🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10d4a7e6b370aba96dab9da75d56b3fd3e53938423cd7f302790b59fc42b3f97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10d4a7e6b370aba96dab9da75d56b3fd3e53938423cd7f302790b59fc42b3f97
SHA3-384 hash: 21a49eac4d0e03b288f1e347a041ba40131275ad2d5b115697af77f58225bdb0a97ae605de2c72a4addb9bfe927ba694
SHA1 hash: 9791e5c2e1002827505243c7ea0f465b5e46925b
MD5 hash: f692344f03c5fec20f49424c8a6de1df
humanhash: fillet-river-tennessee-ten
File name:ruck
Download: download sample
Signature Mirai
Create hunting rule
File size:2'685 bytes
First seen:2026-09-01 22:20:36 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:pKQvt8tXHtYt2t6tDtltat1totPatbH/tPtr:pJt8tXHtYt2t6tDtltat1totPatbftP5
TLSH T1415191C417620A763C539DC337AF8C443188AAFE28C29E25A9EC74E4054EDCAF1C4B53
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://46.151.182.200/bot.x86c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d Miraielf mirai ua-wget
http://46.151.182.200/bot.mips2bdcd6e8a368c28488926a4773bf4cc2d5840ced8cb6499e417c3743cec7c44c Miraielf mirai ua-wget
http://46.151.182.200/bot.arcf8a45723a8bcd8f0858b958a9d61f38a7b657949ffe3d43038be0e7f562c24d0 Miraielf mirai ua-wget
http://46.151.182.200/bot.i48620e0b568507ba65e67672f860905880e5fea56654285f9b258675b5eae473b01 Miraielf mirai ua-wget
http://46.151.182.200/bot.i686d9bce6c9a1e6dc24747f2b754bc3ec0b381bac755d2dcc52db38c87fce8a46ab Miraielf mirai ua-wget
http://46.151.182.200/bot.x86_6408ffaa3060aceda41990ab74a6f996b8fced28c3e3065e23e8cdebdb255be0e0 Miraielf mirai ua-wget
http://46.151.182.200/bot.mpsld0d1bbcd8900f190bc7b24e1b15e5558fbc917e5172712075207ee3e29c16a3f Miraielf mirai ua-wget
http://46.151.182.200/bot.arm3cf3edeeeac605be90d682b402ca8f34841633b05b45be6be2c50d30e5563fb2 Miraiarm elf mirai ua-wget
http://46.151.182.200/bot.arm570dce1cfed01b0cbaa7a50d2d23f44cd80621947a082c424a0c55a2e3fe48d61 Miraielf mirai ua-wget
http://46.151.182.200/bot.arm66e2317a8a15f7dfdda44266aea43fa0579fe4319546e7a47e07b53e8e5e4fdae Miraielf mirai ua-wget
http://46.151.182.200/bot.arm7bdbcb94265f715c4e044499b7f18a9193972117c06daf9097f91afe812de6207 Miraiarm elf mirai ua-wget
http://46.151.182.200/bot.ppcd5c876aed3c43d53d1c37d5ea33a44e84fcd3af80a10c53b020fb8946bfd3765 Miraielf mirai ua-wget
http://46.151.182.200/bot.spc6dea295dace414dcecb4580a7882b707364cd31ea7708e4ec0643a022091b152 Miraielf mirai ua-wget
http://46.151.182.200/bot.m68k59b3e567a22126d9d26ab758dabe2a17908d0c48d326fdf2c260546fd8b220c8 Miraielf mirai ua-wget
http://46.151.182.200/bot.sh44892824a9316779d423c3190df9bcaa9cdbde0756eb225b7a7ad5746dc04f654 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader mirai
Link:
https://www.filescan.io/uploads/6a974fda449040cf92b9bdca/reports/e26972e4-c23e-4846-aa2c-66672679fc26/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-01T20:21:00Z UTC
Last seen:
2026-09-03T17:31:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/10d4a7e6b370aba96dab9da75d56b3fd3e53938423cd7f302790b59fc42b3f97/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1805a3eb-eafb-4fdd-a230-5f94493612e8
Behavior Graph:
Download SVG
%3 guuid=5cff7d7b-1600-0000-7537-b8df740d0000 pid=3444 /usr/bin/sudo guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448 /tmp/sample.bin guuid=5cff7d7b-1600-0000-7537-b8df740d0000 pid=3444->guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448 execve guuid=3cb4807d-1600-0000-7537-b8df790d0000 pid=3449 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=3cb4807d-1600-0000-7537-b8df790d0000 pid=3449 execve guuid=27c30588-1600-0000-7537-b8df960d0000 pid=3478 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=27c30588-1600-0000-7537-b8df960d0000 pid=3478 execve guuid=70149998-1600-0000-7537-b8dfc60d0000 pid=3526 /usr/bin/cat guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=70149998-1600-0000-7537-b8dfc60d0000 pid=3526 execve guuid=a29c6b9a-1600-0000-7537-b8dfcb0d0000 pid=3531 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=a29c6b9a-1600-0000-7537-b8dfcb0d0000 pid=3531 execve guuid=982f7e9b-1600-0000-7537-b8dfcf0d0000 pid=3535 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=982f7e9b-1600-0000-7537-b8dfcf0d0000 pid=3535 execve guuid=b0f1259d-1600-0000-7537-b8dfd90d0000 pid=3545 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=b0f1259d-1600-0000-7537-b8dfd90d0000 pid=3545 execve guuid=6cabe6a9-1600-0000-7537-b8dfde0d0000 pid=3550 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=6cabe6a9-1600-0000-7537-b8dfde0d0000 pid=3550 execve guuid=e61e9ab9-1600-0000-7537-b8dff70d0000 pid=3575 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=e61e9ab9-1600-0000-7537-b8dff70d0000 pid=3575 clone guuid=e795bfb9-1600-0000-7537-b8dff80d0000 pid=3576 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=e795bfb9-1600-0000-7537-b8dff80d0000 pid=3576 execve guuid=87f20eba-1600-0000-7537-b8dffa0d0000 pid=3578 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=87f20eba-1600-0000-7537-b8dffa0d0000 pid=3578 execve guuid=11d75dc7-1600-0000-7537-b8df320e0000 pid=3634 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=11d75dc7-1600-0000-7537-b8df320e0000 pid=3634 execve guuid=e0a06fd5-1600-0000-7537-b8df5e0e0000 pid=3678 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=e0a06fd5-1600-0000-7537-b8df5e0e0000 pid=3678 execve guuid=30dbd6e1-1600-0000-7537-b8df840e0000 pid=3716 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=30dbd6e1-1600-0000-7537-b8df840e0000 pid=3716 clone guuid=8ea714e2-1600-0000-7537-b8df850e0000 pid=3717 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=8ea714e2-1600-0000-7537-b8df850e0000 pid=3717 execve guuid=4446b3e3-1600-0000-7537-b8df880e0000 pid=3720 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=4446b3e3-1600-0000-7537-b8df880e0000 pid=3720 execve guuid=8261d8f1-1600-0000-7537-b8dfb30e0000 pid=3763 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=8261d8f1-1600-0000-7537-b8dfb30e0000 pid=3763 execve guuid=d6ee82fb-1600-0000-7537-b8dfd50e0000 pid=3797 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=d6ee82fb-1600-0000-7537-b8dfd50e0000 pid=3797 execve guuid=f70be506-1700-0000-7537-b8dffa0e0000 pid=3834 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=f70be506-1700-0000-7537-b8dffa0e0000 pid=3834 clone guuid=17ea0607-1700-0000-7537-b8dffb0e0000 pid=3835 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=17ea0607-1700-0000-7537-b8dffb0e0000 pid=3835 execve guuid=ceca7707-1700-0000-7537-b8dffe0e0000 pid=3838 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=ceca7707-1700-0000-7537-b8dffe0e0000 pid=3838 execve guuid=2d305215-1700-0000-7537-b8df2c0f0000 pid=3884 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=2d305215-1700-0000-7537-b8df2c0f0000 pid=3884 execve guuid=af35a31e-1700-0000-7537-b8df4b0f0000 pid=3915 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=af35a31e-1700-0000-7537-b8df4b0f0000 pid=3915 execve guuid=148e732c-1700-0000-7537-b8df760f0000 pid=3958 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=148e732c-1700-0000-7537-b8df760f0000 pid=3958 clone guuid=1d0bda2c-1700-0000-7537-b8df780f0000 pid=3960 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=1d0bda2c-1700-0000-7537-b8df780f0000 pid=3960 execve guuid=d819fd2e-1700-0000-7537-b8df7c0f0000 pid=3964 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=d819fd2e-1700-0000-7537-b8df7c0f0000 pid=3964 execve guuid=30392d3c-1700-0000-7537-b8dfb80f0000 pid=4024 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=30392d3c-1700-0000-7537-b8dfb80f0000 pid=4024 execve guuid=52ded644-1700-0000-7537-b8dfce0f0000 pid=4046 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=52ded644-1700-0000-7537-b8dfce0f0000 pid=4046 execve guuid=c8a2a350-1700-0000-7537-b8df03100000 pid=4099 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=c8a2a350-1700-0000-7537-b8df03100000 pid=4099 clone guuid=2066c850-1700-0000-7537-b8df05100000 pid=4101 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=2066c850-1700-0000-7537-b8df05100000 pid=4101 execve guuid=49961d51-1700-0000-7537-b8df07100000 pid=4103 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=49961d51-1700-0000-7537-b8df07100000 pid=4103 execve guuid=97dafc5e-1700-0000-7537-b8df45100000 pid=4165 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=97dafc5e-1700-0000-7537-b8df45100000 pid=4165 execve guuid=09dff16a-1700-0000-7537-b8df83100000 pid=4227 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=09dff16a-1700-0000-7537-b8df83100000 pid=4227 execve guuid=e535cc79-1700-0000-7537-b8dfd3100000 pid=4307 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=e535cc79-1700-0000-7537-b8dfd3100000 pid=4307 clone guuid=c160e279-1700-0000-7537-b8dfd4100000 pid=4308 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=c160e279-1700-0000-7537-b8dfd4100000 pid=4308 execve guuid=8cdf247a-1700-0000-7537-b8dfd6100000 pid=4310 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=8cdf247a-1700-0000-7537-b8dfd6100000 pid=4310 execve guuid=5ada5a87-1700-0000-7537-b8df0d110000 pid=4365 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=5ada5a87-1700-0000-7537-b8df0d110000 pid=4365 execve guuid=693d3192-1700-0000-7537-b8df3c110000 pid=4412 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=693d3192-1700-0000-7537-b8df3c110000 pid=4412 execve guuid=af65cd9c-1700-0000-7537-b8df52110000 pid=4434 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=af65cd9c-1700-0000-7537-b8df52110000 pid=4434 clone guuid=a683039d-1700-0000-7537-b8df53110000 pid=4435 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=a683039d-1700-0000-7537-b8df53110000 pid=4435 execve guuid=0dfca79d-1700-0000-7537-b8df54110000 pid=4436 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=0dfca79d-1700-0000-7537-b8df54110000 pid=4436 execve guuid=d0a0a1ab-1700-0000-7537-b8df60110000 pid=4448 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=d0a0a1ab-1700-0000-7537-b8df60110000 pid=4448 execve guuid=f7e2deb5-1700-0000-7537-b8df91110000 pid=4497 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=f7e2deb5-1700-0000-7537-b8df91110000 pid=4497 execve guuid=afe8dac0-1700-0000-7537-b8dfca110000 pid=4554 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=afe8dac0-1700-0000-7537-b8dfca110000 pid=4554 clone guuid=51a404c1-1700-0000-7537-b8dfcb110000 pid=4555 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=51a404c1-1700-0000-7537-b8dfcb110000 pid=4555 execve guuid=b15a7cc1-1700-0000-7537-b8dfcd110000 pid=4557 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=b15a7cc1-1700-0000-7537-b8dfcd110000 pid=4557 execve guuid=f6a4aece-1700-0000-7537-b8dff8110000 pid=4600 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=f6a4aece-1700-0000-7537-b8dff8110000 pid=4600 execve guuid=28c750d7-1700-0000-7537-b8df12120000 pid=4626 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=28c750d7-1700-0000-7537-b8df12120000 pid=4626 execve guuid=1255cfe0-1700-0000-7537-b8df42120000 pid=4674 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=1255cfe0-1700-0000-7537-b8df42120000 pid=4674 clone guuid=fe5ae9e0-1700-0000-7537-b8df44120000 pid=4676 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=fe5ae9e0-1700-0000-7537-b8df44120000 pid=4676 execve guuid=504539e1-1700-0000-7537-b8df46120000 pid=4678 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=504539e1-1700-0000-7537-b8df46120000 pid=4678 execve guuid=9ff386ee-1700-0000-7537-b8df6e120000 pid=4718 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=9ff386ee-1700-0000-7537-b8df6e120000 pid=4718 execve guuid=ffac66f8-1700-0000-7537-b8df9b120000 pid=4763 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=ffac66f8-1700-0000-7537-b8df9b120000 pid=4763 execve guuid=ecbfe43e-1800-0000-7537-b8df6a130000 pid=4970 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=ecbfe43e-1800-0000-7537-b8df6a130000 pid=4970 clone guuid=e848133f-1800-0000-7537-b8df6b130000 pid=4971 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=e848133f-1800-0000-7537-b8df6b130000 pid=4971 execve guuid=6ff7653f-1800-0000-7537-b8df6e130000 pid=4974 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=6ff7653f-1800-0000-7537-b8df6e130000 pid=4974 execve guuid=c524ab4c-1800-0000-7537-b8dfa4130000 pid=5028 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=c524ab4c-1800-0000-7537-b8dfa4130000 pid=5028 execve guuid=1c360459-1800-0000-7537-b8dfd3130000 pid=5075 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=1c360459-1800-0000-7537-b8dfd3130000 pid=5075 execve guuid=30f1ba62-1800-0000-7537-b8dff3130000 pid=5107 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=30f1ba62-1800-0000-7537-b8dff3130000 pid=5107 clone guuid=93a9d262-1800-0000-7537-b8dff4130000 pid=5108 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=93a9d262-1800-0000-7537-b8dff4130000 pid=5108 execve guuid=bff02963-1800-0000-7537-b8dff6130000 pid=5110 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=bff02963-1800-0000-7537-b8dff6130000 pid=5110 execve guuid=7fa76970-1800-0000-7537-b8df17140000 pid=5143 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=7fa76970-1800-0000-7537-b8df17140000 pid=5143 execve guuid=5984e27b-1800-0000-7537-b8df53140000 pid=5203 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=5984e27b-1800-0000-7537-b8df53140000 pid=5203 execve guuid=3f623c8a-1800-0000-7537-b8df54140000 pid=5204 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=3f623c8a-1800-0000-7537-b8df54140000 pid=5204 clone guuid=66e7f28a-1800-0000-7537-b8df55140000 pid=5205 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=66e7f28a-1800-0000-7537-b8df55140000 pid=5205 execve guuid=18397e8b-1800-0000-7537-b8df56140000 pid=5206 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=18397e8b-1800-0000-7537-b8df56140000 pid=5206 execve guuid=5d03b39a-1800-0000-7537-b8df5b140000 pid=5211 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=5d03b39a-1800-0000-7537-b8df5b140000 pid=5211 execve guuid=580fdba3-1800-0000-7537-b8df67140000 pid=5223 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=580fdba3-1800-0000-7537-b8df67140000 pid=5223 execve guuid=2bf45cae-1800-0000-7537-b8df68140000 pid=5224 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=2bf45cae-1800-0000-7537-b8df68140000 pid=5224 clone guuid=9da57fae-1800-0000-7537-b8df69140000 pid=5225 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=9da57fae-1800-0000-7537-b8df69140000 pid=5225 execve guuid=dee8e2ae-1800-0000-7537-b8df6a140000 pid=5226 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=dee8e2ae-1800-0000-7537-b8df6a140000 pid=5226 execve guuid=e43b56bc-1800-0000-7537-b8df6c140000 pid=5228 /usr/bin/wget net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=e43b56bc-1800-0000-7537-b8df6c140000 pid=5228 execve guuid=f6425ac7-1800-0000-7537-b8df70140000 pid=5232 /usr/bin/curl net send-data write-file guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=f6425ac7-1800-0000-7537-b8df70140000 pid=5232 execve guuid=8464c8d7-1800-0000-7537-b8df71140000 pid=5233 /usr/bin/bash guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=8464c8d7-1800-0000-7537-b8df71140000 pid=5233 clone guuid=b620e8d7-1800-0000-7537-b8df72140000 pid=5234 /usr/bin/chmod guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=b620e8d7-1800-0000-7537-b8df72140000 pid=5234 execve guuid=941059d8-1800-0000-7537-b8df73140000 pid=5235 /tmp/WTF guuid=3acd2d7d-1600-0000-7537-b8df780d0000 pid=3448->guuid=941059d8-1800-0000-7537-b8df73140000 pid=5235 execve 68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 46.151.182.200:80 guuid=3cb4807d-1600-0000-7537-b8df790d0000 pid=3449->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=27c30588-1600-0000-7537-b8df960d0000 pid=3478->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=fe3f0d9d-1600-0000-7537-b8dfd80d0000 pid=3544 /tmp/WTF net write-file zombie guuid=982f7e9b-1600-0000-7537-b8dfcf0d0000 pid=3535->guuid=fe3f0d9d-1600-0000-7537-b8dfd80d0000 pid=3544 clone 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=fe3f0d9d-1600-0000-7537-b8dfd80d0000 pid=3544->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=afd73ea6-1600-0000-7537-b8dfdb0d0000 pid=3547 /tmp/WTF write-file guuid=fe3f0d9d-1600-0000-7537-b8dfd80d0000 pid=3544->guuid=afd73ea6-1600-0000-7537-b8dfdb0d0000 pid=3547 clone guuid=b0f1259d-1600-0000-7537-b8dfd90d0000 pid=3545->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=28a65ba6-1600-0000-7537-b8dfdc0d0000 pid=3548 /tmp/WTF guuid=afd73ea6-1600-0000-7537-b8dfdb0d0000 pid=3547->guuid=28a65ba6-1600-0000-7537-b8dfdc0d0000 pid=3548 clone guuid=31da6da6-1600-0000-7537-b8dfdd0d0000 pid=3549 /tmp/WTF guuid=afd73ea6-1600-0000-7537-b8dfdb0d0000 pid=3547->guuid=31da6da6-1600-0000-7537-b8dfdd0d0000 pid=3549 clone guuid=6cabe6a9-1600-0000-7537-b8dfde0d0000 pid=3550->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=c05653c7-1600-0000-7537-b8df310e0000 pid=3633 /tmp/WTF net write-file zombie guuid=87f20eba-1600-0000-7537-b8dffa0d0000 pid=3578->guuid=c05653c7-1600-0000-7537-b8df310e0000 pid=3633 clone guuid=c05653c7-1600-0000-7537-b8df310e0000 pid=3633->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=15d98dc7-1600-0000-7537-b8df340e0000 pid=3636 /tmp/WTF write-file guuid=c05653c7-1600-0000-7537-b8df310e0000 pid=3633->guuid=15d98dc7-1600-0000-7537-b8df340e0000 pid=3636 clone guuid=11d75dc7-1600-0000-7537-b8df320e0000 pid=3634->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=a5dd97c7-1600-0000-7537-b8df350e0000 pid=3637 /tmp/WTF guuid=15d98dc7-1600-0000-7537-b8df340e0000 pid=3636->guuid=a5dd97c7-1600-0000-7537-b8df350e0000 pid=3637 clone guuid=22279dc7-1600-0000-7537-b8df370e0000 pid=3639 /tmp/WTF guuid=15d98dc7-1600-0000-7537-b8df340e0000 pid=3636->guuid=22279dc7-1600-0000-7537-b8df370e0000 pid=3639 clone guuid=e0a06fd5-1600-0000-7537-b8df5e0e0000 pid=3678->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=b291cef1-1600-0000-7537-b8dfb20e0000 pid=3762 /tmp/WTF net write-file zombie guuid=4446b3e3-1600-0000-7537-b8df880e0000 pid=3720->guuid=b291cef1-1600-0000-7537-b8dfb20e0000 pid=3762 clone guuid=b291cef1-1600-0000-7537-b8dfb20e0000 pid=3762->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=29e608f2-1600-0000-7537-b8dfb50e0000 pid=3765 /tmp/WTF write-file guuid=b291cef1-1600-0000-7537-b8dfb20e0000 pid=3762->guuid=29e608f2-1600-0000-7537-b8dfb50e0000 pid=3765 clone guuid=8261d8f1-1600-0000-7537-b8dfb30e0000 pid=3763->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=e7c914f2-1600-0000-7537-b8dfb60e0000 pid=3766 /tmp/WTF guuid=29e608f2-1600-0000-7537-b8dfb50e0000 pid=3765->guuid=e7c914f2-1600-0000-7537-b8dfb60e0000 pid=3766 clone guuid=4e4c1af2-1600-0000-7537-b8dfb70e0000 pid=3767 /tmp/WTF guuid=29e608f2-1600-0000-7537-b8dfb50e0000 pid=3765->guuid=4e4c1af2-1600-0000-7537-b8dfb70e0000 pid=3767 clone guuid=d6ee82fb-1600-0000-7537-b8dfd50e0000 pid=3797->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=bdbc4215-1700-0000-7537-b8df2a0f0000 pid=3882 /tmp/WTF net write-file zombie guuid=ceca7707-1700-0000-7537-b8dffe0e0000 pid=3838->guuid=bdbc4215-1700-0000-7537-b8df2a0f0000 pid=3882 clone guuid=bdbc4215-1700-0000-7537-b8df2a0f0000 pid=3882->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=b4467e15-1700-0000-7537-b8df2f0f0000 pid=3887 /tmp/WTF write-file guuid=bdbc4215-1700-0000-7537-b8df2a0f0000 pid=3882->guuid=b4467e15-1700-0000-7537-b8df2f0f0000 pid=3887 clone guuid=2d305215-1700-0000-7537-b8df2c0f0000 pid=3884->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=92e64519-1700-0000-7537-b8df380f0000 pid=3896 /tmp/WTF guuid=b4467e15-1700-0000-7537-b8df2f0f0000 pid=3887->guuid=92e64519-1700-0000-7537-b8df380f0000 pid=3896 clone guuid=58f14d19-1700-0000-7537-b8df390f0000 pid=3897 /tmp/WTF guuid=b4467e15-1700-0000-7537-b8df2f0f0000 pid=3887->guuid=58f14d19-1700-0000-7537-b8df390f0000 pid=3897 clone guuid=af35a31e-1700-0000-7537-b8df4b0f0000 pid=3915->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=a29d1d3c-1700-0000-7537-b8dfb70f0000 pid=4023 /tmp/WTF net write-file zombie guuid=d819fd2e-1700-0000-7537-b8df7c0f0000 pid=3964->guuid=a29d1d3c-1700-0000-7537-b8dfb70f0000 pid=4023 clone guuid=a29d1d3c-1700-0000-7537-b8dfb70f0000 pid=4023->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=98d84a3c-1700-0000-7537-b8dfb90f0000 pid=4025 /tmp/WTF write-file guuid=a29d1d3c-1700-0000-7537-b8dfb70f0000 pid=4023->guuid=98d84a3c-1700-0000-7537-b8dfb90f0000 pid=4025 clone guuid=30392d3c-1700-0000-7537-b8dfb80f0000 pid=4024->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 139B guuid=ccf55e3c-1700-0000-7537-b8dfba0f0000 pid=4026 /tmp/WTF guuid=98d84a3c-1700-0000-7537-b8dfb90f0000 pid=4025->guuid=ccf55e3c-1700-0000-7537-b8dfba0f0000 pid=4026 clone guuid=19b66a3c-1700-0000-7537-b8dfbc0f0000 pid=4028 /tmp/WTF guuid=98d84a3c-1700-0000-7537-b8dfb90f0000 pid=4025->guuid=19b66a3c-1700-0000-7537-b8dfbc0f0000 pid=4028 clone guuid=52ded644-1700-0000-7537-b8dfce0f0000 pid=4046->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 88B guuid=0a78f05e-1700-0000-7537-b8df42100000 pid=4162 /tmp/WTF net write-file zombie guuid=49961d51-1700-0000-7537-b8df07100000 pid=4103->guuid=0a78f05e-1700-0000-7537-b8df42100000 pid=4162 clone guuid=0a78f05e-1700-0000-7537-b8df42100000 pid=4162->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d109265f-1700-0000-7537-b8df47100000 pid=4167 /tmp/WTF write-file guuid=0a78f05e-1700-0000-7537-b8df42100000 pid=4162->guuid=d109265f-1700-0000-7537-b8df47100000 pid=4167 clone guuid=97dafc5e-1700-0000-7537-b8df45100000 pid=4165->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=13442f5f-1700-0000-7537-b8df48100000 pid=4168 /tmp/WTF guuid=d109265f-1700-0000-7537-b8df47100000 pid=4167->guuid=13442f5f-1700-0000-7537-b8df48100000 pid=4168 clone guuid=1fd9345f-1700-0000-7537-b8df49100000 pid=4169 /tmp/WTF guuid=d109265f-1700-0000-7537-b8df47100000 pid=4167->guuid=1fd9345f-1700-0000-7537-b8df49100000 pid=4169 clone guuid=09dff16a-1700-0000-7537-b8df83100000 pid=4227->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=5baa5087-1700-0000-7537-b8df0c110000 pid=4364 /tmp/WTF net write-file zombie guuid=8cdf247a-1700-0000-7537-b8dfd6100000 pid=4310->guuid=5baa5087-1700-0000-7537-b8df0c110000 pid=4364 clone guuid=5baa5087-1700-0000-7537-b8df0c110000 pid=4364->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6fd98087-1700-0000-7537-b8df0e110000 pid=4366 /tmp/WTF write-file guuid=5baa5087-1700-0000-7537-b8df0c110000 pid=4364->guuid=6fd98087-1700-0000-7537-b8df0e110000 pid=4366 clone guuid=5ada5a87-1700-0000-7537-b8df0d110000 pid=4365->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=c4e78a87-1700-0000-7537-b8df0f110000 pid=4367 /tmp/WTF guuid=6fd98087-1700-0000-7537-b8df0e110000 pid=4366->guuid=c4e78a87-1700-0000-7537-b8df0f110000 pid=4367 clone guuid=b3509187-1700-0000-7537-b8df10110000 pid=4368 /tmp/WTF guuid=6fd98087-1700-0000-7537-b8df0e110000 pid=4366->guuid=b3509187-1700-0000-7537-b8df10110000 pid=4368 clone guuid=693d3192-1700-0000-7537-b8df3c110000 pid=4412->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=7ccc91ab-1700-0000-7537-b8df5f110000 pid=4447 /tmp/WTF net write-file zombie guuid=0dfca79d-1700-0000-7537-b8df54110000 pid=4436->guuid=7ccc91ab-1700-0000-7537-b8df5f110000 pid=4447 clone guuid=7ccc91ab-1700-0000-7537-b8df5f110000 pid=4447->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9e15f6ab-1700-0000-7537-b8df62110000 pid=4450 /tmp/WTF write-file guuid=7ccc91ab-1700-0000-7537-b8df5f110000 pid=4447->guuid=9e15f6ab-1700-0000-7537-b8df62110000 pid=4450 clone guuid=d0a0a1ab-1700-0000-7537-b8df60110000 pid=4448->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=76b910ac-1700-0000-7537-b8df63110000 pid=4451 /tmp/WTF guuid=9e15f6ab-1700-0000-7537-b8df62110000 pid=4450->guuid=76b910ac-1700-0000-7537-b8df63110000 pid=4451 clone guuid=133c1aac-1700-0000-7537-b8df64110000 pid=4452 /tmp/WTF guuid=9e15f6ab-1700-0000-7537-b8df62110000 pid=4450->guuid=133c1aac-1700-0000-7537-b8df64110000 pid=4452 clone guuid=f7e2deb5-1700-0000-7537-b8df91110000 pid=4497->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=b2e1a0ce-1700-0000-7537-b8dff7110000 pid=4599 /tmp/WTF net write-file zombie guuid=b15a7cc1-1700-0000-7537-b8dfcd110000 pid=4557->guuid=b2e1a0ce-1700-0000-7537-b8dff7110000 pid=4599 clone guuid=b2e1a0ce-1700-0000-7537-b8dff7110000 pid=4599->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9b75e3ce-1700-0000-7537-b8dffa110000 pid=4602 /tmp/WTF write-file guuid=b2e1a0ce-1700-0000-7537-b8dff7110000 pid=4599->guuid=9b75e3ce-1700-0000-7537-b8dffa110000 pid=4602 clone guuid=f6a4aece-1700-0000-7537-b8dff8110000 pid=4600->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=233beece-1700-0000-7537-b8dffb110000 pid=4603 /tmp/WTF guuid=9b75e3ce-1700-0000-7537-b8dffa110000 pid=4602->guuid=233beece-1700-0000-7537-b8dffb110000 pid=4603 clone guuid=cc17f7ce-1700-0000-7537-b8dffc110000 pid=4604 /tmp/WTF guuid=9b75e3ce-1700-0000-7537-b8dffa110000 pid=4602->guuid=cc17f7ce-1700-0000-7537-b8dffc110000 pid=4604 clone guuid=28c750d7-1700-0000-7537-b8df12120000 pid=4626->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=95c874ee-1700-0000-7537-b8df6d120000 pid=4717 /tmp/WTF net write-file zombie guuid=504539e1-1700-0000-7537-b8df46120000 pid=4678->guuid=95c874ee-1700-0000-7537-b8df6d120000 pid=4717 clone guuid=95c874ee-1700-0000-7537-b8df6d120000 pid=4717->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=bbcaa2ee-1700-0000-7537-b8df70120000 pid=4720 /tmp/WTF write-file guuid=95c874ee-1700-0000-7537-b8df6d120000 pid=4717->guuid=bbcaa2ee-1700-0000-7537-b8df70120000 pid=4720 clone guuid=9ff386ee-1700-0000-7537-b8df6e120000 pid=4718->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=b78fb1ee-1700-0000-7537-b8df71120000 pid=4721 /tmp/WTF guuid=bbcaa2ee-1700-0000-7537-b8df70120000 pid=4720->guuid=b78fb1ee-1700-0000-7537-b8df71120000 pid=4721 clone guuid=2ff3b6ee-1700-0000-7537-b8df72120000 pid=4722 /tmp/WTF guuid=bbcaa2ee-1700-0000-7537-b8df70120000 pid=4720->guuid=2ff3b6ee-1700-0000-7537-b8df72120000 pid=4722 clone guuid=ffac66f8-1700-0000-7537-b8df9b120000 pid=4763->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=8f56a04c-1800-0000-7537-b8dfa3130000 pid=5027 /tmp/WTF net write-file zombie guuid=6ff7653f-1800-0000-7537-b8df6e130000 pid=4974->guuid=8f56a04c-1800-0000-7537-b8dfa3130000 pid=5027 clone guuid=8f56a04c-1800-0000-7537-b8dfa3130000 pid=5027->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e7a4d84c-1800-0000-7537-b8dfa5130000 pid=5029 /tmp/WTF write-file guuid=8f56a04c-1800-0000-7537-b8dfa3130000 pid=5027->guuid=e7a4d84c-1800-0000-7537-b8dfa5130000 pid=5029 clone guuid=c524ab4c-1800-0000-7537-b8dfa4130000 pid=5028->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=c8ffe34c-1800-0000-7537-b8dfa6130000 pid=5030 /tmp/WTF guuid=e7a4d84c-1800-0000-7537-b8dfa5130000 pid=5029->guuid=c8ffe34c-1800-0000-7537-b8dfa6130000 pid=5030 clone guuid=3a58eb4c-1800-0000-7537-b8dfa7130000 pid=5031 /tmp/WTF guuid=e7a4d84c-1800-0000-7537-b8dfa5130000 pid=5029->guuid=3a58eb4c-1800-0000-7537-b8dfa7130000 pid=5031 clone guuid=1c360459-1800-0000-7537-b8dfd3130000 pid=5075->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=6cbf6070-1800-0000-7537-b8df16140000 pid=5142 /tmp/WTF net write-file zombie guuid=bff02963-1800-0000-7537-b8dff6130000 pid=5110->guuid=6cbf6070-1800-0000-7537-b8df16140000 pid=5142 clone guuid=6cbf6070-1800-0000-7537-b8df16140000 pid=5142->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=abc99970-1800-0000-7537-b8df19140000 pid=5145 /tmp/WTF write-file guuid=6cbf6070-1800-0000-7537-b8df16140000 pid=5142->guuid=abc99970-1800-0000-7537-b8df19140000 pid=5145 clone guuid=7fa76970-1800-0000-7537-b8df17140000 pid=5143->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=4122ab70-1800-0000-7537-b8df1a140000 pid=5146 /tmp/WTF guuid=abc99970-1800-0000-7537-b8df19140000 pid=5145->guuid=4122ab70-1800-0000-7537-b8df1a140000 pid=5146 clone guuid=e6a0b170-1800-0000-7537-b8df1b140000 pid=5147 /tmp/WTF guuid=abc99970-1800-0000-7537-b8df19140000 pid=5145->guuid=e6a0b170-1800-0000-7537-b8df1b140000 pid=5147 clone guuid=5984e27b-1800-0000-7537-b8df53140000 pid=5203->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=975e0299-1800-0000-7537-b8df5a140000 pid=5210 /tmp/WTF net write-file zombie guuid=18397e8b-1800-0000-7537-b8df56140000 pid=5206->guuid=975e0299-1800-0000-7537-b8df5a140000 pid=5210 clone guuid=975e0299-1800-0000-7537-b8df5a140000 pid=5210->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7185db9a-1800-0000-7537-b8df5c140000 pid=5212 /tmp/WTF write-file guuid=975e0299-1800-0000-7537-b8df5a140000 pid=5210->guuid=7185db9a-1800-0000-7537-b8df5c140000 pid=5212 clone guuid=5d03b39a-1800-0000-7537-b8df5b140000 pid=5211->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=462ae99a-1800-0000-7537-b8df5d140000 pid=5213 /tmp/WTF guuid=7185db9a-1800-0000-7537-b8df5c140000 pid=5212->guuid=462ae99a-1800-0000-7537-b8df5d140000 pid=5213 clone guuid=c01df49a-1800-0000-7537-b8df5e140000 pid=5214 /tmp/WTF guuid=7185db9a-1800-0000-7537-b8df5c140000 pid=5212->guuid=c01df49a-1800-0000-7537-b8df5e140000 pid=5214 clone guuid=580fdba3-1800-0000-7537-b8df67140000 pid=5223->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=246e40bc-1800-0000-7537-b8df6b140000 pid=5227 /tmp/WTF net write-file zombie guuid=dee8e2ae-1800-0000-7537-b8df6a140000 pid=5226->guuid=246e40bc-1800-0000-7537-b8df6b140000 pid=5227 clone guuid=246e40bc-1800-0000-7537-b8df6b140000 pid=5227->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e4997cbc-1800-0000-7537-b8df6d140000 pid=5229 /tmp/WTF write-file guuid=246e40bc-1800-0000-7537-b8df6b140000 pid=5227->guuid=e4997cbc-1800-0000-7537-b8df6d140000 pid=5229 clone guuid=e43b56bc-1800-0000-7537-b8df6c140000 pid=5228->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=173394bc-1800-0000-7537-b8df6e140000 pid=5230 /tmp/WTF guuid=e4997cbc-1800-0000-7537-b8df6d140000 pid=5229->guuid=173394bc-1800-0000-7537-b8df6e140000 pid=5230 clone guuid=ec25a9bc-1800-0000-7537-b8df6f140000 pid=5231 /tmp/WTF guuid=e4997cbc-1800-0000-7537-b8df6d140000 pid=5229->guuid=ec25a9bc-1800-0000-7537-b8df6f140000 pid=5231 clone guuid=f6425ac7-1800-0000-7537-b8df70140000 pid=5232->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=572b3ee6-1800-0000-7537-b8df74140000 pid=5236 /tmp/WTF net write-file zombie guuid=941059d8-1800-0000-7537-b8df73140000 pid=5235->guuid=572b3ee6-1800-0000-7537-b8df74140000 pid=5236 clone guuid=572b3ee6-1800-0000-7537-b8df74140000 pid=5236->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237 /tmp/WTF net send-data write-config write-file guuid=572b3ee6-1800-0000-7537-b8df74140000 pid=5236->guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237 clone guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con ae4ae37b-03d1-540e-ac1d-11e74f766f2a 46.151.182.200:33769 guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->ae4ae37b-03d1-540e-ac1d-11e74f766f2a send: 604B a7eef23b-3bd8-5389-bd5c-62af93207a18 127.0.0.1:9 guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->a7eef23b-3bd8-5389-bd5c-62af93207a18 send: 4188160B guuid=85f4b7e6-1800-0000-7537-b8df76140000 pid=5238 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=85f4b7e6-1800-0000-7537-b8df76140000 pid=5238 clone guuid=6f13cce6-1800-0000-7537-b8df77140000 pid=5239 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=6f13cce6-1800-0000-7537-b8df77140000 pid=5239 clone guuid=e3b71166-1900-0000-7537-b8df78140000 pid=5240 /usr/bin/systemctl guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=e3b71166-1900-0000-7537-b8df78140000 pid=5240 execve guuid=724dc8a1-1900-0000-7537-b8df80140000 pid=5248 /usr/bin/systemctl guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=724dc8a1-1900-0000-7537-b8df80140000 pid=5248 execve guuid=f8c520fb-1900-0000-7537-b8df81140000 pid=5249 /usr/bin/systemctl guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=f8c520fb-1900-0000-7537-b8df81140000 pid=5249 execve guuid=51a41c37-1a00-0000-7537-b8df82140000 pid=5250 /usr/bin/systemctl guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=51a41c37-1a00-0000-7537-b8df82140000 pid=5250 execve guuid=00a84b73-1a00-0000-7537-b8df83140000 pid=5251 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=00a84b73-1a00-0000-7537-b8df83140000 pid=5251 clone guuid=3a75ffae-1a00-0000-7537-b8df8a140000 pid=5258 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=3a75ffae-1a00-0000-7537-b8df8a140000 pid=5258 clone guuid=0efcf5ed-1a00-0000-7537-b8df9c140000 pid=5276 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=0efcf5ed-1a00-0000-7537-b8df9c140000 pid=5276 clone guuid=d24aa029-1b00-0000-7537-b8dfa6140000 pid=5286 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=d24aa029-1b00-0000-7537-b8dfa6140000 pid=5286 clone guuid=52c35165-1b00-0000-7537-b8dfa7140000 pid=5287 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=52c35165-1b00-0000-7537-b8dfa7140000 pid=5287 clone guuid=f1590ea1-1b00-0000-7537-b8dfa8140000 pid=5288 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=f1590ea1-1b00-0000-7537-b8dfa8140000 pid=5288 clone guuid=1d2c4ca1-1b00-0000-7537-b8dfa9140000 pid=5289 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=1d2c4ca1-1b00-0000-7537-b8dfa9140000 pid=5289 clone guuid=fd73cef1-1b00-0000-7537-b8dfaa140000 pid=5290 /etc/init.d/network-dispatch guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=fd73cef1-1b00-0000-7537-b8dfaa140000 pid=5290 execve guuid=529a5334-1c00-0000-7537-b8dfab140000 pid=5291 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=529a5334-1c00-0000-7537-b8dfab140000 pid=5291 clone guuid=1d2cd774-1c00-0000-7537-b8dfac140000 pid=5292 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=1d2cd774-1c00-0000-7537-b8dfac140000 pid=5292 clone guuid=80600175-1c00-0000-7537-b8dfae140000 pid=5294 /tmp/WTF guuid=05d495e6-1800-0000-7537-b8df75140000 pid=5237->guuid=80600175-1c00-0000-7537-b8dfae140000 pid=5294 clone guuid=d2bcec74-1c00-0000-7537-b8dfad140000 pid=5293 /tmp/WTF dns net send-data guuid=1d2cd774-1c00-0000-7537-b8dfac140000 pid=5292->guuid=d2bcec74-1c00-0000-7537-b8dfad140000 pid=5293 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=d2bcec74-1c00-0000-7537-b8dfad140000 pid=5293->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 360B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/10d4a7e6b370aba96dab9da75d56b3fd3e53938423cd7f302790b59fc42b3f97
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10d4a7e6b370aba96dab9da75d56b3fd3e53938423cd7f302790b59fc42b3f97/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-09-01 22:21:23 UTC
File Type:
Text (Shell)
AV detection:
23 of 38 (60.53%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cdkkpzvtocv2s3nltwtv2vvt7u7fhe4eepgx6mbhsc2z7rblh6lq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260901-19rlqafa66/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to shm directory
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Creates a desktop entry file
Modifies Bash startup script
Creates/modifies Cron job
Creates/modifies environment variables
Deletes log files
Modifies init.d
Modifies rc script
Modifies systemd
Write file to user bin folder
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Traces itself
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/10d4a7e6b370/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10d4a7e6b370aba96dab9da75d56b3fd3e53938423cd7f302790b59fc42b3f97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 10d4a7e6b370aba96dab9da75d56b3fd3e53938423cd7f302790b59fc42b3f97

(this sample)

Mirai

elf c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d

  
URLhaus
https://urlhaus.abuse.ch/url/3910549/
  
Delivery method
Distributed via web download
  
Dropping
MD5 c4d00ea7e5fddfc2323e9b7dd7afe177
  
Dropping
SHA256 c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d

Comments