MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b
SHA3-384 hash: a08fb17fb43cfbaf05c830dbb19ba2676032377297540c5e5f2892e45999fa0728c3a1285e95b0f78ce2fb36e06d3f57
SHA1 hash: c439b914de2aced88b73984a7c59d9b164e88530
MD5 hash: ef16341fab41d3c9cf70291aa40c3333
humanhash: social-magazine-neptune-coffee
File name:76d32be0.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:4'732 bytes
First seen:2025-09-03 20:42:57 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vIZMV4kgIu1V4kIrHrWV4VIVoV4XIEBEEV4EjIhkV4DIu1V4kIiZV4YIzSV4FIDV:vbKd7f2LyfWEpjbItX3dzm7gBt/R74Ni
TLSH T16AA191F5742897BE2DA0AD7365DA8542B25125B6E1DC0C0AE7D6F0E50D4CF71F890E83
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86n/an/aelf geofenced mirai ua-wget USA x86
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mipsn/an/aelf geofenced mips mirai ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsln/an/aelf geofenced mips mirai ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm236fa5092bd06813996532ef793834e31a69ed1e576599eaa97bcf8fb7db9b61 Miraiarm elf geofenced mirai ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5dc06d5d4daab1b23eef11b6eac8da75bafa7e75a7e44d60fb14c9db8199c7553 Miraiarm elf geofenced mirai ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm641e5adc3527479d2bee1a3bb4c590899d40713df8fd20e0871a8f2e46a7afedd Miraiarm elf geofenced mirai ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm76d65317a9d29fdfee8ff125c78705186155fdb0162f3d13890c43b971bdf6586 Miraiarm elf geofenced mirai ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppcn/an/aelf geofenced mirai PowerPC ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68kn/an/aelf geofenced m68k mirai ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spcn/an/aelf geofenced mirai sparc ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686n/an/aelf geofenced mirai ua-wget USA x86
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4n/an/aelf geofenced mirai SuperH ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arcn/an/aarc elf geofenced mirai ua-wget USA
http://213.209.150.159/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86_64n/an/aelf geofenced mirai ua-wget USA

Intelligence

File Origin
# of uploads :
1
# of downloads :
44
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-03T11:50:00Z UTC
Last seen:
2025-09-03T11:50:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7a64dc72-48a5-4db3-bca5-1fdc8dac3232
Behavior Graph:
Download SVG
%3 guuid=61dfb3fa-1600-0000-8d59-6077210d0000 pid=3361 /usr/bin/sudo guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367 /tmp/sample.bin guuid=61dfb3fa-1600-0000-8d59-6077210d0000 pid=3361->guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367 execve guuid=555470fd-1600-0000-8d59-6077280d0000 pid=3368 /usr/bin/wget net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=555470fd-1600-0000-8d59-6077280d0000 pid=3368 execve guuid=95d0ec0a-1700-0000-8d59-6077450d0000 pid=3397 /usr/bin/curl net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=95d0ec0a-1700-0000-8d59-6077450d0000 pid=3397 execve guuid=29868b1c-1700-0000-8d59-6077750d0000 pid=3445 /usr/bin/cat guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=29868b1c-1700-0000-8d59-6077750d0000 pid=3445 execve guuid=e9d9f71c-1700-0000-8d59-6077770d0000 pid=3447 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=e9d9f71c-1700-0000-8d59-6077770d0000 pid=3447 execve guuid=d48d531d-1700-0000-8d59-6077790d0000 pid=3449 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=d48d531d-1700-0000-8d59-6077790d0000 pid=3449 execve guuid=026db71d-1700-0000-8d59-60777c0d0000 pid=3452 /usr/bin/wget net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=026db71d-1700-0000-8d59-60777c0d0000 pid=3452 execve guuid=700b9d2a-1700-0000-8d59-6077a70d0000 pid=3495 /usr/bin/curl net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=700b9d2a-1700-0000-8d59-6077a70d0000 pid=3495 execve guuid=61124b37-1700-0000-8d59-6077c00d0000 pid=3520 /usr/bin/bash guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=61124b37-1700-0000-8d59-6077c00d0000 pid=3520 clone guuid=53ce7637-1700-0000-8d59-6077c20d0000 pid=3522 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=53ce7637-1700-0000-8d59-6077c20d0000 pid=3522 execve guuid=433afe37-1700-0000-8d59-6077c50d0000 pid=3525 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=433afe37-1700-0000-8d59-6077c50d0000 pid=3525 execve guuid=628d7069-1800-0000-8d59-607797100000 pid=4247 /usr/bin/wget net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=628d7069-1800-0000-8d59-607797100000 pid=4247 execve guuid=49b94e75-1800-0000-8d59-6077c6100000 pid=4294 /usr/bin/curl net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=49b94e75-1800-0000-8d59-6077c6100000 pid=4294 execve guuid=c2a2ac84-1800-0000-8d59-6077f1100000 pid=4337 /usr/bin/bash guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=c2a2ac84-1800-0000-8d59-6077f1100000 pid=4337 clone guuid=506be184-1800-0000-8d59-6077f2100000 pid=4338 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=506be184-1800-0000-8d59-6077f2100000 pid=4338 execve guuid=5d717385-1800-0000-8d59-6077f3100000 pid=4339 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=5d717385-1800-0000-8d59-6077f3100000 pid=4339 execve guuid=880a4db8-1900-0000-8d59-607785130000 pid=4997 /usr/bin/wget net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=880a4db8-1900-0000-8d59-607785130000 pid=4997 execve guuid=a74484c3-1900-0000-8d59-6077ac130000 pid=5036 /usr/bin/curl net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=a74484c3-1900-0000-8d59-6077ac130000 pid=5036 execve guuid=2cd6abcf-1900-0000-8d59-6077db130000 pid=5083 /usr/bin/bash guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=2cd6abcf-1900-0000-8d59-6077db130000 pid=5083 clone guuid=bd09e3cf-1900-0000-8d59-6077dc130000 pid=5084 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=bd09e3cf-1900-0000-8d59-6077dc130000 pid=5084 execve guuid=7e2f6ed0-1900-0000-8d59-6077de130000 pid=5086 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=7e2f6ed0-1900-0000-8d59-6077de130000 pid=5086 execve guuid=55b2b506-1b00-0000-8d59-60778e140000 pid=5262 /usr/bin/wget net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=55b2b506-1b00-0000-8d59-60778e140000 pid=5262 execve guuid=9467ab08-1b00-0000-8d59-607791140000 pid=5265 /usr/bin/curl net send-data write-file guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=9467ab08-1b00-0000-8d59-607791140000 pid=5265 execve guuid=d2c37118-1b00-0000-8d59-607792140000 pid=5266 /usr/bin/bash guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=d2c37118-1b00-0000-8d59-607792140000 pid=5266 clone guuid=0ad29a18-1b00-0000-8d59-607793140000 pid=5267 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=0ad29a18-1b00-0000-8d59-607793140000 pid=5267 execve guuid=242aff18-1b00-0000-8d59-607794140000 pid=5268 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=242aff18-1b00-0000-8d59-607794140000 pid=5268 execve guuid=ade4c44c-1c00-0000-8d59-6077b6140000 pid=5302 /usr/bin/wget net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=ade4c44c-1c00-0000-8d59-6077b6140000 pid=5302 execve guuid=9758d74f-1c00-0000-8d59-6077ba140000 pid=5306 /usr/bin/curl net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=9758d74f-1c00-0000-8d59-6077ba140000 