MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f330df2b5e0e3cac30d9f2907ccd155eba3fed8f3f5ebcb66650b542c183fec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f330df2b5e0e3cac30d9f2907ccd155eba3fed8f3f5ebcb66650b542c183fec
SHA3-384 hash: 9b3f9f2dbeea385bb855c73e747579b0693100a94bd12dbffa1ccfbda2c5e54ab07cd5e57ef5deff0584fa544f5d7880
SHA1 hash: 463b70db77c55dc3b979e3ed6c7a0f0ef4a61669
MD5 hash: bcd1db9de826cfd3e3dc82a2e37b7ee3
humanhash: zulu-earth-fix-robin
File name:pulse
Download: download sample
Signature Mirai
Create hunting rule
File size:2'835 bytes
First seen:2025-10-14 20:14:59 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vTKNYKNqKNEKNOKNNkzEKNJKNqKNjKNEKNSKNLRUfKNZKNGKa:vTKNYKNqKNEKNOKNmEKNJKNqKNjKNEKp
TLSH T1C9514EC4B32243B07FE25D727DB5406CB2C9E1D1B6C59E89D8ECA8BD818DF0C14A06A3
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://64.91.237.162/bins/sora.x869209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10 Miraimirai opendir
http://64.91.237.162/bins/sora.mips29c7491b527a0e18a776b8cc1831a8ba4b97d917fd76d047c96cc5ae21a79924 Miraimirai opendir
http://64.91.237.162/bins/sora.x86_647e8a271658bd0f9be6bf33a2ea92ce4fad4774aafac33c5b2caedf6417fd15ac Miraimirai opendir
http://64.91.237.162/bins/sora.i468n/an/aelf ua-wget
http://64.91.237.162/bins/sora.i68692575fbaacd79518241425e42a4cdacbf65def900864a48fc0b27504f78cbff4 Miraimirai opendir
http://64.91.237.162/bins/sora.mpsla3b52b958c8ea783c24f7a02fb57b5228fc1969791021519b42e14e58124e30d Miraimirai opendir
http://64.91.237.162/bins/sora.arm4n/an/aelf ua-wget
http://64.91.237.162/bins/sora.arm56357efa12b55a6c1f2d555f6dbbe40a0ed2d5c1e2dced815347fa98881eeefcb Miraimirai opendir
http://64.91.237.162/bins/sora.arm6579e9db35f7d3e276a6fd3b2bb98091a12c58d4cb0cd0ed3ae3cdbfd19304b0a Miraimirai opendir
http://64.91.237.162/bins/sora.arm7a2a3eda8d88cb807ffc26480a5a40cf79ac74b135b8aadaa225fed856da77cef Miraimirai opendir
http://64.91.237.162/bins/sora.ppc773298e6d3a314ffe9554eeea412ac65fbb16cf4030acf0e2553c42a1f159bb2 Miraimirai opendir
http://64.91.237.162/bins/sora.ppc440fpn/an/aelf ua-wget
http://64.91.237.162/bins/sora.m68ka25e8659220a59deaae914fc945fa6b31667bc0c7146a968bec1c4be9ffee9ed Miraimirai opendir
http://64.91.237.162/bins/sora.sh40dd50416937f0bbb202464b09fb982739b34bde7d11834b78a137fc4659502de Miraimirai opendir

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-14T17:40:00Z UTC
Last seen:
2025-10-14T19:48:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4f330df2b5e0e3cac30d9f2907ccd155eba3fed8f3f5ebcb66650b542c183fec/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/084a921b-3c75-4cd2-aabb-e300f0b411c2
Behavior Graph:
Download SVG
%3 guuid=ca3838de-2400-0000-e4ce-bdae75140000 pid=5237 /usr/bin/sudo guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238 /tmp/sample.bin guuid=ca3838de-2400-0000-e4ce-bdae75140000 pid=5237->guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238 execve guuid=b6b91fe4-2400-0000-e4ce-bdae77140000 pid=5239 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=b6b91fe4-2400-0000-e4ce-bdae77140000 pid=5239 execve guuid=ead41400-2500-0000-e4ce-bdae78140000 pid=5240 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=ead41400-2500-0000-e4ce-bdae78140000 pid=5240 execve guuid=694a7d17-2500-0000-e4ce-bdae79140000 pid=5241 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=694a7d17-2500-0000-e4ce-bdae79140000 pid=5241 execve guuid=cd8f1318-2500-0000-e4ce-bdae7a140000 pid=5242 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=cd8f1318-2500-0000-e4ce-bdae7a140000 pid=5242 execve guuid=a5f77b18-2500-0000-e4ce-bdae7b140000 pid=5243 /tmp/robben net guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=a5f77b18-2500-0000-e4ce-bdae7b140000 pid=5243 execve guuid=ad7d4c1c-2500-0000-e4ce-bdae7c140000 pid=5244 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=ad7d4c1c-2500-0000-e4ce-bdae7c140000 pid=5244 execve guuid=fdb97631-2500-0000-e4ce-bdae7d140000 pid=5245 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=fdb97631-2500-0000-e4ce-bdae7d140000 pid=5245 execve guuid=61d51a4c-2500-0000-e4ce-bdae7f140000 pid=5247 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=61d51a4c-2500-0000-e4ce-bdae7f140000 pid=5247 execve guuid=7b236b4c-2500-0000-e4ce-bdae80140000 pid=5248 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=7b236b4c-2500-0000-e4ce-bdae80140000 pid=5248 execve guuid=b583aa4c-2500-0000-e4ce-bdae81140000 pid=5249 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=b583aa4c-2500-0000-e4ce-bdae81140000 pid=5249 clone guuid=28c8834d-2500-0000-e4ce-bdae83140000 pid=5251 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=28c8834d-2500-0000-e4ce-bdae83140000 pid=5251 execve guuid=6080ac64-2500-0000-e4ce-bdae89140000 pid=5257 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=6080ac64-2500-0000-e4ce-bdae89140000 pid=5257 execve guuid=ed16c07c-2500-0000-e4ce-bdae8a140000 pid=5258 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=ed16c07c-2500-0000-e4ce-bdae8a140000 pid=5258 execve guuid=9bb04d7d-2500-0000-e4ce-bdae8b140000 pid=5259 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=9bb04d7d-2500-0000-e4ce-bdae8b140000 pid=5259 execve guuid=563e977d-2500-0000-e4ce-bdae8c140000 pid=5260 /tmp/robben mprotect-exec net guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=563e977d-2500-0000-e4ce-bdae8c140000 pid=5260 execve guuid=91aafd81-2500-0000-e4ce-bdae8d140000 pid=5261 /usr/bin/wget net send-data guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=91aafd81-2500-0000-e4ce-bdae8d140000 pid=5261 execve guuid=99baf691-2500-0000-e4ce-bdae95140000 pid=5269 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=99baf691-2500-0000-e4ce-bdae95140000 pid=5269 execve guuid=07b53da2-2500-0000-e4ce-bdae97140000 pid=5271 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=07b53da2-2500-0000-e4ce-bdae97140000 pid=5271 execve guuid=e3f59da2-2500-0000-e4ce-bdae98140000 pid=5272 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=e3f59da2-2500-0000-e4ce-bdae98140000 pid=5272 execve guuid=97c5eaa2-2500-0000-e4ce-bdae99140000 pid=5273 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=97c5eaa2-2500-0000-e4ce-bdae99140000 pid=5273 clone guuid=e29f1fa3-2500-0000-e4ce-bdae9a140000 pid=5274 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=e29f1fa3-2500-0000-e4ce-bdae9a140000 pid=5274 execve guuid=dfff72b8-2500-0000-e4ce-bdae9d140000 pid=5277 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=dfff72b8-2500-0000-e4ce-bdae9d140000 pid=5277 execve guuid=99c298cf-2500-0000-e4ce-bdaeae140000 pid=5294 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=99c298cf-2500-0000-e4ce-bdaeae140000 pid=5294 execve guuid=a489f0cf-2500-0000-e4ce-bdaeaf140000 pid=5295 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=a489f0cf-2500-0000-e4ce-bdaeaf140000 pid=5295 execve guuid=d2003ad0-2500-0000-e4ce-bdaeb0140000 pid=5296 /tmp/robben net guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=d2003ad0-2500-0000-e4ce-bdaeb0140000 pid=5296 execve guuid=919952d3-2500-0000-e4ce-bdaeb1140000 pid=5297 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=919952d3-2500-0000-e4ce-bdaeb1140000 pid=5297 execve guuid=c6ce7be8-2500-0000-e4ce-bdaeb2140000 pid=5298 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=c6ce7be8-2500-0000-e4ce-bdaeb2140000 pid=5298 execve guuid=11b3b1fe-2500-0000-e4ce-bdaeb3140000 pid=5299 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=11b3b1fe-2500-0000-e4ce-bdaeb3140000 pid=5299 execve guuid=54d097ff-2500-0000-e4ce-bdaeb4140000 pid=5300 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=54d097ff-2500-0000-e4ce-bdaeb4140000 pid=5300 execve guuid=67821300-2600-0000-e4ce-bdaeb5140000 pid=5301 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=67821300-2600-0000-e4ce-bdaeb5140000 pid=5301 clone guuid=1bd23601-2600-0000-e4ce-bdaeb7140000 pid=5303 /usr/bin/wget net send-data guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=1bd23601-2600-0000-e4ce-bdaeb7140000 pid=5303 execve guuid=a947f70f-2600-0000-e4ce-bdaeb8140000 pid=5304 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=a947f70f-2600-0000-e4ce-bdaeb8140000 pid=5304 execve guuid=249c1420-2600-0000-e4ce-bdaeb9140000 pid=5305 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=249c1420-2600-0000-e4ce-bdaeb9140000 pid=5305 execve guuid=c3646d20-2600-0000-e4ce-bdaeba140000 pid=5306 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=c3646d20-2600-0000-e4ce-bdaeba140000 pid=5306 execve guuid=d2f3bb20-2600-0000-e4ce-bdaebb140000 pid=5307 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=d2f3bb20-2600-0000-e4ce-bdaebb140000 pid=5307 clone guuid=cb62e820-2600-0000-e4ce-bdaebc140000 pid=5308 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=cb62e820-2600-0000-e4ce-bdaebc140000 pid=5308 execve guuid=2f538a36-2600-0000-e4ce-bdaebd140000 pid=5309 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=2f538a36-2600-0000-e4ce-bdaebd140000 pid=5309 execve guuid=ea86c74d-2600-0000-e4ce-bdaebe140000 pid=5310 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=ea86c74d-2600-0000-e4ce-bdaebe140000 pid=5310 execve guuid=60c26f4e-2600-0000-e4ce-bdaebf140000 pid=5311 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=60c26f4e-2600-0000-e4ce-bdaebf140000 pid=5311 execve guuid=87433c4f-2600-0000-e4ce-bdaec0140000 pid=5312 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=87433c4f-2600-0000-e4ce-bdaec0140000 pid=5312 clone guuid=fc5b6f50-2600-0000-e4ce-bdaec2140000 pid=5314 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=fc5b6f50-2600-0000-e4ce-bdaec2140000 pid=5314 execve guuid=6290af65-2600-0000-e4ce-bdaec3140000 pid=5315 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=6290af65-2600-0000-e4ce-bdaec3140000 pid=5315 execve guuid=ddcc6c7c-2600-0000-e4ce-bdaec4140000 pid=5316 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=ddcc6c7c-2600-0000-e4ce-bdaec4140000 pid=5316 execve guuid=d1e0ba7c-2600-0000-e4ce-bdaec5140000 pid=5317 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=d1e0ba7c-2600-0000-e4ce-bdaec5140000 pid=5317 execve guuid=9aee147d-2600-0000-e4ce-bdaec6140000 pid=5318 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=9aee147d-2600-0000-e4ce-bdaec6140000 pid=5318 clone guuid=ea70fb7d-2600-0000-e4ce-bdaec8140000 pid=5320 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=ea70fb7d-2600-0000-e4ce-bdaec8140000 pid=5320 execve guuid=b870b09a-2600-0000-e4ce-bdaec9140000 pid=5321 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=b870b09a-2600-0000-e4ce-bdaec9140000 pid=5321 execve guuid=f7e259b9-2600-0000-e4ce-bdaeca140000 pid=5322 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=f7e259b9-2600-0000-e4ce-bdaeca140000 pid=5322 execve guuid=b2424eba-2600-0000-e4ce-bdaecb140000 pid=5323 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=b2424eba-2600-0000-e4ce-bdaecb140000 pid=5323 execve guuid=a6d4f7ba-2600-0000-e4ce-bdaecc140000 pid=5324 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=a6d4f7ba-2600-0000-e4ce-bdaecc140000 pid=5324 clone guuid=e862afbb-2600-0000-e4ce-bdaece140000 pid=5326 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=e862afbb-2600-0000-e4ce-bdaece140000 pid=5326 execve guuid=19020cd2-2600-0000-e4ce-bdaecf140000 pid=5327 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=19020cd2-2600-0000-e4ce-bdaecf140000 