🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1445fc404539ff262b568562c083ec11ff1c06b5c4fe7ee300c043c6bba60b7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1445fc404539ff262b568562c083ec11ff1c06b5c4fe7ee300c043c6bba60b7f
SHA3-384 hash: 09716213df2ae9115e376506d9663ae5b8c366d87a259e3249d1a7a93354cbdc7addf35b84fdc21ae86edb208b85a5cf
SHA1 hash: 7c448dd81a08475a376e857a1529800e03e77a00
MD5 hash: 7921c1aa3ffde420706990cded6dde24
humanhash: fix-ceiling-winter-connecticut
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'596 bytes
First seen:2026-06-17 21:05:39 UTC
Last seen:2026-06-18 19:43:12 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:U46IJbebql166f45I65fyECFC65D164JMEOPP+6PxNYY0lpdE6pdDY6Go6rElM6Q:hfOpfYC65tME+1jYvZY6czK2JaFiIqF
TLSH T13831448E06212E358253DAEF7BA7324CB05C56FB399BD7608C4C1FB983489C87551F85
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/378006n/an/aua-wget
http://5.182.210.61/a4e6c4n/an/aua-wget
http://5.182.210.61/bad254n/an/aua-wget
http://5.182.210.61/c6d6e9n/an/aua-wget
http://5.182.210.61/3aaa35n/an/aua-wget
http://5.182.210.61/028bc9n/an/aua-wget
http://5.182.210.61/9fd15cn/an/aua-wget
http://5.182.210.61/f778bbn/an/aua-wget
http://5.182.210.61/60706en/an/aua-wget
http://5.182.210.61/66f22dn/an/aua-wget
http://5.182.210.61/b8c6cbn/an/aua-wget
http://5.182.210.61/f78083n/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
94
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a330c3d9799578a6c3e1987/reports/df07528f-6779-46a7-a701-1bb1b4afaad2/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-17T18:16:00Z UTC
Last seen:
2026-06-19T03:56:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/1445fc404539ff262b568562c083ec11ff1c06b5c4fe7ee300c043c6bba60b7f/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4a9eac84-2c0c-4988-87c6-5ebdebf8961e
Behavior Graph:
Download SVG
%3 guuid=68b23a6d-1900-0000-c271-d55e2f140000 pid=5167 /usr/bin/sudo guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168 /tmp/sample.bin guuid=68b23a6d-1900-0000-c271-d55e2f140000 pid=5167->guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168 execve guuid=25acca70-1900-0000-c271-d55e31140000 pid=5169 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=25acca70-1900-0000-c271-d55e31140000 pid=5169 execve guuid=5cadcea4-1900-0000-c271-d55e32140000 pid=5170 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=5cadcea4-1900-0000-c271-d55e32140000 pid=5170 execve guuid=cb1cb1d7-1900-0000-c271-d55e34140000 pid=5172 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=cb1cb1d7-1900-0000-c271-d55e34140000 pid=5172 execve guuid=74ec3ad8-1900-0000-c271-d55e35140000 pid=5173 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=74ec3ad8-1900-0000-c271-d55e35140000 pid=5173 clone guuid=0c19fbd8-1900-0000-c271-d55e39140000 pid=5177 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=0c19fbd8-1900-0000-c271-d55e39140000 pid=5177 execve guuid=790b87d9-1900-0000-c271-d55e3a140000 pid=5178 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=790b87d9-1900-0000-c271-d55e3a140000 pid=5178 execve guuid=1a6ceed9-1900-0000-c271-d55e3b140000 pid=5179 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=1a6ceed9-1900-0000-c271-d55e3b140000 pid=5179 execve guuid=54ae45dd-1900-0000-c271-d55e40140000 pid=5184 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=54ae45dd-1900-0000-c271-d55e40140000 pid=5184 execve guuid=bb6d60e3-1900-0000-c271-d55e41140000 pid=5185 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=bb6d60e3-1900-0000-c271-d55e41140000 pid=5185 execve guuid=03d7c3e3-1900-0000-c271-d55e42140000 pid=5186 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=03d7c3e3-1900-0000-c271-d55e42140000 pid=5186 clone guuid=403115e4-1900-0000-c271-d55e44140000 pid=5188 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=403115e4-1900-0000-c271-d55e44140000 pid=5188 execve guuid=94a172e4-1900-0000-c271-d55e45140000 pid=5189 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=94a172e4-1900-0000-c271-d55e45140000 pid=5189 execve guuid=5fa3cae4-1900-0000-c271-d55e46140000 pid=5190 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=5fa3cae4-1900-0000-c271-d55e46140000 pid=5190 execve guuid=b4a38ee7-1900-0000-c271-d55e47140000 pid=5191 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=b4a38ee7-1900-0000-c271-d55e47140000 pid=5191 execve guuid=59d5b6eb-1900-0000-c271-d55e48140000 pid=5192 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=59d5b6eb-1900-0000-c271-d55e48140000 pid=5192 execve guuid=c2b32dec-1900-0000-c271-d55e49140000 pid=5193 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=c2b32dec-1900-0000-c271-d55e49140000 pid=5193 clone guuid=eb4e89ec-1900-0000-c271-d55e4b140000 pid=5195 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=eb4e89ec-1900-0000-c271-d55e4b140000 pid=5195 execve guuid=cce5ffec-1900-0000-c271-d55e4c140000 pid=5196 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=cce5ffec-1900-0000-c271-d55e4c140000 pid=5196 execve guuid=4d9a67ed-1900-0000-c271-d55e4d140000 pid=5197 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=4d9a67ed-1900-0000-c271-d55e4d140000 pid=5197 execve guuid=a03c9df0-1900-0000-c271-d55e4e140000 pid=5198 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=a03c9df0-1900-0000-c271-d55e4e140000 pid=5198 execve guuid=16ce64f6-1900-0000-c271-d55e4f140000 pid=5199 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=16ce64f6-1900-0000-c271-d55e4f140000 pid=5199 execve guuid=4d26c8f6-1900-0000-c271-d55e50140000 pid=5200 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=4d26c8f6-1900-0000-c271-d55e50140000 pid=5200 clone guuid=e4c920f7-1900-0000-c271-d55e52140000 pid=5202 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=e4c920f7-1900-0000-c271-d55e52140000 pid=5202 execve guuid=6ee4cdf7-1900-0000-c271-d55e53140000 pid=5203 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=6ee4cdf7-1900-0000-c271-d55e53140000 pid=5203 execve guuid=661e76f8-1900-0000-c271-d55e54140000 pid=5204 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=661e76f8-1900-0000-c271-d55e54140000 pid=5204 execve guuid=a5b8c2fb-1900-0000-c271-d55e55140000 pid=5205 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=a5b8c2fb-1900-0000-c271-d55e55140000 pid=5205 execve guuid=cde8b000-1a00-0000-c271-d55e56140000 pid=5206 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=cde8b000-1a00-0000-c271-d55e56140000 pid=5206 execve guuid=ffe33901-1a00-0000-c271-d55e57140000 pid=5207 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=ffe33901-1a00-0000-c271-d55e57140000 pid=5207 clone guuid=a20ecb01-1a00-0000-c271-d55e59140000 pid=5209 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=a20ecb01-1a00-0000-c271-d55e59140000 pid=5209 execve guuid=b43d5102-1a00-0000-c271-d55e5a140000 pid=5210 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=b43d5102-1a00-0000-c271-d55e5a140000 pid=5210 execve guuid=90bbce02-1a00-0000-c271-d55e5b140000 pid=5211 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=90bbce02-1a00-0000-c271-d55e5b140000 pid=5211 execve guuid=8ac56207-1a00-0000-c271-d55e5c140000 pid=5212 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=8ac56207-1a00-0000-c271-d55e5c140000 pid=5212 execve guuid=7c48fb0d-1a00-0000-c271-d55e5d140000 pid=5213 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=7c48fb0d-1a00-0000-c271-d55e5d140000 pid=5213 execve guuid=f737970e-1a00-0000-c271-d55e5e140000 pid=5214 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=f737970e-1a00-0000-c271-d55e5e140000 pid=5214 clone guuid=d8d60a0f-1a00-0000-c271-d55e60140000 pid=5216 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=d8d60a0f-1a00-0000-c271-d55e60140000 pid=5216 execve guuid=0a836c0f-1a00-0000-c271-d55e61140000 pid=5217 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=0a836c0f-1a00-0000-c271-d55e61140000 pid=5217 execve guuid=01fac10f-1a00-0000-c271-d55e62140000 pid=5218 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=01fac10f-1a00-0000-c271-d55e62140000 pid=5218 execve guuid=9d18c012-1a00-0000-c271-d55e63140000 pid=5219 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=9d18c012-1a00-0000-c271-d55e63140000 pid=5219 execve guuid=b76a1318-1a00-0000-c271-d55e64140000 pid=5220 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=b76a1318-1a00-0000-c271-d55e64140000 pid=5220 execve guuid=e3b16118-1a00-0000-c271-d55e65140000 pid=5221 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=e3b16118-1a00-0000-c271-d55e65140000 pid=5221 clone guuid=1390c118-1a00-0000-c271-d55e67140000 pid=5223 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=1390c118-1a00-0000-c271-d55e67140000 pid=5223 execve guuid=4af62019-1a00-0000-c271-d55e68140000 pid=5224 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=4af62019-1a00-0000-c271-d55e68140000 pid=5224 execve guuid=5a0f8119-1a00-0000-c271-d55e69140000 pid=5225 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=5a0f8119-1a00-0000-c271-d55e69140000 pid=5225 execve guuid=06546c1c-1a00-0000-c271-d55e6a140000 pid=5226 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=06546c1c-1a00-0000-c271-d55e6a140000 pid=5226 execve guuid=d56e1a21-1a00-0000-c271-d55e6b140000 pid=5227 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=d56e1a21-1a00-0000-c271-d55e6b140000 pid=5227 execve guuid=24187721-1a00-0000-c271-d55e6c140000 pid=5228 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=24187721-1a00-0000-c271-d55e6c140000 pid=5228 clone guuid=a3050e22-1a00-0000-c271-d55e6e140000 pid=5230 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=a3050e22-1a00-0000-c271-d55e6e140000 pid=5230 execve guuid=e95cc622-1a00-0000-c271-d55e6f140000 pid=5231 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=e95cc622-1a00-0000-c271-d55e6f140000 pid=5231 execve guuid=a9277923-1a00-0000-c271-d55e70140000 pid=5232 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=a9277923-1a00-0000-c271-d55e70140000 pid=5232 execve guuid=9ddf0f28-1a00-0000-c271-d55e71140000 pid=5233 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=9ddf0f28-1a00-0000-c271-d55e71140000 pid=5233 execve guuid=c082442e-1a00-0000-c271-d55e72140000 pid=5234 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=c082442e-1a00-0000-c271-d55e72140000 pid=5234 execve guuid=89f6b62e-1a00-0000-c271-d55e73140000 pid=5235 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=89f6b62e-1a00-0000-c271-d55e73140000 pid=5235 clone guuid=88973c31-1a00-0000-c271-d55e75140000 pid=5237 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=88973c31-1a00-0000-c271-d55e75140000 pid=5237 execve guuid=887db231-1a00-0000-c271-d55e76140000 pid=5238 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=887db231-1a00-0000-c271-d55e76140000 pid=5238 execve guuid=fa002332-1a00-0000-c271-d55e77140000 pid=5239 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=fa002332-1a00-0000-c271-d55e77140000 pid=5239 execve guuid=837baf35-1a00-0000-c271-d55e78140000 pid=5240 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=837baf35-1a00-0000-c271-d55e78140000 pid=5240 execve guuid=8c67e03b-1a00-0000-c271-d55e79140000 pid=5241 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=8c67e03b-1a00-0000-c271-d55e79140000 pid=5241 execve guuid=520b6c3c-1a00-0000-c271-d55e7a140000 pid=5242 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=520b6c3c-1a00-0000-c271-d55e7a140000 pid=5242 clone guuid=4dd0c53c-1a00-0000-c271-d55e7c140000 pid=5244 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=4dd0c53c-1a00-0000-c271-d55e7c140000 pid=5244 execve guuid=a93a1f3d-1a00-0000-c271-d55e7d140000 pid=5245 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=a93a1f3d-1a00-0000-c271-d55e7d140000 pid=5245 execve guuid=2ef9763d-1a00-0000-c271-d55e7e140000 pid=5246 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=2ef9763d-1a00-0000-c271-d55e7e140000 pid=5246 execve guuid=2d3aa740-1a00-0000-c271-d55e7f140000 pid=5247 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=2d3aa740-1a00-0000-c271-d55e7f140000 pid=5247 execve guuid=5ee61e47-1a00-0000-c271-d55e80140000 pid=5248 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=5ee61e47-1a00-0000-c271-d55e80140000 pid=5248 execve guuid=1aee8d47-1a00-0000-c271-d55e81140000 pid=5249 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=1aee8d47-1a00-0000-c271-d55e81140000 pid=5249 clone guuid=bd57e947-1a00-0000-c271-d55e83140000 pid=5251 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=bd57e947-1a00-0000-c271-d55e83140000 pid=5251 execve guuid=26716d48-1a00-0000-c271-d55e84140000 pid=5252 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=26716d48-1a00-0000-c271-d55e84140000 pid=5252 execve guuid=1a15ce48-1a00-0000-c271-d55e85140000 pid=5253 /usr/bin/wget net send-data guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=1a15ce48-1a00-0000-c271-d55e85140000 pid=5253 execve guuid=6c25cc4c-1a00-0000-c271-d55e86140000 pid=5254 /usr/bin/curl net send-data write-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=6c25cc4c-1a00-0000-c271-d55e86140000 pid=5254 execve guuid=1794b852-1a00-0000-c271-d55e87140000 pid=5255 /usr/bin/chmod guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=1794b852-1a00-0000-c271-d55e87140000 pid=5255 execve guuid=f1fd2253-1a00-0000-c271-d55e88140000 pid=5256 /usr/bin/bash guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=f1fd2253-1a00-0000-c271-d55e88140000 pid=5256 clone guuid=0ba98653-1a00-0000-c271-d55e8a140000 pid=5258 /usr/bin/rm delete-file guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=0ba98653-1a00-0000-c271-d55e8a140000 pid=5258 execve guuid=3034f553-1a00-0000-c271-d55e8b140000 pid=5259 /usr/bin/rm guuid=2e1cef6f-1900-0000-c271-d55e30140000 pid=5168->guuid=3034f553-1a00-0000-c271-d55e8b140000 pid=5259 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=25acca70-1900-0000-c271-d55e31140000 pid=5169->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=5cadcea4-1900-0000-c271-d55e32140000 pid=5170->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=6b8b74d8-1900-0000-c271-d55e37140000 pid=5175 /usr/bin/bash guuid=74ec3ad8-1900-0000-c271-d55e35140000 pid=5173->guuid=6b8b74d8-1900-0000-c271-d55e37140000 pid=5175 clone guuid=1a6ceed9-1900-0000-c271-d55e3b140000 pid=5179->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=54ae45dd-1900-0000-c271-d55e40140000 pid=5184->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=1d5be8e3-1900-0000-c271-d55e43140000 pid=5187 /usr/bin/bash guuid=03d7c3e3-1900-0000-c271-d55e42140000 pid=5186->guuid=1d5be8e3-1900-0000-c271-d55e43140000 pid=5187 clone guuid=5fa3cae4-1900-0000-c271-d55e46140000 pid=5190->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=b4a38ee7-1900-0000-c271-d55e47140000 pid=5191->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=5fd558ec-1900-0000-c271-d55e4a140000 pid=5194 /usr/bin/bash guuid=c2b32dec-1900-0000-c271-d55e49140000 pid=5193->guuid=5fd558ec-1900-0000-c271-d55e4a140000 pid=5194 clone guuid=4d9a67ed-1900-0000-c271-d55e4d140000 pid=5197->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a03c9df0-1900-0000-c271-d55e4e140000 pid=5198->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=fbceeef6-1900-0000-c271-d55e51140000 pid=5201 /usr/bin/bash guuid=4d26c8f6-1900-0000-c271-d55e50140000 pid=5200->guuid=fbceeef6-1900-0000-c271-d55e51140000 pid=5201 clone guuid=661e76f8-1900-0000-c271-d55e54140000 pid=5204->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a5b8c2fb-1900-0000-c271-d55e55140000 pid=5205->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=27747601-1a00-0000-c271-d55e58140000 pid=5208 /usr/bin/bash guuid=ffe33901-1a00-0000-c271-d55e57140000 pid=5207->guuid=27747601-1a00-0000-c271-d55e58140000 pid=5208 clone guuid=90bbce02-1a00-0000-c271-d55e5b140000 pid=5211->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8ac56207-1a00-0000-c271-d55e5c140000 pid=5212->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=ee5dd50e-1a00-0000-c271-d55e5f140000 pid=5215 /usr/bin/bash guuid=f737970e-1a00-0000-c271-d55e5e140000 pid=5214->guuid=ee5dd50e-1a00-0000-c271-d55e5f140000 pid=5215 clone guuid=01fac10f-1a00-0000-c271-d55e62140000 pid=5218->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9d18c012-1a00-0000-c271-d55e63140000 pid=5219->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=53238018-1a00-0000-c271-d55e66140000 pid=5222 /usr/bin/bash guuid=e3b16118-1a00-0000-c271-d55e65140000 pid=5221->guuid=53238018-1a00-0000-c271-d55e66140000 pid=5222 clone guuid=5a0f8119-1a00-0000-c271-d55e69140000 pid=5225->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=06546c1c-1a00-0000-c271-d55e6a140000 pid=5226->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=f53d9821-1a00-0000-c271-d55e6d140000 pid=5229 /usr/bin/bash guuid=24187721-1a00-0000-c271-d55e6c140000 pid=5228->guuid=f53d9821-1a00-0000-c271-d55e6d140000 pid=5229 clone guuid=a9277923-1a00-0000-c271-d55e70140000 pid=5232->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9ddf0f28-1a00-0000-c271-d55e71140000 pid=5233->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=2aa00031-1a00-0000-c271-d55e74140000 pid=5236 /usr/bin/bash guuid=89f6b62e-1a00-0000-c271-d55e73140000 pid=5235->guuid=2aa00031-1a00-0000-c271-d55e74140000 pid=5236 clone guuid=fa002332-1a00-0000-c271-d55e77140000 pid=5239->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=837baf35-1a00-0000-c271-d55e78140000 pid=5240->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c3e2953c-1a00-0000-c271-d55e7b140000 pid=5243 /usr/bin/bash guuid=520b6c3c-1a00-0000-c271-d55e7a140000 pid=5242->guuid=c3e2953c-1a00-0000-c271-d55e7b140000 pid=5243 clone guuid=2ef9763d-1a00-0000-c271-d55e7e140000 pid=5246->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=2d3aa740-1a00-0000-c271-d55e7f140000 pid=5247->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=3b17b647-1a00-0000-c271-d55e82140000 pid=5250 /usr/bin/bash guuid=1aee8d47-1a00-0000-c271-d55e81140000 pid=5249->guuid=3b17b647-1a00-0000-c271-d55e82140000 pid=5250 clone guuid=1a15ce48-1a00-0000-c271-d55e85140000 pid=5253->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=6c25cc4c-1a00-0000-c271-d55e86140000 pid=5254->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=2fe44853-1a00-0000-c271-d55e89140000 pid=5257 /usr/bin/bash guuid=f1fd2253-1a00-0000-c271-d55e88140000 pid=5256->guuid=2fe44853-1a00-0000-c271-d55e89140000 pid=5257 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1445fc404539ff262b568562c083ec11ff1c06b5c4fe7ee300c043c6bba60b7f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1445fc404539ff262b568562c083ec11ff1c06b5c4fe7ee300c043c6bba60b7f/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/1445fc404539ff262b568562c083ec11ff1c06b5c4fe7ee300c043c6bba60b7f
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-17 21:06:16 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=crc7yqcfhh7smk2wqvrmba7mch7rybvvyt7h5yyaybb4no5gbn7q._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260617-zxrwaaft81/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/1445fc404539ff262b568562c083ec11ff1c06b5c4fe7ee300c043c6bba60b7f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 1445fc404539ff262b568562c083ec11ff1c06b5c4fe7ee300c043c6bba60b7f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments