MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dc4396eb4890ad3ed55f4acb8f461fb3318917202c811a72c4de25a6a2d3a2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0dc4396eb4890ad3ed55f4acb8f461fb3318917202c811a72c4de25a6a2d3a2a
SHA3-384 hash: e925f6071123346d9aa8f3080178e8dddf4107300e695b1a1e1d37de1a9c3fad6e689f8ca9bec2904c2574c8485fba05
SHA1 hash: a3ff3a3bc66be9cda2750872e40b6f6176ed9bd0
MD5 hash: 696a5ec6bc507b990c4133d341b17c7e
humanhash: lion-early-purple-missouri
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'959 bytes
First seen:2025-10-13 17:49:28 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:iFFMFhmlFFWFnElFFdFCXlFFxFePlFFaqFazvZlFFaIFaFvjlFF9NQF9z4gelFFp:iF2HmlFEZElFnoXlFPwPlF0q0zvZlF07
TLSH T179517FC732124B312C67BA23FEBA8F6D3582549258E37F3459DC35A662CCD88F454A47
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://103.77.241.42/hiddenbin/Space.arcn/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.x86n/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.x86_64n/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.i686n/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.mipsn/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.mips64n/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.mpsln/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.armn/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.arm5n/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.arm6n/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.arm7n/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.ppcn/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.sparcn/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.m68kn/an/aelf ua-wget
http://103.77.241.42/hiddenbin/Space.sh4n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
39
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-28T07:14:00Z UTC
Last seen:
2025-10-14T10:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0dc4396eb4890ad3ed55f4acb8f461fb3318917202c811a72c4de25a6a2d3a2a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3fecca07-909d-4944-8ab6-11e552199e7e
Behavior Graph:
Download SVG
%3 guuid=e7068dc2-1a00-0000-1838-87ecc1090000 pid=2497 /usr/bin/sudo guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503 /tmp/sample.bin guuid=e7068dc2-1a00-0000-1838-87ecc1090000 pid=2497->guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503 execve guuid=f0d1c0c5-1a00-0000-1838-87ecc9090000 pid=2505 /usr/bin/cp guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=f0d1c0c5-1a00-0000-1838-87ecc9090000 pid=2505 execve guuid=65f47bc7-1a00-0000-1838-87ecca090000 pid=2506 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=65f47bc7-1a00-0000-1838-87ecca090000 pid=2506 execve guuid=3cccaf22-1b00-0000-1838-87ecbc0a0000 pid=2748 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=3cccaf22-1b00-0000-1838-87ecbc0a0000 pid=2748 execve guuid=d0cbe383-1b00-0000-1838-87ec6a0b0000 pid=2922 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=d0cbe383-1b00-0000-1838-87ec6a0b0000 pid=2922 execve guuid=54568184-1b00-0000-1838-87ec6b0b0000 pid=2923 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=54568184-1b00-0000-1838-87ec6b0b0000 pid=2923 execve guuid=c6ec1285-1b00-0000-1838-87ec6c0b0000 pid=2924 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=c6ec1285-1b00-0000-1838-87ec6c0b0000 pid=2924 clone guuid=18d35185-1b00-0000-1838-87ec6d0b0000 pid=2925 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=18d35185-1b00-0000-1838-87ec6d0b0000 pid=2925 execve guuid=5afa25a3-1b00-0000-1838-87ec960b0000 pid=2966 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=5afa25a3-1b00-0000-1838-87ec960b0000 pid=2966 execve guuid=76263bc1-1b00-0000-1838-87ecca0b0000 pid=3018 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=76263bc1-1b00-0000-1838-87ecca0b0000 pid=3018 execve guuid=7eb8a1c1-1b00-0000-1838-87eccc0b0000 pid=3020 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=7eb8a1c1-1b00-0000-1838-87eccc0b0000 pid=3020 execve guuid=e462f7c1-1b00-0000-1838-87ecce0b0000 pid=3022 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=e462f7c1-1b00-0000-1838-87ecce0b0000 pid=3022 clone guuid=4c5a21c2-1b00-0000-1838-87eccf0b0000 pid=3023 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=4c5a21c2-1b00-0000-1838-87eccf0b0000 pid=3023 execve guuid=803f39e0-1b00-0000-1838-87ec140c0000 pid=3092 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=803f39e0-1b00-0000-1838-87ec140c0000 pid=3092 execve guuid=6c9be1ff-1b00-0000-1838-87ec580c0000 pid=3160 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=6c9be1ff-1b00-0000-1838-87ec580c0000 pid=3160 execve guuid=4c372700-1c00-0000-1838-87ec590c0000 pid=3161 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=4c372700-1c00-0000-1838-87ec590c0000 pid=3161 execve guuid=3c266700-1c00-0000-1838-87ec5b0c0000 pid=3163 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=3c266700-1c00-0000-1838-87ec5b0c0000 pid=3163 clone guuid=f3228c00-1c00-0000-1838-87ec5c0c0000 pid=3164 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=f3228c00-1c00-0000-1838-87ec5c0c0000 pid=3164 execve guuid=6521141d-1c00-0000-1838-87ec920c0000 pid=3218 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=6521141d-1c00-0000-1838-87ec920c0000 pid=3218 execve guuid=8ddc8e3b-1c00-0000-1838-87ecb30c0000 pid=3251 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=8ddc8e3b-1c00-0000-1838-87ecb30c0000 pid=3251 execve guuid=583eff3b-1c00-0000-1838-87ecb40c0000 pid=3252 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=583eff3b-1c00-0000-1838-87ecb40c0000 pid=3252 execve guuid=48045d3c-1c00-0000-1838-87ecb50c0000 pid=3253 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=48045d3c-1c00-0000-1838-87ecb50c0000 pid=3253 clone guuid=c9459d3c-1c00-0000-1838-87ecb60c0000 pid=3254 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=c9459d3c-1c00-0000-1838-87ecb60c0000 pid=3254 execve guuid=c9a8925a-1c00-0000-1838-87ecee0c0000 pid=3310 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=c9a8925a-1c00-0000-1838-87ecee0c0000 pid=3310 execve guuid=67c9607b-1c00-0000-1838-87ec270d0000 pid=3367 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=67c9607b-1c00-0000-1838-87ec270d0000 pid=3367 execve guuid=c095f47b-1c00-0000-1838-87ec280d0000 pid=3368 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=c095f47b-1c00-0000-1838-87ec280d0000 pid=3368 execve guuid=5a105e7c-1c00-0000-1838-87ec290d0000 pid=3369 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=5a105e7c-1c00-0000-1838-87ec290d0000 pid=3369 clone guuid=b30f817c-1c00-0000-1838-87ec2b0d0000 pid=3371 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=b30f817c-1c00-0000-1838-87ec2b0d0000 pid=3371 execve guuid=ec99b399-1c00-0000-1838-87ec6f0d0000 pid=3439 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=ec99b399-1c00-0000-1838-87ec6f0d0000 pid=3439 execve guuid=e5dd39b9-1c00-0000-1838-87ecc40d0000 pid=3524 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=e5dd39b9-1c00-0000-1838-87ecc40d0000 pid=3524 execve guuid=da5d7eb9-1c00-0000-1838-87ecc60d0000 pid=3526 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=da5d7eb9-1c00-0000-1838-87ecc60d0000 pid=3526 execve guuid=f965ccb9-1c00-0000-1838-87ecc80d0000 pid=3528 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=f965ccb9-1c00-0000-1838-87ecc80d0000 pid=3528 clone guuid=3159f9b9-1c00-0000-1838-87ecca0d0000 pid=3530 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=3159f9b9-1c00-0000-1838-87ecca0d0000 pid=3530 execve guuid=f7f45fd7-1c00-0000-1838-87ec000e0000 pid=3584 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=f7f45fd7-1c00-0000-1838-87ec000e0000 pid=3584 execve guuid=3b93b332-1d00-0000-1838-87ecdc0e0000 pid=3804 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=3b93b332-1d00-0000-1838-87ecdc0e0000 pid=3804 execve guuid=b3661033-1d00-0000-1838-87ecdf0e0000 pid=3807 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=b3661033-1d00-0000-1838-87ecdf0e0000 pid=3807 execve guuid=f69e7233-1d00-0000-1838-87ece20e0000 pid=3810 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=f69e7233-1d00-0000-1838-87ece20e0000 pid=3810 clone guuid=456fae33-1d00-0000-1838-87ece30e0000 pid=3811 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=456fae33-1d00-0000-1838-87ece30e0000 pid=3811 execve guuid=111a7d52-1d00-0000-1838-87ec510f0000 pid=3921 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=111a7d52-1d00-0000-1838-87ec510f0000 pid=3921 execve guuid=37b98974-1d00-0000-1838-87ecc50f0000 pid=4037 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=37b98974-1d00-0000-1838-87ecc50f0000 pid=4037 execve guuid=6e4ce074-1d00-0000-1838-87ecc70f0000 pid=4039 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=6e4ce074-1d00-0000-1838-87ecc70f0000 pid=4039 execve guuid=991f3375-1d00-0000-1838-87ecc90f0000 pid=4041 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=991f3375-1d00-0000-1838-87ecc90f0000 pid=4041 clone guuid=72606575-1d00-0000-1838-87eccb0f0000 pid=4043 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=72606575-1d00-0000-1838-87eccb0f0000 pid=4043 execve guuid=82fcf092-1d00-0000-1838-87ec2e100000 pid=4142 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=82fcf092-1d00-0000-1838-87ec2e100000 pid=4142 execve guuid=354ac9b2-1d00-0000-1838-87ec94100000 pid=4244 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=354ac9b2-1d00-0000-1838-87ec94100000 pid=4244 execve guuid=56d138b3-1d00-0000-1838-87ec98100000 pid=4248 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=56d138b3-1d00-0000-1838-87ec98100000 pid=4248 execve guuid=19b0c3b3-1d00-0000-1838-87ec99100000 pid=4249 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=19b0c3b3-1d00-0000-1838-87ec99100000 pid=4249 clone guuid=f965edb3-1d00-0000-1838-87ec9b100000 pid=4251 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=f965edb3-1d00-0000-1838-87ec9b100000 pid=4251 execve guuid=b10be6d0-1d00-0000-1838-87ec0b110000 pid=4363 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=b10be6d0-1d00-0000-1838-87ec0b110000 pid=4363 execve guuid=c18739f2-1d00-0000-1838-87ec78110000 pid=4472 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=c18739f2-1d00-0000-1838-87ec78110000 pid=4472 execve guuid=38e6b8f2-1d00-0000-1838-87ec7c110000 pid=4476 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=38e6b8f2-1d00-0000-1838-87ec7c110000 pid=4476 execve guuid=f76dfef2-1d00-0000-1838-87ec7f110000 pid=4479 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=f76dfef2-1d00-0000-1838-87ec7f110000 pid=4479 clone guuid=2bb437f3-1d00-0000-1838-87ec81110000 pid=4481 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=2bb437f3-1d00-0000-1838-87ec81110000 pid=4481 execve guuid=6b147311-1e00-0000-1838-87eceb110000 pid=4587 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=6b147311-1e00-0000-1838-87eceb110000 pid=4587 execve guuid=eb2eac30-1e00-0000-1838-87ec56120000 pid=4694 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=eb2eac30-1e00-0000-1838-87ec56120000 pid=4694 execve guuid=293ffa30-1e00-0000-1838-87ec59120000 pid=4697 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=293ffa30-1e00-0000-1838-87ec59120000 pid=4697 execve guuid=25cd3731-1e00-0000-1838-87ec5c120000 pid=4700 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=25cd3731-1e00-0000-1838-87ec5c120000 pid=4700 clone guuid=10025e31-1e00-0000-1838-87ec5d120000 pid=4701 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=10025e31-1e00-0000-1838-87ec5d120000 pid=4701 execve guuid=d1386e4f-1e00-0000-1838-87ecba120000 pid=4794 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=d1386e4f-1e00-0000-1838-87ecba120000 pid=4794 execve guuid=b6b9b86c-1e00-0000-1838-87ecf6120000 pid=4854 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=b6b9b86c-1e00-0000-1838-87ecf6120000 pid=4854 execve guuid=a3502f6d-1e00-0000-1838-87ecf9120000 pid=4857 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=a3502f6d-1e00-0000-1838-87ecf9120000 pid=4857 execve guuid=91c5a16d-1e00-0000-1838-87ecfc120000 pid=4860 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=91c5a16d-1e00-0000-1838-87ecfc120000 pid=4860 clone guuid=4080d46d-1e00-0000-1838-87ecfd120000 pid=4861 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=4080d46d-1e00-0000-1838-87ecfd120000 pid=4861 execve guuid=a64cd18a-1e00-0000-1838-87ec63130000 pid=4963 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=a64cd18a-1e00-0000-1838-87ec63130000 pid=4963 execve guuid=822c92e9-1e00-0000-1838-87ec74140000 pid=5236 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=822c92e9-1e00-0000-1838-87ec74140000 pid=5236 execve guuid=dca0f1e9-1e00-0000-1838-87ec77140000 pid=5239 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=dca0f1e9-1e00-0000-1838-87ec77140000 pid=5239 execve guuid=5a1643ea-1e00-0000-1838-87ec7a140000 pid=5242 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=5a1643ea-1e00-0000-1838-87ec7a140000 pid=5242 clone guuid=218a70ea-1e00-0000-1838-87ec7c140000 pid=5244 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=218a70ea-1e00-0000-1838-87ec7c140000 pid=5244 execve guuid=0f5c9807-1f00-0000-1838-87eca3140000 pid=5283 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=0f5c9807-1f00-0000-1838-87eca3140000 pid=5283 execve guuid=8f0ad525-1f00-0000-1838-87ecac140000 pid=5292 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=8f0ad525-1f00-0000-1838-87ecac140000 pid=5292 execve guuid=167b1f26-1f00-0000-1838-87ecad140000 pid=5293 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=167b1f26-1f00-0000-1838-87ecad140000 pid=5293 execve guuid=55e16226-1f00-0000-1838-87ecae140000 pid=5294 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=55e16226-1f00-0000-1838-87ecae140000 pid=5294 clone guuid=9dda8c26-1f00-0000-1838-87ecaf140000 pid=5295 /usr/bin/wget net send-data guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=9dda8c26-1f00-0000-1838-87ecaf140000 pid=5295 execve guuid=3f4a9644-1f00-0000-1838-87ecb0140000 pid=5296 /usr/bin/curl net send-data write-file guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=3f4a9644-1f00-0000-1838-87ecb0140000 pid=5296 execve guuid=4b1d6b64-1f00-0000-1838-87ecb1140000 pid=5297 /usr/bin/cat guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=4b1d6b64-1f00-0000-1838-87ecb1140000 pid=5297 execve guuid=32a9c464-1f00-0000-1838-87ecb2140000 pid=5298 /usr/bin/chmod guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=32a9c464-1f00-0000-1838-87ecb2140000 pid=5298 execve guuid=29371565-1f00-0000-1838-87ecb3140000 pid=5299 /usr/bin/bash guuid=039798c4-1a00-0000-1838-87ecc7090000 pid=2503->guuid=29371565-1f00-0000-1838-87ecb3140000 pid=5299 clone 71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 103.77.241.42:80 guuid=65f47bc7-1a00-0000-1838-87ecca090000 pid=2506->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 147B guuid=3cccaf22-1b00-0000-1838-87ecbc0a0000 pid=2748->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 96B guuid=18d35185-1b00-0000-1838-87ec6d0b0000 pid=2925->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 147B guuid=5afa25a3-1b00-0000-1838-87ec960b0000 pid=2966->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 96B guuid=4c5a21c2-1b00-0000-1838-87eccf0b0000 pid=3023->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 150B guuid=803f39e0-1b00-0000-1838-87ec140c0000 pid=3092->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 99B guuid=f3228c00-1c00-0000-1838-87ec5c0c0000 pid=3164->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 148B guuid=6521141d-1c00-0000-1838-87ec920c0000 pid=3218->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 97B guuid=c9459d3c-1c00-0000-1838-87ecb60c0000 pid=3254->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 148B guuid=c9a8925a-1c00-0000-1838-87ecee0c0000 pid=3310->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 97B guuid=b30f817c-1c00-0000-1838-87ec2b0d0000 pid=3371->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 150B guuid=ec99b399-1c00-0000-1838-87ec6f0d0000 pid=3439->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 99B guuid=3159f9b9-1c00-0000-1838-87ecca0d0000 pid=3530->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 148B guuid=f7f45fd7-1c00-0000-1838-87ec000e0000 pid=3584->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 97B guuid=456fae33-1d00-0000-1838-87ece30e0000 pid=3811->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 147B guuid=111a7d52-1d00-0000-1838-87ec510f0000 pid=3921->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 96B guuid=72606575-1d00-0000-1838-87eccb0f0000 pid=4043->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 148B guuid=82fcf092-1d00-0000-1838-87ec2e100000 pid=4142->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 97B guuid=f965edb3-1d00-0000-1838-87ec9b100000 pid=4251->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 148B guuid=b10be6d0-1d00-0000-1838-87ec0b110000 pid=4363->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 97B guuid=2bb437f3-1d00-0000-1838-87ec81110000 pid=4481->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 148B guuid=6b147311-1e00-0000-1838-87eceb110000 pid=4587->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 97B guuid=10025e31-1e00-0000-1838-87ec5d120000 pid=4701->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 147B guuid=d1386e4f-1e00-0000-1838-87ecba120000 pid=4794->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 96B guuid=4080d46d-1e00-0000-1838-87ecfd120000 pid=4861->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 149B guuid=a64cd18a-1e00-0000-1838-87ec63130000 pid=4963->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 98B guuid=218a70ea-1e00-0000-1838-87ec7c140000 pid=5244->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 148B guuid=0f5c9807-1f00-0000-1838-87eca3140000 pid=5283->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 97B guuid=9dda8c26-1f00-0000-1838-87ecaf140000 pid=5295->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 147B guuid=3f4a9644-1f00-0000-1838-87ecb0140000 pid=5296->71c3d771-fc0c-5d57-9ce2-e1e3dc35e4f2 send: 96B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0dc4396eb4890ad3ed55f4acb8f461fb3318917202c811a72c4de25a6a2d3a2a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0dc4396eb4890ad3ed55f4acb8f461fb3318917202c811a72c4de25a6a2d3a2a/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-09-28 11:59:07 UTC
AV detection:
17 of 24 (70.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bxcds3vurefnh3kv6swlr5db7mzrrelsalebdjzmjxrfu2rnhiva._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/251013-weyz4a1qs7/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0dc4396eb489/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/0dc4396eb4890ad3ed55f4acb8f461fb3318917202c811a72c4de25a6a2d3a2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 0dc4396eb4890ad3ed55f4acb8f461fb3318917202c811a72c4de25a6a2d3a2a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3656454/
  
Delivery method
Distributed via web download

Comments