pid=5327 execve guuid=01d2cbe8-2600-0000-e4ce-bdaed0140000 pid=5328 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=01d2cbe8-2600-0000-e4ce-bdaed0140000 pid=5328 execve guuid=708256e9-2600-0000-e4ce-bdaed1140000 pid=5329 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=708256e9-2600-0000-e4ce-bdaed1140000 pid=5329 execve guuid=7162d3e9-2600-0000-e4ce-bdaed2140000 pid=5330 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=7162d3e9-2600-0000-e4ce-bdaed2140000 pid=5330 clone guuid=9dd373eb-2600-0000-e4ce-bdaed4140000 pid=5332 /usr/bin/wget net send-data guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=9dd373eb-2600-0000-e4ce-bdaed4140000 pid=5332 execve guuid=5f46ebfa-2600-0000-e4ce-bdaed5140000 pid=5333 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=5f46ebfa-2600-0000-e4ce-bdaed5140000 pid=5333 execve guuid=ebde090c-2700-0000-e4ce-bdaed6140000 pid=5334 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=ebde090c-2700-0000-e4ce-bdaed6140000 pid=5334 execve guuid=0078990c-2700-0000-e4ce-bdaed7140000 pid=5335 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=0078990c-2700-0000-e4ce-bdaed7140000 pid=5335 execve guuid=4890100d-2700-0000-e4ce-bdaed8140000 pid=5336 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=4890100d-2700-0000-e4ce-bdaed8140000 pid=5336 clone guuid=4687460d-2700-0000-e4ce-bdaed9140000 pid=5337 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=4687460d-2700-0000-e4ce-bdaed9140000 pid=5337 execve guuid=d02eb629-2700-0000-e4ce-bdaeda140000 pid=5338 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=d02eb629-2700-0000-e4ce-bdaeda140000 pid=5338 execve guuid=dfeab447-2700-0000-e4ce-bdaedb140000 pid=5339 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=dfeab447-2700-0000-e4ce-bdaedb140000 pid=5339 execve guuid=40777348-2700-0000-e4ce-bdaedc140000 pid=5340 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=40777348-2700-0000-e4ce-bdaedc140000 pid=5340 execve guuid=2068c648-2700-0000-e4ce-bdaedd140000 pid=5341 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=2068c648-2700-0000-e4ce-bdaedd140000 pid=5341 clone guuid=bc0d304a-2700-0000-e4ce-bdaedf140000 pid=5343 /usr/bin/wget net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=bc0d304a-2700-0000-e4ce-bdaedf140000 pid=5343 execve guuid=47f96267-2700-0000-e4ce-bdaee0140000 pid=5344 /usr/bin/curl net send-data write-file guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=47f96267-2700-0000-e4ce-bdaee0140000 pid=5344 execve guuid=ec3c0886-2700-0000-e4ce-bdaee1140000 pid=5345 /usr/bin/cat guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=ec3c0886-2700-0000-e4ce-bdaee1140000 pid=5345 execve guuid=46cba386-2700-0000-e4ce-bdaee2140000 pid=5346 /usr/bin/chmod guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=46cba386-2700-0000-e4ce-bdaee2140000 pid=5346 execve guuid=a1da1787-2700-0000-e4ce-bdaee3140000 pid=5347 /usr/bin/bash guuid=0b6e98e3-2400-0000-e4ce-bdae76140000 pid=5238->guuid=a1da1787-2700-0000-e4ce-bdaee3140000 pid=5347 clone 10651e68-131f-5e6d-a670-1d19a7120e88 64.91.237.162:80 guuid=b6b91fe4-2400-0000-e4ce-bdae77140000 pid=5239->10651e68-131f-5e6d-a670-1d19a7120e88 send: 141B guuid=ead41400-2500-0000-e4ce-bdae78140000 pid=5240->10651e68-131f-5e6d-a670-1d19a7120e88 send: 90B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=a5f77b18-2500-0000-e4ce-bdae7b140000 pid=5243->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ad7d4c1c-2500-0000-e4ce-bdae7c140000 pid=5244->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=fdb97631-2500-0000-e4ce-bdae7d140000 pid=5245->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=28c8834d-2500-0000-e4ce-bdae83140000 pid=5251->10651e68-131f-5e6d-a670-1d19a7120e88 send: 144B guuid=6080ac64-2500-0000-e4ce-bdae89140000 