🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6325c8ac334cfdd103648f5065c2ea69e850e6f5d736ca6430d84724180f58bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash: 6325c8ac334cfdd103648f5065c2ea69e850e6f5d736ca6430d84724180f58bf
SHA3-384 hash: 31bb0121cd217938cf156ef65279b2aa5739f5c3ce15c0ba2c9c4246a1520d22abf242bd1693b2ef978b65a083c96468
SHA1 hash: 52b90f14812a64a5d78a85410eddc26e1161cf2a
MD5 hash: b700a0b5332ff09f0a41833935b294aa
humanhash: kilo-nineteen-two-lithium
File name:zyxel.sh
Download: download sample
Signature Mirai
File size:2'985 bytes
First seen:2026-10-27 10:26:13 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vW8hFoINKSFoIP4FFo7sggFoSsicFoIsJcFoUgSbFovYkjNtFogq8Fog4brFoqrS:vWzIaMZQ8S7IKUFuvYfg0g4ygIa6
TLSH T1BE5132C50773C9387969FD0F3DE68B14B9C4E4916CC2AA84B6EC79ED0ACEE28584C147
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://45.66.228.20/bins/mewww.arme46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.arm5e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.arm6e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.arm706044efe3f19c9e3635689c7d817deb6ba4f7ad390fa742d8be17148a59dfa9b Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.x868d681fcd69fb1fbe04ef49e05a8e9f4e3c4505092229313e145879b8435eab4d Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.x86_64375f130b77f559a0e17715bd55d92f60baa0e3122a4d2fdf247e6f2e9755f8b0 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.mips09847bb71dec9bb2b313841cf66ed9ec4908c7352ec9af0c46701378ff5a864c Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.mpsl5f653af0ceb544277300b3e397d4ff706e1a646d6ce488fe9da59914dd714d24 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.ppc0bbdda72a34ad768c003df63b94257dbb9c3a04851524fa7fe47a3e32b296ca4 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.m68kf26b1ca0a3713260c713e1bf8e30b4143f20fd46677170f4fe50495b99d84bc4 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.sh4n/an/aelf ua-wget
http://45.66.228.20/bins/mewww.arcn/an/aelf ua-wget

Intelligence


File Origin
# of uploads :
1
# of downloads :
63
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-27T09:28:00Z UTC
Last seen:
2026-10-28T19:02:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
%3 guuid=31a2e1ea-1b00-0000-48ad-d497030c0000 pid=3075 /usr/bin/sudo guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079 /tmp/sample.bin guuid=31a2e1ea-1b00-0000-48ad-d497030c0000 pid=3075->guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079 execve guuid=d552b0ee-1b00-0000-48ad-d4970a0c0000 pid=3082 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=d552b0ee-1b00-0000-48ad-d4970a0c0000 pid=3082 execve guuid=eb55e4f4-1b00-0000-48ad-d497140c0000 pid=3092 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=eb55e4f4-1b00-0000-48ad-d497140c0000 pid=3092 execve guuid=4ea860f5-1b00-0000-48ad-d497160c0000 pid=3094 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=4ea860f5-1b00-0000-48ad-d497160c0000 pid=3094 execve guuid=8d2ab8f5-1b00-0000-48ad-d497170c0000 pid=3095 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=8d2ab8f5-1b00-0000-48ad-d497170c0000 pid=3095 clone guuid=cef304f7-1b00-0000-48ad-d4971c0c0000 pid=3100 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=cef304f7-1b00-0000-48ad-d4971c0c0000 pid=3100 execve guuid=2be0a0fb-1b00-0000-48ad-d4971d0c0000 pid=3101 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=2be0a0fb-1b00-0000-48ad-d4971d0c0000 pid=3101 execve guuid=ec916afc-1b00-0000-48ad-d4971e0c0000 pid=3102 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=ec916afc-1b00-0000-48ad-d4971e0c0000 pid=3102 execve guuid=be8321fd-1b00-0000-48ad-d4971f0c0000 pid=3103 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=be8321fd-1b00-0000-48ad-d4971f0c0000 pid=3103 clone guuid=55bd74fe-1b00-0000-48ad-d497210c0000 pid=3105 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=55bd74fe-1b00-0000-48ad-d497210c0000 pid=3105 execve guuid=d3dff503-1c00-0000-48ad-d497240c0000 pid=3108 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=d3dff503-1c00-0000-48ad-d497240c0000 pid=3108 execve guuid=8cf38304-1c00-0000-48ad-d497260c0000 pid=3110 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=8cf38304-1c00-0000-48ad-d497260c0000 pid=3110 execve guuid=491bef04-1c00-0000-48ad-d497280c0000 pid=3112 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=491bef04-1c00-0000-48ad-d497280c0000 pid=3112 clone guuid=a7bb0d08-1c00-0000-48ad-d4972d0c0000 pid=3117 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=a7bb0d08-1c00-0000-48ad-d4972d0c0000 pid=3117 execve guuid=0d11080d-1c00-0000-48ad-d497350c0000 pid=3125 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=0d11080d-1c00-0000-48ad-d497350c0000 pid=3125 execve guuid=e3569e0d-1c00-0000-48ad-d497370c0000 pid=3127 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=e3569e0d-1c00-0000-48ad-d497370c0000 pid=3127 execve guuid=6b7b830e-1c00-0000-48ad-d497380c0000 pid=3128 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=6b7b830e-1c00-0000-48ad-d497380c0000 pid=3128 clone guuid=f1757e0f-1c00-0000-48ad-d4973a0c0000 pid=3130 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=f1757e0f-1c00-0000-48ad-d4973a0c0000 pid=3130 execve guuid=2fb80f14-1c00-0000-48ad-d497410c0000 pid=3137 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=2fb80f14-1c00-0000-48ad-d497410c0000 pid=3137 execve guuid=0d86aa14-1c00-0000-48ad-d497420c0000 pid=3138 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=0d86aa14-1c00-0000-48ad-d497420c0000 pid=3138 execve guuid=43d16215-1c00-0000-48ad-d497430c0000 pid=3139 /tmp/ssh-updater guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=43d16215-1c00-0000-48ad-d497430c0000 pid=3139 execve guuid=bf22e116-1c00-0000-48ad-d497440c0000 pid=3140 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=bf22e116-1c00-0000-48ad-d497440c0000 pid=3140 execve guuid=e1b9a91d-1c00-0000-48ad-d4974a0c0000 pid=3146 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=e1b9a91d-1c00-0000-48ad-d4974a0c0000 pid=3146 execve guuid=349e351e-1c00-0000-48ad-d4974c0c0000 pid=3148 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=349e351e-1c00-0000-48ad-d4974c0c0000 pid=3148 execve guuid=4312a31e-1c00-0000-48ad-d4974e0c0000 pid=3150 /tmp/ssh-updater mprotect-exec guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=4312a31e-1c00-0000-48ad-d4974e0c0000 pid=3150 execve guuid=8e1ea71f-1c00-0000-48ad-d497500c0000 pid=3152 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=8e1ea71f-1c00-0000-48ad-d497500c0000 pid=3152 execve guuid=9b787b24-1c00-0000-48ad-d497550c0000 pid=3157 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=9b787b24-1c00-0000-48ad-d497550c0000 pid=3157 execve guuid=47800825-1c00-0000-48ad-d497560c0000 pid=3158 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=47800825-1c00-0000-48ad-d497560c0000 pid=3158 execve guuid=6f8e7325-1c00-0000-48ad-d497580c0000 pid=3160 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=6f8e7325-1c00-0000-48ad-d497580c0000 pid=3160 clone guuid=a13a2c26-1c00-0000-48ad-d4975b0c0000 pid=3163 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=a13a2c26-1c00-0000-48ad-d4975b0c0000 pid=3163 execve guuid=0fb0312b-1c00-0000-48ad-d4975f0c0000 pid=3167 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=0fb0312b-1c00-0000-48ad-d4975f0c0000 pid=3167 execve guuid=98d93e2c-1c00-0000-48ad-d497620c0000 pid=3170 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=98d93e2c-1c00-0000-48ad-d497620c0000 pid=3170 execve guuid=fba9082d-1c00-0000-48ad-d497650c0000 pid=3173 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=fba9082d-1c00-0000-48ad-d497650c0000 pid=3173 clone guuid=f9eb942e-1c00-0000-48ad-d497670c0000 pid=3175 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=f9eb942e-1c00-0000-48ad-d497670c0000 pid=3175 execve guuid=fa778433-1c00-0000-48ad-d497690c0000 pid=3177 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=fa778433-1c00-0000-48ad-d497690c0000 pid=3177 execve guuid=132a1534-1c00-0000-48ad-d4976a0c0000 pid=3178 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=132a1534-1c00-0000-48ad-d4976a0c0000 pid=3178 execve guuid=465aad34-1c00-0000-48ad-d4976b0c0000 pid=3179 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=465aad34-1c00-0000-48ad-d4976b0c0000 pid=3179 clone guuid=8b897e35-1c00-0000-48ad-d4976d0c0000 pid=3181 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=8b897e35-1c00-0000-48ad-d4976d0c0000 pid=3181 execve guuid=3458b03b-1c00-0000-48ad-d497710c0000 pid=3185 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=3458b03b-1c00-0000-48ad-d497710c0000 pid=3185 execve guuid=8d947b3c-1c00-0000-48ad-d497730c0000 pid=3187 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=8d947b3c-1c00-0000-48ad-d497730c0000 pid=3187 execve guuid=174fe83c-1c00-0000-48ad-d497750c0000 pid=3189 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=174fe83c-1c00-0000-48ad-d497750c0000 pid=3189 clone guuid=e440ca3d-1c00-0000-48ad-d497780c0000 pid=3192 /usr/bin/wget net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=e440ca3d-1c00-0000-48ad-d497780c0000 pid=3192 execve guuid=69dfd344-1c00-0000-48ad-d497850c0000 pid=3205 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=69dfd344-1c00-0000-48ad-d497850c0000 pid=3205 execve guuid=b818ca46-1c00-0000-48ad-d497870c0000 pid=3207 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=b818ca46-1c00-0000-48ad-d497870c0000 pid=3207 execve guuid=99fe3e47-1c00-0000-48ad-d497880c0000 pid=3208 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=99fe3e47-1c00-0000-48ad-d497880c0000 pid=3208 clone guuid=6e104f49-1c00-0000-48ad-d4978b0c0000 pid=3211 /usr/bin/wget net send-data guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=6e104f49-1c00-0000-48ad-d4978b0c0000 pid=3211 execve guuid=163b774d-1c00-0000-48ad-d497980c0000 pid=3224 /usr/bin/curl net send-data write-file guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=163b774d-1c00-0000-48ad-d497980c0000 pid=3224 execve guuid=bcfa8456-1c00-0000-48ad-d497a30c0000 pid=3235 /usr/bin/cat guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=bcfa8456-1c00-0000-48ad-d497a30c0000 pid=3235 execve guuid=36c6cf56-1c00-0000-48ad-d497a50c0000 pid=3237 /usr/bin/chmod guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=36c6cf56-1c00-0000-48ad-d497a50c0000 pid=3237 execve guuid=19001257-1c00-0000-48ad-d497a60c0000 pid=3238 /usr/bin/bash guuid=d27a0aee-1b00-0000-48ad-d497070c0000 pid=3079->guuid=19001257-1c00-0000-48ad-d497a60c0000 pid=3238 clone 34f3fc5f-5353-5421-bf3d-44e89693cc6d 45.66.228.20:80 guuid=d552b0ee-1b00-0000-48ad-d4970a0c0000 pid=3082->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=cef304f7-1b00-0000-48ad-d4971c0c0000 pid=3100->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=55bd74fe-1b00-0000-48ad-d497210c0000 pid=3105->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=a7bb0d08-1c00-0000-48ad-d4972d0c0000 pid=3117->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=f1757e0f-1c00-0000-48ad-d4973a0c0000 pid=3130->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=bf22e116-1c00-0000-48ad-d497440c0000 pid=3140->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 144B guuid=8e1ea71f-1c00-0000-48ad-d497500c0000 pid=3152->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=a13a2c26-1c00-0000-48ad-d4975b0c0000 pid=3163->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=f9eb942e-1c00-0000-48ad-d497670c0000 pid=3175->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=8b897e35-1c00-0000-48ad-d4976d0c0000 pid=3181->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=e440ca3d-1c00-0000-48ad-d497780c0000 pid=3192->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=6e104f49-1c00-0000-48ad-d4978b0c0000 pid=3211->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=163b774d-1c00-0000-48ad-d497980c0000 pid=3224->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 90B
Threat name:
Linux.Trojan.Egairtigado
Status:
Malicious
First seen:
2026-10-27 10:27:00 UTC
File Type:
Text (Shell)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux upx
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
File and Directory Permissions Modification
Executes dropped EXE
Traces itself
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures


MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 6325c8ac334cfdd103648f5065c2ea69e850e6f5d736ca6430d84724180f58bf

(this sample)

  
Delivery method
Distributed via web download

Comments