MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36bdf59bb5e719eda9d2da8619cbb6827e5f9a2b9dd19806c704faa98c411360. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36bdf59bb5e719eda9d2da8619cbb6827e5f9a2b9dd19806c704faa98c411360
SHA3-384 hash: d836077124426fabb336ed2e93912c4f6b0d1f711c0a9bca03bd99135cce45a18c2a76f31db6061ae686a454fc12e182
SHA1 hash: f1ddc671a4b06030f1e4314ac86b019acfeb7000
MD5 hash: 8ed7e8aca1f11661eeaf8a01f1082f3b
humanhash: fifteen-september-fanta-cup
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-14 01:55:56 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Uh65rhGpx6GpbLN3DIr6Di4wli6lWGrIDjx6jwrU0EgI6gOrnU46UQ5THi6a33C6:frYxgr4CfAaIy5T+uE9UA0+pjX5
TLSH T1F0319EDF44500A321512CD8D33A2344C618EE1E72DAFDBE4DD495EA993886DCF262F1E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/c5d620n/an/aua-wget
http://5.182.210.174/45cbd5n/an/aua-wget
http://5.182.210.174/e44028n/an/aua-wget
http://5.182.210.174/e1bf38n/an/aua-wget
http://5.182.210.174/3a2ee0n/an/aua-wget
http://5.182.210.174/61f089n/an/aua-wget
http://5.182.210.174/fff372n/an/aua-wget
http://5.182.210.174/03ab36n/an/aua-wget
http://5.182.210.174/6a2daan/an/aua-wget
http://5.182.210.174/e2ee47n/an/aua-wget
http://5.182.210.174/3abc4dn/an/aua-wget
http://5.182.210.174/6d0d44n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7e75cf59d164daba6321e2/reports/f9fe0a59-13ff-4da2-887d-8f31b7a594f5/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4a8dd665-da98-4dd2-bc81-5a4e0936adb0
Behavior Graph:
Download SVG
%3 guuid=4006e7e0-1600-0000-6431-f1018a0c0000 pid=3210 /usr/bin/sudo guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217 /tmp/sample.bin guuid=4006e7e0-1600-0000-6431-f1018a0c0000 pid=3210->guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217 execve guuid=e5b8e1e2-1600-0000-6431-f101920c0000 pid=3218 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=e5b8e1e2-1600-0000-6431-f101920c0000 pid=3218 execve guuid=5f5718e8-1600-0000-6431-f1019b0c0000 pid=3227 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=5f5718e8-1600-0000-6431-f1019b0c0000 pid=3227 execve guuid=c7b90ff1-1600-0000-6431-f101b20c0000 pid=3250 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=c7b90ff1-1600-0000-6431-f101b20c0000 pid=3250 execve guuid=ecbd4ff1-1600-0000-6431-f101b40c0000 pid=3252 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=ecbd4ff1-1600-0000-6431-f101b40c0000 pid=3252 clone guuid=9bad81f1-1600-0000-6431-f101b70c0000 pid=3255 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=9bad81f1-1600-0000-6431-f101b70c0000 pid=3255 execve guuid=3b51e1f1-1600-0000-6431-f101b90c0000 pid=3257 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=3b51e1f1-1600-0000-6431-f101b90c0000 pid=3257 execve guuid=8fe534f2-1600-0000-6431-f101bb0c0000 pid=3259 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=8fe534f2-1600-0000-6431-f101bb0c0000 pid=3259 execve guuid=82fbaff4-1600-0000-6431-f101c30c0000 pid=3267 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=82fbaff4-1600-0000-6431-f101c30c0000 pid=3267 execve guuid=20ccb3fa-1600-0000-6431-f101d50c0000 pid=3285 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=20ccb3fa-1600-0000-6431-f101d50c0000 pid=3285 execve guuid=5f15f4fa-1600-0000-6431-f101d70c0000 pid=3287 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=5f15f4fa-1600-0000-6431-f101d70c0000 pid=3287 clone guuid=09685ffb-1600-0000-6431-f101da0c0000 pid=3290 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=09685ffb-1600-0000-6431-f101da0c0000 pid=3290 execve guuid=3981a2fb-1600-0000-6431-f101dc0c0000 pid=3292 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=3981a2fb-1600-0000-6431-f101dc0c0000 pid=3292 execve guuid=b7d5e0fb-1600-0000-6431-f101de0c0000 pid=3294 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=b7d5e0fb-1600-0000-6431-f101de0c0000 pid=3294 execve guuid=1f19e7ff-1600-0000-6431-f101e80c0000 pid=3304 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=1f19e7ff-1600-0000-6431-f101e80c0000 pid=3304 execve guuid=22dfbb04-1700-0000-6431-f101f00c0000 pid=3312 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=22dfbb04-1700-0000-6431-f101f00c0000 pid=3312 execve guuid=61fb2005-1700-0000-6431-f101f20c0000 pid=3314 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=61fb2005-1700-0000-6431-f101f20c0000 pid=3314 clone guuid=dca76805-1700-0000-6431-f101f50c0000 pid=3317 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=dca76805-1700-0000-6431-f101f50c0000 pid=3317 execve guuid=180ef705-1700-0000-6431-f101f80c0000 pid=3320 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=180ef705-1700-0000-6431-f101f80c0000 pid=3320 execve guuid=365b4f06-1700-0000-6431-f101fa0c0000 pid=3322 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=365b4f06-1700-0000-6431-f101fa0c0000 pid=3322 execve guuid=72794409-1700-0000-6431-f101030d0000 pid=3331 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=72794409-1700-0000-6431-f101030d0000 pid=3331 execve guuid=c97fc20d-1700-0000-6431-f1010e0d0000 pid=3342 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=c97fc20d-1700-0000-6431-f1010e0d0000 pid=3342 execve guuid=b53f430e-1700-0000-6431-f101100d0000 pid=3344 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=b53f430e-1700-0000-6431-f101100d0000 pid=3344 clone guuid=dd99960e-1700-0000-6431-f101130d0000 pid=3347 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=dd99960e-1700-0000-6431-f101130d0000 pid=3347 execve guuid=062eea0e-1700-0000-6431-f101150d0000 pid=3349 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=062eea0e-1700-0000-6431-f101150d0000 pid=3349 execve guuid=6b9f3010-1700-0000-6431-f1011b0d0000 pid=3355 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=6b9f3010-1700-0000-6431-f1011b0d0000 pid=3355 execve guuid=593d0813-1700-0000-6431-f101240d0000 pid=3364 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=593d0813-1700-0000-6431-f101240d0000 pid=3364 execve guuid=d17e7317-1700-0000-6431-f101320d0000 pid=3378 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=d17e7317-1700-0000-6431-f101320d0000 pid=3378 execve guuid=7469b717-1700-0000-6431-f101330d0000 pid=3379 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=7469b717-1700-0000-6431-f101330d0000 pid=3379 clone guuid=a028f117-1700-0000-6431-f101360d0000 pid=3382 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=a028f117-1700-0000-6431-f101360d0000 pid=3382 execve guuid=c25a3618-1700-0000-6431-f101380d0000 pid=3384 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=c25a3618-1700-0000-6431-f101380d0000 pid=3384 execve guuid=d2837918-1700-0000-6431-f1013a0d0000 pid=3386 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=d2837918-1700-0000-6431-f1013a0d0000 pid=3386 execve guuid=4d94d61a-1700-0000-6431-f101450d0000 pid=3397 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=4d94d61a-1700-0000-6431-f101450d0000 pid=3397 execve guuid=8976d51e-1700-0000-6431-f1014f0d0000 pid=3407 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=8976d51e-1700-0000-6431-f1014f0d0000 pid=3407 execve guuid=0d22161f-1700-0000-6431-f101500d0000 pid=3408 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=0d22161f-1700-0000-6431-f101500d0000 pid=3408 clone guuid=8a3f461f-1700-0000-6431-f101520d0000 pid=3410 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=8a3f461f-1700-0000-6431-f101520d0000 pid=3410 execve guuid=2453841f-1700-0000-6431-f101530d0000 pid=3411 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=2453841f-1700-0000-6431-f101530d0000 pid=3411 execve guuid=9b8cbf1f-1700-0000-6431-f101540d0000 pid=3412 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=9b8cbf1f-1700-0000-6431-f101540d0000 pid=3412 execve guuid=81023022-1700-0000-6431-f101550d0000 pid=3413 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=81023022-1700-0000-6431-f101550d0000 pid=3413 execve guuid=3e692826-1700-0000-6431-f1015f0d0000 pid=3423 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=3e692826-1700-0000-6431-f1015f0d0000 pid=3423 execve guuid=962c6926-1700-0000-6431-f101610d0000 pid=3425 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=962c6926-1700-0000-6431-f101610d0000 pid=3425 clone guuid=23cb9526-1700-0000-6431-f101640d0000 pid=3428 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=23cb9526-1700-0000-6431-f101640d0000 pid=3428 execve guuid=0586d326-1700-0000-6431-f101660d0000 pid=3430 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=0586d326-1700-0000-6431-f101660d0000 pid=3430 execve guuid=44100f27-1700-0000-6431-f101680d0000 pid=3432 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=44100f27-1700-0000-6431-f101680d0000 pid=3432 execve guuid=a7bda229-1700-0000-6431-f1016f0d0000 pid=3439 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=a7bda229-1700-0000-6431-f1016f0d0000 pid=3439 execve guuid=ae791f2e-1700-0000-6431-f1017e0d0000 pid=3454 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=ae791f2e-1700-0000-6431-f1017e0d0000 pid=3454 execve guuid=93d4662e-1700-0000-6431-f1017f0d0000 pid=3455 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=93d4662e-1700-0000-6431-f1017f0d0000 pid=3455 clone guuid=a253992e-1700-0000-6431-f101820d0000 pid=3458 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=a253992e-1700-0000-6431-f101820d0000 pid=3458 execve guuid=6b2cda2e-1700-0000-6431-f101830d0000 pid=3459 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=6b2cda2e-1700-0000-6431-f101830d0000 pid=3459 execve guuid=e3ab182f-1700-0000-6431-f101850d0000 pid=3461 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=e3ab182f-1700-0000-6431-f101850d0000 pid=3461 execve guuid=60328431-1700-0000-6431-f1018c0d0000 pid=3468 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=60328431-1700-0000-6431-f1018c0d0000 pid=3468 execve guuid=2d989e34-1700-0000-6431-f1019a0d0000 pid=3482 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=2d989e34-1700-0000-6431-f1019a0d0000 pid=3482 execve guuid=959be334-1700-0000-6431-f1019c0d0000 pid=3484 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=959be334-1700-0000-6431-f1019c0d0000 pid=3484 clone guuid=b2462235-1700-0000-6431-f1019f0d0000 pid=3487 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=b2462235-1700-0000-6431-f1019f0d0000 pid=3487 execve guuid=e3867335-1700-0000-6431-f101a10d0000 pid=3489 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=e3867335-1700-0000-6431-f101a10d0000 pid=3489 execve guuid=2b50b635-1700-0000-6431-f101a30d0000 pid=3491 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=2b50b635-1700-0000-6431-f101a30d0000 pid=3491 execve guuid=27244f38-1700-0000-6431-f101ae0d0000 pid=3502 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=27244f38-1700-0000-6431-f101ae0d0000 pid=3502 execve guuid=298d8e3c-1700-0000-6431-f101b80d0000 pid=3512 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=298d8e3c-1700-0000-6431-f101b80d0000 pid=3512 execve guuid=f741cb3c-1700-0000-6431-f101ba0d0000 pid=3514 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=f741cb3c-1700-0000-6431-f101ba0d0000 pid=3514 clone guuid=d480fd3c-1700-0000-6431-f101bc0d0000 pid=3516 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=d480fd3c-1700-0000-6431-f101bc0d0000 pid=3516 execve guuid=c123513d-1700-0000-6431-f101be0d0000 pid=3518 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=c123513d-1700-0000-6431-f101be0d0000 pid=3518 execve guuid=a3fca83d-1700-0000-6431-f101bf0d0000 pid=3519 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=a3fca83d-1700-0000-6431-f101bf0d0000 pid=3519 execve guuid=59175740-1700-0000-6431-f101c30d0000 pid=3523 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=59175740-1700-0000-6431-f101c30d0000 pid=3523 execve guuid=e05e9344-1700-0000-6431-f101cb0d0000 pid=3531 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=e05e9344-1700-0000-6431-f101cb0d0000 pid=3531 execve guuid=40176245-1700-0000-6431-f101cf0d0000 pid=3535 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=40176245-1700-0000-6431-f101cf0d0000 pid=3535 clone guuid=1749e745-1700-0000-6431-f101d30d0000 pid=3539 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=1749e745-1700-0000-6431-f101d30d0000 pid=3539 execve guuid=69e7a046-1700-0000-6431-f101d60d0000 pid=3542 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=69e7a046-1700-0000-6431-f101d60d0000 pid=3542 execve guuid=562a3f47-1700-0000-6431-f101d80d0000 pid=3544 /usr/bin/wget net send-data guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=562a3f47-1700-0000-6431-f101d80d0000 pid=3544 execve guuid=dc7c8b4b-1700-0000-6431-f101e30d0000 pid=3555 /usr/bin/curl net send-data write-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=dc7c8b4b-1700-0000-6431-f101e30d0000 pid=3555 execve guuid=9678cb4f-1700-0000-6431-f101e90d0000 pid=3561 /usr/bin/chmod guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=9678cb4f-1700-0000-6431-f101e90d0000 pid=3561 execve guuid=74e3cd50-1700-0000-6431-f101ed0d0000 pid=3565 /usr/bin/bash guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=74e3cd50-1700-0000-6431-f101ed0d0000 pid=3565 clone guuid=05994f51-1700-0000-6431-f101f10d0000 pid=3569 /usr/bin/rm delete-file guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=05994f51-1700-0000-6431-f101f10d0000 pid=3569 execve guuid=69ff1252-1700-0000-6431-f101f50d0000 pid=3573 /usr/bin/rm guuid=ea2264e2-1600-0000-6431-f101910c0000 pid=3217->guuid=69ff1252-1700-0000-6431-f101f50d0000 pid=3573 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=e5b8e1e2-1600-0000-6431-f101920c0000 pid=3218->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5f5718e8-1600-0000-6431-f1019b0c0000 pid=3227->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=766367f1-1600-0000-6431-f101b50c0000 pid=3253 /usr/bin/bash guuid=ecbd4ff1-1600-0000-6431-f101b40c0000 pid=3252->guuid=766367f1-1600-0000-6431-f101b50c0000 pid=3253 clone guuid=8fe534f2-1600-0000-6431-f101bb0c0000 pid=3259->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=82fbaff4-1600-0000-6431-f101c30c0000 pid=3267->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=606a0ffb-1600-0000-6431-f101d80c0000 pid=3288 /usr/bin/bash guuid=5f15f4fa-1600-0000-6431-f101d70c0000 pid=3287->guuid=606a0ffb-1600-0000-6431-f101d80c0000 pid=3288 clone guuid=b7d5e0fb-1600-0000-6431-f101de0c0000 pid=3294->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1f19e7ff-1600-0000-6431-f101e80c0000 pid=3304->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=84ac3f05-1700-0000-6431-f101f40c0000 pid=3316 /usr/bin/bash guuid=61fb2005-1700-0000-6431-f101f20c0000 pid=3314->guuid=84ac3f05-1700-0000-6431-f101f40c0000 pid=3316 clone guuid=365b4f06-1700-0000-6431-f101fa0c0000 pid=3322->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=72794409-1700-0000-6431-f101030d0000 pid=3331->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6cf4680e-1700-0000-6431-f101120d0000 pid=3346 /usr/bin/bash guuid=b53f430e-1700-0000-6431-f101100d0000 pid=3344->guuid=6cf4680e-1700-0000-6431-f101120d0000 pid=3346 clone guuid=6b9f3010-1700-0000-6431-f1011b0d0000 pid=3355->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=593d0813-1700-0000-6431-f101240d0000 pid=3364->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7b9fcf17-1700-0000-6431-f101350d0000 pid=3381 /usr/bin/bash guuid=7469b717-1700-0000-6431-f101330d0000 pid=3379->guuid=7b9fcf17-1700-0000-6431-f101350d0000 pid=3381 clone guuid=d2837918-1700-0000-6431-f1013a0d0000 pid=3386->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4d94d61a-1700-0000-6431-f101450d0000 pid=3397->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=04a6291f-1700-0000-6431-f101510d0000 pid=3409 /usr/bin/bash guuid=0d22161f-1700-0000-6431-f101500d0000 pid=3408->guuid=04a6291f-1700-0000-6431-f101510d0000 pid=3409 clone guuid=9b8cbf1f-1700-0000-6431-f101540d0000 pid=3412->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=81023022-1700-0000-6431-f101550d0000 pid=3413->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=72557b26-1700-0000-6431-f101620d0000 pid=3426 /usr/bin/bash guuid=962c6926-1700-0000-6431-f101610d0000 pid=3425->guuid=72557b26-1700-0000-6431-f101620d0000 pid=3426 clone guuid=44100f27-1700-0000-6431-f101680d0000 pid=3432->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a7bda229-1700-0000-6431-f1016f0d0000 pid=3439->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=32537f2e-1700-0000-6431-f101810d0000 pid=3457 /usr/bin/bash guuid=93d4662e-1700-0000-6431-f1017f0d0000 pid=3455->guuid=32537f2e-1700-0000-6431-f101810d0000 pid=3457 clone guuid=e3ab182f-1700-0000-6431-f101850d0000 pid=3461->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=60328431-1700-0000-6431-f1018c0d0000 pid=3468->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3fd0ff34-1700-0000-6431-f1019d0d0000 pid=3485 /usr/bin/bash guuid=959be334-1700-0000-6431-f1019c0d0000 pid=3484->guuid=3fd0ff34-1700-0000-6431-f1019d0d0000 pid=3485 clone guuid=2b50b635-1700-0000-6431-f101a30d0000 pid=3491->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=27244f38-1700-0000-6431-f101ae0d0000 pid=3502->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ca6ae13c-1700-0000-6431-f101bb0d0000 pid=3515 /usr/bin/bash guuid=f741cb3c-1700-0000-6431-f101ba0d0000 pid=3514->guuid=ca6ae13c-1700-0000-6431-f101bb0d0000 pid=3515 clone guuid=a3fca83d-1700-0000-6431-f101bf0d0000 pid=3519->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=59175740-1700-0000-6431-f101c30d0000 pid=3523->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2625a545-1700-0000-6431-f101d10d0000 pid=3537 /usr/bin/bash guuid=40176245-1700-0000-6431-f101cf0d0000 pid=3535->guuid=2625a545-1700-0000-6431-f101d10d0000 pid=3537 clone guuid=562a3f47-1700-0000-6431-f101d80d0000 pid=3544->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=dc7c8b4b-1700-0000-6431-f101e30d0000 pid=3555->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=737fff50-1700-0000-6431-f101ef0d0000 pid=3567 /usr/bin/bash guuid=74e3cd50-1700-0000-6431-f101ed0d0000 pid=3565->guuid=737fff50-1700-0000-6431-f101ef0d0000 pid=3567 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/36bdf59bb5e719eda9d2da8619cbb6827e5f9a2b9dd19806c704faa98c411360
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36bdf59bb5e719eda9d2da8619cbb6827e5f9a2b9dd19806c704faa98c411360/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-14 01:56:54 UTC
File Type:
Text (Shell)
AV detection:
12 of 36 (33.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g267lg5v44m63kos3kdbts5wqj7f7grltxizqbwhat5ktdcbcnqa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260814-ccy3jaswbt/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Creates a large amount of network flows
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 36bdf59bb5e719eda9d2da8619cbb6827e5f9a2b9dd19806c704faa98c411360

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments