MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 314c048ccfd30945314dea4c3764e7bffde5a1d4ac07966f4e05bb9d2c50e615. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 314c048ccfd30945314dea4c3764e7bffde5a1d4ac07966f4e05bb9d2c50e615
SHA3-384 hash: aa1fefcdb064afe7eb9a844db80e3b1cf256a0cf1218334834c9e66030a4b18366671886da92e0d49fb60c84b120ae3b
SHA1 hash: 1b5e79f3aa6bd797d0c0f05e8929b14b616cadef
MD5 hash: b78c9d192d4aae2e5c2d7677b159dc36
humanhash: orange-speaker-enemy-twelve
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-28 02:45:43 UTC
Last seen:2026-08-28 05:19:37 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:a+xaYMg4awB2ZFFq7QAh1BJH3cECDCDsDNY7HxV7:a+xaJBYFFqN1BJX1CG4hY7RV7
TLSH T1563186DE15301B365002CE8EB3A37448B68D95FB6C5FCBE4D9484DAC92893CCF562B49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/4d4d17n/an/an/a
http://5.182.210.174/b22fafn/an/an/a
http://5.182.210.174/b1225an/an/an/a
http://5.182.210.174/937a88n/an/an/a
http://5.182.210.174/46b56an/an/an/a
http://5.182.210.174/8e2425n/an/an/a
http://5.182.210.174/b31a24n/an/an/a
http://5.182.210.174/04be16n/an/an/a
http://5.182.210.174/330d82n/an/an/a
http://5.182.210.174/9536aan/an/an/a
http://5.182.210.174/43c224n/an/an/a
http://5.182.210.174/68e98an/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a90f67650abb7afb3bf0d36/reports/cfb7b278-d872-4f7d-9e5e-7503a98d5c23/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/08038561-873d-4542-b553-839f4453cad6
Behavior Graph:
Download SVG
%3 guuid=e7d90cb4-1600-0000-afcc-5ad4df0d0000 pid=3551 /usr/bin/sudo guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552 /tmp/sample.bin guuid=e7d90cb4-1600-0000-afcc-5ad4df0d0000 pid=3551->guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552 execve guuid=e2aa3fb7-1600-0000-afcc-5ad4e10d0000 pid=3553 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=e2aa3fb7-1600-0000-afcc-5ad4e10d0000 pid=3553 execve guuid=471bd8bd-1600-0000-afcc-5ad4f00d0000 pid=3568 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=471bd8bd-1600-0000-afcc-5ad4f00d0000 pid=3568 execve guuid=57460ec8-1600-0000-afcc-5ad40e0e0000 pid=3598 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=57460ec8-1600-0000-afcc-5ad40e0e0000 pid=3598 execve guuid=53624dc8-1600-0000-afcc-5ad4100e0000 pid=3600 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=53624dc8-1600-0000-afcc-5ad4100e0000 pid=3600 clone guuid=1c7080c8-1600-0000-afcc-5ad4130e0000 pid=3603 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=1c7080c8-1600-0000-afcc-5ad4130e0000 pid=3603 execve guuid=6136bcc8-1600-0000-afcc-5ad4160e0000 pid=3606 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=6136bcc8-1600-0000-afcc-5ad4160e0000 pid=3606 execve guuid=d0abf8c8-1600-0000-afcc-5ad4180e0000 pid=3608 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=d0abf8c8-1600-0000-afcc-5ad4180e0000 pid=3608 execve guuid=afd8e9cb-1600-0000-afcc-5ad4290e0000 pid=3625 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=afd8e9cb-1600-0000-afcc-5ad4290e0000 pid=3625 execve guuid=574558d1-1600-0000-afcc-5ad43b0e0000 pid=3643 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=574558d1-1600-0000-afcc-5ad43b0e0000 pid=3643 execve guuid=bb99c8d1-1600-0000-afcc-5ad43e0e0000 pid=3646 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=bb99c8d1-1600-0000-afcc-5ad43e0e0000 pid=3646 clone guuid=7c9c13d2-1600-0000-afcc-5ad4410e0000 pid=3649 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=7c9c13d2-1600-0000-afcc-5ad4410e0000 pid=3649 execve guuid=8bc07ad2-1600-0000-afcc-5ad4440e0000 pid=3652 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=8bc07ad2-1600-0000-afcc-5ad4440e0000 pid=3652 execve guuid=5d0328d3-1600-0000-afcc-5ad4470e0000 pid=3655 