🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 036000bac9d3ec067332774b1b8a9b057554d255ff845f801f5d882a5ed9aba5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 036000bac9d3ec067332774b1b8a9b057554d255ff845f801f5d882a5ed9aba5
SHA3-384 hash: 6294df99eae819f259b2dc1cdaa792ba5cf32ebb620a81824fb0f9c2c4668e7d67e6ae5e845ed86463f55244e7587688
SHA1 hash: f019aa6580f9d7a6b749bb55bfcc798d8f4c5d2c
MD5 hash: 7e2b346a5ee1dec32c0b064f314c9299
humanhash: cold-king-alanine-jersey
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-14 20:00:02 UTC
Last seen:2026-08-15 11:52:31 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:Lanvi1SDHIaFlbXNYLjuDQ+5aMEFlRqvs2gQzN:2nviEDHIaF9FDQ+5a5Nqvs4
TLSH T12631239B40201A311102DE4E7762354D729EA5FB2C9FDBD4DC5C4EA992893CCF361F99
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/de3e3bn/an/aua-wget
http://5.182.210.174/c5ee89n/an/aua-wget
http://5.182.210.174/5969e9n/an/aua-wget
http://5.182.210.174/1a029en/an/aua-wget
http://5.182.210.174/a8ac25n/an/aua-wget
http://5.182.210.174/f873b2n/an/aua-wget
http://5.182.210.174/e51ddbn/an/aua-wget
http://5.182.210.174/8ec572n/an/aua-wget
http://5.182.210.174/acdc3bn/an/aua-wget
http://5.182.210.174/523965n/an/aua-wget
http://5.182.210.174/694268n/an/aua-wget
http://5.182.210.174/ba982an/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
83
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7f73f841279f0b4e48432b/reports/9e7b10e7-d002-4aff-8ae1-d1c76c161912/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-14T18:08:00Z UTC
Last seen:
2026-08-16T03:34:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/036000bac9d3ec067332774b1b8a9b057554d255ff845f801f5d882a5ed9aba5/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6fc89031-e3b1-4d21-ac22-adcd1a6f032a
Behavior Graph:
Download SVG
%3 guuid=87481649-1900-0000-ccec-a1ae9f0d0000 pid=3487 /usr/bin/sudo guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493 /tmp/sample.bin guuid=87481649-1900-0000-ccec-a1ae9f0d0000 pid=3487->guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493 execve guuid=40a6a34b-1900-0000-ccec-a1aea60d0000 pid=3494 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=40a6a34b-1900-0000-ccec-a1aea60d0000 pid=3494 execve guuid=11f7eb51-1900-0000-ccec-a1aebb0d0000 pid=3515 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=11f7eb51-1900-0000-ccec-a1aebb0d0000 pid=3515 execve guuid=7c16c659-1900-0000-ccec-a1aecd0d0000 pid=3533 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=7c16c659-1900-0000-ccec-a1aecd0d0000 pid=3533 execve guuid=1418675a-1900-0000-ccec-a1aed10d0000 pid=3537 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=1418675a-1900-0000-ccec-a1aed10d0000 pid=3537 clone guuid=b7c9d15a-1900-0000-ccec-a1aed30d0000 pid=3539 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=b7c9d15a-1900-0000-ccec-a1aed30d0000 pid=3539 execve guuid=073a295b-1900-0000-ccec-a1aed70d0000 pid=3543 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=073a295b-1900-0000-ccec-a1aed70d0000 pid=3543 execve guuid=c01b8e5b-1900-0000-ccec-a1aeda0d0000 pid=3546 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=c01b8e5b-1900-0000-ccec-a1aeda0d0000 pid=3546 execve guuid=4c67585e-1900-0000-ccec-a1aedf0d0000 pid=3551 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=4c67585e-1900-0000-ccec-a1aedf0d0000 pid=3551 execve guuid=fcd0f46a-1900-0000-ccec-a1aee00d0000 pid=3552 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=fcd0f46a-1900-0000-ccec-a1aee00d0000 pid=3552 execve guuid=53cfed6b-1900-0000-ccec-a1aee40d0000 pid=3556 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=53cfed6b-1900-0000-ccec-a1aee40d0000 pid=3556 clone guuid=12e1926c-1900-0000-ccec-a1aee60d0000 pid=3558 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=12e1926c-1900-0000-ccec-a1aee60d0000 pid=3558 execve guuid=f12d656d-1900-0000-ccec-a1aeea0d0000 pid=3562 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=f12d656d-1900-0000-ccec-a1aeea0d0000 pid=3562 execve guuid=4fb1246e-1900-0000-ccec-a1aeed0d0000 pid=3565 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=4fb1246e-1900-0000-ccec-a1aeed0d0000 pid=3565 execve guuid=41432672-1900-0000-ccec-a1aef20d0000 pid=3570 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=41432672-1900-0000-ccec-a1aef20d0000 pid=3570 execve guuid=817b3b78-1900-0000-ccec-a1aeff0d0000 pid=3583 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=817b3b78-1900-0000-ccec-a1aeff0d0000 pid=3583 execve guuid=5cfe7978-1900-0000-ccec-a1ae010e0000 pid=3585 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=5cfe7978-1900-0000-ccec-a1ae010e0000 pid=3585 clone guuid=b0e9b678-1900-0000-ccec-a1ae040e0000 pid=3588 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=b0e9b678-1900-0000-ccec-a1ae040e0000 pid=3588 execve guuid=ebe01479-1900-0000-ccec-a1ae050e0000 pid=3589 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=ebe01479-1900-0000-ccec-a1ae050e0000 pid=3589 execve guuid=cda66679-1900-0000-ccec-a1ae060e0000 pid=3590 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=cda66679-1900-0000-ccec-a1ae060e0000 pid=3590 execve guuid=95dff67b-1900-0000-ccec-a1ae0c0e0000 pid=3596 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=95dff67b-1900-0000-ccec-a1ae0c0e0000 pid=3596 execve guuid=d78cc77f-1900-0000-ccec-a1ae1e0e0000 pid=3614 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=d78cc77f-1900-0000-ccec-a1ae1e0e0000 pid=3614 execve guuid=18012080-1900-0000-ccec-a1ae200e0000 pid=3616 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=18012080-1900-0000-ccec-a1ae200e0000 pid=3616 clone guuid=9a1c5e80-1900-0000-ccec-a1ae220e0000 pid=3618 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=9a1c5e80-1900-0000-ccec-a1ae220e0000 pid=3618 execve guuid=8b0fab80-1900-0000-ccec-a1ae260e0000 pid=3622 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=8b0fab80-1900-0000-ccec-a1ae260e0000 pid=3622 execve guuid=ea74f080-1900-0000-ccec-a1ae270e0000 pid=3623 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=ea74f080-1900-0000-ccec-a1ae270e0000 pid=3623 execve guuid=411d6784-1900-0000-ccec-a1ae360e0000 pid=3638 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=411d6784-1900-0000-ccec-a1ae360e0000 pid=3638 execve guuid=5ac30f88-1900-0000-ccec-a1ae490e0000 pid=3657 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=5ac30f88-1900-0000-ccec-a1ae490e0000 pid=3657 execve guuid=e6735c88-1900-0000-ccec-a1ae4b0e0000 pid=3659 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=e6735c88-1900-0000-ccec-a1ae4b0e0000 pid=3659 clone guuid=c8409d88-1900-0000-ccec-a1ae4e0e0000 pid=3662 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=c8409d88-1900-0000-ccec-a1ae4e0e0000 pid=3662 execve guuid=3187e688-1900-0000-ccec-a1ae4f0e0000 pid=3663 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=3187e688-1900-0000-ccec-a1ae4f0e0000 pid=3663 execve guuid=ee3e3b89-1900-0000-ccec-a1ae510e0000 pid=3665 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=ee3e3b89-1900-0000-ccec-a1ae510e0000 pid=3665 execve guuid=92c2f78b-1900-0000-ccec-a1ae590e0000 pid=3673 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=92c2f78b-1900-0000-ccec-a1ae590e0000 pid=3673 execve guuid=642c6092-1900-0000-ccec-a1ae6c0e0000 pid=3692 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=642c6092-1900-0000-ccec-a1ae6c0e0000 pid=3692 execve guuid=0987ca92-1900-0000-ccec-a1ae6d0e0000 pid=3693 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=0987ca92-1900-0000-ccec-a1ae6d0e0000 pid=3693 clone guuid=72933593-1900-0000-ccec-a1ae710e0000 pid=3697 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=72933593-1900-0000-ccec-a1ae710e0000 pid=3697 execve guuid=53183196-1900-0000-ccec-a1ae720e0000 pid=3698 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=53183196-1900-0000-ccec-a1ae720e0000 pid=3698 execve guuid=785ab096-1900-0000-ccec-a1ae750e0000 pid=3701 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=785ab096-1900-0000-ccec-a1ae750e0000 pid=3701 execve guuid=567abd9a-1900-0000-ccec-a1ae7c0e0000 pid=3708 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=567abd9a-1900-0000-ccec-a1ae7c0e0000 pid=3708 execve guuid=15e72b9f-1900-0000-ccec-a1ae950e0000 pid=3733 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=15e72b9f-1900-0000-ccec-a1ae950e0000 pid=3733 execve guuid=cda2819f-1900-0000-ccec-a1ae980e0000 pid=3736 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=cda2819f-1900-0000-ccec-a1ae980e0000 pid=3736 clone guuid=dfb12ba0-1900-0000-ccec-a1ae9b0e0000 pid=3739 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=dfb12ba0-1900-0000-ccec-a1ae9b0e0000 pid=3739 execve guuid=08f487a0-1900-0000-ccec-a1ae9c0e0000 pid=3740 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=08f487a0-1900-0000-ccec-a1ae9c0e0000 pid=3740 execve guuid=ececc7a0-1900-0000-ccec-a1ae9e0e0000 pid=3742 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=ececc7a0-1900-0000-ccec-a1ae9e0e0000 pid=3742 execve guuid=304a33a4-1900-0000-ccec-a1aea50e0000 pid=3749 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=304a33a4-1900-0000-ccec-a1aea50e0000 pid=3749 execve guuid=9cc419ae-1900-0000-ccec-a1aeb50e0000 pid=3765 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=9cc419ae-1900-0000-ccec-a1aeb50e0000 pid=3765 execve guuid=4b2e60ae-1900-0000-ccec-a1aeb90e0000 pid=3769 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=4b2e60ae-1900-0000-ccec-a1aeb90e0000 pid=3769 clone guuid=0a52c3ae-1900-0000-ccec-a1aebb0e0000 pid=3771 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=0a52c3ae-1900-0000-ccec-a1aebb0e0000 pid=3771 execve guuid=bd770caf-1900-0000-ccec-a1aebf0e0000 pid=3775 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=bd770caf-1900-0000-ccec-a1aebf0e0000 pid=3775 execve guuid=10984caf-1900-0000-ccec-a1aec20e0000 pid=3778 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=10984caf-1900-0000-ccec-a1aec20e0000 pid=3778 execve guuid=fa5bd7b1-1900-0000-ccec-a1aecb0e0000 pid=3787 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=fa5bd7b1-1900-0000-ccec-a1aecb0e0000 pid=3787 execve guuid=d1d5a9b5-1900-0000-ccec-a1aed90e0000 pid=3801 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=d1d5a9b5-1900-0000-ccec-a1aed90e0000 pid=3801 execve guuid=3dec0cb6-1900-0000-ccec-a1aedb0e0000 pid=3803 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=3dec0cb6-1900-0000-ccec-a1aedb0e0000 pid=3803 clone guuid=bb8445b6-1900-0000-ccec-a1aede0e0000 pid=3806 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=bb8445b6-1900-0000-ccec-a1aede0e0000 pid=3806 execve guuid=500194b6-1900-0000-ccec-a1aedf0e0000 pid=3807 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=500194b6-1900-0000-ccec-a1aedf0e0000 pid=3807 execve guuid=8586d7b6-1900-0000-ccec-a1aee30e0000 pid=3811 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=8586d7b6-1900-0000-ccec-a1aee30e0000 pid=3811 execve guuid=5ebb68b9-1900-0000-ccec-a1aeec0e0000 pid=3820 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=5ebb68b9-1900-0000-ccec-a1aeec0e0000 pid=3820 execve guuid=baca3abd-1900-0000-ccec-a1aefd0e0000 pid=3837 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=baca3abd-1900-0000-ccec-a1aefd0e0000 pid=3837 execve guuid=c0f59fbd-1900-0000-ccec-a1ae020f0000 pid=3842 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=c0f59fbd-1900-0000-ccec-a1ae020f0000 pid=3842 clone guuid=123af5bd-1900-0000-ccec-a1ae070f0000 pid=3847 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=123af5bd-1900-0000-ccec-a1ae070f0000 pid=3847 execve guuid=551070be-1900-0000-ccec-a1ae090f0000 pid=3849 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=551070be-1900-0000-ccec-a1ae090f0000 pid=3849 execve guuid=3d09edbe-1900-0000-ccec-a1ae0c0f0000 pid=3852 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=3d09edbe-1900-0000-ccec-a1ae0c0f0000 pid=3852 execve guuid=327b71c2-1900-0000-ccec-a1ae180f0000 pid=3864 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=327b71c2-1900-0000-ccec-a1ae180f0000 pid=3864 execve guuid=65ba1cc6-1900-0000-ccec-a1ae290f0000 pid=3881 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=65ba1cc6-1900-0000-ccec-a1ae290f0000 pid=3881 execve guuid=94c558c6-1900-0000-ccec-a1ae2c0f0000 pid=3884 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=94c558c6-1900-0000-ccec-a1ae2c0f0000 pid=3884 clone guuid=f8a985c6-1900-0000-ccec-a1ae300f0000 pid=3888 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=f8a985c6-1900-0000-ccec-a1ae300f0000 pid=3888 execve guuid=35dabdc6-1900-0000-ccec-a1ae310f0000 pid=3889 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=35dabdc6-1900-0000-ccec-a1ae310f0000 pid=3889 execve guuid=27f9f2c6-1900-0000-ccec-a1ae350f0000 pid=3893 /usr/bin/wget net send-data guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=27f9f2c6-1900-0000-ccec-a1ae350f0000 pid=3893 execve guuid=dd21d7c9-1900-0000-ccec-a1ae400f0000 pid=3904 /usr/bin/curl net send-data write-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=dd21d7c9-1900-0000-ccec-a1ae400f0000 pid=3904 execve guuid=f271a3ce-1900-0000-ccec-a1ae570f0000 pid=3927 /usr/bin/chmod guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=f271a3ce-1900-0000-ccec-a1ae570f0000 pid=3927 execve guuid=936ce4ce-1900-0000-ccec-a1ae590f0000 pid=3929 /usr/bin/bash guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=936ce4ce-1900-0000-ccec-a1ae590f0000 pid=3929 clone guuid=65eb1fcf-1900-0000-ccec-a1ae5b0f0000 pid=3931 /usr/bin/rm delete-file guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=65eb1fcf-1900-0000-ccec-a1ae5b0f0000 pid=3931 execve guuid=4d3566cf-1900-0000-ccec-a1ae5d0f0000 pid=3933 /usr/bin/rm guuid=f4ff504b-1900-0000-ccec-a1aea50d0000 pid=3493->guuid=4d3566cf-1900-0000-ccec-a1ae5d0f0000 pid=3933 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=40a6a34b-1900-0000-ccec-a1aea60d0000 pid=3494->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=11f7eb51-1900-0000-ccec-a1aebb0d0000 pid=3515->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d919945a-1900-0000-ccec-a1aed20d0000 pid=3538 /usr/bin/bash guuid=1418675a-1900-0000-ccec-a1aed10d0000 pid=3537->guuid=d919945a-1900-0000-ccec-a1aed20d0000 pid=3538 clone guuid=c01b8e5b-1900-0000-ccec-a1aeda0d0000 pid=3546->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4c67585e-1900-0000-ccec-a1aedf0d0000 pid=3551->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6a04476c-1900-0000-ccec-a1aee50d0000 pid=3557 /usr/bin/bash guuid=53cfed6b-1900-0000-ccec-a1aee40d0000 pid=3556->guuid=6a04476c-1900-0000-ccec-a1aee50d0000 pid=3557 clone guuid=4fb1246e-1900-0000-ccec-a1aeed0d0000 pid=3565->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=41432672-1900-0000-ccec-a1aef20d0000 pid=3570->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4ac59278-1900-0000-ccec-a1ae020e0000 pid=3586 /usr/bin/bash guuid=5cfe7978-1900-0000-ccec-a1ae010e0000 pid=3585->guuid=4ac59278-1900-0000-ccec-a1ae020e0000 pid=3586 clone guuid=cda66679-1900-0000-ccec-a1ae060e0000 pid=3590->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=95dff67b-1900-0000-ccec-a1ae0c0e0000 pid=3596->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=98a53880-1900-0000-ccec-a1ae210e0000 pid=3617 /usr/bin/bash guuid=18012080-1900-0000-ccec-a1ae200e0000 pid=3616->guuid=98a53880-1900-0000-ccec-a1ae210e0000 pid=3617 clone guuid=ea74f080-1900-0000-ccec-a1ae270e0000 pid=3623->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=411d6784-1900-0000-ccec-a1ae360e0000 pid=3638->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=28d17388-1900-0000-ccec-a1ae4c0e0000 pid=3660 /usr/bin/bash guuid=e6735c88-1900-0000-ccec-a1ae4b0e0000 pid=3659->guuid=28d17388-1900-0000-ccec-a1ae4c0e0000 pid=3660 clone guuid=ee3e3b89-1900-0000-ccec-a1ae510e0000 pid=3665->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=92c2f78b-1900-0000-ccec-a1ae590e0000 pid=3673->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=79550793-1900-0000-ccec-a1ae700e0000 pid=3696 /usr/bin/bash guuid=0987ca92-1900-0000-ccec-a1ae6d0e0000 pid=3693->guuid=79550793-1900-0000-ccec-a1ae700e0000 pid=3696 clone guuid=785ab096-1900-0000-ccec-a1ae750e0000 pid=3701->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=567abd9a-1900-0000-ccec-a1ae7c0e0000 pid=3708->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c138b89f-1900-0000-ccec-a1ae990e0000 pid=3737 /usr/bin/bash guuid=cda2819f-1900-0000-ccec-a1ae980e0000 pid=3736->guuid=c138b89f-1900-0000-ccec-a1ae990e0000 pid=3737 clone guuid=ececc7a0-1900-0000-ccec-a1ae9e0e0000 pid=3742->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=304a33a4-1900-0000-ccec-a1aea50e0000 pid=3749->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=43c67eae-1900-0000-ccec-a1aeba0e0000 pid=3770 /usr/bin/bash guuid=4b2e60ae-1900-0000-ccec-a1aeb90e0000 pid=3769->guuid=43c67eae-1900-0000-ccec-a1aeba0e0000 pid=3770 clone guuid=10984caf-1900-0000-ccec-a1aec20e0000 pid=3778->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fa5bd7b1-1900-0000-ccec-a1aecb0e0000 pid=3787->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=dcfc24b6-1900-0000-ccec-a1aedd0e0000 pid=3805 /usr/bin/bash guuid=3dec0cb6-1900-0000-ccec-a1aedb0e0000 pid=3803->guuid=dcfc24b6-1900-0000-ccec-a1aedd0e0000 pid=3805 clone guuid=8586d7b6-1900-0000-ccec-a1aee30e0000 pid=3811->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5ebb68b9-1900-0000-ccec-a1aeec0e0000 pid=3820->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9d57bebd-1900-0000-ccec-a1ae030f0000 pid=3843 /usr/bin/bash guuid=c0f59fbd-1900-0000-ccec-a1ae020f0000 pid=3842->guuid=9d57bebd-1900-0000-ccec-a1ae030f0000 pid=3843 clone guuid=3d09edbe-1900-0000-ccec-a1ae0c0f0000 pid=3852->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=327b71c2-1900-0000-ccec-a1ae180f0000 pid=3864->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fe6b6cc6-1900-0000-ccec-a1ae2f0f0000 pid=3887 /usr/bin/bash guuid=94c558c6-1900-0000-ccec-a1ae2c0f0000 pid=3884->guuid=fe6b6cc6-1900-0000-ccec-a1ae2f0f0000 pid=3887 clone guuid=27f9f2c6-1900-0000-ccec-a1ae350f0000 pid=3893->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=dd21d7c9-1900-0000-ccec-a1ae400f0000 pid=3904->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7ecdfcce-1900-0000-ccec-a1ae5a0f0000 pid=3930 /usr/bin/bash guuid=936ce4ce-1900-0000-ccec-a1ae590f0000 pid=3929->guuid=7ecdfcce-1900-0000-ccec-a1ae5a0f0000 pid=3930 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/036000bac9d3ec067332774b1b8a9b057554d255ff845f801f5d882a5ed9aba5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/036000bac9d3ec067332774b1b8a9b057554d255ff845f801f5d882a5ed9aba5/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-14 20:10:49 UTC
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=anqabowj2pwam4zso5frxcu3av2vjusv76cf7aa7lwecuxwzvosq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260814-yrg88a1aje/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Creates a large amount of network flows
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/036000bac9d3ec067332774b1b8a9b057554d255ff845f801f5d882a5ed9aba5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 036000bac9d3ec067332774b1b8a9b057554d255ff845f801f5d882a5ed9aba5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments