBvC6c+
TLSH
T11A35331B2E380A1EF2D5587DA07BA54DDF3F4120A8694C8DD93CE2A85D5074A3CB85BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet defense_evasion execution mirai persistence

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.system.update
/system/xbin/su	com.system.update
/sbin/su	com.system.update
/data/local/su	com.system.update
/data/local/bin/su	com.system.update
/data/local/xbin/su	com.system.update
/system/sd/xbin/su	com.system.update
/system/bin/failsafe/su	com.system.update

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.system.update

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 4 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.system.update

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.system.update

com.system.update
1⤵
- Checks if the Android device is rooted.
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Schedules tasks to execute at a specified time
PID:4718
- getprop ro.debuggable
  2⤵
  PID:4803
- setprop service.adb.root 1
  2⤵
  PID:4824
- id
  2⤵
  PID:4844
- setprop service.adb.tcp.port 12341
  2⤵
  PID:4921
- stop adbd
  2⤵
  PID:4943
- start adbd
  2⤵
  PID:4961
- setprop service.adb.tcp.port 12341
  2⤵
  PID:4982
- stop adbd
  2⤵
  PID:5001
- start adbd
  2⤵
  PID:5020
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5040
- stop adbd
  2⤵
  PID:5060
- start adbd
  2⤵
  PID:5078
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5097
- stop adbd
  2⤵
  PID:5118
- start adbd
  2⤵
  PID:5136
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5155
- stop adbd
  2⤵
  PID:5173
- start adbd
  2⤵
  PID:5191
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5209
- stop adbd
  2⤵
  PID:5227
- start adbd
  2⤵
  PID:5245
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5263
- stop adbd
  2⤵
  PID:5281
- start adbd
  2⤵
  PID:5299
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5317
- stop adbd
  2⤵
  PID:5335
- start adbd
  2⤵
  PID:5353
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5388
- stop adbd
  2⤵
  PID:5406
- start adbd
  2⤵
  PID:5424
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5442
- stop adbd
  2⤵
  PID:5460
- start adbd
  2⤵
  PID:5478
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5496
- stop adbd
  2⤵
  PID:5515
- start adbd
  2⤵
  PID:5533
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5552
- stop adbd
  2⤵
  PID:5570
- start adbd
  2⤵
  PID:5588
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5606
- stop adbd
  2⤵
  PID:5625
- start adbd
  2⤵
  PID:5643
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5661
- stop adbd
  2⤵
  PID:5679
- start adbd
  2⤵
  PID:5697
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5720
- stop adbd
  2⤵
  PID:5738
- start adbd
  2⤵
  PID:5756
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5774
- stop adbd
  2⤵
  PID:5792
- start adbd
  2⤵
  PID:5810
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5856
- stop adbd
  2⤵
  PID:5886
- start adbd
  2⤵
  PID:5904
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5922
- stop adbd
  2⤵
  PID:5940
- start adbd
  2⤵
  PID:5958
- setprop service.adb.tcp.port 12341
  2⤵
  PID:5989
- stop adbd
  2⤵
  PID:6007
- start adbd
  2⤵
  PID:6025
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6043
- stop adbd
  2⤵
  PID:6061
- start adbd
  2⤵
  PID:6079
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6097
- stop adbd
  2⤵
  PID:6115
- start adbd
  2⤵
  PID:6133
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6151
- stop adbd
  2⤵
  PID:6169
- start adbd
  2⤵
  PID:6187
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6205
- stop adbd
  2⤵
  PID:6223
- start adbd
  2⤵
  PID:6241
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6259
- stop adbd
  2⤵
  PID:6277
- start adbd
  2⤵
  PID:6295
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6314
- stop adbd
  2⤵
  PID:6334
- start adbd
  2⤵
  PID:6353
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6371
- stop adbd
  2⤵
  PID:6389
- start adbd
  2⤵
  PID:6408
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6426
- stop adbd
  2⤵
  PID:6444
- start adbd
  2⤵
  PID:6462
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6480
- stop adbd
  2⤵
  PID:6498
- start adbd
  2⤵
  PID:6538
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6557
- stop adbd
  2⤵
  PID:6575
- start adbd
  2⤵
  PID:6593
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6611
- stop adbd
  2⤵
  PID:6629
- start adbd
  2⤵
  PID:6647
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6665
- stop adbd
  2⤵
  PID:6683
- start adbd
  2⤵
  PID:6701
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6719
- stop adbd
  2⤵
  PID:6737
- start adbd
  2⤵
  PID:6756
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6774
- stop adbd
  2⤵
  PID:6792
- start adbd
  2⤵
  PID:6810
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6828
- stop adbd
  2⤵
  PID:6848
- start adbd
  2⤵
  PID:6866
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6884
- stop adbd
  2⤵
  PID:6902
- start adbd
  2⤵
  PID:6920
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6938
- stop adbd
  2⤵
  PID:6956
- start adbd
  2⤵
  PID:6974
- setprop service.adb.tcp.port 12341
  2⤵
  PID:6993
- stop adbd
  2⤵
  PID:7011
- start adbd
  2⤵
  PID:7029
- setprop service.adb.tcp.port 12341
  2⤵
  PID:7047
- stop adbd
  2⤵
  PID:7065
- start adbd
  2⤵
  PID:7096
- setprop service.adb.tcp.port 12341
  2⤵
  PID:7114
- stop adbd
  2⤵
  PID:7132
- start adbd
  2⤵
  PID:7150
- setprop service.adb.tcp.port 12341
  2⤵
  PID:7168
- stop adbd
  2⤵
  PID:7186
- start adbd
  2⤵
  PID:7204
- setprop service.adb.tcp.port 12341
  2⤵
  PID:7222
- stop adbd
  2⤵
  PID:7240
- start adbd
  2⤵
  PID:7258
- setprop service.adb.tcp.port 12341
  2⤵
  PID:7289
- stop adbd
  2⤵
  PID:7307
- start adbd
  2⤵
  PID:7325

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libupdate.so

Path /data/user/0/com.system.update/files/libupdate.so
Size 121KB
SHA256 6cc3fc0284dfe57881f5ea01dcd3cecb6c667dc8d1147b049c3d6bd661d9c906
MD5 474a5445862638e0dfdf6543a11803f7
SHA1 143c7fd6a2297d8b0d91d7a12a5db901988ea2b3
SHA512 964868a0f4d8a60a433ebf2b554903a7f07a8d9db02d82272d755469da58363ccef99995b75bd004922cae3d57f401321f0a36b2527eebb412a41c922bfe07df
SSDEEP 3072:hWdmwuSdhhGpk4wiuGfnAllVQu49DkEGugK0:xwuMhaaMu5K0
TLSH
T18EC36B02FAC088FCC49AC27857AFA175D462F91C1131765B5FD4EE223D4EE217B2EA91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.apk

Path /storage/emulated/0/.android/system.apk
Size 1.1MB
SHA256 aaaa89488caf328bea8e56fa95cae69124a561ec97594b686c93cfdd24f13e96
MD5 01e909a65bc736be3c5fa49ca16c4cf8
SHA1 6af4ef79c4f733167f67d7d8e6dd77b174feb2fa
SHA512 ca354c69acc83bad4389287089fc1829ff5c1fa0bb46ebaaf13770a06417d9fab0c23655c36e5780a970df01ed4ddebb348e449f34de3744c362206452887cc2
SSDEEP 24576:kjmOO/9iY58t2CGr0ffGAotwuMgxBETxSC6EBUlh:kdOViAPvr0WAotwuVxBvC6c+
TLSH
T11A35331B2E380A1EF2D5587DA07BA54DDF3F4120A8694C8DD93CE2A85D5074A3CB85BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads