🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cc6621aa8311d15b172c95edeb7da76a7d3ab35f6ef0a74f3a0a5b85384865c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cc6621aa8311d15b172c95edeb7da76a7d3ab35f6ef0a74f3a0a5b85384865c
SHA3-384 hash: 7d7eb31e4354a7c9dfb7a76681f081dbc57295a7a9efcdb5bbc56633bc44ecc1713fc9942c530d8e8d1caab4e982b818
SHA1 hash: 12530308fe66def597ad667b0d25f63a3e1e5ef6
MD5 hash: 51d911a61d677a12eb54cb5dc9740331
humanhash: india-monkey-mississippi-fifteen
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-22 21:50:30 UTC
Last seen:2026-08-23 07:31:05 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:u2Lwnm4VGs9pSeWo171AocMBiNKXEoOmCWGhdEN:km4VGESenTBiNCEoeWJN
TLSH T1853190DA05518B311403CA5E73F2714CA68EA3FB2D4FD7E0C91D0EAA428978CF261B49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/f9161en/an/an/a
http://5.182.210.174/e4ba02n/an/an/a
http://5.182.210.174/908bb5n/an/an/a
http://5.182.210.174/5151c3n/an/an/a
http://5.182.210.174/1eda19n/an/an/a
http://5.182.210.174/ca7c0an/an/an/a
http://5.182.210.174/e8880fn/an/an/a
http://5.182.210.174/55d285n/an/an/a
http://5.182.210.174/71a1a1n/an/an/a
http://5.182.210.174/0c965dn/an/an/a
http://5.182.210.174/f44823n/an/an/a
http://5.182.210.174/0af3c3n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8a19cd6e3d629fe001d268/reports/6f6ef9d9-5929-4287-9407-7ef1acf0b276/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c8a73766-5444-4725-b296-04b7f287b57f
Behavior Graph:
Download SVG
%3 guuid=cf18b3de-1600-0000-1eb8-9dbb830c0000 pid=3203 /usr/bin/sudo guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204 /tmp/sample.bin guuid=cf18b3de-1600-0000-1eb8-9dbb830c0000 pid=3203->guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204 execve guuid=fef6c4e3-1600-0000-1eb8-9dbb850c0000 pid=3205 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=fef6c4e3-1600-0000-1eb8-9dbb850c0000 pid=3205 execve guuid=6880a7ea-1600-0000-1eb8-9dbb900c0000 pid=3216 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=6880a7ea-1600-0000-1eb8-9dbb900c0000 pid=3216 execve guuid=5bbb32f4-1600-0000-1eb8-9dbba10c0000 pid=3233 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=5bbb32f4-1600-0000-1eb8-9dbba10c0000 pid=3233 execve guuid=055f80f4-1600-0000-1eb8-9dbba20c0000 pid=3234 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=055f80f4-1600-0000-1eb8-9dbba20c0000 pid=3234 clone guuid=bbc2e2f4-1600-0000-1eb8-9dbba40c0000 pid=3236 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=bbc2e2f4-1600-0000-1eb8-9dbba40c0000 pid=3236 execve guuid=4f8a3bf5-1600-0000-1eb8-9dbba70c0000 pid=3239 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=4f8a3bf5-1600-0000-1eb8-9dbba70c0000 pid=3239 execve guuid=d55d9bf5-1600-0000-1eb8-9dbba90c0000 pid=3241 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=d55d9bf5-1600-0000-1eb8-9dbba90c0000 pid=3241 execve guuid=201437f8-1600-0000-1eb8-9dbbb20c0000 pid=3250 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=201437f8-1600-0000-1eb8-9dbbb20c0000 pid=3250 execve guuid=2c06a5fc-1600-0000-1eb8-9dbbbd0c0000 pid=3261 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=2c06a5fc-1600-0000-1eb8-9dbbbd0c0000 pid=3261 execve guuid=69d9e6fc-1600-0000-1eb8-9dbbbf0c0000 pid=3263 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=69d9e6fc-1600-0000-1eb8-9dbbbf0c0000 pid=3263 clone guuid=bbe425fd-1600-0000-1eb8-9dbbc20c0000 pid=3266 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=bbe425fd-1600-0000-1eb8-9dbbc20c0000 pid=3266 execve guuid=4b7c27ff-1600-0000-1eb8-9dbbc80c0000 pid=3272 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=4b7c27ff-1600-0000-1eb8-9dbbc80c0000 pid=3272 execve guuid=85cb84ff-1600-0000-1eb8-9dbbca0c0000 pid=3274 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=85cb84ff-1600-0000-1eb8-9dbbca0c0000 pid=3274 execve guuid=c5f0fb02-1700-0000-1eb8-9dbbd30c0000 pid=3283 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=c5f0fb02-1700-0000-1eb8-9dbbd30c0000 pid=3283 execve guuid=45bd1c08-1700-0000-1eb8-9dbbe10c0000 pid=3297 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=45bd1c08-1700-0000-1eb8-9dbbe10c0000 pid=3297 execve guuid=a8b87408-1700-0000-1eb8-9dbbe30c0000 pid=3299 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=a8b87408-1700-0000-1eb8-9dbbe30c0000 pid=3299 clone guuid=d103be08-1700-0000-1eb8-9dbbe60c0000 pid=3302 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=d103be08-1700-0000-1eb8-9dbbe60c0000 pid=3302 execve guuid=d8ee1309-1700-0000-1eb8-9dbbe80c0000 pid=3304 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=d8ee1309-1700-0000-1eb8-9dbbe80c0000 pid=3304 execve guuid=3bea6b09-1700-0000-1eb8-9dbbea0c0000 pid=3306 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=3bea6b09-1700-0000-1eb8-9dbbea0c0000 pid=3306 execve guuid=a534910c-1700-0000-1eb8-9dbbf30c0000 pid=3315 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=a534910c-1700-0000-1eb8-9dbbf30c0000 pid=3315 execve guuid=c8f1ee10-1700-0000-1eb8-9dbb010d0000 pid=3329 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=c8f1ee10-1700-0000-1eb8-9dbb010d0000 pid=3329 execve guuid=6f033611-1700-0000-1eb8-9dbb040d0000 pid=3332 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=6f033611-1700-0000-1eb8-9dbb040d0000 pid=3332 clone guuid=459f7211-1700-0000-1eb8-9dbb060d0000 pid=3334 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=459f7211-1700-0000-1eb8-9dbb060d0000 pid=3334 execve guuid=b993b311-1700-0000-1eb8-9dbb080d0000 pid=3336 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=b993b311-1700-0000-1eb8-9dbb080d0000 pid=3336 execve guuid=4e4ff511-1700-0000-1eb8-9dbb0a0d0000 pid=3338 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=4e4ff511-1700-0000-1eb8-9dbb0a0d0000 pid=3338 execve guuid=b0628d14-1700-0000-1eb8-9dbb130d0000 pid=3347 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=b0628d14-1700-0000-1eb8-9dbb130d0000 pid=3347 execve guuid=33b1fc18-1700-0000-1eb8-9dbb1e0d0000 pid=3358 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=33b1fc18-1700-0000-1eb8-9dbb1e0d0000 pid=3358 execve guuid=d7267319-1700-0000-1eb8-9dbb210d0000 pid=3361 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=d7267319-1700-0000-1eb8-9dbb210d0000 pid=3361 clone guuid=b2d7091a-1700-0000-1eb8-9dbb240d0000 pid=3364 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=b2d7091a-1700-0000-1eb8-9dbb240d0000 pid=3364 execve guuid=aaceab1a-1700-0000-1eb8-9dbb270d0000 pid=3367 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=aaceab1a-1700-0000-1eb8-9dbb270d0000 pid=3367 execve guuid=17d0a11b-1700-0000-1eb8-9dbb290d0000 pid=3369 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=17d0a11b-1700-0000-1eb8-9dbb290d0000 pid=3369 execve guuid=cbd4f21f-1700-0000-1eb8-9dbb370d0000 pid=3383 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=cbd4f21f-1700-0000-1eb8-9dbb370d0000 pid=3383 execve guuid=e764a826-1700-0000-1eb8-9dbb470d0000 pid=3399 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=e764a826-1700-0000-1eb8-9dbb470d0000 pid=3399 execve guuid=5d7b5027-1700-0000-1eb8-9dbb490d0000 pid=3401 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=5d7b5027-1700-0000-1eb8-9dbb490d0000 pid=3401 clone guuid=0bfe0428-1700-0000-1eb8-9dbb4c0d0000 pid=3404 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=0bfe0428-1700-0000-1eb8-9dbb4c0d0000 pid=3404 execve guuid=9d22c628-1700-0000-1eb8-9dbb510d0000 pid=3409 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=9d22c628-1700-0000-1eb8-9dbb510d0000 pid=3409 execve guuid=90c62629-1700-0000-1eb8-9dbb520d0000 pid=3410 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=90c62629-1700-0000-1eb8-9dbb520d0000 pid=3410 execve guuid=444e972d-1700-0000-1eb8-9dbb530d0000 pid=3411 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=444e972d-1700-0000-1eb8-9dbb530d0000 pid=3411 execve guuid=39bb8431-1700-0000-1eb8-9dbb590d0000 pid=3417 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=39bb8431-1700-0000-1eb8-9dbb590d0000 pid=3417 execve guuid=d24cc631-1700-0000-1eb8-9dbb5a0d0000 pid=3418 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=d24cc631-1700-0000-1eb8-9dbb5a0d0000 pid=3418 clone guuid=aaf8f631-1700-0000-1eb8-9dbb5d0d0000 pid=3421 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=aaf8f631-1700-0000-1eb8-9dbb5d0d0000 pid=3421 execve guuid=ff883932-1700-0000-1eb8-9dbb5e0d0000 pid=3422 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=ff883932-1700-0000-1eb8-9dbb5e0d0000 pid=3422 execve guuid=4c9e7132-1700-0000-1eb8-9dbb600d0000 pid=3424 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=4c9e7132-1700-0000-1eb8-9dbb600d0000 pid=3424 execve guuid=3b05d134-1700-0000-1eb8-9dbb670d0000 pid=3431 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=3b05d134-1700-0000-1eb8-9dbb670d0000 pid=3431 execve guuid=65d63b3a-1700-0000-1eb8-9dbb6f0d0000 pid=3439 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=65d63b3a-1700-0000-1eb8-9dbb6f0d0000 pid=3439 execve guuid=a956b93a-1700-0000-1eb8-9dbb700d0000 pid=3440 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=a956b93a-1700-0000-1eb8-9dbb700d0000 pid=3440 clone guuid=648ef73a-1700-0000-1eb8-9dbb730d0000 pid=3443 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=648ef73a-1700-0000-1eb8-9dbb730d0000 pid=3443 execve guuid=d230a03b-1700-0000-1eb8-9dbb750d0000 pid=3445 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=d230a03b-1700-0000-1eb8-9dbb750d0000 pid=3445 execve guuid=32812b3c-1700-0000-1eb8-9dbb770d0000 pid=3447 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=32812b3c-1700-0000-1eb8-9dbb770d0000 pid=3447 execve guuid=7e11d13f-1700-0000-1eb8-9dbb800d0000 pid=3456 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=7e11d13f-1700-0000-1eb8-9dbb800d0000 pid=3456 execve guuid=43c18244-1700-0000-1eb8-9dbb8c0d0000 pid=3468 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=43c18244-1700-0000-1eb8-9dbb8c0d0000 pid=3468 execve guuid=3a15cc44-1700-0000-1eb8-9dbb8d0d0000 pid=3469 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=3a15cc44-1700-0000-1eb8-9dbb8d0d0000 pid=3469 clone guuid=0dd50245-1700-0000-1eb8-9dbb900d0000 pid=3472 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=0dd50245-1700-0000-1eb8-9dbb900d0000 pid=3472 execve guuid=49374345-1700-0000-1eb8-9dbb920d0000 pid=3474 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=49374345-1700-0000-1eb8-9dbb920d0000 pid=3474 execve guuid=4fe17e45-1700-0000-1eb8-9dbb930d0000 pid=3475 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=4fe17e45-1700-0000-1eb8-9dbb930d0000 pid=3475 execve guuid=19b40148-1700-0000-1eb8-9dbb9b0d0000 pid=3483 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=19b40148-1700-0000-1eb8-9dbb9b0d0000 pid=3483 execve guuid=7c80ce4c-1700-0000-1eb8-9dbbaf0d0000 pid=3503 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=7c80ce4c-1700-0000-1eb8-9dbbaf0d0000 pid=3503 execve guuid=21fe0c4d-1700-0000-1eb8-9dbbb00d0000 pid=3504 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=21fe0c4d-1700-0000-1eb8-9dbbb00d0000 pid=3504 clone guuid=1b85484d-1700-0000-1eb8-9dbbb30d0000 pid=3507 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=1b85484d-1700-0000-1eb8-9dbbb30d0000 pid=3507 execve guuid=0d6b9a4d-1700-0000-1eb8-9dbbb40d0000 pid=3508 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=0d6b9a4d-1700-0000-1eb8-9dbbb40d0000 pid=3508 execve guuid=d097024e-1700-0000-1eb8-9dbbb60d0000 pid=3510 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=d097024e-1700-0000-1eb8-9dbbb60d0000 pid=3510 execve guuid=2c6ba350-1700-0000-1eb8-9dbbbd0d0000 pid=3517 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=2c6ba350-1700-0000-1eb8-9dbbbd0d0000 pid=3517 execve guuid=a4496e55-1700-0000-1eb8-9dbbcb0d0000 pid=3531 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=a4496e55-1700-0000-1eb8-9dbbcb0d0000 pid=3531 execve guuid=201fde55-1700-0000-1eb8-9dbbce0d0000 pid=3534 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=201fde55-1700-0000-1eb8-9dbbce0d0000 pid=3534 clone guuid=c5822f56-1700-0000-1eb8-9dbbd10d0000 pid=3537 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=c5822f56-1700-0000-1eb8-9dbbd10d0000 pid=3537 execve guuid=10bb9956-1700-0000-1eb8-9dbbd30d0000 pid=3539 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=10bb9956-1700-0000-1eb8-9dbbd30d0000 pid=3539 execve guuid=7b12de56-1700-0000-1eb8-9dbbd50d0000 pid=3541 /usr/bin/wget net send-data guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=7b12de56-1700-0000-1eb8-9dbbd50d0000 pid=3541 execve guuid=2f6e6359-1700-0000-1eb8-9dbbdc0d0000 pid=3548 /usr/bin/curl net send-data write-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=2f6e6359-1700-0000-1eb8-9dbbdc0d0000 pid=3548 execve guuid=73b0fc5c-1700-0000-1eb8-9dbbe60d0000 pid=3558 /usr/bin/chmod guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=73b0fc5c-1700-0000-1eb8-9dbbe60d0000 pid=3558 execve guuid=bfbc405d-1700-0000-1eb8-9dbbe80d0000 pid=3560 /usr/bin/bash guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=bfbc405d-1700-0000-1eb8-9dbbe80d0000 pid=3560 clone guuid=6acd815d-1700-0000-1eb8-9dbbeb0d0000 pid=3563 /usr/bin/rm delete-file guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=6acd815d-1700-0000-1eb8-9dbbeb0d0000 pid=3563 execve guuid=0131e05d-1700-0000-1eb8-9dbbee0d0000 pid=3566 /usr/bin/rm guuid=4a3e76e2-1600-0000-1eb8-9dbb840c0000 pid=3204->guuid=0131e05d-1700-0000-1eb8-9dbbee0d0000 pid=3566 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=fef6c4e3-1600-0000-1eb8-9dbb850c0000 pid=3205->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6880a7ea-1600-0000-1eb8-9dbb900c0000 pid=3216->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cff0acf4-1600-0000-1eb8-9dbba30c0000 pid=3235 /usr/bin/bash guuid=055f80f4-1600-0000-1eb8-9dbba20c0000 pid=3234->guuid=cff0acf4-1600-0000-1eb8-9dbba30c0000 pid=3235 clone guuid=d55d9bf5-1600-0000-1eb8-9dbba90c0000 pid=3241->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=201437f8-1600-0000-1eb8-9dbbb20c0000 pid=3250->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bf90fdfc-1600-0000-1eb8-9dbbc00c0000 pid=3264 /usr/bin/bash guuid=69d9e6fc-1600-0000-1eb8-9dbbbf0c0000 pid=3263->guuid=bf90fdfc-1600-0000-1eb8-9dbbc00c0000 pid=3264 clone guuid=85cb84ff-1600-0000-1eb8-9dbbca0c0000 pid=3274->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c5f0fb02-1700-0000-1eb8-9dbbd30c0000 pid=3283->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=65dc9508-1700-0000-1eb8-9dbbe40c0000 pid=3300 /usr/bin/bash guuid=a8b87408-1700-0000-1eb8-9dbbe30c0000 pid=3299->guuid=65dc9508-1700-0000-1eb8-9dbbe40c0000 pid=3300 clone guuid=3bea6b09-1700-0000-1eb8-9dbbea0c0000 pid=3306->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a534910c-1700-0000-1eb8-9dbbf30c0000 pid=3315->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=34834c11-1700-0000-1eb8-9dbb050d0000 pid=3333 /usr/bin/bash guuid=6f033611-1700-0000-1eb8-9dbb040d0000 pid=3332->guuid=34834c11-1700-0000-1eb8-9dbb050d0000 pid=3333 clone guuid=4e4ff511-1700-0000-1eb8-9dbb0a0d0000 pid=3338->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b0628d14-1700-0000-1eb8-9dbb130d0000 