🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96
SHA3-384 hash: 024cf6e114d7597bfac7abfc6ffd0be7ed40f6442278f3228b85b1f5c0ed999322132dfb353a12930ebbaaec30b2c550
SHA1 hash: 182b94055cbf17b68cd32fca2828a7049320fc35
MD5 hash: 9e3b46f7626b0408ec194c37d7dd9c06
humanhash: north-low-sixteen-kansas
File name:39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96
Download: download sample
Signature Mirai
Create hunting rule
File size:3'241 bytes
First seen:2026-09-13 18:52:51 UTC
Last seen:2026-10-11 08:07:30 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 96:rdfn9fduf0OfGQ0Qb/jh4Vo/aBbB5dIT+lEFJpGVxwyT:rhnBdo0Ik1X
TLSH T1C861218851B1F173D8C5692D22BE86D1E9409EF25BB1EEECA858D4F0444070673FB2F6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c2hunter
Tags:mirai sh wraith
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.66.206/bins/net.x86_6464d8f97bbbb1cfe1dde092d03baf0778385b16c441dafe2f758d50602cd00209 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.x8635c6fa31bcf17ac8694064fafd8ce0978ca10c439223a76df03efcbdd12a6f43 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.mipseb5c49ad43e0a483bae757c3584c89bfd8ad12487d19037866669e5983de4458 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.mpsl30296d1e0bdb9a7a611ea84851891195c1169883d6bb814b618456bd669405df Miraielf mirai ua-wget
http://160.119.66.206/bins/net.armb8c25f4cb6f3319e0c6e80ae637eb1a84529a2267e308a7d1f7aa5f608d95ae6 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.arm524ed5f65114cd2aca1e14d0b5c531710dfbb8c692e7200dfc3c5b00593b1627d Miraielf mirai ua-wget
http://160.119.66.206/bins/net.arm6fd05f8921a805175caf9373d3651ea05d62b01b8ef9ad9cba1a59618336f2cd5 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.arm7666f2f4144c6fd2535836c224c0a50042fed583469c08e53197e2555363d4915 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.ppc268c5f9349a3db7eb8bfcf7edadbcf8350f4683439edac77426baffbc7f10422 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.m68kef378a3980a058fa5ea9babd47e2c6b74e7b5e99af08181ae5610e28fb62bd00 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.sh44dba360095973d183c75708f58e1e065903f41c7cad4e5a4fe076cb4e26055f8 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.spcn/an/aelf ua-wget
http://160.119.66.206/bins/net.arc4c6ac7638f9b47b187ffe4be8d1afb6f86dd3cf3975f113188d22e6f532480f2 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.i68646c8c93cfd8877e0c60d09070148991e90416c64209929cd7fd4d8e8096c7140 Miraielf mirai ua-wget
http://160.119.66.206/bins/net.i4867e54ecd8c09c1f9847e88287def757c95508bdbbbf683282763798a747f3ec6b Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
21
# of downloads :
90
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6aa6f11627761b9e5aecd167/reports/c03c1f1b-e8b9-4f21-ba2d-1751f78ef7ec/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-13T17:07:00Z UTC
Last seen:
2026-09-15T16:03:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d3598176-79a8-4e0f-afab-0c9738b99751
Behavior Graph:
Download SVG
%3 guuid=724071f7-1600-0000-ed8a-8fe7d40d0000 pid=3540 /usr/bin/sudo guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541 /tmp/sample.bin guuid=724071f7-1600-0000-ed8a-8fe7d40d0000 pid=3540->guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541 execve guuid=45d953fd-1600-0000-ed8a-8fe7d60d0000 pid=3542 /usr/bin/wget net send-data write-file guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541->guuid=45d953fd-1600-0000-ed8a-8fe7d60d0000 pid=3542 execve guuid=5c9d4405-1700-0000-ed8a-8fe7e60d0000 pid=3558 /usr/bin/chmod guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541->guuid=5c9d4405-1700-0000-ed8a-8fe7e60d0000 pid=3558 execve guuid=66a19e05-1700-0000-ed8a-8fe7e90d0000 pid=3561 /tmp/net_bot delete-file net guuid=1e85b9fc-1600-0000-ed8a-8fe7d50d0000 pid=3541->guuid=66a19e05-1700-0000-ed8a-8fe7e90d0000 pid=3561 execve e422999a-f7c9-5d7f-ace6-06619932a6e1 160.119.66.206:80 guuid=45d953fd-1600-0000-ed8a-8fe7d60d0000 pid=3542->e422999a-f7c9-5d7f-ace6-06619932a6e1 send: 144B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=66a19e05-1700-0000-ed8a-8fe7e90d0000 pid=3561->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=008ace05-1700-0000-ed8a-8fe7eb0d0000 pid=3563 /tmp/net_bot zombie guuid=66a19e05-1700-0000-ed8a-8fe7e90d0000 pid=3561->guuid=008ace05-1700-0000-ed8a-8fe7eb0d0000 pid=3563 clone guuid=8a101106-1700-0000-ed8a-8fe7ec0d0000 pid=3564 /tmp/net_bot guuid=008ace05-1700-0000-ed8a-8fe7eb0d0000 pid=3563->guuid=8a101106-1700-0000-ed8a-8fe7ec0d0000 pid=3564 clone guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565 /tmp/net_bot net send-data write-config write-file guuid=8a101106-1700-0000-ed8a-8fe7ec0d0000 pid=3564->guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565 clone guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 8b26227b-2cdf-5588-854d-163784b9b998 160.119.66.206:25565 guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->8b26227b-2cdf-5588-854d-163784b9b998 send: 18B guuid=a4772a06-1700-0000-ed8a-8fe7ee0d0000 pid=3566 /tmp/net_bot guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=a4772a06-1700-0000-ed8a-8fe7ee0d0000 pid=3566 clone guuid=2e120307-1700-0000-ed8a-8fe7f10d0000 pid=3569 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=2e120307-1700-0000-ed8a-8fe7f10d0000 pid=3569 execve guuid=7d33a107-1700-0000-ed8a-8fe7f50d0000 pid=3573 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=7d33a107-1700-0000-ed8a-8fe7f50d0000 pid=3573 execve guuid=459b2e0a-1700-0000-ed8a-8fe7fe0d0000 pid=3582 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=459b2e0a-1700-0000-ed8a-8fe7fe0d0000 pid=3582 execve guuid=cea4ad42-1700-0000-ed8a-8fe7d20e0000 pid=3794 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=cea4ad42-1700-0000-ed8a-8fe7d20e0000 pid=3794 execve guuid=2f3aee42-1700-0000-ed8a-8fe7d40e0000 pid=3796 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=2f3aee42-1700-0000-ed8a-8fe7d40e0000 pid=3796 execve guuid=e5a7f76b-1700-0000-ed8a-8fe7a50f0000 pid=4005 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=e5a7f76b-1700-0000-ed8a-8fe7a50f0000 pid=4005 execve guuid=ad5d9598-1700-0000-ed8a-8fe75d100000 pid=4189 /usr/bin/dash guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=ad5d9598-1700-0000-ed8a-8fe75d100000 pid=4189 execve guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210 /tmp/net_bot net send-data guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210 clone guuid=853af49c-1700-0000-ed8a-8fe773100000 pid=4211 /tmp/net_bot guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=853af49c-1700-0000-ed8a-8fe773100000 pid=4211 clone guuid=b665fb9c-1700-0000-ed8a-8fe774100000 pid=4212 /tmp/net_bot guuid=e1702206-1700-0000-ed8a-8fe7ed0d0000 pid=3565->guuid=b665fb9c-1700-0000-ed8a-8fe774100000 pid=4212 clone guuid=f93e4107-1700-0000-ed8a-8fe7f20d0000 pid=3570 /usr/bin/chmod guuid=2e120307-1700-0000-ed8a-8fe7f10d0000 pid=3569->guuid=f93e4107-1700-0000-ed8a-8fe7f20d0000 pid=3570 execve guuid=0f27c907-1700-0000-ed8a-8fe7f60d0000 pid=3574 /usr/bin/systemctl guuid=7d33a107-1700-0000-ed8a-8fe7f50d0000 pid=3573->guuid=0f27c907-1700-0000-ed8a-8fe7f60d0000 pid=3574 execve guuid=6d43760a-1700-0000-ed8a-8fe7000e0000 pid=3584 /usr/sbin/update-rc.d guuid=459b2e0a-1700-0000-ed8a-8fe7fe0d0000 pid=3582->guuid=6d43760a-1700-0000-ed8a-8fe7000e0000 pid=3584 execve guuid=787ac90c-1700-0000-ed8a-8fe7060e0000 pid=3590 /usr/bin/systemctl guuid=6d43760a-1700-0000-ed8a-8fe7000e0000 pid=3584->guuid=787ac90c-1700-0000-ed8a-8fe7060e0000 pid=3590 execve guuid=fa800f43-1700-0000-ed8a-8fe7d60e0000 pid=3798 /usr/bin/systemctl guuid=2f3aee42-1700-0000-ed8a-8fe7d40e0000 pid=3796->guuid=fa800f43-1700-0000-ed8a-8fe7d60e0000 pid=3798 execve guuid=b7d71e6c-1700-0000-ed8a-8fe7a60f0000 pid=4006 /usr/bin/systemctl guuid=e5a7f76b-1700-0000-ed8a-8fe7a50f0000 pid=4005->guuid=b7d71e6c-1700-0000-ed8a-8fe7a60f0000 pid=4006 execve guuid=7766bd98-1700-0000-ed8a-8fe75e100000 pid=4190 /usr/bin/systemctl guuid=ad5d9598-1700-0000-ed8a-8fe75d100000 pid=4189->guuid=7766bd98-1700-0000-ed8a-8fe75e100000 pid=4190 execve guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210->8b26227b-2cdf-5588-854d-163784b9b998 send: 18B guuid=049408c7-1800-0000-ed8a-8fe788130000 pid=5000 /tmp/net_bot guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210->guuid=049408c7-1800-0000-ed8a-8fe788130000 pid=5000 clone guuid=b22e13c7-1800-0000-ed8a-8fe789130000 pid=5001 /tmp/net_bot guuid=a646f09c-1700-0000-ed8a-8fe772100000 pid=4210->guuid=b22e13c7-1800-0000-ed8a-8fe789130000 pid=5001 clone guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213 /tmp/net_bot net send-data guuid=b665fb9c-1700-0000-ed8a-8fe774100000 pid=4212->guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213 clone 68de0db4-c08a-5676-9fb4-10f060f12524 13.207.34.174:49544 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->68de0db4-c08a-5676-9fb4-10f060f12524 send: 8B b9cbf427-8490-582d-a6e4-2c6661082422 120.52.157.90:4942 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->b9cbf427-8490-582d-a6e4-2c6661082422 con 2500a989-fbde-5e41-8617-dc9273c115ea 189.221.235.15:26390 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->2500a989-fbde-5e41-8617-dc9273c115ea send: 8B c0002139-a90d-5126-a033-c98653301bae 83.172.93.232:34577 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->c0002139-a90d-5126-a033-c98653301bae send: 8B 0e06ce58-949d-59a0-9865-25c54305f11a 137.139.198.43:28923 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->0e06ce58-949d-59a0-9865-25c54305f11a send: 8B 8feea385-88d6-58dc-9340-b58bbb7ef66c 191.255.106.214:21382 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->8feea385-88d6-58dc-9340-b58bbb7ef66c send: 8B dc4b94e2-47fe-5c38-9335-8721360e8daf 15.73.203.237:51918 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->dc4b94e2-47fe-5c38-9335-8721360e8daf send: 8B 7400b5b3-7127-54ab-a138-2519f78e4933 108.230.169.33:42527 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->7400b5b3-7127-54ab-a138-2519f78e4933 send: 8B 400cb31a-c624-508b-aa17-22abf63695cc 24.214.195.25:6029 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->400cb31a-c624-508b-aa17-22abf63695cc send: 8B 776ae8ca-32af-5579-bd67-ac9e465be5b5 120.52.157.90:0 guuid=2aaa019d-1700-0000-ed8a-8fe775100000 pid=4213->776ae8ca-32af-5579-bd67-ac9e465be5b5 send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002 /tmp/net_bot net send-data guuid=b22e13c7-1800-0000-ed8a-8fe789130000 pid=5001->guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002 clone guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->68de0db4-c08a-5676-9fb4-10f060f12524 send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->b9cbf427-8490-582d-a6e4-2c6661082422 con guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->2500a989-fbde-5e41-8617-dc9273c115ea send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->c0002139-a90d-5126-a033-c98653301bae send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->0e06ce58-949d-59a0-9865-25c54305f11a send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->8feea385-88d6-58dc-9340-b58bbb7ef66c send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->dc4b94e2-47fe-5c38-9335-8721360e8daf send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->7400b5b3-7127-54ab-a138-2519f78e4933 send: 8B guuid=c32f17c7-1800-0000-ed8a-8fe78a130000 pid=5002->776ae8ca-32af-5579-bd67-ac9e465be5b5 send: 8B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96/
Threat name:
Script-Shell.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-09-13 18:53:25 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hg7gqu5iebgomrk2g45g762mwrts2stc3ef6nh35n3vwntnbbola._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet credential_access defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260913-xjp4essbmf/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads process memory
Creates/modifies Cron job
Enumerates running processes
Modifies init.d
Modifies systemd
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/39be6853a820/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96

(this sample)

Mirai

elf cd6ccc5dabe85309a938e43c9508998bb0f52a9264fa9ba9276956f7fa42f48d

  
Link
http://160.119.66.206/bins/kla.sh
  
URLhaus
https://urlhaus.abuse.ch/url/3916061/
  
Delivery method
Distributed via web download
  
Dropping
MD5 390b35e39dd659cdfc59900f820b7d40
  
Dropping
SHA256 cd6ccc5dabe85309a938e43c9508998bb0f52a9264fa9ba9276956f7fa42f48d

Comments