pid=5306 execve guuid=797ae252-1c00-0000-8d59-6077bb140000 pid=5307 /usr/bin/bash guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=797ae252-1c00-0000-8d59-6077bb140000 pid=5307 clone guuid=a7f50553-1c00-0000-8d59-6077bc140000 pid=5308 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=a7f50553-1c00-0000-8d59-6077bc140000 pid=5308 execve guuid=d8e69053-1c00-0000-8d59-6077bd140000 pid=5309 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=d8e69053-1c00-0000-8d59-6077bd140000 pid=5309 execve guuid=49a7ba96-2000-0000-8d59-6077bf140000 pid=5311 /usr/bin/wget net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=49a7ba96-2000-0000-8d59-6077bf140000 pid=5311 execve guuid=0faac899-2000-0000-8d59-6077c3140000 pid=5315 /usr/bin/curl net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=0faac899-2000-0000-8d59-6077c3140000 pid=5315 execve guuid=f910a99c-2000-0000-8d59-6077c4140000 pid=5316 /usr/bin/bash guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=f910a99c-2000-0000-8d59-6077c4140000 pid=5316 clone guuid=eddcc19c-2000-0000-8d59-6077c5140000 pid=5317 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=eddcc19c-2000-0000-8d59-6077c5140000 pid=5317 execve guuid=152a239d-2000-0000-8d59-6077c6140000 pid=5318 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=152a239d-2000-0000-8d59-6077c6140000 pid=5318 execve guuid=831fb1e1-2400-0000-8d59-6077c9140000 pid=5321 /usr/bin/wget net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=831fb1e1-2400-0000-8d59-6077c9140000 pid=5321 execve guuid=cb6414e3-2400-0000-8d59-6077cc140000 pid=5324 /usr/bin/curl net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=cb6414e3-2400-0000-8d59-6077cc140000 pid=5324 execve guuid=1e08d0e5-2400-0000-8d59-6077cd140000 pid=5325 /usr/bin/bash guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=1e08d0e5-2400-0000-8d59-6077cd140000 pid=5325 clone guuid=bc58ece5-2400-0000-8d59-6077ce140000 pid=5326 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=bc58ece5-2400-0000-8d59-6077ce140000 pid=5326 execve guuid=23673ae6-2400-0000-8d59-6077cf140000 pid=5327 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=23673ae6-2400-0000-8d59-6077cf140000 pid=5327 execve guuid=9af9a823-2900-0000-8d59-6077d2140000 pid=5330 /usr/bin/wget net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=9af9a823-2900-0000-8d59-6077d2140000 pid=5330 execve guuid=79a21125-2900-0000-8d59-6077d5140000 pid=5333 /usr/bin/curl net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=79a21125-2900-0000-8d59-6077d5140000 pid=5333 execve guuid=ecf8dc27-2900-0000-8d59-6077d6140000 pid=5334 /usr/bin/bash guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=ecf8dc27-2900-0000-8d59-6077d6140000 pid=5334 clone guuid=ffaef227-2900-0000-8d59-6077d7140000 pid=5335 /usr/bin/chmod guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=ffaef227-2900-0000-8d59-6077d7140000 pid=5335 execve guuid=41fd3528-2900-0000-8d59-6077d8140000 pid=5336 /tmp/76d32be0 net guuid=b9c5affc-1600-0000-8d59-6077270d0000 pid=3367->guuid=41fd3528-2900-0000-8d59-6077d8140000 pid=5336 execve f71eebf6-e950-512a-92da-27103fed21f4 213.209.150.159:80 guuid=555470fd-1600-0000-8d59-6077280d0000 pid=3368->f71eebf6-e950-512a-92da-27103fed21f4 send: 199B guuid=95d0ec0a-1700-0000-8d59-6077450d0000 pid=3397->f71eebf6-e950-512a-92da-27103fed21f4 send: 148B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=d48d531d-1700-0000-8d59-6077790d0000 pid=3449->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=712fac1d-1700-0000-8d59-60777b0d0000 pid=3451 /tmp/76d32be0 dns net send-data zombie guuid=d48d531d-1700-0000-8d59-6077790d0000 pid=3449->guuid=712fac1d-1700-0000-8d59-60777b0d0000 pid=3451 clone guuid=712fac1d-1700-0000-8d59-60777b0d0000 pid=3451->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B 2ac2249c-25bc-5019-a88f-33a6c2731b07 cnc.504.su:56999 guuid=712fac1d-1700-0000-8d59-60777b0d0000 pid=3451->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 14B guuid=5b33131e-1700-0000-8d59-60777f0d0000 pid=3455 /tmp/76d32be0 guuid=712fac1d-1700-0000-8d59-60777b0d0000 pid=3451->guuid=5b33131e-1700-0000-8d59-60777f0d0000 pid=3455 clone guuid=8770161e-1700-0000-8d59-6077800d0000 pid=3456 /tmp/76d32be0 net net-scan send-data guuid=712fac1d-1700-0000-8d59-60777b0d0000 pid=3451->guuid=8770161e-1700-0000-8d59-6077800d0000 pid=3456 clone guuid=caf8191e-1700-0000-8d59-6077810d0000 pid=3457 /tmp/76d32be0 guuid=712fac1d-1700-0000-8d59-60777b0d0000 pid=3451->guuid=caf8191e-1700-0000-8d59-6077810d0000 pid=3457 clone 4bcd05e0-7ebf-53bb-9cc8-c008d3256770 cnc.504.su:80 guuid=026db71d-1700-0000-8d59-60777c0d0000 pid=3452->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 200B guuid=8770161e-1700-0000-8d59-6077800d0000 pid=3456->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8770161e-1700-0000-8d59-6077800d0000 pid=3456|send-data send-data to 384 IP addresses review logs to see them all guuid=8770161e-1700-0000-8d59-6077800d0000 pid=3456->guuid=8770161e-1700-0000-8d59-6077800d0000 pid=3456|send-data send guuid=700b9d2a-1700-0000-8d59-6077a70d0000 pid=3495->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 149B guuid=433afe37-1700-0000-8d59-6077c50d0000 pid=3525->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 5fbefa0b-74db-5ddb-909f-7c8f89ca1384 0.0.0.0:46157 guuid=433afe37-1700-0000-8d59-6077c50d0000 pid=3525->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=e9136469-1800-0000-8d59-607795100000 pid=4245 /tmp/76d32be0 dns net send-data zombie guuid=433afe37-1700-0000-8d59-6077c50d0000 pid=3525->guuid=e9136469-1800-0000-8d59-607795100000 pid=4245 clone guuid=e9136469-1800-0000-8d59-607795100000 pid=4245->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=e9136469-1800-0000-8d59-607795100000 pid=4245->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 14B guuid=837c6d69-1800-0000-8d59-607796100000 pid=4246 /tmp/76d32be0 guuid=e9136469-1800-0000-8d59-607795100000 pid=4245->guuid=837c6d69-1800-0000-8d59-607796100000 pid=4246 clone guuid=c66b7469-1800-0000-8d59-607798100000 pid=4248 /tmp/76d32be0 net net-scan send-data guuid=e9136469-1800-0000-8d59-607795100000 pid=4245->guuid=c66b7469-1800-0000-8d59-607798100000 pid=4248 clone guuid=d73d7969-1800-0000-8d59-607799100000 pid=4249 /tmp/76d32be0 guuid=e9136469-1800-0000-8d59-607795100000 pid=4245->guuid=d73d7969-1800-0000-8d59-607799100000 pid=4249 clone guuid=628d7069-1800-0000-8d59-607797100000 pid=4247->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 200B guuid=c66b7469-1800-0000-8d59-607798100000 pid=4248->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c66b7469-1800-0000-8d59-607798100000 pid=4248|send-data send-data to 384 IP addresses review logs to see them all guuid=c66b7469-1800-0000-8d59-607798100000 pid=4248->guuid=c66b7469-1800-0000-8d59-607798100000 pid=4248|send-data send guuid=49b94e75-1800-0000-8d59-6077c6100000 pid=4294->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 149B guuid=5d717385-1800-0000-8d59-6077f3100000 pid=4339->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5d717385-1800-0000-8d59-6077f3100000 pid=4339->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=88a142b8-1900-0000-8d59-607784130000 pid=4996 /tmp/76d32be0 dns net send-data zombie guuid=5d717385-1800-0000-8d59-6077f3100000 pid=4339->guuid=88a142b8-1900-0000-8d59-607784130000 pid=4996 clone guuid=88a142b8-1900-0000-8d59-607784130000 pid=4996->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=88a142b8-1900-0000-8d59-607784130000 pid=4996->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 7B guuid=9de250b8-1900-0000-8d59-607786130000 pid=4998 /tmp/76d32be0 guuid=88a142b8-1900-0000-8d59-607784130000 pid=4996->guuid=9de250b8-1900-0000-8d59-607786130000 pid=4998 clone guuid=14e455b8-1900-0000-8d59-607787130000 pid=4999 /tmp/76d32be0 net net-scan send-data guuid=88a142b8-1900-0000-8d59-607784130000 pid=4996->guuid=14e455b8-1900-0000-8d59-607787130000 pid=4999 clone guuid=14a35bb8-1900-0000-8d59-607788130000 pid=5000 /tmp/76d32be0 guuid=88a142b8-1900-0000-8d59-607784130000 pid=4996->guuid=14a35bb8-1900-0000-8d59-607788130000 pid=5000 clone guuid=880a4db8-1900-0000-8d59-607785130000 pid=4997->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 199B guuid=14e455b8-1900-0000-8d59-607787130000 pid=4999->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=14e455b8-1900-0000-8d59-607787130000 pid=4999|send-data send-data to 384 IP addresses review logs to see them all guuid=14e455b8-1900-0000-8d59-607787130000 pid=4999->guuid=14e455b8-1900-0000-8d59-607787130000 pid=4999|send-data send guuid=a74484c3-1900-0000-8d59-6077ac130000 pid=5036->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 148B guuid=7e2f6ed0-1900-0000-8d59-6077de130000 pid=5086->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7e2f6ed0-1900-0000-8d59-6077de130000 pid=5086->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=61a69c06-1b00-0000-8d59-60778c140000 pid=5260 /tmp/76d32be0 dns net send-data zombie guuid=7e2f6ed0-1900-0000-8d59-6077de130000 pid=5086->guuid=61a69c06-1b00-0000-8d59-60778c140000 pid=5260 clone guuid=61a69c06-1b00-0000-8d59-60778c140000 pid=5260->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=61a69c06-1b00-0000-8d59-60778c140000 pid=5260->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 7B guuid=078daf06-1b00-0000-8d59-60778d140000 pid=5261 /tmp/76d32be0 guuid=61a69c06-1b00-0000-8d59-60778c140000 pid=5260->guuid=078daf06-1b00-0000-8d59-60778d140000 pid=5261 clone guuid=08bcb906-1b00-0000-8d59-60778f140000 pid=5263 /tmp/76d32be0 net net-scan send-data guuid=61a69c06-1b00-0000-8d59-60778c140000 pid=5260->guuid=08bcb906-1b00-0000-8d59-60778f140000 pid=5263 clone guuid=a362c406-1b00-0000-8d59-607790140000 pid=5264 /tmp/76d32be0 guuid=61a69c06-1b00-0000-8d59-60778c140000 pid=5260->guuid=a362c406-1b00-0000-8d59-607790140000 pid=5264 clone guuid=55b2b506-1b00-0000-8d59-60778e140000 pid=5262->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=08bcb906-1b00-0000-8d59-60778f140000 pid=5263->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=08bcb906-1b00-0000-8d59-60778f140000 pid=5263|send-data send-data to 384 IP addresses review logs to see them all guuid=08bcb906-1b00-0000-8d59-60778f140000 pid=5263->guuid=08bcb906-1b00-0000-8d59-60778f140000 pid=5263|send-data send guuid=9467ab08-1b00-0000-8d59-607791140000 pid=5265->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 149B guuid=242aff18-1b00-0000-8d59-607794140000 pid=5268->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=242aff18-1b00-0000-8d59-607794140000 pid=5268->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=57fbb54c-1c00-0000-8d59-6077b5140000 pid=5301 /tmp/76d32be0 dns net send-data zombie guuid=242aff18-1b00-0000-8d59-607794140000 pid=5268->guuid=57fbb54c-1c00-0000-8d59-6077b5140000 pid=5301 clone guuid=57fbb54c-1c00-0000-8d59-6077b5140000 pid=5301->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=57fbb54c-1c00-0000-8d59-6077b5140000 pid=5301->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=dececd4c-1c00-0000-8d59-6077b7140000 pid=5303 /tmp/76d32be0 guuid=57fbb54c-1c00-0000-8d59-6077b5140000 pid=5301->guuid=dececd4c-1c00-0000-8d59-6077b7140000 pid=5303 clone guuid=42e5db4c-1c00-0000-8d59-6077b8140000 pid=5304 /tmp/76d32be0 net net-scan send-data zombie guuid=57fbb54c-1c00-0000-8d59-6077b5140000 pid=5301->guuid=42e5db4c-1c00-0000-8d59-6077b8140000 pid=5304 clone guuid=bbc5e44c-1c00-0000-8d59-6077b9140000 pid=5305 /tmp/76d32be0 guuid=57fbb54c-1c00-0000-8d59-6077b5140000 pid=5301->guuid=bbc5e44c-1c00-0000-8d59-6077b9140000 pid=5305 clone guuid=ade4c44c-1c00-0000-8d59-6077b6140000 pid=5302->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=42e5db4c-1c00-0000-8d59-6077b8140000 pid=5304->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=42e5db4c-1c00-0000-8d59-6077b8140000 pid=5304|send-data send-data to 4097 IP addresses review logs to see them all guuid=42e5db4c-1c00-0000-8d59-6077b8140000 pid=5304->guuid=42e5db4c-1c00-0000-8d59-6077b8140000 pid=5304|send-data send guuid=9758d74f-1c00-0000-8d59-6077ba140000 pid=5306->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=d8e69053-1c00-0000-8d59-6077bd140000 pid=5309->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d8e69053-1c00-0000-8d59-6077bd140000 pid=5309->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=93ffa396-2000-0000-8d59-6077be140000 pid=5310 /tmp/76d32be0 net send-data zombie guuid=d8e69053-1c00-0000-8d59-6077bd140000 pid=5309->guuid=93ffa396-2000-0000-8d59-6077be140000 pid=5310 clone guuid=93ffa396-2000-0000-8d59-6077be140000 pid=5310->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=91ecbd96-2000-0000-8d59-6077c0140000 pid=5312 /tmp/76d32be0 guuid=93ffa396-2000-0000-8d59-6077be140000 pid=5310->guuid=91ecbd96-2000-0000-8d59-6077c0140000 pid=5312 clone guuid=c509c896-2000-0000-8d59-6077c1140000 pid=5313 /tmp/76d32be0 net net-scan send-data zombie guuid=93ffa396-2000-0000-8d59-6077be140000 pid=5310->guuid=c509c896-2000-0000-8d59-6077c1140000 pid=5313 clone guuid=f8bad296-2000-0000-8d59-6077c2140000 pid=5314 /tmp/76d32be0 guuid=93ffa396-2000-0000-8d59-6077be140000 pid=5310->guuid=f8bad296-2000-0000-8d59-6077c2140000 pid=5314 clone guuid=49a7ba96-2000-0000-8d59-6077bf140000 pid=5311->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=c509c896-2000-0000-8d59-6077c1140000 pid=5313->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c509c896-2000-0000-8d59-6077c1140000 pid=5313|send-data send-data to 4097 IP addresses review logs to see them all guuid=c509c896-2000-0000-8d59-6077c1140000 pid=5313->guuid=c509c896-2000-0000-8d59-6077c1140000 pid=5313|send-data send guuid=0faac899-2000-0000-8d59-6077c3140000 pid=5315->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=152a239d-2000-0000-8d59-6077c6140000 pid=5318->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=152a239d-2000-0000-8d59-6077c6140000 pid=5318->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=3bd7a1e1-2400-0000-8d59-6077c7140000 pid=5319 /tmp/76d32be0 net send-data zombie guuid=152a239d-2000-0000-8d59-6077c6140000 pid=5318->guuid=3bd7a1e1-2400-0000-8d59-6077c7140000 pid=5319 clone guuid=3bd7a1e1-2400-0000-8d59-6077c7140000 pid=5319->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=1d45b0e1-2400-0000-8d59-6077c8140000 pid=5320 /tmp/76d32be0 guuid=3bd7a1e1-2400-0000-8d59-6077c7140000 pid=5319->guuid=1d45b0e1-2400-0000-8d59-6077c8140000 pid=5320 clone guuid=bfb9b5e1-2400-0000-8d59-6077ca140000 pid=5322 /tmp/76d32be0 net net-scan send-data zombie guuid=3bd7a1e1-2400-0000-8d59-6077c7140000 pid=5319->guuid=bfb9b5e1-2400-0000-8d59-6077ca140000 pid=5322 clone guuid=fab3bce1-2400-0000-8d59-6077cb140000 pid=5323 /tmp/76d32be0 guuid=3bd7a1e1-2400-0000-8d59-6077c7140000 pid=5319->guuid=fab3bce1-2400-0000-8d59-6077cb140000 pid=5323 clone guuid=831fb1e1-2400-0000-8d59-6077c9140000 pid=5321->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=bfb9b5e1-2400-0000-8d59-6077ca140000 pid=5322->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=bfb9b5e1-2400-0000-8d59-6077ca140000 pid=5322|send-data send-data to 4097 IP addresses review logs to see them all guuid=bfb9b5e1-2400-0000-8d59-6077ca140000 pid=5322->guuid=bfb9b5e1-2400-0000-8d59-6077ca140000 pid=5322|send-data send guuid=cb6414e3-2400-0000-8d59-6077cc140000 pid=5324->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=23673ae6-2400-0000-8d59-6077cf140000 pid=5327->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=23673ae6-2400-0000-8d59-6077cf140000 pid=5327->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=afbb9923-2900-0000-8d59-6077d0140000 pid=5328 /tmp/76d32be0 net send-data zombie guuid=23673ae6-2400-0000-8d59-6077cf140000 pid=5327->guuid=afbb9923-2900-0000-8d59-6077d0140000 pid=5328 clone guuid=afbb9923-2900-0000-8d59-6077d0140000 pid=5328->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=ea1fa723-2900-0000-8d59-6077d1140000 pid=5329 /tmp/76d32be0 guuid=afbb9923-2900-0000-8d59-6077d0140000 pid=5328->guuid=ea1fa723-2900-0000-8d59-6077d1140000 pid=5329 clone guuid=dcedad23-2900-0000-8d59-6077d3140000 pid=5331 /tmp/76d32be0 net net-scan send-data zombie guuid=afbb9923-2900-0000-8d59-6077d0140000 pid=5328->guuid=dcedad23-2900-0000-8d59-6077d3140000 pid=5331 clone guuid=6431b223-2900-0000-8d59-6077d4140000 pid=5332 /tmp/76d32be0 guuid=afbb9923-2900-0000-8d59-6077d0140000 pid=5328->guuid=6431b223-2900-0000-8d59-6077d4140000 pid=5332 clone guuid=9af9a823-2900-0000-8d59-6077d2140000 pid=5330->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=dcedad23-2900-0000-8d59-6077d3140000 pid=5331->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=dcedad23-2900-0000-8d59-6077d3140000 pid=5331|send-data send-data to 2688 IP addresses review logs to see them all guuid=dcedad23-2900-0000-8d59-6077d3140000 pid=5331->guuid=dcedad23-2900-0000-8d59-6077d3140000 pid=5331|send-data send guuid=79a21125-2900-0000-8d59-6077d5140000 pid=5333->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=41fd3528-2900-0000-8d59-6077d8140000 pid=5336->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=41fd3528-2900-0000-8d59-6077d8140000 pid=5336->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-09-03 11:13:38 UTC
File Type:
Text (Shell)
AV detection:
24 of 38 (63.16%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=keougkqdqxuip2nv4vupliturwzmv64gql74ija4g4dcgkj6au5q._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:unstable antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/250903-zhv96adj2z/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
UPX packed file
Enumerates active TCP sockets
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (53739) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware Config
C2 Extraction:
cnc.504.su
scan.504.su
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/511d432a0385/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 511d432a0385e887e9b5e568f5a2748db2cafb8682ffc4241c370623293e053b

(this sample)

HTML Application (hta) hta 00be7f643a12ac2221c9ba8df4fb34b3701c336fa830d24fe906c55364ef7b35

  
URLhaus
https://urlhaus.abuse.ch/url/3598497/
  
Delivery method
Distributed via web download
  
Dropping
MD5 3ee445c6a991c5e535940d674f7bfeb6
  
Dropping
SHA256 00be7f643a12ac2221c9ba8df4fb34b3701c336fa830d24fe906c55364ef7b35

Comments