pid=3347->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6cd9b119-1700-0000-1eb8-9dbb220d0000 pid=3362 /usr/bin/bash guuid=d7267319-1700-0000-1eb8-9dbb210d0000 pid=3361->guuid=6cd9b119-1700-0000-1eb8-9dbb220d0000 pid=3362 clone guuid=17d0a11b-1700-0000-1eb8-9dbb290d0000 pid=3369->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cbd4f21f-1700-0000-1eb8-9dbb370d0000 pid=3383->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c4bed127-1700-0000-1eb8-9dbb4b0d0000 pid=3403 /usr/bin/bash guuid=5d7b5027-1700-0000-1eb8-9dbb490d0000 pid=3401->guuid=c4bed127-1700-0000-1eb8-9dbb4b0d0000 pid=3403 clone guuid=90c62629-1700-0000-1eb8-9dbb520d0000 pid=3410->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=444e972d-1700-0000-1eb8-9dbb530d0000 pid=3411->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=44e8db31-1700-0000-1eb8-9dbb5b0d0000 pid=3419 /usr/bin/bash guuid=d24cc631-1700-0000-1eb8-9dbb5a0d0000 pid=3418->guuid=44e8db31-1700-0000-1eb8-9dbb5b0d0000 pid=3419 clone guuid=4c9e7132-1700-0000-1eb8-9dbb600d0000 pid=3424->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3b05d134-1700-0000-1eb8-9dbb670d0000 pid=3431->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6149d93a-1700-0000-1eb8-9dbb710d0000 pid=3441 /usr/bin/bash guuid=a956b93a-1700-0000-1eb8-9dbb700d0000 pid=3440->guuid=6149d93a-1700-0000-1eb8-9dbb710d0000 pid=3441 clone guuid=32812b3c-1700-0000-1eb8-9dbb770d0000 pid=3447->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7e11d13f-1700-0000-1eb8-9dbb800d0000 pid=3456->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=dbe6e044-1700-0000-1eb8-9dbb8f0d0000 pid=3471 /usr/bin/bash guuid=3a15cc44-1700-0000-1eb8-9dbb8d0d0000 pid=3469->guuid=dbe6e044-1700-0000-1eb8-9dbb8f0d0000 pid=3471 clone guuid=4fe17e45-1700-0000-1eb8-9dbb930d0000 pid=3475->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=19b40148-1700-0000-1eb8-9dbb9b0d0000 pid=3483->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a2f21f4d-1700-0000-1eb8-9dbbb10d0000 pid=3505 /usr/bin/bash guuid=21fe0c4d-1700-0000-1eb8-9dbbb00d0000 pid=3504->guuid=a2f21f4d-1700-0000-1eb8-9dbbb10d0000 pid=3505 clone guuid=d097024e-1700-0000-1eb8-9dbbb60d0000 pid=3510->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2c6ba350-1700-0000-1eb8-9dbbbd0d0000 pid=3517->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9a74fe55-1700-0000-1eb8-9dbbcf0d0000 pid=3535 /usr/bin/bash guuid=201fde55-1700-0000-1eb8-9dbbce0d0000 pid=3534->guuid=9a74fe55-1700-0000-1eb8-9dbbcf0d0000 pid=3535 clone guuid=7b12de56-1700-0000-1eb8-9dbbd50d0000 pid=3541->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2f6e6359-1700-0000-1eb8-9dbbdc0d0000 pid=3548->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9c2f555d-1700-0000-1eb8-9dbbe90d0000 pid=3561 /usr/bin/bash guuid=bfbc405d-1700-0000-1eb8-9dbbe80d0000 pid=3560->guuid=9c2f555d-1700-0000-1eb8-9dbbe90d0000 pid=3561 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4cc6621aa8311d15b172c95edeb7da76a7d3ab35f6ef0a74f3a0a5b85384865c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cc6621aa8311d15b172c95edeb7da76a7d3ab35f6ef0a74f3a0a5b85384865c/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-22 21:51:20 UTC
File Type:
Text (Shell)
AV detection:
17 of 37 (45.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jtdgegvigeorlmlszfpn5n62o2t5hkzv63xqu5htucs3qu4eqzoa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260822-1qhjpszdjc/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/4cc6621aa8311d15b172c95edeb7da76a7d3ab35f6ef0a74f3a0a5b85384865c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 4cc6621aa8311d15b172c95edeb7da76a7d3ab35f6ef0a74f3a0a5b85384865c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments