MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08b2f8080a69d822cd030695a824bb12b75949d98e810c620daeca70735da1d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08b2f8080a69d822cd030695a824bb12b75949d98e810c620daeca70735da1d7
SHA3-384 hash: 4c8fb362c1319e60712061b3b5fc68d2db188665fb390ba026d1b0b15542dfa5502e9a374010023ac7a3068d94ef4c3c
SHA1 hash: 18f5534aa9bd8c62272c5fa600e97f9b56ab8aca
MD5 hash: 7b9b86a4c08823ad5e23145ab0f8be11
humanhash: stairway-leopard-carbon-failed
File name:tplink.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'726 bytes
First seen:2026-08-07 20:33:14 UTC
Last seen:2026-08-08 04:39:06 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:7aDU1aT8GWAxqcF6EFGOe9GGGVUBSA65Xr8DYXO8GmIHbQjfZbMPf9JSXLcTYleN:7aDU1aAyxpF6EFGOe9GGGVUBSAyr84Oz
TLSH T1FE51748E14A0563DA4BFDD9C76F74600E84887E135B23B289EB41C639CC7A34B369E5D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://130.12.182.77/main.aarch64ae87db8792e25d5d09b5732f1cae306bacde28f0ec927be19abed84b92c5f593 Miraiarm elf mirai opendir ua-wget
http://130.12.182.77/main.arc700n/an/aarc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38n/an/aelf mirai opendir ua-wget
http://130.12.182.77/main.arm7n/an/aarm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7n/an/aarm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4ce6877673a5562fddb23109127fb9534be420e0a3191284c06775b277295fa90 Miraiarm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4ebn/an/aarm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tln/an/aarm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5n/an/aarm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi7099805ddc0647122cfd66d28fcd68c462e8d1c9fe9869221d6e0fe4129d820e Miraiarm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6n/an/aarm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihfn/an/aarm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf85e137cce38fd043ff723f80610d52adae34db5b2a4d528273308225efa0688f Miraiarm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3n/an/aelf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.i486n/an/aelf mirai opendir ua-wget x86
http://130.12.182.77/main.microblazeben/an/aelf mirai opendir ua-wget
http://130.12.182.77/main.microblazeeln/an/aelf mirai opendir ua-wget
http://130.12.182.77/main.mipsn/an/aelf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32eln/an/aelf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64n/an/aelf mips mirai opendir ua-wget
http://130.12.182.77/main.mipseld3ab958551ae4b0c4d3086b00804e00b52c612cd5e19ac28dfb5fa969585d65d Miraielf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2n/an/aelf mirai opendir ua-wget
http://130.12.182.77/main.openriscn/an/aelf mirai opendir ua-wget
http://130.12.182.77/main.powerpcn/an/aelf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32n/an/aelf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.sh4n/an/aelf mirai opendir SuperH ua-wget
http://130.12.182.77/main.riscv64n/an/aelf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.sparcn/an/aelf mirai opendir sparc ua-wget
http://130.12.182.77/main.x86_64n/an/aelf mirai opendir ua-wget x86
http://130.12.182.77/main.xtensan/an/aelf mirai opendir ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader mirai
Link:
https://www.filescan.io/uploads/6a764115d7c6023b8d1d5702/reports/bdbaee42-e9f2-4f30-99f6-0d15a50463ba/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-07T18:11:00Z UTC
Last seen:
2026-08-08T00:08:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/08b2f8080a69d822cd030695a824bb12b75949d98e810c620daeca70735da1d7/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5e825c77-23b5-4bfd-826b-b8e96198f435
Behavior Graph:
Download SVG
%3 guuid=c39e425c-1900-0000-5c17-850e49090000 pid=2377 /usr/bin/sudo guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385 /tmp/sample.bin guuid=c39e425c-1900-0000-5c17-850e49090000 pid=2377->guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385 execve guuid=7807b65f-1900-0000-5c17-850e53090000 pid=2387 /usr/bin/mkdir guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=7807b65f-1900-0000-5c17-850e53090000 pid=2387 execve guuid=c5c12560-1900-0000-5c17-850e54090000 pid=2388 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=c5c12560-1900-0000-5c17-850e54090000 pid=2388 execve guuid=a350596c-1900-0000-5c17-850e6c090000 pid=2412 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=a350596c-1900-0000-5c17-850e6c090000 pid=2412 execve guuid=8f6bce6c-1900-0000-5c17-850e6e090000 pid=2414 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=8f6bce6c-1900-0000-5c17-850e6e090000 pid=2414 clone guuid=575d566e-1900-0000-5c17-850e74090000 pid=2420 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=575d566e-1900-0000-5c17-850e74090000 pid=2420 execve guuid=2ad85079-1900-0000-5c17-850e85090000 pid=2437 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=2ad85079-1900-0000-5c17-850e85090000 pid=2437 execve guuid=498a0b7a-1900-0000-5c17-850e88090000 pid=2440 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=498a0b7a-1900-0000-5c17-850e88090000 pid=2440 clone guuid=b313597c-1900-0000-5c17-850e8c090000 pid=2444 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=b313597c-1900-0000-5c17-850e8c090000 pid=2444 execve guuid=3982dc87-1900-0000-5c17-850ea2090000 pid=2466 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=3982dc87-1900-0000-5c17-850ea2090000 pid=2466 execve guuid=c19e4d88-1900-0000-5c17-850ea4090000 pid=2468 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=c19e4d88-1900-0000-5c17-850ea4090000 pid=2468 clone guuid=e3b82b89-1900-0000-5c17-850ea8090000 pid=2472 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=e3b82b89-1900-0000-5c17-850ea8090000 pid=2472 execve guuid=10db5c94-1900-0000-5c17-850ec3090000 pid=2499 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=10db5c94-1900-0000-5c17-850ec3090000 pid=2499 execve guuid=10c4c994-1900-0000-5c17-850ec4090000 pid=2500 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=10c4c994-1900-0000-5c17-850ec4090000 pid=2500 clone guuid=68ed9d95-1900-0000-5c17-850ec8090000 pid=2504 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=68ed9d95-1900-0000-5c17-850ec8090000 pid=2504 execve guuid=236d48a0-1900-0000-5c17-850ee2090000 pid=2530 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=236d48a0-1900-0000-5c17-850ee2090000 pid=2530 execve guuid=bb583ca1-1900-0000-5c17-850ee5090000 pid=2533 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=bb583ca1-1900-0000-5c17-850ee5090000 pid=2533 clone guuid=25b3c1a3-1900-0000-5c17-850eed090000 pid=2541 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=25b3c1a3-1900-0000-5c17-850eed090000 pid=2541 execve guuid=064777ae-1900-0000-5c17-850e040a0000 pid=2564 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=064777ae-1900-0000-5c17-850e040a0000 pid=2564 execve guuid=7057e5ae-1900-0000-5c17-850e060a0000 pid=2566 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=7057e5ae-1900-0000-5c17-850e060a0000 pid=2566 clone guuid=dc2fc2b0-1900-0000-5c17-850e0c0a0000 pid=2572 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=dc2fc2b0-1900-0000-5c17-850e0c0a0000 pid=2572 execve guuid=2c3f4abb-1900-0000-5c17-850e1a0a0000 pid=2586 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=2c3f4abb-1900-0000-5c17-850e1a0a0000 pid=2586 execve guuid=510cd6bb-1900-0000-5c17-850e1c0a0000 pid=2588 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=510cd6bb-1900-0000-5c17-850e1c0a0000 pid=2588 clone guuid=502702be-1900-0000-5c17-850e240a0000 pid=2596 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=502702be-1900-0000-5c17-850e240a0000 pid=2596 execve guuid=a95b37c8-1900-0000-5c17-850e3c0a0000 pid=2620 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=a95b37c8-1900-0000-5c17-850e3c0a0000 pid=2620 execve guuid=b380a6c8-1900-0000-5c17-850e3e0a0000 pid=2622 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=b380a6c8-1900-0000-5c17-850e3e0a0000 pid=2622 clone guuid=af68b5c9-1900-0000-5c17-850e440a0000 pid=2628 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=af68b5c9-1900-0000-5c17-850e440a0000 pid=2628 execve guuid=f083bbd2-1900-0000-5c17-850e590a0000 pid=2649 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=f083bbd2-1900-0000-5c17-850e590a0000 pid=2649 execve guuid=aede2ed3-1900-0000-5c17-850e5b0a0000 pid=2651 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=aede2ed3-1900-0000-5c17-850e5b0a0000 pid=2651 clone guuid=fd9d08d4-1900-0000-5c17-850e5f0a0000 pid=2655 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=fd9d08d4-1900-0000-5c17-850e5f0a0000 pid=2655 execve guuid=3bd1fcdd-1900-0000-5c17-850e700a0000 pid=2672 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=3bd1fcdd-1900-0000-5c17-850e700a0000 pid=2672 execve guuid=ce8874de-1900-0000-5c17-850e710a0000 pid=2673 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=ce8874de-1900-0000-5c17-850e710a0000 pid=2673 clone guuid=17ec6bdf-1900-0000-5c17-850e750a0000 pid=2677 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=17ec6bdf-1900-0000-5c17-850e750a0000 pid=2677 execve guuid=3c2241e9-1900-0000-5c17-850e7f0a0000 pid=2687 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=3c2241e9-1900-0000-5c17-850e7f0a0000 pid=2687 execve guuid=5800a2e9-1900-0000-5c17-850e810a0000 pid=2689 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=5800a2e9-1900-0000-5c17-850e810a0000 pid=2689 clone guuid=66dc68ea-1900-0000-5c17-850e840a0000 pid=2692 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=66dc68ea-1900-0000-5c17-850e840a0000 pid=2692 execve guuid=94e3cff5-1900-0000-5c17-850e910a0000 pid=2705 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=94e3cff5-1900-0000-5c17-850e910a0000 pid=2705 execve guuid=6ae690f6-1900-0000-5c17-850e940a0000 pid=2708 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=6ae690f6-1900-0000-5c17-850e940a0000 pid=2708 clone guuid=2df97cf7-1900-0000-5c17-850e970a0000 pid=2711 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=2df97cf7-1900-0000-5c17-850e970a0000 pid=2711 execve guuid=78cc8c02-1a00-0000-5c17-850ea50a0000 pid=2725 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=78cc8c02-1a00-0000-5c17-850ea50a0000 pid=2725 execve guuid=e8f99903-1a00-0000-5c17-850ea80a0000 pid=2728 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=e8f99903-1a00-0000-5c17-850ea80a0000 pid=2728 clone guuid=f20fb304-1a00-0000-5c17-850eac0a0000 pid=2732 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=f20fb304-1a00-0000-5c17-850eac0a0000 pid=2732 execve guuid=17c97e16-1a00-0000-5c17-850eb40a0000 pid=2740 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=17c97e16-1a00-0000-5c17-850eb40a0000 pid=2740 execve guuid=35532717-1a00-0000-5c17-850eb60a0000 pid=2742 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=35532717-1a00-0000-5c17-850eb60a0000 pid=2742 clone guuid=b844d518-1a00-0000-5c17-850eb80a0000 pid=2744 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=b844d518-1a00-0000-5c17-850eb80a0000 pid=2744 execve guuid=f4929a21-1a00-0000-5c17-850ec30a0000 pid=2755 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=f4929a21-1a00-0000-5c17-850ec30a0000 pid=2755 execve guuid=715ed721-1a00-0000-5c17-850ec50a0000 pid=2757 /tmp2/main.i486 guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=715ed721-1a00-0000-5c17-850ec50a0000 pid=2757 execve guuid=1354ec21-1a00-0000-5c17-850ec70a0000 pid=2759 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=1354ec21-1a00-0000-5c17-850ec70a0000 pid=2759 execve guuid=66c9632b-1a00-0000-5c17-850ed70a0000 pid=2775 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=66c9632b-1a00-0000-5c17-850ed70a0000 pid=2775 execve guuid=4333cc2b-1a00-0000-5c17-850ed90a0000 pid=2777 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=4333cc2b-1a00-0000-5c17-850ed90a0000 pid=2777 clone guuid=28d2b92c-1a00-0000-5c17-850edd0a0000 pid=2781 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=28d2b92c-1a00-0000-5c17-850edd0a0000 pid=2781 execve guuid=77fc6135-1a00-0000-5c17-850eee0a0000 pid=2798 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=77fc6135-1a00-0000-5c17-850eee0a0000 pid=2798 execve guuid=baecd735-1a00-0000-5c17-850eef0a0000 pid=2799 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=baecd735-1a00-0000-5c17-850eef0a0000 pid=2799 clone guuid=d7a77d36-1a00-0000-5c17-850ef20a0000 pid=2802 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=d7a77d36-1a00-0000-5c17-850ef20a0000 pid=2802 execve guuid=4810b23f-1a00-0000-5c17-850e070b0000 pid=2823 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=4810b23f-1a00-0000-5c17-850e070b0000 pid=2823 execve guuid=fff21940-1a00-0000-5c17-850e090b0000 pid=2825 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=fff21940-1a00-0000-5c17-850e090b0000 pid=2825 clone guuid=c705ac40-1a00-0000-5c17-850e0d0b0000 pid=2829 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=c705ac40-1a00-0000-5c17-850e0d0b0000 pid=2829 execve guuid=b9bcf14a-1a00-0000-5c17-850e270b0000 pid=2855 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=b9bcf14a-1a00-0000-5c17-850e270b0000 pid=2855 execve guuid=a713664b-1a00-0000-5c17-850e290b0000 pid=2857 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=a713664b-1a00-0000-5c17-850e290b0000 pid=2857 clone guuid=29f7554d-1a00-0000-5c17-850e2e0b0000 pid=2862 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=29f7554d-1a00-0000-5c17-850e2e0b0000 pid=2862 execve guuid=d77c7e56-1a00-0000-5c17-850e400b0000 pid=2880 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=d77c7e56-1a00-0000-5c17-850e400b0000 pid=2880 execve guuid=5c07e156-1a00-0000-5c17-850e410b0000 pid=2881 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=5c07e156-1a00-0000-5c17-850e410b0000 pid=2881 clone guuid=5b75b457-1a00-0000-5c17-850e430b0000 pid=2883 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=5b75b457-1a00-0000-5c17-850e430b0000 pid=2883 execve guuid=b937e060-1a00-0000-5c17-850e4e0b0000 pid=2894 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=b937e060-1a00-0000-5c17-850e4e0b0000 pid=2894 execve guuid=04ee3d61-1a00-0000-5c17-850e500b0000 pid=2896 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=04ee3d61-1a00-0000-5c17-850e500b0000 pid=2896 clone guuid=6b1f1062-1a00-0000-5c17-850e550b0000 pid=2901 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=6b1f1062-1a00-0000-5c17-850e550b0000 pid=2901 execve guuid=4dcfed72-1a00-0000-5c17-850e6a0b0000 pid=2922 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=4dcfed72-1a00-0000-5c17-850e6a0b0000 pid=2922 execve guuid=5ba64073-1a00-0000-5c17-850e6c0b0000 pid=2924 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=5ba64073-1a00-0000-5c17-850e6c0b0000 pid=2924 clone guuid=e781ca73-1a00-0000-5c17-850e6f0b0000 pid=2927 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=e781ca73-1a00-0000-5c17-850e6f0b0000 pid=2927 execve guuid=be85327c-1a00-0000-5c17-850e7d0b0000 pid=2941 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=be85327c-1a00-0000-5c17-850e7d0b0000 pid=2941 execve guuid=6599c57c-1a00-0000-5c17-850e7e0b0000 pid=2942 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=6599c57c-1a00-0000-5c17-850e7e0b0000 pid=2942 clone guuid=1f5e807d-1a00-0000-5c17-850e810b0000 pid=2945 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=1f5e807d-1a00-0000-5c17-850e810b0000 pid=2945 execve guuid=57a52987-1a00-0000-5c17-850e990b0000 pid=2969 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=57a52987-1a00-0000-5c17-850e990b0000 pid=2969 execve guuid=228f9587-1a00-0000-5c17-850e9b0b0000 pid=2971 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=228f9587-1a00-0000-5c17-850e9b0b0000 pid=2971 clone guuid=0e3b4788-1a00-0000-5c17-850ea00b0000 pid=2976 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=0e3b4788-1a00-0000-5c17-850ea00b0000 pid=2976 execve guuid=4cf90992-1a00-0000-5c17-850eb40b0000 pid=2996 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=4cf90992-1a00-0000-5c17-850eb40b0000 pid=2996 execve guuid=9ac17b92-1a00-0000-5c17-850eb60b0000 pid=2998 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=9ac17b92-1a00-0000-5c17-850eb60b0000 pid=2998 clone guuid=b43f3793-1a00-0000-5c17-850ebb0b0000 pid=3003 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=b43f3793-1a00-0000-5c17-850ebb0b0000 pid=3003 execve guuid=2a00019a-1a00-0000-5c17-850ec80b0000 pid=3016 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=2a00019a-1a00-0000-5c17-850ec80b0000 pid=3016 execve guuid=abc06b9a-1a00-0000-5c17-850eca0b0000 pid=3018 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=abc06b9a-1a00-0000-5c17-850eca0b0000 pid=3018 clone guuid=a5740b9b-1a00-0000-5c17-850ece0b0000 pid=3022 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=a5740b9b-1a00-0000-5c17-850ece0b0000 pid=3022 execve guuid=34a5a9a5-1a00-0000-5c17-850eec0b0000 pid=3052 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=34a5a9a5-1a00-0000-5c17-850eec0b0000 pid=3052 execve guuid=64f132a6-1a00-0000-5c17-850eee0b0000 pid=3054 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=64f132a6-1a00-0000-5c17-850eee0b0000 pid=3054 clone guuid=c46f9ca7-1a00-0000-5c17-850ef60b0000 pid=3062 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=c46f9ca7-1a00-0000-5c17-850ef60b0000 pid=3062 execve guuid=820a04b1-1a00-0000-5c17-850e0a0c0000 pid=3082 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=820a04b1-1a00-0000-5c17-850e0a0c0000 pid=3082 execve guuid=76f04bb1-1a00-0000-5c17-850e0c0c0000 pid=3084 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=76f04bb1-1a00-0000-5c17-850e0c0c0000 pid=3084 clone guuid=4966cfb1-1a00-0000-5c17-850e0e0c0000 pid=3086 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=4966cfb1-1a00-0000-5c17-850e0e0c0000 pid=3086 execve guuid=9b2eb6b9-1a00-0000-5c17-850e1f0c0000 pid=3103 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=9b2eb6b9-1a00-0000-5c17-850e1f0c0000 pid=3103 execve guuid=2c1e09ba-1a00-0000-5c17-850e210c0000 pid=3105 /tmp2/main.x86_64 guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=2c1e09ba-1a00-0000-5c17-850e210c0000 pid=3105 execve guuid=f72e34ba-1a00-0000-5c17-850e240c0000 pid=3108 /usr/bin/wget net send-data write-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=f72e34ba-1a00-0000-5c17-850e240c0000 pid=3108 execve guuid=70d260c6-1a00-0000-5c17-850e430c0000 pid=3139 /usr/bin/chmod guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=70d260c6-1a00-0000-5c17-850e430c0000 pid=3139 execve guuid=099ba6c6-1a00-0000-5c17-850e450c0000 pid=3141 /usr/bin/bash guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=099ba6c6-1a00-0000-5c17-850e450c0000 pid=3141 clone guuid=01a3b9c7-1a00-0000-5c17-850e490c0000 pid=3145 /usr/bin/rm delete-file guuid=c895215f-1900-0000-5c17-850e51090000 pid=2385->guuid=01a3b9c7-1a00-0000-5c17-850e490c0000 pid=3145 execve 6bb63a09-5140-5e45-a32a-aa1de3f42ba5 130.12.182.77:80 guuid=c5c12560-1900-0000-5c17-850e54090000 pid=2388->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 140B guuid=575d566e-1900-0000-5c17-850e74090000 pid=2420->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 139B guuid=b313597c-1900-0000-5c17-850e8c090000 pid=2444->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 140B guuid=e3b82b89-1900-0000-5c17-850ea8090000 pid=2472->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 137B guuid=68ed9d95-1900-0000-5c17-850ec8090000 pid=2504->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 140B guuid=25b3c1a3-1900-0000-5c17-850eed090000 pid=2541->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 138B guuid=dc2fc2b0-1900-0000-5c17-850e0c0a0000 pid=2572->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 140B guuid=502702be-1900-0000-5c17-850e240a0000 pid=2596->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 140B guuid=af68b5c9-1900-0000-5c17-850e440a0000 pid=2628->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 138B guuid=fd9d08d4-1900-0000-5c17-850e5f0a0000 pid=2655->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 143B guuid=17ec6bdf-1900-0000-5c17-850e750a0000 pid=2677->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 138B guuid=66dc68ea-1900-0000-5c17-850e840a0000 pid=2692->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 145B guuid=2df97cf7-1900-0000-5c17-850e970a0000 pid=2711->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 145B guuid=f20fb304-1a00-0000-5c17-850eac0a0000 pid=2732->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 139B guuid=b844d518-1a00-0000-5c17-850eb80a0000 pid=2744->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 137B guuid=d463e521-1a00-0000-5c17-850ec60a0000 pid=2758 /tmp2/main.i486 net send-data zombie guuid=715ed721-1a00-0000-5c17-850ec50a0000 pid=2757->guuid=d463e521-1a00-0000-5c17-850ec60a0000 pid=2758 clone 879313db-9102-5ffc-8443-1eefa773f834 94.154.43.12:32 guuid=d463e521-1a00-0000-5c17-850ec60a0000 pid=2758->879313db-9102-5ffc-8443-1eefa773f834 send: 1B guuid=b312f421-1a00-0000-5c17-850ec80a0000 pid=2760 /tmp2/main.i486 guuid=d463e521-1a00-0000-5c17-850ec60a0000 pid=2758->guuid=b312f421-1a00-0000-5c17-850ec80a0000 pid=2760 clone guuid=1354ec21-1a00-0000-5c17-850ec70a0000 pid=2759->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 145B guuid=28d2b92c-1a00-0000-5c17-850edd0a0000 pid=2781->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 145B guuid=d7a77d36-1a00-0000-5c17-850ef20a0000 pid=2802->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 137B guuid=c705ac40-1a00-0000-5c17-850e0d0b0000 pid=2829->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 141B guuid=29f7554d-1a00-0000-5c17-850e2e0b0000 pid=2862->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 139B guuid=5b75b457-1a00-0000-5c17-850e430b0000 pid=2883->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 139B guuid=6b1f1062-1a00-0000-5c17-850e550b0000 pid=2901->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 138B guuid=e781ca73-1a00-0000-5c17-850e6f0b0000 pid=2927->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 141B guuid=1f5e807d-1a00-0000-5c17-850e810b0000 pid=2945->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 140B guuid=0e3b4788-1a00-0000-5c17-850ea00b0000 pid=2976->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 140B guuid=b43f3793-1a00-0000-5c17-850ebb0b0000 pid=3003->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 136B guuid=a5740b9b-1a00-0000-5c17-850ece0b0000 pid=3022->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 140B guuid=c46f9ca7-1a00-0000-5c17-850ef60b0000 pid=3062->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 138B guuid=4966cfb1-1a00-0000-5c17-850e0e0c0000 pid=3086->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 139B guuid=d7a91fba-1a00-0000-5c17-850e220c0000 pid=3106 /tmp2/main.x86_64 net send-data zombie guuid=2c1e09ba-1a00-0000-5c17-850e210c0000 pid=3105->guuid=d7a91fba-1a00-0000-5c17-850e220c0000 pid=3106 clone guuid=d7a91fba-1a00-0000-5c17-850e220c0000 pid=3106->879313db-9102-5ffc-8443-1eefa773f834 send: 1B guuid=203530ba-1a00-0000-5c17-850e230c0000 pid=3107 /tmp2/main.x86_64 zombie guuid=d7a91fba-1a00-0000-5c17-850e220c0000 pid=3106->guuid=203530ba-1a00-0000-5c17-850e230c0000 pid=3107 clone guuid=f72e34ba-1a00-0000-5c17-850e240c0000 pid=3108->6bb63a09-5140-5e45-a32a-aa1de3f42ba5 send: 139B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/08b2f8080a69d822cd030695a824bb12b75949d98e810c620daeca70735da1d7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08b2f8080a69d822cd030695a824bb12b75949d98e810c620daeca70735da1d7/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bczpqcaknhmcftida2k2qjf3ck3vssozr2aqyyqnv3fha425uhlq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260807-zb3ewsck8s/
Behaviour
Reads runtime system information
System Network Configuration Discovery
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/08b2f8080a69d822cd030695a824bb12b75949d98e810c620daeca70735da1d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 08b2f8080a69d822cd030695a824bb12b75949d98e810c620daeca70735da1d7

(this sample)

Mirai

elf ae87db8792e25d5d09b5732f1cae306bacde28f0ec927be19abed84b92c5f593

  
URLhaus
https://urlhaus.abuse.ch/url/3897933/
  
Delivery method
Distributed via web download
  
Dropping
MD5 c9b45d1375dc83ac067a53b46f530b57
  
Dropping
SHA256 ae87db8792e25d5d09b5732f1cae306bacde28f0ec927be19abed84b92c5f593

Comments