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=5d0328d3-1600-0000-afcc-5ad4470e0000 pid=3655 execve guuid=e3ac20d7-1600-0000-afcc-5ad45c0e0000 pid=3676 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=e3ac20d7-1600-0000-afcc-5ad45c0e0000 pid=3676 execve guuid=5edb9bdc-1600-0000-afcc-5ad4810e0000 pid=3713 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=5edb9bdc-1600-0000-afcc-5ad4810e0000 pid=3713 execve guuid=37f6dcdc-1600-0000-afcc-5ad4820e0000 pid=3714 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=37f6dcdc-1600-0000-afcc-5ad4820e0000 pid=3714 clone guuid=30f33add-1600-0000-afcc-5ad4840e0000 pid=3716 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=30f33add-1600-0000-afcc-5ad4840e0000 pid=3716 execve guuid=9b1cb4dd-1600-0000-afcc-5ad4850e0000 pid=3717 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=9b1cb4dd-1600-0000-afcc-5ad4850e0000 pid=3717 execve guuid=852606de-1600-0000-afcc-5ad4880e0000 pid=3720 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=852606de-1600-0000-afcc-5ad4880e0000 pid=3720 execve guuid=923036e1-1600-0000-afcc-5ad4930e0000 pid=3731 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=923036e1-1600-0000-afcc-5ad4930e0000 pid=3731 execve guuid=e5227be5-1600-0000-afcc-5ad4a10e0000 pid=3745 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=e5227be5-1600-0000-afcc-5ad4a10e0000 pid=3745 execve guuid=07c2dee5-1600-0000-afcc-5ad4a30e0000 pid=3747 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=07c2dee5-1600-0000-afcc-5ad4a30e0000 pid=3747 clone guuid=ef5033e6-1600-0000-afcc-5ad4a60e0000 pid=3750 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=ef5033e6-1600-0000-afcc-5ad4a60e0000 pid=3750 execve guuid=bd7f77e6-1600-0000-afcc-5ad4a80e0000 pid=3752 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=bd7f77e6-1600-0000-afcc-5ad4a80e0000 pid=3752 execve guuid=1bb7bae6-1600-0000-afcc-5ad4aa0e0000 pid=3754 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=1bb7bae6-1600-0000-afcc-5ad4aa0e0000 pid=3754 execve guuid=f4a765e9-1600-0000-afcc-5ad4b40e0000 pid=3764 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=f4a765e9-1600-0000-afcc-5ad4b40e0000 pid=3764 execve guuid=0ce30aef-1600-0000-afcc-5ad4c50e0000 pid=3781 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=0ce30aef-1600-0000-afcc-5ad4c50e0000 pid=3781 execve guuid=84875fef-1600-0000-afcc-5ad4c90e0000 pid=3785 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=84875fef-1600-0000-afcc-5ad4c90e0000 pid=3785 clone guuid=bca5adef-1600-0000-afcc-5ad4cb0e0000 pid=3787 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=bca5adef-1600-0000-afcc-5ad4cb0e0000 pid=3787 execve guuid=090c1af0-1600-0000-afcc-5ad4cf0e0000 pid=3791 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=090c1af0-1600-0000-afcc-5ad4cf0e0000 pid=3791 execve guuid=324d88f0-1600-0000-afcc-5ad4d00e0000 pid=3792 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=324d88f0-1600-0000-afcc-5ad4d00e0000 pid=3792 execve guuid=fd0216f4-1600-0000-afcc-5ad4dd0e0000 pid=3805 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=fd0216f4-1600-0000-afcc-5ad4dd0e0000 pid=3805 execve guuid=836ba2f7-1600-0000-afcc-5ad4eb0e0000 pid=3819 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=836ba2f7-1600-0000-afcc-5ad4eb0e0000 pid=3819 execve guuid=ff5dddf7-1600-0000-afcc-5ad4ec0e0000 pid=3820 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=ff5dddf7-1600-0000-afcc-5ad4ec0e0000 pid=3820 clone guuid=00180df8-1600-0000-afcc-5ad4ef0e0000 pid=3823 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=00180df8-1600-0000-afcc-5ad4ef0e0000 pid=3823 execve guuid=6f7c46f8-1600-0000-afcc-5ad4f10e0000 pid=3825 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=6f7c46f8-1600-0000-afcc-5ad4f10e0000 pid=3825 execve guuid=b8bd7df8-1600-0000-afcc-5ad4f20e0000 pid=3826 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=b8bd7df8-1600-0000-afcc-5ad4f20e0000 pid=3826 execve guuid=d78516fb-1600-0000-afcc-5ad4fa0e0000 pid=3834 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=d78516fb-1600-0000-afcc-5ad4fa0e0000 pid=3834 execve guuid=754af600-1700-0000-afcc-5ad4140f0000 pid=3860 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=754af600-1700-0000-afcc-5ad4140f0000 pid=3860 execve guuid=a6b25e01-1700-0000-afcc-5ad4170f0000 pid=3863 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=a6b25e01-1700-0000-afcc-5ad4170f0000 pid=3863 clone guuid=f96aaf01-1700-0000-afcc-5ad41a0f0000 pid=3866 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=f96aaf01-1700-0000-afcc-5ad41a0f0000 pid=3866 execve guuid=d5841202-1700-0000-afcc-5ad41c0f0000 pid=3868 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=d5841202-1700-0000-afcc-5ad41c0f0000 pid=3868 execve guuid=66297602-1700-0000-afcc-5ad41d0f0000 pid=3869 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=66297602-1700-0000-afcc-5ad41d0f0000 pid=3869 execve guuid=d5ef5b05-1700-0000-afcc-5ad4230f0000 pid=3875 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=d5ef5b05-1700-0000-afcc-5ad4230f0000 pid=3875 execve guuid=8ff4c90b-1700-0000-afcc-5ad4430f0000 pid=3907 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=8ff4c90b-1700-0000-afcc-5ad4430f0000 pid=3907 execve guuid=2ab7040c-1700-0000-afcc-5ad4440f0000 pid=3908 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=2ab7040c-1700-0000-afcc-5ad4440f0000 pid=3908 clone guuid=60c1320c-1700-0000-afcc-5ad4460f0000 pid=3910 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=60c1320c-1700-0000-afcc-5ad4460f0000 pid=3910 execve guuid=03796b0c-1700-0000-afcc-5ad4480f0000 pid=3912 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=03796b0c-1700-0000-afcc-5ad4480f0000 pid=3912 execve guuid=49afa40c-1700-0000-afcc-5ad44a0f0000 pid=3914 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=49afa40c-1700-0000-afcc-5ad44a0f0000 pid=3914 execve guuid=7355e40f-1700-0000-afcc-5ad4520f0000 pid=3922 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=7355e40f-1700-0000-afcc-5ad4520f0000 pid=3922 execve guuid=536da114-1700-0000-afcc-5ad4610f0000 pid=3937 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=536da114-1700-0000-afcc-5ad4610f0000 pid=3937 execve guuid=9034f214-1700-0000-afcc-5ad4630f0000 pid=3939 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=9034f214-1700-0000-afcc-5ad4630f0000 pid=3939 clone guuid=f8843e15-1700-0000-afcc-5ad4660f0000 pid=3942 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=f8843e15-1700-0000-afcc-5ad4660f0000 pid=3942 execve guuid=757d9415-1700-0000-afcc-5ad4680f0000 pid=3944 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=757d9415-1700-0000-afcc-5ad4680f0000 pid=3944 execve guuid=72b4de15-1700-0000-afcc-5ad4690f0000 pid=3945 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=72b4de15-1700-0000-afcc-5ad4690f0000 pid=3945 execve guuid=046de719-1700-0000-afcc-5ad4770f0000 pid=3959 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=046de719-1700-0000-afcc-5ad4770f0000 pid=3959 execve guuid=24268e1e-1700-0000-afcc-5ad4890f0000 pid=3977 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=24268e1e-1700-0000-afcc-5ad4890f0000 pid=3977 execve guuid=2647e11e-1700-0000-afcc-5ad48b0f0000 pid=3979 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=2647e11e-1700-0000-afcc-5ad48b0f0000 pid=3979 clone guuid=15562b1f-1700-0000-afcc-5ad48e0f0000 pid=3982 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=15562b1f-1700-0000-afcc-5ad48e0f0000 pid=3982 execve guuid=8b358b1f-1700-0000-afcc-5ad4900f0000 pid=3984 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=8b358b1f-1700-0000-afcc-5ad4900f0000 pid=3984 execve guuid=7967e01f-1700-0000-afcc-5ad4920f0000 pid=3986 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=7967e01f-1700-0000-afcc-5ad4920f0000 pid=3986 execve guuid=50a0e822-1700-0000-afcc-5ad49b0f0000 pid=3995 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=50a0e822-1700-0000-afcc-5ad49b0f0000 pid=3995 execve guuid=adf89527-1700-0000-afcc-5ad4ad0f0000 pid=4013 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=adf89527-1700-0000-afcc-5ad4ad0f0000 pid=4013 execve guuid=bfb3fb27-1700-0000-afcc-5ad4b00f0000 pid=4016 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=bfb3fb27-1700-0000-afcc-5ad4b00f0000 pid=4016 clone guuid=5ab24628-1700-0000-afcc-5ad4b20f0000 pid=4018 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=5ab24628-1700-0000-afcc-5ad4b20f0000 pid=4018 execve guuid=6542ac28-1700-0000-afcc-5ad4b40f0000 pid=4020 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=6542ac28-1700-0000-afcc-5ad4b40f0000 pid=4020 execve guuid=95e12229-1700-0000-afcc-5ad4b80f0000 pid=4024 /usr/bin/wget net send-data guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=95e12229-1700-0000-afcc-5ad4b80f0000 pid=4024 execve guuid=2c6d162c-1700-0000-afcc-5ad4c20f0000 pid=4034 /usr/bin/curl net send-data write-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=2c6d162c-1700-0000-afcc-5ad4c20f0000 pid=4034 execve guuid=ff688431-1700-0000-afcc-5ad4d60f0000 pid=4054 /usr/bin/chmod guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=ff688431-1700-0000-afcc-5ad4d60f0000 pid=4054 execve guuid=3e61c931-1700-0000-afcc-5ad4da0f0000 pid=4058 /usr/bin/bash guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=3e61c931-1700-0000-afcc-5ad4da0f0000 pid=4058 clone guuid=6ce10232-1700-0000-afcc-5ad4dd0f0000 pid=4061 /usr/bin/rm delete-file guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=6ce10232-1700-0000-afcc-5ad4dd0f0000 pid=4061 execve guuid=1cda3e32-1700-0000-afcc-5ad4de0f0000 pid=4062 /usr/bin/rm guuid=f88f4eb6-1600-0000-afcc-5ad4e00d0000 pid=3552->guuid=1cda3e32-1700-0000-afcc-5ad4de0f0000 pid=4062 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=e2aa3fb7-1600-0000-afcc-5ad4e10d0000 pid=3553->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=471bd8bd-1600-0000-afcc-5ad4f00d0000 pid=3568->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=810561c8-1600-0000-afcc-5ad4110e0000 pid=3601 /usr/bin/bash guuid=53624dc8-1600-0000-afcc-5ad4100e0000 pid=3600->guuid=810561c8-1600-0000-afcc-5ad4110e0000 pid=3601 clone guuid=d0abf8c8-1600-0000-afcc-5ad4180e0000 pid=3608->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=afd8e9cb-1600-0000-afcc-5ad4290e0000 pid=3625->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8502e8d1-1600-0000-afcc-5ad43f0e0000 pid=3647 /usr/bin/bash guuid=bb99c8d1-1600-0000-afcc-5ad43e0e0000 pid=3646->guuid=8502e8d1-1600-0000-afcc-5ad43f0e0000 pid=3647 clone guuid=5d0328d3-1600-0000-afcc-5ad4470e0000 pid=3655->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e3ac20d7-1600-0000-afcc-5ad45c0e0000 pid=3676->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=194404dd-1600-0000-afcc-5ad4830e0000 pid=3715 /usr/bin/bash guuid=37f6dcdc-1600-0000-afcc-5ad4820e0000 pid=3714->guuid=194404dd-1600-0000-afcc-5ad4830e0000 pid=3715 clone guuid=852606de-1600-0000-afcc-5ad4880e0000 pid=3720->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=923036e1-1600-0000-afcc-5ad4930e0000 pid=3731->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2490fce5-1600-0000-afcc-5ad4a40e0000 pid=3748 /usr/bin/bash guuid=07c2dee5-1600-0000-afcc-5ad4a30e0000 pid=3747->guuid=2490fce5-1600-0000-afcc-5ad4a40e0000 pid=3748 clone guuid=1bb7bae6-1600-0000-afcc-5ad4aa0e0000 pid=3754->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f4a765e9-1600-0000-afcc-5ad4b40e0000 pid=3764->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=52077fef-1600-0000-afcc-5ad4ca0e0000 pid=3786 /usr/bin/bash guuid=84875fef-1600-0000-afcc-5ad4c90e0000 pid=3785->guuid=52077fef-1600-0000-afcc-5ad4ca0e0000 pid=3786 clone guuid=324d88f0-1600-0000-afcc-5ad4d00e0000 pid=3792->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fd0216f4-1600-0000-afcc-5ad4dd0e0000 pid=3805->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1cf5f2f7-1600-0000-afcc-5ad4ee0e0000 pid=3822 /usr/bin/bash guuid=ff5dddf7-1600-0000-afcc-5ad4ec0e0000 pid=3820->guuid=1cf5f2f7-1600-0000-afcc-5ad4ee0e0000 pid=3822 clone guuid=b8bd7df8-1600-0000-afcc-5ad4f20e0000 pid=3826->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d78516fb-1600-0000-afcc-5ad4fa0e0000 pid=3834->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2d4c8501-1700-0000-afcc-5ad4190f0000 pid=3865 /usr/bin/bash guuid=a6b25e01-1700-0000-afcc-5ad4170f0000 pid=3863->guuid=2d4c8501-1700-0000-afcc-5ad4190f0000 pid=3865 clone guuid=66297602-1700-0000-afcc-5ad41d0f0000 pid=3869->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d5ef5b05-1700-0000-afcc-5ad4230f0000 pid=3875->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=581d170c-1700-0000-afcc-5ad4450f0000 pid=3909 /usr/bin/bash guuid=2ab7040c-1700-0000-afcc-5ad4440f0000 pid=3908->guuid=581d170c-1700-0000-afcc-5ad4450f0000 pid=3909 clone guuid=49afa40c-1700-0000-afcc-5ad44a0f0000 pid=3914->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7355e40f-1700-0000-afcc-5ad4520f0000 pid=3922->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=37ce1315-1700-0000-afcc-5ad4640f0000 pid=3940 /usr/bin/bash guuid=9034f214-1700-0000-afcc-5ad4630f0000 pid=3939->guuid=37ce1315-1700-0000-afcc-5ad4640f0000 pid=3940 clone guuid=72b4de15-1700-0000-afcc-5ad4690f0000 pid=3945->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=046de719-1700-0000-afcc-5ad4770f0000 pid=3959->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2f58031f-1700-0000-afcc-5ad48c0f0000 pid=3980 /usr/bin/bash guuid=2647e11e-1700-0000-afcc-5ad48b0f0000 pid=3979->guuid=2f58031f-1700-0000-afcc-5ad48c0f0000 pid=3980 clone guuid=7967e01f-1700-0000-afcc-5ad4920f0000 pid=3986->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=50a0e822-1700-0000-afcc-5ad49b0f0000 pid=3995->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=94031f28-1700-0000-afcc-5ad4b10f0000 pid=4017 /usr/bin/bash guuid=bfb3fb27-1700-0000-afcc-5ad4b00f0000 pid=4016->guuid=94031f28-1700-0000-afcc-5ad4b10f0000 pid=4017 clone guuid=95e12229-1700-0000-afcc-5ad4b80f0000 pid=4024->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2c6d162c-1700-0000-afcc-5ad4c20f0000 pid=4034->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=601fe631-1700-0000-afcc-5ad4db0f0000 pid=4059 /usr/bin/bash guuid=3e61c931-1700-0000-afcc-5ad4da0f0000 pid=4058->guuid=601fe631-1700-0000-afcc-5ad4db0f0000 pid=4059 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/314c048ccfd30945314dea4c3764e7bffde5a1d4ac07966f4e05bb9d2c50e615
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/314c048ccfd30945314dea4c3764e7bffde5a1d4ac07966f4e05bb9d2c50e615/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-28 02:46:14 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gfgajdgp2meukmkn5jgdozhhx766liouvqdzm32oaw5z2lcq4ykq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260828-c9d4mabf56/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
141.98.10.50
kappadocia.net
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 314c048ccfd30945314dea4c3764e7bffde5a1d4ac07966f4e05bb9d2c50e615

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments