MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c1da1d7b0e95464c4fa93e0ea8e93ea93af6a819a04c4f0badb6b839f86b319. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c1da1d7b0e95464c4fa93e0ea8e93ea93af6a819a04c4f0badb6b839f86b319
SHA3-384 hash: 2439ede09b7a6d3b00994b280abe8675422ea743b21c9908a42ba5a4d1361ff81d95009b91df1fff893f0d37cb705029
SHA1 hash: 2da33a54b6b1dfe92d3653b57a0aa21cd532ba18
MD5 hash: 1ad9bfa8f8e0d93d7b2b4bd6c60f5423
humanhash: autumn-friend-louisiana-edward
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:4'514 bytes
First seen:2025-10-31 22:21:08 UTC
Last seen:2025-10-31 22:57:09 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 96:ioMwMw3oMxMWoMGMUoM1MWoM7Md0oMzMyoM8MgoMIMcoM7MILoM+M0oMVMSoMjM7:3MwMBMxMLMGM5M1MLM7MLMzMHM8MFMIj
TLSH T1C39129BDF196063FDADFC67272A68808B4904AE755D90F598BBD35E90C4CFCC2E40942
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.x86d5a2a37855cba7723ca1c4c8f4df23c4764d86d969fda2dd198e2debbb4531ba Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.mipsafe175ad1aa35699964e5ec1f92ee4882a9db071104fc26549d053e0504ec0a4 Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.arc7e84bfdf1224248be4d0231119d56ba67f927f0929b0cee7ff3163236f3125ba Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.i468n/an/aelf ua-wget
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.i686363173c2b230db1304140a3c0717d9a1ba670622942c1c7697ee8886c300e8c4 Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.x86_64884701aa069f53b4c1105ab88ad4e9d3579c50d6bf923a01b00f2441b5be64c9 Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.mpsldabfc5ca580de3ed06ecc49c568e38f616d5c8ffc9aa09d0d5f02324565997fc Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.arma71bb6e666379eb55376d6d59bc96c9e5c2053102ec1cdab7dc09bc9aefaf638 Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.arm55d3e1fadf881aaa5999b16dccf4be9e6b16e32d867cab805c5a21c678249afef Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.arm6b765f4a9c485a38566c5f81aa7f33b840a7a11c8dc51107509a50ced0072cc3e Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.arm7fbd6afa7453d3b6cd783926ff98882e2610e565227182b912562ef15b3f2e2f4 Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.ppc201b3b0c9001f3f69d4e1fa692b096aaab9de5f31b5b72ccdad54d27f54cd853 Gafgytgafgyt mirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.spcn/an/aelf ua-wget
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.m68kf8d00ebec069ba2d8b99d9125b89874bd97188d808660c68f1449de81b218e7c Miraimirai opendir
http://213.136.76.210/001010101010010110101011101010101101010111010101/Labello.sh45685ed6fce8cd6affd16a4c487f0f7599ac9534784834b2d1451f54a92412274 Miraimirai opendir

Intelligence

File Origin
# of uploads :
2
# of downloads :
35
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-31T19:29:00Z UTC
Last seen:
2025-11-01T10:18:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/0c1da1d7b0e95464c4fa93e0ea8e93ea93af6a819a04c4f0badb6b839f86b319/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/21116684-59fa-4cc7-a875-60f0d1296049
Behavior Graph:
Download SVG
%3 guuid=0caab29e-1d00-0000-0e83-8722f80b0000 pid=3064 /usr/bin/sudo guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071 /tmp/sample.bin guuid=0caab29e-1d00-0000-0e83-8722f80b0000 pid=3064->guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071 execve guuid=f3b336a1-1d00-0000-0e83-8722020c0000 pid=3074 /usr/bin/cp guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=f3b336a1-1d00-0000-0e83-8722020c0000 pid=3074 execve guuid=684dd2a6-1d00-0000-0e83-8722090c0000 pid=3081 /usr/bin/wget net send-data write-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=684dd2a6-1d00-0000-0e83-8722090c0000 pid=3081 execve guuid=805955ad-1d00-0000-0e83-8722160c0000 pid=3094 /usr/bin/curl net send-data write-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=805955ad-1d00-0000-0e83-8722160c0000 pid=3094 execve guuid=7bd6aae5-1d00-0000-0e83-87224a0c0000 pid=3146 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=7bd6aae5-1d00-0000-0e83-87224a0c0000 pid=3146 execve guuid=f64f56e6-1d00-0000-0e83-87224b0c0000 pid=3147 /tmp/Labello.x86 net guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=f64f56e6-1d00-0000-0e83-87224b0c0000 pid=3147 execve guuid=237d18e7-1d00-0000-0e83-87224e0c0000 pid=3150 /usr/bin/rm delete-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=237d18e7-1d00-0000-0e83-87224e0c0000 pid=3150 execve guuid=63c178e7-1d00-0000-0e83-87224f0c0000 pid=3151 /usr/bin/wget net send-data write-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=63c178e7-1d00-0000-0e83-87224f0c0000 pid=3151 execve guuid=14933eed-1d00-0000-0e83-8722530c0000 pid=3155 /usr/bin/curl net send-data write-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=14933eed-1d00-0000-0e83-8722530c0000 pid=3155 execve guuid=0a8bc0f7-1d00-0000-0e83-8722550c0000 pid=3157 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=0a8bc0f7-1d00-0000-0e83-8722550c0000 pid=3157 execve guuid=515f18f8-1d00-0000-0e83-8722560c0000 pid=3158 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=515f18f8-1d00-0000-0e83-8722560c0000 pid=3158 clone guuid=ed000ff9-1d00-0000-0e83-87225a0c0000 pid=3162 /usr/bin/rm delete-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=ed000ff9-1d00-0000-0e83-87225a0c0000 pid=3162 execve guuid=ddc764f9-1d00-0000-0e83-87225c0c0000 pid=3164 /usr/bin/wget net send-data write-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=ddc764f9-1d00-0000-0e83-87225c0c0000 pid=3164 execve guuid=806cc6fc-1d00-0000-0e83-8722640c0000 pid=3172 /usr/bin/curl net send-data write-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=806cc6fc-1d00-0000-0e83-8722640c0000 pid=3172 execve guuid=62503c06-1e00-0000-0e83-8722780c0000 pid=3192 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=62503c06-1e00-0000-0e83-8722780c0000 pid=3192 execve guuid=68bfa006-1e00-0000-0e83-87227a0c0000 pid=3194 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=68bfa006-1e00-0000-0e83-87227a0c0000 pid=3194 clone guuid=3bb60a08-1e00-0000-0e83-87227c0c0000 pid=3196 /usr/bin/rm delete-file guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=3bb60a08-1e00-0000-0e83-87227c0c0000 pid=3196 execve guuid=f8bb6708-1e00-0000-0e83-87227d0c0000 pid=3197 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=f8bb6708-1e00-0000-0e83-87227d0c0000 pid=3197 clone guuid=c2608c08-1e00-0000-0e83-87227e0c0000 pid=3198 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=c2608c08-1e00-0000-0e83-87227e0c0000 pid=3198 clone guuid=9185b508-1e00-0000-0e83-87227f0c0000 pid=3199 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=9185b508-1e00-0000-0e83-87227f0c0000 pid=3199 execve guuid=9dc04409-1e00-0000-0e83-8722800c0000 pid=3200 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=9dc04409-1e00-0000-0e83-8722800c0000 pid=3200 clone guuid=c9c86b09-1e00-0000-0e83-8722810c0000 pid=3201 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=c9c86b09-1e00-0000-0e83-8722810c0000 pid=3201 execve guuid=94b71f0a-1e00-0000-0e83-8722820c0000 pid=3202 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=94b71f0a-1e00-0000-0e83-8722820c0000 pid=3202 clone guuid=5d2d5e0a-1e00-0000-0e83-8722830c0000 pid=3203 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=5d2d5e0a-1e00-0000-0e83-8722830c0000 pid=3203 clone guuid=42a6980a-1e00-0000-0e83-8722840c0000 pid=3204 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=42a6980a-1e00-0000-0e83-8722840c0000 pid=3204 execve guuid=9e753d0b-1e00-0000-0e83-8722850c0000 pid=3205 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=9e753d0b-1e00-0000-0e83-8722850c0000 pid=3205 clone guuid=6a59650b-1e00-0000-0e83-8722860c0000 pid=3206 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=6a59650b-1e00-0000-0e83-8722860c0000 pid=3206 execve guuid=5470f10b-1e00-0000-0e83-8722870c0000 pid=3207 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=5470f10b-1e00-0000-0e83-8722870c0000 pid=3207 clone guuid=9fef350c-1e00-0000-0e83-8722880c0000 pid=3208 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=9fef350c-1e00-0000-0e83-8722880c0000 pid=3208 clone guuid=da6c7b0c-1e00-0000-0e83-8722890c0000 pid=3209 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=da6c7b0c-1e00-0000-0e83-8722890c0000 pid=3209 execve guuid=faeb1c0d-1e00-0000-0e83-87228a0c0000 pid=3210 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=faeb1c0d-1e00-0000-0e83-87228a0c0000 pid=3210 clone guuid=0025500d-1e00-0000-0e83-87228b0c0000 pid=3211 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=0025500d-1e00-0000-0e83-87228b0c0000 pid=3211 execve guuid=b4a1ea0d-1e00-0000-0e83-87228c0c0000 pid=3212 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=b4a1ea0d-1e00-0000-0e83-87228c0c0000 pid=3212 clone guuid=ccb8100e-1e00-0000-0e83-87228d0c0000 pid=3213 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=ccb8100e-1e00-0000-0e83-87228d0c0000 pid=3213 clone guuid=f1b1490e-1e00-0000-0e83-87228e0c0000 pid=3214 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=f1b1490e-1e00-0000-0e83-87228e0c0000 pid=3214 execve guuid=afd6d40e-1e00-0000-0e83-87228f0c0000 pid=3215 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=afd6d40e-1e00-0000-0e83-87228f0c0000 pid=3215 clone guuid=8884190f-1e00-0000-0e83-8722900c0000 pid=3216 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=8884190f-1e00-0000-0e83-8722900c0000 pid=3216 execve guuid=39e2890f-1e00-0000-0e83-8722910c0000 pid=3217 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=39e2890f-1e00-0000-0e83-8722910c0000 pid=3217 clone guuid=5829c30f-1e00-0000-0e83-8722920c0000 pid=3218 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=5829c30f-1e00-0000-0e83-8722920c0000 pid=3218 clone guuid=ee30f70f-1e00-0000-0e83-8722930c0000 pid=3219 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=ee30f70f-1e00-0000-0e83-8722930c0000 pid=3219 execve guuid=2d725110-1e00-0000-0e83-8722940c0000 pid=3220 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=2d725110-1e00-0000-0e83-8722940c0000 pid=3220 clone guuid=cf4e6f10-1e00-0000-0e83-8722950c0000 pid=3221 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=cf4e6f10-1e00-0000-0e83-8722950c0000 pid=3221 execve guuid=c2e5c610-1e00-0000-0e83-8722960c0000 pid=3222 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=c2e5c610-1e00-0000-0e83-8722960c0000 pid=3222 clone guuid=85a6ec10-1e00-0000-0e83-8722970c0000 pid=3223 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=85a6ec10-1e00-0000-0e83-8722970c0000 pid=3223 clone guuid=12491311-1e00-0000-0e83-8722980c0000 pid=3224 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=12491311-1e00-0000-0e83-8722980c0000 pid=3224 execve guuid=01e88011-1e00-0000-0e83-8722990c0000 pid=3225 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=01e88011-1e00-0000-0e83-8722990c0000 pid=3225 clone guuid=5fe1a611-1e00-0000-0e83-87229a0c0000 pid=3226 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=5fe1a611-1e00-0000-0e83-87229a0c0000 pid=3226 execve guuid=0fef2112-1e00-0000-0e83-87229b0c0000 pid=3227 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=0fef2112-1e00-0000-0e83-87229b0c0000 pid=3227 clone guuid=b1394712-1e00-0000-0e83-87229c0c0000 pid=3228 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=b1394712-1e00-0000-0e83-87229c0c0000 pid=3228 clone guuid=1fca6a12-1e00-0000-0e83-87229d0c0000 pid=3229 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=1fca6a12-1e00-0000-0e83-87229d0c0000 pid=3229 execve guuid=548ccc12-1e00-0000-0e83-87229e0c0000 pid=3230 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=548ccc12-1e00-0000-0e83-87229e0c0000 pid=3230 clone guuid=2e04ed12-1e00-0000-0e83-87229f0c0000 pid=3231 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=2e04ed12-1e00-0000-0e83-87229f0c0000 pid=3231 execve guuid=82344813-1e00-0000-0e83-8722a00c0000 pid=3232 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=82344813-1e00-0000-0e83-8722a00c0000 pid=3232 clone guuid=d3fc6d13-1e00-0000-0e83-8722a10c0000 pid=3233 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=d3fc6d13-1e00-0000-0e83-8722a10c0000 pid=3233 clone guuid=e57a9e13-1e00-0000-0e83-8722a20c0000 pid=3234 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=e57a9e13-1e00-0000-0e83-8722a20c0000 pid=3234 execve guuid=d4ec1014-1e00-0000-0e83-8722a30c0000 pid=3235 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=d4ec1014-1e00-0000-0e83-8722a30c0000 pid=3235 clone guuid=ab0bac14-1e00-0000-0e83-8722a50c0000 pid=3237 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=ab0bac14-1e00-0000-0e83-8722a50c0000 pid=3237 execve guuid=05581715-1e00-0000-0e83-8722a60c0000 pid=3238 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=05581715-1e00-0000-0e83-8722a60c0000 pid=3238 clone guuid=f8068615-1e00-0000-0e83-8722a70c0000 pid=3239 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=f8068615-1e00-0000-0e83-8722a70c0000 pid=3239 clone guuid=e3c1a815-1e00-0000-0e83-8722a80c0000 pid=3240 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=e3c1a815-1e00-0000-0e83-8722a80c0000 pid=3240 execve guuid=a236ff15-1e00-0000-0e83-8722a90c0000 pid=3241 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=a236ff15-1e00-0000-0e83-8722a90c0000 pid=3241 clone guuid=10c12916-1e00-0000-0e83-8722ab0c0000 pid=3243 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=10c12916-1e00-0000-0e83-8722ab0c0000 pid=3243 execve guuid=14be9c16-1e00-0000-0e83-8722ad0c0000 pid=3245 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=14be9c16-1e00-0000-0e83-8722ad0c0000 pid=3245 clone guuid=71f2c316-1e00-0000-0e83-8722ae0c0000 pid=3246 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=71f2c316-1e00-0000-0e83-8722ae0c0000 pid=3246 clone guuid=1e8b2217-1e00-0000-0e83-8722b00c0000 pid=3248 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=1e8b2217-1e00-0000-0e83-8722b00c0000 pid=3248 execve guuid=08439317-1e00-0000-0e83-8722b30c0000 pid=3251 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=08439317-1e00-0000-0e83-8722b30c0000 pid=3251 clone guuid=da3bd317-1e00-0000-0e83-8722b40c0000 pid=3252 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=da3bd317-1e00-0000-0e83-8722b40c0000 pid=3252 execve guuid=41021f18-1e00-0000-0e83-8722b60c0000 pid=3254 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=41021f18-1e00-0000-0e83-8722b60c0000 pid=3254 clone guuid=60a13f18-1e00-0000-0e83-8722b70c0000 pid=3255 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=60a13f18-1e00-0000-0e83-8722b70c0000 pid=3255 clone guuid=fd407018-1e00-0000-0e83-8722b90c0000 pid=3257 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=fd407018-1e00-0000-0e83-8722b90c0000 pid=3257 execve guuid=be26c818-1e00-0000-0e83-8722bb0c0000 pid=3259 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=be26c818-1e00-0000-0e83-8722bb0c0000 pid=3259 clone guuid=f178ef18-1e00-0000-0e83-8722bc0c0000 pid=3260 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=f178ef18-1e00-0000-0e83-8722bc0c0000 pid=3260 execve guuid=cdfaac19-1e00-0000-0e83-8722be0c0000 pid=3262 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=cdfaac19-1e00-0000-0e83-8722be0c0000 pid=3262 clone guuid=ff4be019-1e00-0000-0e83-8722bf0c0000 pid=3263 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=ff4be019-1e00-0000-0e83-8722bf0c0000 pid=3263 clone guuid=0500171a-1e00-0000-0e83-8722c00c0000 pid=3264 /usr/bin/chmod guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=0500171a-1e00-0000-0e83-8722c00c0000 pid=3264 execve guuid=eabe821a-1e00-0000-0e83-8722c10c0000 pid=3265 /usr/bin/bash guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=eabe821a-1e00-0000-0e83-8722c10c0000 pid=3265 clone guuid=ca31af1a-1e00-0000-0e83-8722c20c0000 pid=3266 /usr/bin/rm guuid=1ebfe2a0-1d00-0000-0e83-8722ff0b0000 pid=3071->guuid=ca31af1a-1e00-0000-0e83-8722c20c0000 pid=3266 execve 7dbe3df6-9624-549d-8896-f6b5c1f7cd35 213.136.76.210:80 guuid=684dd2a6-1d00-0000-0e83-8722090c0000 pid=3081->7dbe3df6-9624-549d-8896-f6b5c1f7cd35 send: 189B guuid=805955ad-1d00-0000-0e83-8722160c0000 pid=3094->7dbe3df6-9624-549d-8896-f6b5c1f7cd35 send: 138B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=f64f56e6-1d00-0000-0e83-87224b0c0000 pid=3147->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=30600ce7-1d00-0000-0e83-87224c0c0000 pid=3148 /tmp/Labello.x86 guuid=f64f56e6-1d00-0000-0e83-87224b0c0000 pid=3147->guuid=30600ce7-1d00-0000-0e83-87224c0c0000 pid=3148 clone guuid=411617e7-1d00-0000-0e83-87224d0c0000 pid=3149 /tmp/Labello.x86 guuid=30600ce7-1d00-0000-0e83-87224c0c0000 pid=3148->guuid=411617e7-1d00-0000-0e83-87224d0c0000 pid=3149 clone guuid=02f6b8eb-1d00-0000-0e83-8722500c0000 pid=3152 /tmp/Labello.x86 dns net send-data zombie guuid=411617e7-1d00-0000-0e83-87224d0c0000 pid=3149->guuid=02f6b8eb-1d00-0000-0e83-8722500c0000 pid=3152 clone guuid=63c178e7-1d00-0000-0e83-87224f0c0000 pid=3151->7dbe3df6-9624-549d-8896-f6b5c1f7cd35 send: 190B guuid=02f6b8eb-1d00-0000-0e83-8722500c0000 pid=3152->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 18981B f2ed4a3e-5112-5529-9a33-2efea11ea93b netherxcloud.online:12121 guuid=02f6b8eb-1d00-0000-0e83-8722500c0000 pid=3152->f2ed4a3e-5112-5529-9a33-2efea11ea93b con ef5b5859-ccb7-50ff-bbe0-8d49bba80ba6 netherxcloud.online:0 guuid=02f6b8eb-1d00-0000-0e83-8722500c0000 pid=3152->ef5b5859-ccb7-50ff-bbe0-8d49bba80ba6 send: 12800B guuid=7be7c7eb-1d00-0000-0e83-8722510c0000 pid=3153 /tmp/Labello.x86 guuid=02f6b8eb-1d00-0000-0e83-8722500c0000 pid=3152->guuid=7be7c7eb-1d00-0000-0e83-8722510c0000 pid=3153 clone guuid=272dcceb-1d00-0000-0e83-8722520c0000 pid=3154 /tmp/Labello.x86 guuid=02f6b8eb-1d00-0000-0e83-8722500c0000 pid=3152->guuid=272dcceb-1d00-0000-0e83-8722520c0000 pid=3154 clone 7fec7485-7cf1-5692-9eae-904597a20f54 netherxcloud.online:80 guuid=14933eed-1d00-0000-0e83-8722530c0000 pid=3155->7fec7485-7cf1-5692-9eae-904597a20f54 send: 139B guuid=ddc764f9-1d00-0000-0e83-87225c0c0000 pid=3164->7fec7485-7cf1-5692-9eae-904597a20f54 send: 189B guuid=806cc6fc-1d00-0000-0e83-8722640c0000 pid=3172->7fec7485-7cf1-5692-9eae-904597a20f54 send: 138B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0c1da1d7b0e95464c4fa93e0ea8e93ea93af6a819a04c4f0badb6b839f86b319
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c1da1d7b0e95464c4fa93e0ea8e93ea93af6a819a04c4f0badb6b839f86b319/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/0c1da1d7b0e95464c4fa93e0ea8e93ea93af6a819a04c4f0badb6b839f86b319
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-10-31 22:27:51 UTC
File Type:
Text (Shell)
AV detection:
20 of 37 (54.05%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bqo2dv5q5fkgjrh2spqovdut5kj262ubticmj4f23nvyhh4gwmmq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251031-2a4yfaslds/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Creates a large amount of network flows
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes system logs
Executes dropped EXE
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0c1da1d7b0e9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.36
Link:
https://yomi.yoroi.company/submissions/0c1da1d7b0e95464c4fa93e0ea8e93ea93af6a819a04c4f0badb6b839f86b319

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 0c1da1d7b0e95464c4fa93e0ea8e93ea93af6a819a04c4f0badb6b839f86b319

(this sample)

Mirai

elf 8121fcda85a1bc82355ee2e0387ac4c27a1ff41b158734409eafcae2226c049c

Mirai

elf d5a2a37855cba7723ca1c4c8f4df23c4764d86d969fda2dd198e2debbb4531ba

  
URLhaus
https://urlhaus.abuse.ch/url/3692400/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3692410/
  
Dropping
MD5 fc35796b804351d5889e14fae964e739
  
Dropping
SHA256 d5a2a37855cba7723ca1c4c8f4df23c4764d86d969fda2dd198e2debbb4531ba

Comments