pid=5257->10651e68-131f-5e6d-a670-1d19a7120e88 send: 93B guuid=563e977d-2500-0000-e4ce-bdae8c140000 pid=5260->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=91aafd81-2500-0000-e4ce-bdae8d140000 pid=5261->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=99baf691-2500-0000-e4ce-bdae95140000 pid=5269->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=e29f1fa3-2500-0000-e4ce-bdae9a140000 pid=5274->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=dfff72b8-2500-0000-e4ce-bdae9d140000 pid=5277->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=d2003ad0-2500-0000-e4ce-bdaeb0140000 pid=5296->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=919952d3-2500-0000-e4ce-bdaeb1140000 pid=5297->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=c6ce7be8-2500-0000-e4ce-bdaeb2140000 pid=5298->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=1bd23601-2600-0000-e4ce-bdaeb7140000 pid=5303->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=a947f70f-2600-0000-e4ce-bdaeb8140000 pid=5304->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=cb62e820-2600-0000-e4ce-bdaebc140000 pid=5308->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=2f538a36-2600-0000-e4ce-bdaebd140000 pid=5309->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=fc5b6f50-2600-0000-e4ce-bdaec2140000 pid=5314->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=6290af65-2600-0000-e4ce-bdaec3140000 pid=5315->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=ea70fb7d-2600-0000-e4ce-bdaec8140000 pid=5320->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=b870b09a-2600-0000-e4ce-bdaec9140000 pid=5321->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=e862afbb-2600-0000-e4ce-bdaece140000 pid=5326->10651e68-131f-5e6d-a670-1d19a7120e88 send: 141B guuid=19020cd2-2600-0000-e4ce-bdaecf140000 pid=5327->10651e68-131f-5e6d-a670-1d19a7120e88 send: 90B guuid=9dd373eb-2600-0000-e4ce-bdaed4140000 pid=5332->10651e68-131f-5e6d-a670-1d19a7120e88 send: 146B guuid=5f46ebfa-2600-0000-e4ce-bdaed5140000 pid=5333->10651e68-131f-5e6d-a670-1d19a7120e88 send: 95B guuid=4687460d-2700-0000-e4ce-bdaed9140000 pid=5337->10651e68-131f-5e6d-a670-1d19a7120e88 send: 142B guuid=d02eb629-2700-0000-e4ce-bdaeda140000 pid=5338->10651e68-131f-5e6d-a670-1d19a7120e88 send: 91B guuid=bc0d304a-2700-0000-e4ce-bdaedf140000 pid=5343->10651e68-131f-5e6d-a670-1d19a7120e88 send: 141B guuid=47f96267-2700-0000-e4ce-bdaee0140000 pid=5344->10651e68-131f-5e6d-a670-1d19a7120e88 send: 90B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4f330df2b5e0e3cac30d9f2907ccd155eba3fed8f3f5ebcb66650b542c183fec
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f330df2b5e0e3cac30d9f2907ccd155eba3fed8f3f5ebcb66650b542c183fec/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2025-10-14 20:22:25 UTC
File Type:
Text (Shell)
AV detection:
23 of 38 (60.53%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4zq34vv4dr4vqynt4uqptgrkxv2h7wy6p26xs3gmufvilayh7wa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:sora antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251014-y3475atsbv/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (46567) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4f330df2b5e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/4f330df2b5e0e3cac30d9f2907ccd155eba3fed8f3f5ebcb66650b542c183fec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 4f330df2b5e0e3cac30d9f2907ccd155eba3fed8f3f5ebcb66650b542c183fec

(this sample)

Mirai

elf 9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10

  
URLhaus
https://urlhaus.abuse.ch/url/3678181/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3678227/
  
Dropping
MD5 4e24204e7b5dc8623a078e30669fdead
  
Dropping
SHA256 9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10

Comments