🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d536e73ce5be5ecf4eba0c94c14fe9ed7272eab92fea0f9948c113830ad9fc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d536e73ce5be5ecf4eba0c94c14fe9ed7272eab92fea0f9948c113830ad9fc5
SHA3-384 hash: 52c920ba0bd67c97911ef16ebaa5c883b611ed8cdac08117d3c2e511c6f3daa81545aab4164282fb5ef04a1e94dbc5b0
SHA1 hash: cc054a1cd6b05374fcbefe032caac8ac54ec5630
MD5 hash: d899a9c034976c6efde6d6f83fc7fb29
humanhash: zulu-foxtrot-equal-winner
File name:telnet.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'834 bytes
First seen:2026-10-06 05:09:23 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:5kfH0dthNaKG6lODOmJGfaiK1/k1YTVbmVb1LB9N0XN0Kvth2e77ZLB0CXwlv+CX:+fEtFwDzJ+KJkkgz2X2MtJZhe
TLSH T1A931038D22B07E71CD4DCF0AB0E542D6A647D5C8A2930AF2E4C23CB179D9F80B855A36
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://94.154.43.242/iran.x86_647bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed Mirai94-154-43-242 elf ua-wget
http://94.154.43.242/iran.aarch64n/an/aelf iot
http://94.154.43.242/iran.m68kn/an/aelf iot
http://94.154.43.242/iran.mipsn/an/aelf iot
http://94.154.43.242/iran.mipseln/an/aelf iot
http://94.154.43.242/iran.powerpcn/an/aelf iot
http://94.154.43.242/iran.sparcn/an/aelf iot
http://94.154.43.242/iran.sh4n/an/aelf iot
http://94.154.43.242/iran.arc45ac99a83d99879ba0cba10fce2f81f772f67e44ef3df726b4c074c2d7a5f230 Mirai94-154-43-242 elf ua-wget
http://94.154.43.242/iran.i486e09fe1bcfefb15f916979a7bb04a1a570ed999e2e751f7d80266502727e2b6b2 Mirai94-154-43-242 elf ua-wget
http://94.154.43.242/iran.armv4ln/an/aelf iot
http://94.154.43.242/iran.armv5ln/an/aelf iot
http://94.154.43.242/iran.armv6ln/an/aelf iot
http://94.154.43.242/iran.armv7ln/an/aelf iot

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-06T03:18:00Z UTC
Last seen:
2026-10-07T21:41:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2d536e73ce5be5ecf4eba0c94c14fe9ed7272eab92fea0f9948c113830ad9fc5/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a9e7e6f1-d070-4b9f-9a8a-50a3a203e300
Behavior Graph:
Download SVG
%3 guuid=bbf858fd-1c00-0000-30d1-0348a40c0000 pid=3236 /usr/bin/sudo guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247 /tmp/sample.bin guuid=bbf858fd-1c00-0000-30d1-0348a40c0000 pid=3236->guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247 execve guuid=33bd8204-1d00-0000-30d1-0348b20c0000 pid=3250 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=33bd8204-1d00-0000-30d1-0348b20c0000 pid=3250 execve guuid=cc956413-1d00-0000-30d1-0348c40c0000 pid=3268 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=cc956413-1d00-0000-30d1-0348c40c0000 pid=3268 execve guuid=05836014-1d00-0000-30d1-0348c70c0000 pid=3271 /home/sandbox/x86_64 guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=05836014-1d00-0000-30d1-0348c70c0000 pid=3271 execve guuid=89e94616-1d00-0000-30d1-0348cc0c0000 pid=3276 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=89e94616-1d00-0000-30d1-0348cc0c0000 pid=3276 execve guuid=5612c41f-1d00-0000-30d1-0348e10c0000 pid=3297 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=5612c41f-1d00-0000-30d1-0348e10c0000 pid=3297 execve guuid=551c1d20-1d00-0000-30d1-0348e30c0000 pid=3299 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=551c1d20-1d00-0000-30d1-0348e30c0000 pid=3299 clone guuid=a114cf21-1d00-0000-30d1-0348e90c0000 pid=3305 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=a114cf21-1d00-0000-30d1-0348e90c0000 pid=3305 execve guuid=1b7a3129-1d00-0000-30d1-0348fa0c0000 pid=3322 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=1b7a3129-1d00-0000-30d1-0348fa0c0000 pid=3322 execve guuid=3fd19529-1d00-0000-30d1-0348fc0c0000 pid=3324 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=3fd19529-1d00-0000-30d1-0348fc0c0000 pid=3324 clone guuid=b8b3b92a-1d00-0000-30d1-0348000d0000 pid=3328 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=b8b3b92a-1d00-0000-30d1-0348000d0000 pid=3328 execve guuid=5869ca33-1d00-0000-30d1-03480f0d0000 pid=3343 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=5869ca33-1d00-0000-30d1-03480f0d0000 pid=3343 execve guuid=fdd17a34-1d00-0000-30d1-0348110d0000 pid=3345 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=fdd17a34-1d00-0000-30d1-0348110d0000 pid=3345 clone guuid=87367d35-1d00-0000-30d1-0348160d0000 pid=3350 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=87367d35-1d00-0000-30d1-0348160d0000 pid=3350 execve guuid=b445a13a-1d00-0000-30d1-0348220d0000 pid=3362 /usr/bin/curl net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=b445a13a-1d00-0000-30d1-0348220d0000 pid=3362 execve guuid=ceb6814b-1d00-0000-30d1-0348400d0000 pid=3392 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=ceb6814b-1d00-0000-30d1-0348400d0000 pid=3392 execve guuid=665c634c-1d00-0000-30d1-0348420d0000 pid=3394 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=665c634c-1d00-0000-30d1-0348420d0000 pid=3394 clone guuid=f2ee064e-1d00-0000-30d1-0348490d0000 pid=3401 /usr/bin/wget net guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=f2ee064e-1d00-0000-30d1-0348490d0000 pid=3401 execve guuid=69890f52-1d00-0000-30d1-03484b0d0000 pid=3403 /usr/bin/curl net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=69890f52-1d00-0000-30d1-03484b0d0000 pid=3403 execve guuid=9a9baa5c-1d00-0000-30d1-0348530d0000 pid=3411 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=9a9baa5c-1d00-0000-30d1-0348530d0000 pid=3411 execve guuid=8504995f-1d00-0000-30d1-03485a0d0000 pid=3418 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=8504995f-1d00-0000-30d1-03485a0d0000 pid=3418 clone guuid=45e64762-1d00-0000-30d1-03485d0d0000 pid=3421 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=45e64762-1d00-0000-30d1-03485d0d0000 pid=3421 execve guuid=a5be9869-1d00-0000-30d1-0348660d0000 pid=3430 /usr/bin/curl net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=a5be9869-1d00-0000-30d1-0348660d0000 pid=3430 execve guuid=a7120470-1d00-0000-30d1-0348750d0000 pid=3445 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=a7120470-1d00-0000-30d1-0348750d0000 pid=3445 execve guuid=de696370-1d00-0000-30d1-0348770d0000 pid=3447 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=de696370-1d00-0000-30d1-0348770d0000 pid=3447 clone guuid=6564ff70-1d00-0000-30d1-03487b0d0000 pid=3451 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=6564ff70-1d00-0000-30d1-03487b0d0000 pid=3451 execve guuid=4ff89c77-1d00-0000-30d1-0348810d0000 pid=3457 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=4ff89c77-1d00-0000-30d1-0348810d0000 pid=3457 execve guuid=c2db0378-1d00-0000-30d1-0348830d0000 pid=3459 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=c2db0378-1d00-0000-30d1-0348830d0000 pid=3459 clone guuid=5d6dd678-1d00-0000-30d1-0348860d0000 pid=3462 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=5d6dd678-1d00-0000-30d1-0348860d0000 pid=3462 execve guuid=88190881-1d00-0000-30d1-0348990d0000 pid=3481 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=88190881-1d00-0000-30d1-0348990d0000 pid=3481 execve guuid=bd05fc81-1d00-0000-30d1-03489c0d0000 pid=3484 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=bd05fc81-1d00-0000-30d1-03489c0d0000 pid=3484 clone guuid=94695483-1d00-0000-30d1-0348a20d0000 pid=3490 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=94695483-1d00-0000-30d1-0348a20d0000 pid=3490 execve guuid=f385538a-1d00-0000-30d1-0348ae0d0000 pid=3502 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=f385538a-1d00-0000-30d1-0348ae0d0000 pid=3502 execve guuid=6338908a-1d00-0000-30d1-0348af0d0000 pid=3503 /home/sandbox/i486 guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=6338908a-1d00-0000-30d1-0348af0d0000 pid=3503 execve guuid=15fd478c-1d00-0000-30d1-0348b20d0000 pid=3506 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=15fd478c-1d00-0000-30d1-0348b20d0000 pid=3506 execve guuid=0f728e92-1d00-0000-30d1-0348c40d0000 pid=3524 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=0f728e92-1d00-0000-30d1-0348c40d0000 pid=3524 execve guuid=71f7e192-1d00-0000-30d1-0348c50d0000 pid=3525 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=71f7e192-1d00-0000-30d1-0348c50d0000 pid=3525 clone guuid=97a1b293-1d00-0000-30d1-0348c90d0000 pid=3529 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=97a1b293-1d00-0000-30d1-0348c90d0000 pid=3529 execve guuid=4065089a-1d00-0000-30d1-0348d70d0000 pid=3543 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=4065089a-1d00-0000-30d1-0348d70d0000 pid=3543 execve guuid=c054e49a-1d00-0000-30d1-0348d90d0000 pid=3545 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=c054e49a-1d00-0000-30d1-0348d90d0000 pid=3545 clone guuid=ea71009c-1d00-0000-30d1-0348dd0d0000 pid=3549 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=ea71009c-1d00-0000-30d1-0348dd0d0000 pid=3549 execve guuid=48d40aa3-1d00-0000-30d1-0348e70d0000 pid=3559 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=48d40aa3-1d00-0000-30d1-0348e70d0000 pid=3559 execve guuid=09bb65a3-1d00-0000-30d1-0348e90d0000 pid=3561 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=09bb65a3-1d00-0000-30d1-0348e90d0000 pid=3561 clone guuid=eca301a4-1d00-0000-30d1-0348ec0d0000 pid=3564 /usr/bin/wget net send-data write-file guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=eca301a4-1d00-0000-30d1-0348ec0d0000 pid=3564 execve guuid=b13729ab-1d00-0000-30d1-0348fa0d0000 pid=3578 /usr/bin/chmod guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=b13729ab-1d00-0000-30d1-0348fa0d0000 pid=3578 execve guuid=3e6684ab-1d00-0000-30d1-0348fb0d0000 pid=3579 /usr/bin/dash guuid=85da4803-1d00-0000-30d1-0348af0c0000 pid=3247->guuid=3e6684ab-1d00-0000-30d1-0348fb0d0000 pid=3579 clone 02e774cd-3421-5bf6-8c1a-525c5c79b412 94.154.43.242:80 guuid=33bd8204-1d00-0000-30d1-0348b20c0000 pid=3250->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 139B guuid=c4cc0b16-1d00-0000-30d1-0348ca0c0000 pid=3274 /home/sandbox/x86_64 zombie guuid=05836014-1d00-0000-30d1-0348c70c0000 pid=3271->guuid=c4cc0b16-1d00-0000-30d1-0348ca0c0000 pid=3274 clone guuid=f2455216-1d00-0000-30d1-0348cd0c0000 pid=3277 /home/sandbox/x86_64 write-config zombie guuid=c4cc0b16-1d00-0000-30d1-0348ca0c0000 pid=3274->guuid=f2455216-1d00-0000-30d1-0348cd0c0000 pid=3277 clone guuid=89e94616-1d00-0000-30d1-0348cc0c0000 pid=3276->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 140B guuid=5ad0b616-1d00-0000-30d1-0348ce0c0000 pid=3278 /home/sandbox/x86_64 net send-data guuid=f2455216-1d00-0000-30d1-0348cd0c0000 pid=3277->guuid=5ad0b616-1d00-0000-30d1-0348ce0c0000 pid=3278 clone f58f5b1c-bd27-5369-b91a-8202db930d9c 94.154.43.242:6666 guuid=5ad0b616-1d00-0000-30d1-0348ce0c0000 pid=3278->f58f5b1c-bd27-5369-b91a-8202db930d9c send: 13B guuid=1154c716-1d00-0000-30d1-0348cf0c0000 pid=3279 /home/sandbox/x86_64 guuid=5ad0b616-1d00-0000-30d1-0348ce0c0000 pid=3278->guuid=1154c716-1d00-0000-30d1-0348cf0c0000 pid=3279 clone guuid=b8d7ce16-1d00-0000-30d1-0348d00c0000 pid=3280 /home/sandbox/x86_64 guuid=1154c716-1d00-0000-30d1-0348cf0c0000 pid=3279->guuid=b8d7ce16-1d00-0000-30d1-0348d00c0000 pid=3280 clone guuid=a114cf21-1d00-0000-30d1-0348e90c0000 pid=3305->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 137B guuid=b8b3b92a-1d00-0000-30d1-0348000d0000 pid=3328->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 137B guuid=87367d35-1d00-0000-30d1-0348160d0000 pid=3350->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 139B guuid=b445a13a-1d00-0000-30d1-0348220d0000 pid=3362->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 88B guuid=f2ee064e-1d00-0000-30d1-0348490d0000 pid=3401->02e774cd-3421-5bf6-8c1a-525c5c79b412 con guuid=69890f52-1d00-0000-30d1-03484b0d0000 pid=3403->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 89B guuid=45e64762-1d00-0000-30d1-03485d0d0000 pid=3421->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 138B guuid=a5be9869-1d00-0000-30d1-0348660d0000 pid=3430->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 87B guuid=6564ff70-1d00-0000-30d1-03487b0d0000 pid=3451->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 136B guuid=5d6dd678-1d00-0000-30d1-0348860d0000 pid=3462->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 136B guuid=94695483-1d00-0000-30d1-0348a20d0000 pid=3490->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 137B guuid=3ca2368c-1d00-0000-30d1-0348b10d0000 pid=3505 /home/sandbox/i486 guuid=6338908a-1d00-0000-30d1-0348af0d0000 pid=3503->guuid=3ca2368c-1d00-0000-30d1-0348b10d0000 pid=3505 clone guuid=d89c4b8c-1d00-0000-30d1-0348b30d0000 pid=3507 /home/sandbox/i486 write-config guuid=3ca2368c-1d00-0000-30d1-0348b10d0000 pid=3505->guuid=d89c4b8c-1d00-0000-30d1-0348b30d0000 pid=3507 clone guuid=15fd478c-1d00-0000-30d1-0348b20d0000 pid=3506->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 139B guuid=2fef618c-1d00-0000-30d1-0348b40d0000 pid=3508 /home/sandbox/i486 net send-data guuid=d89c4b8c-1d00-0000-30d1-0348b30d0000 pid=3507->guuid=2fef618c-1d00-0000-30d1-0348b40d0000 pid=3508 clone guuid=2fef618c-1d00-0000-30d1-0348b40d0000 pid=3508->f58f5b1c-bd27-5369-b91a-8202db930d9c send: 191B guuid=2fef618c-1d00-0000-30d1-0348b40d0000 pid=3509 /home/sandbox/i486 guuid=2fef618c-1d00-0000-30d1-0348b40d0000 pid=3508->guuid=2fef618c-1d00-0000-30d1-0348b40d0000 pid=3509 clone guuid=97a1b293-1d00-0000-30d1-0348c90d0000 pid=3529->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 139B guuid=ea71009c-1d00-0000-30d1-0348dd0d0000 pid=3549->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 139B guuid=eca301a4-1d00-0000-30d1-0348ec0d0000 pid=3564->02e774cd-3421-5bf6-8c1a-525c5c79b412 send: 139B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2d536e73ce5be5ecf4eba0c94c14fe9ed7272eab92fea0f9948c113830ad9fc5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d536e73ce5be5ecf4eba0c94c14fe9ed7272eab92fea0f9948c113830ad9fc5/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-10-06 05:08:34 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fvjw446olps6z5hludeuyfh6t3lsolvlsl7kb6murqitqmfnt7cq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/261006-ftyd4sda77/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Enumerates running processes
Modifies init.d
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
Gafgyt
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2d536e73ce5b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/2d536e73ce5be5ecf4eba0c94c14fe9ed7272eab92fea0f9948c113830ad9fc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 2d536e73ce5be5ecf4eba0c94c14fe9ed7272eab92fea0f9948c113830ad9fc5

(this sample)

Mirai

elf 7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed

  
URLhaus
https://urlhaus.abuse.ch/url/3929689/
  
Delivery method
Distributed via web download
  
Dropping
MD5 b5644a585e5a60a66f4fee4ba04b7a80
  
Dropping
SHA256 7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed
  
URLhaus
https://urlhaus.abuse.ch/url/3943809/

Comments