MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6529e3500de7cc4a42006c3b27bc59bf8e227a796dfd69edce8a0e4f3a97ffa5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6529e3500de7cc4a42006c3b27bc59bf8e227a796dfd69edce8a0e4f3a97ffa5
SHA3-384 hash: c9a48bcd10f088f093428ce459be3b0acc81d5dc429502040249de8c2afdf94b47ef5b86531589103e2a60769e3c9eec
SHA1 hash: 689ca65d7015564bc7d9dbabb3e9d8fec274d1c2
MD5 hash: 3ab570b5e459098746e035b6603c699f
humanhash: moon-item-robin-west
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-28 21:47:01 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Uo6LgXDJr6IBALKwNWw3Hr6NWw3EjN2Sw+I6+fmhh9BsC76srnefi6NklY6whNAz:dXyXx0SHOOhhHeWTJFjAqol1pwFjYs
TLSH T13431819A080019312103CA9D77B33889628DB1F77C5FD7E5C9491EB992887CCF1A2B5E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/7e10ffn/an/an/a
http://5.182.210.174/d16425n/an/an/a
http://5.182.210.174/93f907n/an/an/a
http://5.182.210.174/61df14n/an/an/a
http://5.182.210.174/a2d8a2n/an/an/a
http://5.182.210.174/e47e5an/an/an/a
http://5.182.210.174/8370e2n/an/an/a
http://5.182.210.174/8b6971n/an/an/a
http://5.182.210.174/2dd6c7n/an/an/a
http://5.182.210.174/323887n/an/an/a
http://5.182.210.174/41c7a2n/an/an/a
http://5.182.210.174/1a0ac0n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a9201e24b356da241396330/reports/4845740c-5f5a-47b8-a037-e6ae0924bf41/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/06bfa6b7-6fdd-4fc4-bfea-d95649cc5a9d
Behavior Graph:
Download SVG
%3 guuid=3afb9925-1700-0000-aa41-b9bd2d0d0000 pid=3373 /usr/bin/sudo guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377 /tmp/sample.bin guuid=3afb9925-1700-0000-aa41-b9bd2d0d0000 pid=3373->guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377 execve guuid=470d6a27-1700-0000-aa41-b9bd320d0000 pid=3378 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=470d6a27-1700-0000-aa41-b9bd320d0000 pid=3378 execve guuid=65c5702b-1700-0000-aa41-b9bd390d0000 pid=3385 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=65c5702b-1700-0000-aa41-b9bd390d0000 pid=3385 execve guuid=73fa1334-1700-0000-aa41-b9bd470d0000 pid=3399 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=73fa1334-1700-0000-aa41-b9bd470d0000 pid=3399 execve guuid=fc106234-1700-0000-aa41-b9bd480d0000 pid=3400 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=fc106234-1700-0000-aa41-b9bd480d0000 pid=3400 clone guuid=773ad134-1700-0000-aa41-b9bd4b0d0000 pid=3403 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=773ad134-1700-0000-aa41-b9bd4b0d0000 pid=3403 execve guuid=4e8b1535-1700-0000-aa41-b9bd4d0d0000 pid=3405 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=4e8b1535-1700-0000-aa41-b9bd4d0d0000 pid=3405 execve guuid=0ec07735-1700-0000-aa41-b9bd4f0d0000 pid=3407 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=0ec07735-1700-0000-aa41-b9bd4f0d0000 pid=3407 execve guuid=fd871538-1700-0000-aa41-b9bd580d0000 pid=3416 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=fd871538-1700-0000-aa41-b9bd580d0000 pid=3416 execve guuid=60939a3d-1700-0000-aa41-b9bd5a0d0000 pid=3418 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=60939a3d-1700-0000-aa41-b9bd5a0d0000 pid=3418 execve guuid=b83b183e-1700-0000-aa41-b9bd5b0d0000 pid=3419 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=b83b183e-1700-0000-aa41-b9bd5b0d0000 pid=3419 clone guuid=c859783e-1700-0000-aa41-b9bd5d0d0000 pid=3421 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=c859783e-1700-0000-aa41-b9bd5d0d0000 pid=3421 execve guuid=ff32073f-1700-0000-aa41-b9bd5e0d0000 pid=3422 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=ff32073f-1700-0000-aa41-b9bd5e0d0000 pid=3422 execve guuid=dca65d3f-1700-0000-aa41-b9bd5f0d0000 pid=3423 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=dca65d3f-1700-0000-aa41-b9bd5f0d0000 pid=3423 execve guuid=64dc7842-1700-0000-aa41-b9bd6a0d0000 pid=3434 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=64dc7842-1700-0000-aa41-b9bd6a0d0000 pid=3434 execve guuid=a26f3347-1700-0000-aa41-b9bd7a0d0000 pid=3450 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=a26f3347-1700-0000-aa41-b9bd7a0d0000 pid=3450 execve guuid=cd459d47-1700-0000-aa41-b9bd7d0d0000 pid=3453 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=cd459d47-1700-0000-aa41-b9bd7d0d0000 pid=3453 clone guuid=a803f747-1700-0000-aa41-b9bd800d0000 pid=3456 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=a803f747-1700-0000-aa41-b9bd800d0000 pid=3456 execve guuid=a87d3648-1700-0000-aa41-b9bd840d0000 pid=3460 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=a87d3648-1700-0000-aa41-b9bd840d0000 pid=3460 execve guuid=f6086d48-1700-0000-aa41-b9bd860d0000 pid=3462 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=f6086d48-1700-0000-aa41-b9bd860d0000 pid=3462 execve guuid=ca58b84b-1700-0000-aa41-b9bd8f0d0000 pid=3471 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=ca58b84b-1700-0000-aa41-b9bd8f0d0000 pid=3471 execve guuid=11e6e550-1700-0000-aa41-b9bda00d0000 pid=3488 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=11e6e550-1700-0000-aa41-b9bda00d0000 pid=3488 execve guuid=bfb02d51-1700-0000-aa41-b9bda30d0000 pid=3491 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=bfb02d51-1700-0000-aa41-b9bda30d0000 pid=3491 clone guuid=4a168951-1700-0000-aa41-b9bda50d0000 pid=3493 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=4a168951-1700-0000-aa41-b9bda50d0000 pid=3493 execve guuid=6ee9cc51-1700-0000-aa41-b9bda70d0000 pid=3495 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=6ee9cc51-1700-0000-aa41-b9bda70d0000 pid=3495 execve guuid=b2980452-1700-0000-aa41-b9bda90d0000 pid=3497 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=b2980452-1700-0000-aa41-b9bda90d0000 pid=3497 execve guuid=1a822855-1700-0000-aa41-b9bdb30d0000 pid=3507 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=1a822855-1700-0000-aa41-b9bdb30d0000 pid=3507 execve guuid=41a0ee58-1700-0000-aa41-b9bdbe0d0000 pid=3518 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=41a0ee58-1700-0000-aa41-b9bdbe0d0000 pid=3518 execve guuid=0f7a2b59-1700-0000-aa41-b9bdbf0d0000 pid=3519 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=0f7a2b59-1700-0000-aa41-b9bdbf0d0000 pid=3519 clone guuid=37115c59-1700-0000-aa41-b9bdc20d0000 pid=3522 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=37115c59-1700-0000-aa41-b9bdc20d0000 pid=3522 execve guuid=cb6b9c59-1700-0000-aa41-b9bdc50d0000 pid=3525 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=cb6b9c59-1700-0000-aa41-b9bdc50d0000 pid=3525 execve guuid=7466db59-1700-0000-aa41-b9bdc70d0000 pid=3527 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=7466db59-1700-0000-aa41-b9bdc70d0000 pid=3527 execve guuid=f833af5c-1700-0000-aa41-b9bdd50d0000 pid=3541 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=f833af5c-1700-0000-aa41-b9bdd50d0000 pid=3541 execve guuid=1f36c85f-1700-0000-aa41-b9bde40d0000 pid=3556 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=1f36c85f-1700-0000-aa41-b9bde40d0000 pid=3556 execve guuid=ab820d60-1700-0000-aa41-b9bde50d0000 pid=3557 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=ab820d60-1700-0000-aa41-b9bde50d0000 pid=3557 clone guuid=978b5860-1700-0000-aa41-b9bdea0d0000 pid=3562 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=978b5860-1700-0000-aa41-b9bdea0d0000 pid=3562 execve guuid=65a92062-1700-0000-aa41-b9bdf00d0000 pid=3568 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=65a92062-1700-0000-aa41-b9bdf00d0000 pid=3568 execve guuid=7b7f6762-1700-0000-aa41-b9bdf20d0000 pid=3570 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=7b7f6762-1700-0000-aa41-b9bdf20d0000 pid=3570 execve guuid=c8b1ee64-1700-0000-aa41-b9bdfb0d0000 pid=3579 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=c8b1ee64-1700-0000-aa41-b9bdfb0d0000 pid=3579 execve guuid=8c760069-1700-0000-aa41-b9bd020e0000 pid=3586 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=8c760069-1700-0000-aa41-b9bd020e0000 pid=3586 execve guuid=ec564e69-1700-0000-aa41-b9bd030e0000 pid=3587 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=ec564e69-1700-0000-aa41-b9bd030e0000 pid=3587 clone guuid=959d8a69-1700-0000-aa41-b9bd050e0000 pid=3589 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=959d8a69-1700-0000-aa41-b9bd050e0000 pid=3589 execve guuid=7968d169-1700-0000-aa41-b9bd060e0000 pid=3590 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=7968d169-1700-0000-aa41-b9bd060e0000 pid=3590 execve guuid=9caf116a-1700-0000-aa41-b9bd070e0000 pid=3591 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=9caf116a-1700-0000-aa41-b9bd070e0000 pid=3591 execve guuid=1afb936c-1700-0000-aa41-b9bd080e0000 pid=3592 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=1afb936c-1700-0000-aa41-b9bd080e0000 pid=3592 execve guuid=161c6470-1700-0000-aa41-b9bd090e0000 pid=3593 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=161c6470-1700-0000-aa41-b9bd090e0000 pid=3593 execve guuid=e890a470-1700-0000-aa41-b9bd0a0e0000 pid=3594 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=e890a470-1700-0000-aa41-b9bd0a0e0000 pid=3594 clone guuid=a015e170-1700-0000-aa41-b9bd0c0e0000 pid=3596 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=a015e170-1700-0000-aa41-b9bd0c0e0000 pid=3596 execve guuid=20512171-1700-0000-aa41-b9bd0d0e0000 pid=3597 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=20512171-1700-0000-aa41-b9bd0d0e0000 pid=3597 execve guuid=d00a7671-1700-0000-aa41-b9bd0e0e0000 pid=3598 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=d00a7671-1700-0000-aa41-b9bd0e0e0000 pid=3598 execve guuid=5f0b6f74-1700-0000-aa41-b9bd0f0e0000 pid=3599 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=5f0b6f74-1700-0000-aa41-b9bd0f0e0000 pid=3599 execve guuid=a81a6d78-1700-0000-aa41-b9bd1c0e0000 pid=3612 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=a81a6d78-1700-0000-aa41-b9bd1c0e0000 pid=3612 execve guuid=22e4e678-1700-0000-aa41-b9bd1d0e0000 pid=3613 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=22e4e678-1700-0000-aa41-b9bd1d0e0000 pid=3613 clone guuid=04282679-1700-0000-aa41-b9bd1f0e0000 pid=3615 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=04282679-1700-0000-aa41-b9bd1f0e0000 pid=3615 execve guuid=6c647579-1700-0000-aa41-b9bd200e0000 pid=3616 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=6c647579-1700-0000-aa41-b9bd200e0000 pid=3616 execve guuid=f888c379-1700-0000-aa41-b9bd210e0000 pid=3617 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=f888c379-1700-0000-aa41-b9bd210e0000 pid=3617 execve guuid=80a7637c-1700-0000-aa41-b9bd260e0000 pid=3622 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=80a7637c-1700-0000-aa41-b9bd260e0000 pid=3622 execve guuid=731f6581-1700-0000-aa41-b9bd3a0e0000 pid=3642 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=731f6581-1700-0000-aa41-b9bd3a0e0000 pid=3642 execve guuid=c5b31982-1700-0000-aa41-b9bd3c0e0000 pid=3644 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=c5b31982-1700-0000-aa41-b9bd3c0e0000 pid=3644 clone guuid=94438382-1700-0000-aa41-b9bd3f0e0000 pid=3647 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=94438382-1700-0000-aa41-b9bd3f0e0000 pid=3647 execve guuid=8eb20283-1700-0000-aa41-b9bd440e0000 pid=3652 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=8eb20283-1700-0000-aa41-b9bd440e0000 pid=3652 execve guuid=54777083-1700-0000-aa41-b9bd480e0000 pid=3656 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=54777083-1700-0000-aa41-b9bd480e0000 pid=3656 execve guuid=7d8ca586-1700-0000-aa41-b9bd5c0e0000 pid=3676 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=7d8ca586-1700-0000-aa41-b9bd5c0e0000 pid=3676 execve guuid=93dc358a-1700-0000-aa41-b9bd6e0e0000 pid=3694 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=93dc358a-1700-0000-aa41-b9bd6e0e0000 pid=3694 execve guuid=0c127b8a-1700-0000-aa41-b9bd700e0000 pid=3696 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=0c127b8a-1700-0000-aa41-b9bd700e0000 pid=3696 clone guuid=9fadb18a-1700-0000-aa41-b9bd730e0000 pid=3699 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=9fadb18a-1700-0000-aa41-b9bd730e0000 pid=3699 execve guuid=14d7f58a-1700-0000-aa41-b9bd750e0000 pid=3701 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=14d7f58a-1700-0000-aa41-b9bd750e0000 pid=3701 execve guuid=997d338b-1700-0000-aa41-b9bd770e0000 pid=3703 /usr/bin/wget net send-data guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=997d338b-1700-0000-aa41-b9bd770e0000 pid=3703 execve guuid=8e8b128e-1700-0000-aa41-b9bd800e0000 pid=3712 /usr/bin/curl net send-data write-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=8e8b128e-1700-0000-aa41-b9bd800e0000 pid=3712 execve guuid=3dd08192-1700-0000-aa41-b9bd880e0000 pid=3720 /usr/bin/chmod guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=3dd08192-1700-0000-aa41-b9bd880e0000 pid=3720 execve guuid=a048e992-1700-0000-aa41-b9bd8a0e0000 pid=3722 /usr/bin/bash guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=a048e992-1700-0000-aa41-b9bd8a0e0000 pid=3722 clone guuid=ac5d1d93-1700-0000-aa41-b9bd8d0e0000 pid=3725 /usr/bin/rm delete-file guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=ac5d1d93-1700-0000-aa41-b9bd8d0e0000 pid=3725 execve guuid=08cf5d93-1700-0000-aa41-b9bd8f0e0000 pid=3727 /usr/bin/rm guuid=b76c2027-1700-0000-aa41-b9bd310d0000 pid=3377->guuid=08cf5d93-1700-0000-aa41-b9bd8f0e0000 pid=3727 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=470d6a27-1700-0000-aa41-b9bd320d0000 pid=3378->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=65c5702b-1700-0000-aa41-b9bd390d0000 pid=3385->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=611b8234-1700-0000-aa41-b9bd4a0d0000 pid=3402 /usr/bin/bash guuid=fc106234-1700-0000-aa41-b9bd480d0000 pid=3400->guuid=611b8234-1700-0000-aa41-b9bd4a0d0000 pid=3402 clone guuid=0ec07735-1700-0000-aa41-b9bd4f0d0000 pid=3407->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fd871538-1700-0000-aa41-b9bd580d0000 pid=3416->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4e08453e-1700-0000-aa41-b9bd5c0d0000 pid=3420 /usr/bin/bash guuid=b83b183e-1700-0000-aa41-b9bd5b0d0000 pid=3419->guuid=4e08453e-1700-0000-aa41-b9bd5c0d0000 pid=3420 clone guuid=dca65d3f-1700-0000-aa41-b9bd5f0d0000 pid=3423->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=64dc7842-1700-0000-aa41-b9bd6a0d0000 pid=3434->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=273fba47-1700-0000-aa41-b9bd7e0d0000 pid=3454 /usr/bin/bash guuid=cd459d47-1700-0000-aa41-b9bd7d0d0000 pid=3453->guuid=273fba47-1700-0000-aa41-b9bd7e0d0000 pid=3454 clone guuid=f6086d48-1700-0000-aa41-b9bd860d0000 pid=3462->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ca58b84b-1700-0000-aa41-b9bd8f0d0000 pid=3471->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=85183f51-1700-0000-aa41-b9bda40d0000 pid=3492 /usr/bin/bash guuid=bfb02d51-1700-0000-aa41-b9bda30d0000 pid=3491->guuid=85183f51-1700-0000-aa41-b9bda40d0000 pid=3492 clone guuid=b2980452-1700-0000-aa41-b9bda90d0000 pid=3497->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1a822855-1700-0000-aa41-b9bdb30d0000 pid=3507->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=dc814059-1700-0000-aa41-b9bdc10d0000 pid=3521 /usr/bin/bash guuid=0f7a2b59-1700-0000-aa41-b9bdbf0d0000 pid=3519->guuid=dc814059-1700-0000-aa41-b9bdc10d0000 pid=3521 clone guuid=7466db59-1700-0000-aa41-b9bdc70d0000 pid=3527->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f833af5c-1700-0000-aa41-b9bdd50d0000 pid=3541->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=11173260-1700-0000-aa41-b9bde80d0000 pid=3560 /usr/bin/bash guuid=ab820d60-1700-0000-aa41-b9bde50d0000 pid=3557->guuid=11173260-1700-0000-aa41-b9bde80d0000 pid=3560 clone guuid=7b7f6762-1700-0000-aa41-b9bdf20d0000 pid=3570->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c8b1ee64-1700-0000-aa41-b9bdfb0d0000 pid=3579->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cf6c6969-1700-0000-aa41-b9bd040e0000 pid=3588 /usr/bin/bash guuid=ec564e69-1700-0000-aa41-b9bd030e0000 pid=3587->guuid=cf6c6969-1700-0000-aa41-b9bd040e0000 pid=3588 clone guuid=9caf116a-1700-0000-aa41-b9bd070e0000 pid=3591->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1afb936c-1700-0000-aa41-b9bd080e0000 pid=3592->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e40abf70-1700-0000-aa41-b9bd0b0e0000 pid=3595 /usr/bin/bash guuid=e890a470-1700-0000-aa41-b9bd0a0e0000 pid=3594->guuid=e40abf70-1700-0000-aa41-b9bd0b0e0000 pid=3595 clone guuid=d00a7671-1700-0000-aa41-b9bd0e0e0000 pid=3598->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5f0b6f74-1700-0000-aa41-b9bd0f0e0000 pid=3599->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=281b0279-1700-0000-aa41-b9bd1e0e0000 pid=3614 /usr/bin/bash guuid=22e4e678-1700-0000-aa41-b9bd1d0e0000 pid=3613->guuid=281b0279-1700-0000-aa41-b9bd1e0e0000 pid=3614 clone guuid=f888c379-1700-0000-aa41-b9bd210e0000 pid=3617->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=80a7637c-1700-0000-aa41-b9bd260e0000 pid=3622->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b55e4a82-1700-0000-aa41-b9bd3e0e0000 pid=3646 /usr/bin/bash guuid=c5b31982-1700-0000-aa41-b9bd3c0e0000 pid=3644->guuid=b55e4a82-1700-0000-aa41-b9bd3e0e0000 pid=3646 clone guuid=54777083-1700-0000-aa41-b9bd480e0000 pid=3656->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7d8ca586-1700-0000-aa41-b9bd5c0e0000 pid=3676->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0c1e918a-1700-0000-aa41-b9bd710e0000 pid=3697 /usr/bin/bash guuid=0c127b8a-1700-0000-aa41-b9bd700e0000 pid=3696->guuid=0c1e918a-1700-0000-aa41-b9bd710e0000 pid=3697 clone guuid=997d338b-1700-0000-aa41-b9bd770e0000 pid=3703->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8e8b128e-1700-0000-aa41-b9bd800e0000 pid=3712->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b765fc92-1700-0000-aa41-b9bd8c0e0000 pid=3724 /usr/bin/bash guuid=a048e992-1700-0000-aa41-b9bd8a0e0000 pid=3722->guuid=b765fc92-1700-0000-aa41-b9bd8c0e0000 pid=3724 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6529e3500de7cc4a42006c3b27bc59bf8e227a796dfd69edce8a0e4f3a97ffa5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6529e3500de7cc4a42006c3b27bc59bf8e227a796dfd69edce8a0e4f3a97ffa5/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-28 21:47:18 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=muu6guan47geuqqanq5sppczx6hce6tznx6wt3oorihe6oux76sq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260828-1nafbael7t/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Creates a large amount of network flows
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/6529e3500de7cc4a42006c3b27bc59bf8e227a796dfd69edce8a0e4f3a97ffa5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 6529e3500de7cc4a42006c3b27bc59bf8e227a796dfd69edce8a0e4f3a97ffa5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments