MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 109ff819036b17c413ff934c90ae2319e31546303f916533b980763cf7e20a3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 109ff819036b17c413ff934c90ae2319e31546303f916533b980763cf7e20a3c
SHA3-384 hash: f6e0f8a53fd309158eeaaf887afad58f30dbdcefa75116b81aa198737a4a8dc38bce3fc66ca10f142b507b9d1e92905f
SHA1 hash: 90f813d071d70886e858878e6f68983f70db2722
MD5 hash: 71f9c8bf34c9ec14aa6ed27595f92d33
humanhash: stream-earth-leopard-friend
File name:huawei
Download: download sample
Signature Mirai
Create hunting rule
File size:2'849 bytes
First seen:2025-10-14 20:15:06 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vTgYgqgEgOgNkzEgJgqgjgEgSgLRUfgZgGz:vTgYgqgEgOgmEgJgqgjgEgSgLRUfgZgw
TLSH T1905140C4722703707FE25D727DB650ACB2C5E2D1B6C59ED9D4ECA8BD818EF0814A06A3
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://64.91.237.162/bins/sora.x869209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10 Miraimirai opendir
http://64.91.237.162/bins/sora.mips29c7491b527a0e18a776b8cc1831a8ba4b97d917fd76d047c96cc5ae21a79924 Miraimirai opendir
http://64.91.237.162/bins/sora.x86_647e8a271658bd0f9be6bf33a2ea92ce4fad4774aafac33c5b2caedf6417fd15ac Miraimirai opendir
http://64.91.237.162/bins/sora.i468n/an/aelf ua-wget
http://64.91.237.162/bins/sora.i68692575fbaacd79518241425e42a4cdacbf65def900864a48fc0b27504f78cbff4 Miraimirai opendir
http://64.91.237.162/bins/sora.mpsla3b52b958c8ea783c24f7a02fb57b5228fc1969791021519b42e14e58124e30d Miraimirai opendir
http://64.91.237.162/bins/sora.arm4n/an/aelf ua-wget
http://64.91.237.162/bins/sora.arm56357efa12b55a6c1f2d555f6dbbe40a0ed2d5c1e2dced815347fa98881eeefcb Miraimirai opendir
http://64.91.237.162/bins/sora.arm6579e9db35f7d3e276a6fd3b2bb98091a12c58d4cb0cd0ed3ae3cdbfd19304b0a Miraimirai opendir
http://64.91.237.162/bins/sora.arm7a2a3eda8d88cb807ffc26480a5a40cf79ac74b135b8aadaa225fed856da77cef Miraimirai opendir
http://64.91.237.162/bins/sora.ppc773298e6d3a314ffe9554eeea412ac65fbb16cf4030acf0e2553c42a1f159bb2 Miraimirai opendir
http://64.91.237.162/bins/sora.ppc440fpn/an/aelf ua-wget
http://64.91.237.162/bins/sora.m68ka25e8659220a59deaae914fc945fa6b31667bc0c7146a968bec1c4be9ffee9ed Miraimirai opendir
http://64.91.237.162/bins/sora.sh40dd50416937f0bbb202464b09fb982739b34bde7d11834b78a137fc4659502de Miraimirai opendir

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-14T17:40:00Z UTC
Last seen:
2025-10-14T19:32:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/109ff819036b17c413ff934c90ae2319e31546303f916533b980763cf7e20a3c/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4610c914-623a-4b60-8831-64f1ad62b41e
Behavior Graph:
Download SVG
%3 guuid=867c5ba6-1900-0000-2523-9413d6070000 pid=2006 /usr/bin/sudo guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013 /tmp/sample.bin guuid=867c5ba6-1900-0000-2523-9413d6070000 pid=2006->guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013 execve guuid=6dcb00aa-1900-0000-2523-9413de070000 pid=2014 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=6dcb00aa-1900-0000-2523-9413de070000 pid=2014 execve guuid=ea29ecc0-1900-0000-2523-941304080000 pid=2052 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=ea29ecc0-1900-0000-2523-941304080000 pid=2052 execve guuid=6e9e29d9-1900-0000-2523-94132d080000 pid=2093 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=6e9e29d9-1900-0000-2523-94132d080000 pid=2093 execve guuid=5e4fbad9-1900-0000-2523-94132f080000 pid=2095 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=5e4fbad9-1900-0000-2523-94132f080000 pid=2095 execve guuid=9d6462da-1900-0000-2523-941330080000 pid=2096 /tmp/robben net guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=9d6462da-1900-0000-2523-941330080000 pid=2096 execve guuid=f569f8de-1900-0000-2523-941338080000 pid=2104 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=f569f8de-1900-0000-2523-941338080000 pid=2104 execve guuid=117345f5-1900-0000-2523-94136f080000 pid=2159 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=117345f5-1900-0000-2523-94136f080000 pid=2159 execve guuid=7e7f7a0b-1a00-0000-2523-9413a0080000 pid=2208 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=7e7f7a0b-1a00-0000-2523-9413a0080000 pid=2208 execve guuid=8f92ea0b-1a00-0000-2523-9413a1080000 pid=2209 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=8f92ea0b-1a00-0000-2523-9413a1080000 pid=2209 execve guuid=8d06370c-1a00-0000-2523-9413a3080000 pid=2211 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=8d06370c-1a00-0000-2523-9413a3080000 pid=2211 clone guuid=e1fc0f0e-1a00-0000-2523-9413aa080000 pid=2218 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=e1fc0f0e-1a00-0000-2523-9413aa080000 pid=2218 execve guuid=e070ee23-1a00-0000-2523-9413d3080000 pid=2259 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=e070ee23-1a00-0000-2523-9413d3080000 pid=2259 execve guuid=4a76ac3c-1a00-0000-2523-9413f5080000 pid=2293 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=4a76ac3c-1a00-0000-2523-9413f5080000 pid=2293 execve guuid=c63a0c3d-1a00-0000-2523-9413f6080000 pid=2294 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=c63a0c3d-1a00-0000-2523-9413f6080000 pid=2294 execve guuid=9452523d-1a00-0000-2523-9413f7080000 pid=2295 /tmp/robben mprotect-exec net guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=9452523d-1a00-0000-2523-9413f7080000 pid=2295 execve guuid=3830cf40-1a00-0000-2523-9413fc080000 pid=2300 /usr/bin/wget net send-data guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=3830cf40-1a00-0000-2523-9413fc080000 pid=2300 execve guuid=3c1a2c4f-1a00-0000-2523-941313090000 pid=2323 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=3c1a2c4f-1a00-0000-2523-941313090000 pid=2323 execve guuid=bf5fb560-1a00-0000-2523-941333090000 pid=2355 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=bf5fb560-1a00-0000-2523-941333090000 pid=2355 execve guuid=1b132061-1a00-0000-2523-941335090000 pid=2357 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=1b132061-1a00-0000-2523-941335090000 pid=2357 execve guuid=9ed77c61-1a00-0000-2523-941337090000 pid=2359 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=9ed77c61-1a00-0000-2523-941337090000 pid=2359 clone guuid=61cdb461-1a00-0000-2523-941339090000 pid=2361 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=61cdb461-1a00-0000-2523-941339090000 pid=2361 execve guuid=1027b777-1a00-0000-2523-94135f090000 pid=2399 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=1027b777-1a00-0000-2523-94135f090000 pid=2399 execve guuid=bf650491-1a00-0000-2523-941387090000 pid=2439 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=bf650491-1a00-0000-2523-941387090000 pid=2439 execve guuid=36b1c791-1a00-0000-2523-94138a090000 pid=2442 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=36b1c791-1a00-0000-2523-94138a090000 pid=2442 execve guuid=3f1f4592-1a00-0000-2523-94138c090000 pid=2444 /tmp/robben net guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=3f1f4592-1a00-0000-2523-94138c090000 pid=2444 execve guuid=a2810396-1a00-0000-2523-941394090000 pid=2452 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=a2810396-1a00-0000-2523-941394090000 pid=2452 execve guuid=1f855aac-1a00-0000-2523-9413c1090000 pid=2497 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=1f855aac-1a00-0000-2523-9413c1090000 pid=2497 execve guuid=de7401c5-1a00-0000-2523-9413eb090000 pid=2539 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=de7401c5-1a00-0000-2523-9413eb090000 pid=2539 execve guuid=fc8668c5-1a00-0000-2523-9413ed090000 pid=2541 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=fc8668c5-1a00-0000-2523-9413ed090000 pid=2541 execve guuid=a806c2c5-1a00-0000-2523-9413ef090000 pid=2543 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=a806c2c5-1a00-0000-2523-9413ef090000 pid=2543 clone guuid=121998c6-1a00-0000-2523-9413f3090000 pid=2547 /usr/bin/wget net send-data guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=121998c6-1a00-0000-2523-9413f3090000 pid=2547 execve guuid=04d568d5-1a00-0000-2523-9413040a0000 pid=2564 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=04d568d5-1a00-0000-2523-9413040a0000 pid=2564 execve guuid=3dc3ede5-1a00-0000-2523-94132c0a0000 pid=2604 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=3dc3ede5-1a00-0000-2523-94132c0a0000 pid=2604 execve guuid=9b6b84e6-1a00-0000-2523-94132e0a0000 pid=2606 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=9b6b84e6-1a00-0000-2523-94132e0a0000 pid=2606 execve guuid=822a06e7-1a00-0000-2523-9413300a0000 pid=2608 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=822a06e7-1a00-0000-2523-9413300a0000 pid=2608 clone guuid=bcd342e7-1a00-0000-2523-9413320a0000 pid=2610 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=bcd342e7-1a00-0000-2523-9413320a0000 pid=2610 execve guuid=8f7d1bfd-1a00-0000-2523-9413660a0000 pid=2662 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=8f7d1bfd-1a00-0000-2523-9413660a0000 pid=2662 execve guuid=c26a8713-1b00-0000-2523-94139a0a0000 pid=2714 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=c26a8713-1b00-0000-2523-94139a0a0000 pid=2714 execve guuid=9858ec13-1b00-0000-2523-94139c0a0000 pid=2716 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=9858ec13-1b00-0000-2523-94139c0a0000 pid=2716 execve guuid=55a43e14-1b00-0000-2523-94139e0a0000 pid=2718 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=55a43e14-1b00-0000-2523-94139e0a0000 pid=2718 clone guuid=bffffa15-1b00-0000-2523-9413a50a0000 pid=2725 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=bffffa15-1b00-0000-2523-9413a50a0000 pid=2725 execve guuid=f41a9d2b-1b00-0000-2523-9413d60a0000 pid=2774 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=f41a9d2b-1b00-0000-2523-9413d60a0000 pid=2774 execve guuid=75b34345-1b00-0000-2523-9413f90a0000 pid=2809 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=75b34345-1b00-0000-2523-9413f90a0000 pid=2809 execve guuid=aae32246-1b00-0000-2523-9413fc0a0000 pid=2812 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=aae32246-1b00-0000-2523-9413fc0a0000 pid=2812 execve guuid=5fae8046-1b00-0000-2523-9413ff0a0000 pid=2815 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=5fae8046-1b00-0000-2523-9413ff0a0000 pid=2815 clone guuid=b9a26948-1b00-0000-2523-9413030b0000 pid=2819 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=b9a26948-1b00-0000-2523-9413030b0000 pid=2819 execve guuid=ab305965-1b00-0000-2523-9413280b0000 pid=2856 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=ab305965-1b00-0000-2523-9413280b0000 pid=2856 execve guuid=5eb50c83-1b00-0000-2523-9413630b0000 pid=2915 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=5eb50c83-1b00-0000-2523-9413630b0000 pid=2915 execve guuid=3b988483-1b00-0000-2523-9413650b0000 pid=2917 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=3b988483-1b00-0000-2523-9413650b0000 pid=2917 execve guuid=504bdd83-1b00-0000-2523-9413670b0000 pid=2919 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=504bdd83-1b00-0000-2523-9413670b0000 pid=2919 clone guuid=c1d09684-1b00-0000-2523-94136b0b0000 pid=2923 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=c1d09684-1b00-0000-2523-94136b0b0000 pid=2923 execve guuid=0349e99b-1b00-0000-2523-9413900b0000 pid=2960 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=0349e99b-1b00-0000-2523-9413900b0000 pid=2960 execve guuid=fbd740b3-1b00-0000-2523-9413b00b0000 pid=2992 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=fbd740b3-1b00-0000-2523-9413b00b0000 pid=2992 execve guuid=98ddb9b3-1b00-0000-2523-9413b30b0000 pid=2995 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=98ddb9b3-1b00-0000-2523-9413b30b0000 pid=2995 execve guuid=1aaf36b4-1b00-0000-2523-9413b40b0000 pid=2996 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=1aaf36b4-1b00-0000-2523-9413b40b0000 pid=2996 clone guuid=d8f741b5-1b00-0000-2523-9413b70b0000 pid=2999 /usr/bin/wget net send-data guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=d8f741b5-1b00-0000-2523-9413b70b0000 pid=2999 execve guuid=ef44bcc3-1b00-0000-2523-9413df0b0000 pid=3039 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=ef44bcc3-1b00-0000-2523-9413df0b0000 pid=3039 execve guuid=1e6d92d5-1b00-0000-2523-94130e0c0000 pid=3086 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=1e6d92d5-1b00-0000-2523-94130e0c0000 pid=3086 execve guuid=6d8448d6-1b00-0000-2523-9413100c0000 pid=3088 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=6d8448d6-1b00-0000-2523-9413100c0000 pid=3088 execve guuid=66dca9d6-1b00-0000-2523-9413120c0000 pid=3090 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=66dca9d6-1b00-0000-2523-9413120c0000 pid=3090 clone guuid=2b41d6d6-1b00-0000-2523-9413130c0000 pid=3091 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=2b41d6d6-1b00-0000-2523-9413130c0000 pid=3091 execve guuid=08d9aaf2-1b00-0000-2523-9413540c0000 pid=3156 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=08d9aaf2-1b00-0000-2523-9413540c0000 pid=3156 execve guuid=49e8820f-1c00-0000-2523-9413970c0000 pid=3223 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=49e8820f-1c00-0000-2523-9413970c0000 pid=3223 execve guuid=feadfa0f-1c00-0000-2523-9413980c0000 pid=3224 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=feadfa0f-1c00-0000-2523-9413980c0000 pid=3224 execve guuid=a09e6e10-1c00-0000-2523-9413990c0000 pid=3225 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=a09e6e10-1c00-0000-2523-9413990c0000 pid=3225 clone guuid=64497811-1c00-0000-2523-94139b0c0000 pid=3227 /usr/bin/wget net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=64497811-1c00-0000-2523-94139b0c0000 pid=3227 execve guuid=5810f02d-1c00-0000-2523-9413c00c0000 pid=3264 /usr/bin/curl net send-data write-file guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=5810f02d-1c00-0000-2523-9413c00c0000 pid=3264 execve guuid=6e3d9a4e-1c00-0000-2523-9413de0c0000 pid=3294 /usr/bin/cat guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=6e3d9a4e-1c00-0000-2523-9413de0c0000 pid=3294 execve guuid=2a78604f-1c00-0000-2523-9413df0c0000 pid=3295 /usr/bin/chmod guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=2a78604f-1c00-0000-2523-9413df0c0000 pid=3295 execve guuid=0ad2e04f-1c00-0000-2523-9413e20c0000 pid=3298 /usr/bin/bash guuid=51f3d8a8-1900-0000-2523-9413dd070000 pid=2013->guuid=0ad2e04f-1c00-0000-2523-9413e20c0000 pid=3298 clone 10651e68-131f-5e6d-a670-1d19a7120e88 64.91.237.162:80 guuid=6dcb00aa-1900-0000-2523-9413de070000 pid=2014->10651e68-131f-5e6d-a670-1d19a7120e88 send: 141B guuid=ea29ecc0-1900-0000-2523-941304080000 pid=2052->10651e68-131f-5e6d-a670-1d19a7120e88 send: 90B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=9d6462da-1900-0000-2523-941330080000 pid=2096->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f569f8de-1900-0000-2523-941338080000 pid=2104->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=117345f5-1900-0000-2523-94136f080000 pid=2159->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=e1fc0f0e-1a00-0000-2523-9413aa080000 pid=2218->10651e68-131f-5e6d-a670-1d19a7120e88 send: 144B guuid=e070ee23-1a00-0000-2523-9413d3080000 pid=2259->10651e68-131f-5e6d-a670-1d19a7120e88 send: 93B guuid=9452523d-1a00-0000-2523-9413f7080000 pid=2295->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3830cf40-1a00-0000-2523-9413fc080000 pid=2300->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=3c1a2c4f-1a00-0000-2523-941313090000 pid=2323->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=61cdb461-1a00-0000-2523-941339090000 pid=2361->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=1027b777-1a00-0000-2523-94135f090000 pid=2399->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=3f1f4592-1a00-0000-2523-94138c090000 pid=2444->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a2810396-1a00-0000-2523-941394090000 pid=2452->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=1f855aac-1a00-0000-2523-9413c1090000 pid=2497->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=121998c6-1a00-0000-2523-9413f3090000 pid=2547->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=04d568d5-1a00-0000-2523-9413040a0000 pid=2564->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=bcd342e7-1a00-0000-2523-9413320a0000 pid=2610->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=8f7d1bfd-1a00-0000-2523-9413660a0000 pid=2662->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=bffffa15-1b00-0000-2523-9413a50a0000 pid=2725->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=f41a9d2b-1b00-0000-2523-9413d60a0000 pid=2774->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=b9a26948-1b00-0000-2523-9413030b0000 pid=2819->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=ab305965-1b00-0000-2523-9413280b0000 pid=2856->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=c1d09684-1b00-0000-2523-94136b0b0000 pid=2923->10651e68-131f-5e6d-a670-1d19a7120e88 send: 141B guuid=0349e99b-1b00-0000-2523-9413900b0000 pid=2960->10651e68-131f-5e6d-a670-1d19a7120e88 send: 90B guuid=d8f741b5-1b00-0000-2523-9413b70b0000 pid=2999->10651e68-131f-5e6d-a670-1d19a7120e88 send: 146B guuid=ef44bcc3-1b00-0000-2523-9413df0b0000 pid=3039->10651e68-131f-5e6d-a670-1d19a7120e88 send: 95B guuid=2b41d6d6-1b00-0000-2523-9413130c0000 pid=3091->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=08d9aaf2-1b00-0000-2523-9413540c0000 pid=3156->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=64497811-1c00-0000-2523-94139b0c0000 pid=3227->10651e68-131f-5e6d-a670-1d19a7120e88 send: 141B guuid=5810f02d-1c00-0000-2523-9413c00c0000 pid=3264->10651e68-131f-5e6d-a670-1d19a7120e88 send: 90B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/109ff819036b17c413ff934c90ae2319e31546303f916533b980763cf7e20a3c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/109ff819036b17c413ff934c90ae2319e31546303f916533b980763cf7e20a3c/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2025-10-14 20:20:36 UTC
File Type:
Text (Shell)
AV detection:
23 of 38 (60.53%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ccp7qgidnml4ie77sngjblrddhrrkrrqh6iwkm5zqb3dz57cbi6a._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:sora antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251014-y449hsbs4h/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (46959) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/109ff819036b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/109ff819036b17c413ff934c90ae2319e31546303f916533b980763cf7e20a3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 109ff819036b17c413ff934c90ae2319e31546303f916533b980763cf7e20a3c

(this sample)

Mirai

elf 9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10

  
URLhaus
https://urlhaus.abuse.ch/url/3678189/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3678204/
  
Dropping
MD5 4e24204e7b5dc8623a078e30669fdead
  
Dropping
SHA256 9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10

Comments