🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96
SHA3-384 hash: 024cf6e114d7597bfac7abfc6ffd0be7ed40f6442278f3228b85b1f5c0ed999322132dfb353a12930ebbaaec30b2c550
SHA1 hash: 182b94055cbf17b68cd32fca2828a7049320fc35
MD5 hash: 9e3b46f7626b0408ec194c37d7dd9c06
humanhash: north-low-sixteen-kansas
File name:39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96
Download: download sample
Signature Mirai
Create hunting rule
File size:3'241 bytes
First seen:2026-09-13 18:52:51 UTC
Last seen:2026-09-20 02:09:24 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 96:rdfn9fduf0OfGQ0Qb/jh4Vo/aBbB5dIT+lEFJpGVxwyT:rhnBdo0Ik1X
TLSH T1C861218851B1F173D8C5692D22BE86D1E9409EF25BB1EEECA858D4F0444070673FB2F6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c2hunter
Tags:mirai sh wraith
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.66.206/bins/net.x86_64cd6ccc5dabe85309a938e43c9508998bb0f52a9264fa9ba9276956f7fa42f48d Miraielf mirai ua-wget
http://160.119.66.206/bins/net.x862136980fc01c33fcd1f5cf0541ebfce02093eec928921654dc35c17d69205946 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.mips683a3f7c5992c013d4cd71eeaf2d0d3b5a781261fa19a30e4d073ddf712c5ea4 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.mpsl57a4487a6f882b2448048164a1b0ea71c104aa94e9ad6aca8d3f8d2c60401ed4 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.armcc049286a66056a4a80331b3c08494f8c7c73b4cc6e26328d3e6fb31deef729f Miraielf mirai ua-wget
http://160.119.66.206/bins/net.arm545bee2b10761884f47fac2f515056d15569d85ecfafc662573bf915dbcb8f943 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.arm6dd225f82614fbe9734a58b04c77858a2491a9ad5071c5988ec8b9896135ec17d Miraielf mirai ua-wget
http://160.119.66.206/bins/net.arm761317fa3019a3a2c66142ebb0e76bcca6374bde0e5b330f04bcb81b366923533 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.ppcf24f459b6526c8583f40a62a3c97485f4c80b812e81c926bf832a67c208fbbfc Miraielf mirai ua-wget
http://160.119.66.206/bins/net.m68kc11473d154b0e18791a5befe375768beed8e93fe0eb6ed71ed6ea642bead7626 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.sh47352f6d206a1aa92c316b0384979fb021fc75a5c2458210455da586a125f7c4c Miraielf mirai ua-wget
http://160.119.66.206/bins/net.spcn/an/aelf ua-wget
http://160.119.66.206/bins/net.arc4979c83681a310a8d3789fb8728b1c291c93babc2883edbebd5f470d45d618fe Miraielf mirai ua-wget
http://160.119.66.206/bins/net.i6861bbf752e3f82b21cbc035fc23de08d0b2539fde3c83cc27c257764a18788cff4 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.i4869bce93a6ea7f1cc1e49f93f0d21bc41d8c065f19a5d9c42f8fb93e0c6e081ebc Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
20
# of downloads :
79
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6aa6f11627761b9e5aecd167/reports/c03c1f1b-e8b9-4f21-ba2d-1751f78ef7ec/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-13T17:07:00Z UTC
Last seen:
2026-09-15T16:03:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d3598176-79a8-4e0f-afab-0c9738b99751
Behavior Graph:
Download SVG
%3 guuid=724071f7-1600-0000-ed8a-8fe7d40d0000 pid=3540 /usr/bin/sudo guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541 /tmp/sample.bin guuid=724071f7-1600-0000-ed8a-8fe7d40d0000 pid=3540->guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541 execve guuid=45d953fd-1600-0000-ed8a-8fe7d60d0000 pid=3542 /usr/bin/wget net send-data write-file guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541->guuid=45d953fd-1600-0000-ed8a-8fe7d60d0000 pid=3542 execve guuid=5c9d4405-1700-0000-ed8a-8fe7e60d0000 pid=3558 /usr/bin/chmod guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541->guuid=5c9d4405-1700-0000-ed8a-8fe7e60d0000 pid=3558 execve guuid=66a19e05-1700-0000-ed8a-8fe7e90d0000 pid=3561 /tmp/net_bot delete-file net guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541->guuid=66a19e05-1700-0000-ed8a-8fe7e90d0000 pid=3561 execve e422999a-f7c9-5d7f-ace6-06619932a6e1 160.119.66.206:80 guuid=45d953fd-1600-0000-ed8a-8fe7d60d0000 pid=3542->e422999a-f7c9-5d7f-ace6-06619932a6e1 send: 144B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=66a19e05-1700-0000-ed8a-8fe7e90d0000 pid=3561->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=008ace05-1700-0000-ed8a-8fe7eb0d0000 pid=3563 /tmp/net_bot zombie guuid=66a19e05-1700-0000-ed8a-8fe7e90d0000 pid=3561->guuid=008ace05-1700-0000-ed8a-8fe7eb0d0000 pid=3563 clone guuid=8a101106-1700-0000-ed8a-8fe7ec0d0000 pid=3564 /tmp/net_bot guuid=008ace05-1700-0000-ed8a-8fe7eb0d0000 pid=3563->guuid=8a101106-1700-0000-ed8a-8fe7ec0d0000 pid=3564 clone guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565 /tmp/net_bot net send-data write-config write-file guuid=8a101106-1700-0000-ed8a-8fe7ec0d0000 pid=3564->guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565 clone guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 8b26227b-2cdf-5588-854d-163784b9b998 160.119.66.206:25565 guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->8b26227b-2cdf-5588-854d-163784b9b998 send: 18B guuid=a4772a06-1700-0000-ed8a-8fe7ee0d0000 pid=3566 /tmp/net_bot guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=a4772a06-1700-0000-ed8a-8fe7ee0d0000 pid=3566 clone guuid=2e120307-1700-0000-ed8a-8fe7f10d0000 pid=3569 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=2e120307-1700-0000-ed8a-8fe7f10d0000 pid=3569 execve guuid=7d33a107-1700-0000-ed8a-8fe7f50d0000 pid=3573 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=7d33a107-1700-0000-ed8a-8fe7f50d0000 pid=3573 execve guuid=459b2e0a-1700-0000-ed8a-8fe7fe0d0000 pid=3582 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=459b2e0a-1700-0000-ed8a-8fe7fe0d0000 pid=3582 execve guuid=cea4ad42-1700-0000-ed8a-8fe7d20e0000 pid=3794 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=cea4ad42-1700-0000-ed8a-8fe7d20e0000 pid=3794 execve guuid=2f3aee42-1700-0000-ed8a-8fe7d40e0000 pid=3796 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=2f3aee42-1700-0000-ed8a-8fe7d40e0000 pid=3796 execve guuid=e5a7f76b-1700-0000-ed8a-8fe7a50f0000 pid=4005 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=e5a7f76b-1700-0000-ed8a-8fe7a50f0000 pid=4005 execve guuid=ad5d9598-1700-0000-ed8a-8fe75d100000 pid=4189 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=ad5d9598-1700-0000-ed8a-8fe75d100000 pid=4189 execve guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210 /tmp/net_bot net send-data guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210 clone guuid=853af49c-1700-0000-ed8a-8fe773100000 pid=4211 /tmp/net_bot guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=853af49c-1700-0000-ed8a-8fe773100000 pid=4211 clone guuid=b665fb9c-1700-0000-ed8a-8fe774100000 pid=4212 /tmp/net_bot guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=b665fb9c-1700-0000-ed8a-8fe774100000 pid=4212 clone guuid=f93e4107-1700-0000-ed8a-8fe7f20d0000 pid=3570 /usr/bin/chmod guuid=2e120307-1700-0000-ed8a-8fe7f10d0000 pid=3569->guuid=f93e4107-1700-0000-ed8a-8fe7f20d0000 pid=3570 execve guuid=0f27c907-1700-0000-ed8a-8fe7f60d0000 pid=3574 /usr/bin/systemctl guuid=7d33a107-1700-0000-ed8a-8fe7f50d0000 pid=3573->guuid=0f27c907-1700-0000-ed8a-8fe7f60d0000 pid=3574 execve guuid=6d43760a-1700-0000-ed8a-8fe7000e0000 pid=3584 /usr/sbin/update-rc.d guuid=459b2e0a-1700-0000-ed8a-8fe7fe0d0000 pid=3582->guuid=6d43760a-1700-0000-ed8a-8fe7000e0000 pid=3584 execve guuid=787ac90c-1700-0000-ed8a-8fe7060e0000 pid=3590 /usr/bin/systemctl guuid=6d43760a-1700-0000-ed8a-8fe7000e0000 pid=3584->guuid=787ac90c-1700-0000-ed8a-8fe7060e0000 pid=3590 execve guuid=fa800f43-1700-0000-ed8a-8fe7d60e0000 pid=3798 /usr/bin/systemctl guuid=2f3aee42-1700-0000-ed8a-8fe7d40e0000 pid=3796->guuid=fa800f43-1700-0000-ed8a-8fe7d60e0000 pid=3798 execve guuid=b7d71e6c-1700-0000-ed8a-8fe7a60f0000 pid=4006 /usr/bin/systemctl guuid=e5a7f76b-1700-0000-ed8a-8fe7a50f0000 pid=4005->guuid=b7d71e6c-1700-0000-ed8a-8fe7a60f0000 pid=4006 execve guuid=7766bd98-1700-0000-ed8a-8fe75e100000 pid=4190 /usr/bin/systemctl guuid=ad5d9598-1700-0000-ed8a-8fe75d100000 pid=4189->guuid=7766bd98-1700-0000-ed8a-8fe75e100000 pid=4190 execve guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210->8b26227b-2cdf-5588-854d-163784b9b998 send: 18B guuid=049408c7-1800-0000-ed8a-8fe788130000 pid=5000 /tmp/net_bot guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210->guuid=049408c7-1800-0000-ed8a-8fe788130000 pid=5000 clone guuid=b22e13c7-1800-0000-ed8a-8fe789130000 pid=5001 /tmp/net_bot guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210->guuid=b22e13c7-1800-0000-ed8a-8fe789130000 pid=5001 clone guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213 /tmp/net_bot net send-data guuid=b665fb9c-1700-0000-ed8a-8fe774100000 pid=4212->guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213 clone 68de0db4-c08a-5676-9fb4-10f060f12524 13.207.34.174:49544 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->68de0db4-c08a-5676-9fb4-10f060f12524 send: 8B b9cbf427-8490-582d-a6e4-2c6661082422 120.52.157.90:4942 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->b9cbf427-8490-582d-a6e4-2c6661082422 con 2500a989-fbde-5e41-8617-dc9273c115ea 189.221.235.15:26390 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->2500a989-fbde-5e41-8617-dc9273c115ea send: 8B c0002139-a90d-5126-a033-c98653301bae 83.172.93.232:34577 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->c0002139-a90d-5126-a033-c98653301bae send: 8B 0e06ce58-949d-59a0-9865-25c54305f11a 137.139.198.43:28923 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->0e06ce58-949d-59a0-9865-25c54305f11a send: 8B 8feea385-88d6-58dc-9340-b58bbb7ef66c 191.255.106.214:21382 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->8feea385-88d6-58dc-9340-b58bbb7ef66c send: 8B dc4b94e2-47fe-5c38-9335-8721360e8daf 15.73.203.237:51918 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->dc4b94e2-47fe-5c38-9335-8721360e8daf send: 8B 7400b5b3-7127-54ab-a138-2519f78e4933 108.230.169.33:42527 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->7400b5b3-7127-54ab-a138-2519f78e4933 send: 8B 400cb31a-c624-508b-aa17-22abf63695cc 24.214.195.25:6029 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->400cb31a-c624-508b-aa17-22abf63695cc send: 8B 776ae8ca-32af-5579-bd67-ac9e465be5b5 120.52.157.90:0 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->776ae8ca-32af-5579-bd67-ac9e465be5b5 send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002 /tmp/net_bot net send-data guuid=b22e13c7-1800-0000-ed8a-8fe789130000 pid=5001->guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002 clone guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->68de0db4-c08a-5676-9fb4-10f060f12524 send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->b9cbf427-8490-582d-a6e4-2c6661082422 con guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->2500a989-fbde-5e41-8617-dc9273c115ea send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->c0002139-a90d-5126-a033-c98653301bae send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->0e06ce58-949d-59a0-9865-25c54305f11a send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->8feea385-88d6-58dc-9340-b58bbb7ef66c send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->dc4b94e2-47fe-5c38-9335-8721360e8daf send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->7400b5b3-7127-54ab-a138-2519f78e4933 send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->776ae8ca-32af-5579-bd67-ac9e465be5b5 send: 8B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96/
Threat name:
Script-Shell.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-09-13 18:53:25 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hg7gqu5iebgomrk2g45g762mwrts2stc3ef6nh35n3vwntnbbola._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet credential_access defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260913-xjp4essbmf/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads process memory
Creates/modifies Cron job
Enumerates running processes
Modifies init.d
Modifies systemd
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/39be6853a820/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96

(this sample)

Mirai

elf cd6ccc5dabe85309a938e43c9508998bb0f52a9264fa9ba9276956f7fa42f48d

  
Link
http://160.119.66.206/bins/kla.sh
  
URLhaus
https://urlhaus.abuse.ch/url/3916061/
  
Delivery method
Distributed via web download
  
Dropping
MD5 390b35e39dd659cdfc59900f820b7d40
  
Dropping
SHA256 cd6ccc5dabe85309a938e43c9508998bb0f52a9264fa9ba9276956f7fa42f48d

Comments