MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e6a1c99288d7838b682e95babfcd17287cff46476bf4f1e84d31bfc040ae0cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e6a1c99288d7838b682e95babfcd17287cff46476bf4f1e84d31bfc040ae0cb
SHA3-384 hash: 0c12aa2c3a5c3d62af3a656cbb45261cb78fe73192573934df350807c0ca2e3aa4e8d439dce84e7a1aecec7bd69dc756
SHA1 hash: 53e0e409a28003c7266150c06c7730654bbfe3c5
MD5 hash: d6dc063f57715dd9ab8bae667f39d902
humanhash: indigo-king-equal-muppet
File name:ohshit.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'940 bytes
First seen:2026-03-28 17:52:38 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vpM70M7N7hpMvM6GpMgnMzPpMfMKWpM1MoUpM71M7o7UpMfOM3bpMEM9RpMhMcg9:v67v7N7h6E6G6gMzP60KW6GoU67G7o7g
TLSH T18651C68942C66C312CF7EA13F6B6E13874C1905318EE7F99DDE4BAE8869ED147140B53
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
47
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Result
Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-03-28T14:04:00Z UTC
Last seen:
2026-03-28T14:27:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/6e6a1c99288d7838b682e95babfcd17287cff46476bf4f1e84d31bfc040ae0cb/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3b92a143-edbe-4e7d-b4aa-749b19701edb
Behavior Graph:
Download SVG
%3 guuid=364aa9d7-1a00-0000-dba9-d9d4470b0000 pid=2887 /usr/bin/sudo guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894 /tmp/sample.bin guuid=364aa9d7-1a00-0000-dba9-d9d4470b0000 pid=2887->guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894 execve guuid=1f4704db-1a00-0000-dba9-d9d4510b0000 pid=2897 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=1f4704db-1a00-0000-dba9-d9d4510b0000 pid=2897 execve guuid=4ab62ee0-1a00-0000-dba9-d9d4600b0000 pid=2912 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=4ab62ee0-1a00-0000-dba9-d9d4600b0000 pid=2912 execve guuid=eace2fec-1a00-0000-dba9-d9d4780b0000 pid=2936 /usr/bin/cat guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=eace2fec-1a00-0000-dba9-d9d4780b0000 pid=2936 execve guuid=cef1c1ec-1a00-0000-dba9-d9d47a0b0000 pid=2938 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=cef1c1ec-1a00-0000-dba9-d9d47a0b0000 pid=2938 execve guuid=deb339ed-1a00-0000-dba9-d9d47b0b0000 pid=2939 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=deb339ed-1a00-0000-dba9-d9d47b0b0000 pid=2939 execve guuid=d27f9fed-1a00-0000-dba9-d9d47f0b0000 pid=2943 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=d27f9fed-1a00-0000-dba9-d9d47f0b0000 pid=2943 execve guuid=7891a6f1-1a00-0000-dba9-d9d4800b0000 pid=2944 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=7891a6f1-1a00-0000-dba9-d9d4800b0000 pid=2944 execve guuid=30a3c8f7-1a00-0000-dba9-d9d4820b0000 pid=2946 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=30a3c8f7-1a00-0000-dba9-d9d4820b0000 pid=2946 clone guuid=c191f9f7-1a00-0000-dba9-d9d4830b0000 pid=2947 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=c191f9f7-1a00-0000-dba9-d9d4830b0000 pid=2947 execve guuid=39aa78f8-1a00-0000-dba9-d9d4850b0000 pid=2949 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=39aa78f8-1a00-0000-dba9-d9d4850b0000 pid=2949 execve guuid=2619cdf8-1a00-0000-dba9-d9d48a0b0000 pid=2954 /usr/bin/wget net send-data guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=2619cdf8-1a00-0000-dba9-d9d48a0b0000 pid=2954 execve guuid=0fe3b8fb-1a00-0000-dba9-d9d4900b0000 pid=2960 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=0fe3b8fb-1a00-0000-dba9-d9d4900b0000 pid=2960 execve guuid=b00a5aff-1a00-0000-dba9-d9d4980b0000 pid=2968 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=b00a5aff-1a00-0000-dba9-d9d4980b0000 pid=2968 clone guuid=100c80ff-1a00-0000-dba9-d9d49a0b0000 pid=2970 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=100c80ff-1a00-0000-dba9-d9d49a0b0000 pid=2970 execve guuid=579cd0ff-1a00-0000-dba9-d9d49c0b0000 pid=2972 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=579cd0ff-1a00-0000-dba9-d9d49c0b0000 pid=2972 execve guuid=1ae33600-1b00-0000-dba9-d9d4a10b0000 pid=2977 /usr/bin/wget net send-data guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=1ae33600-1b00-0000-dba9-d9d4a10b0000 pid=2977 execve guuid=4c841b03-1b00-0000-dba9-d9d4a50b0000 pid=2981 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=4c841b03-1b00-0000-dba9-d9d4a50b0000 pid=2981 execve guuid=b817ba07-1b00-0000-dba9-d9d4ac0b0000 pid=2988 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=b817ba07-1b00-0000-dba9-d9d4ac0b0000 pid=2988 clone guuid=7e9c1d08-1b00-0000-dba9-d9d4ad0b0000 pid=2989 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=7e9c1d08-1b00-0000-dba9-d9d4ad0b0000 pid=2989 execve guuid=3d08ab08-1b00-0000-dba9-d9d4af0b0000 pid=2991 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=3d08ab08-1b00-0000-dba9-d9d4af0b0000 pid=2991 execve guuid=c5460c09-1b00-0000-dba9-d9d4b40b0000 pid=2996 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=c5460c09-1b00-0000-dba9-d9d4b40b0000 pid=2996 execve guuid=e81a8f0e-1b00-0000-dba9-d9d4c00b0000 pid=3008 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=e81a8f0e-1b00-0000-dba9-d9d4c00b0000 pid=3008 execve guuid=974d6c13-1b00-0000-dba9-d9d4c80b0000 pid=3016 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=974d6c13-1b00-0000-dba9-d9d4c80b0000 pid=3016 clone guuid=dcd79213-1b00-0000-dba9-d9d4c90b0000 pid=3017 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=dcd79213-1b00-0000-dba9-d9d4c90b0000 pid=3017 execve guuid=91afdc13-1b00-0000-dba9-d9d4cb0b0000 pid=3019 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=91afdc13-1b00-0000-dba9-d9d4cb0b0000 pid=3019 execve guuid=6bdc2c14-1b00-0000-dba9-d9d4cf0b0000 pid=3023 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=6bdc2c14-1b00-0000-dba9-d9d4cf0b0000 pid=3023 execve guuid=0237ec18-1b00-0000-dba9-d9d4d00b0000 pid=3024 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=0237ec18-1b00-0000-dba9-d9d4d00b0000 pid=3024 execve guuid=ad74991d-1b00-0000-dba9-d9d4de0b0000 pid=3038 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=ad74991d-1b00-0000-dba9-d9d4de0b0000 pid=3038 clone guuid=deaab51d-1b00-0000-dba9-d9d4df0b0000 pid=3039 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=deaab51d-1b00-0000-dba9-d9d4df0b0000 pid=3039 execve guuid=a9c90b1e-1b00-0000-dba9-d9d4e10b0000 pid=3041 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=a9c90b1e-1b00-0000-dba9-d9d4e10b0000 pid=3041 execve guuid=e9e7571e-1b00-0000-dba9-d9d4e60b0000 pid=3046 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=e9e7571e-1b00-0000-dba9-d9d4e60b0000 pid=3046 execve guuid=d475e121-1b00-0000-dba9-d9d4ec0b0000 pid=3052 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=d475e121-1b00-0000-dba9-d9d4ec0b0000 pid=3052 execve guuid=ea6a5b26-1b00-0000-dba9-d9d4f50b0000 pid=3061 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=ea6a5b26-1b00-0000-dba9-d9d4f50b0000 pid=3061 clone guuid=3e5c8326-1b00-0000-dba9-d9d4f70b0000 pid=3063 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=3e5c8326-1b00-0000-dba9-d9d4f70b0000 pid=3063 execve guuid=7265f126-1b00-0000-dba9-d9d4f90b0000 pid=3065 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=7265f126-1b00-0000-dba9-d9d4f90b0000 pid=3065 execve guuid=ec715927-1b00-0000-dba9-d9d4fd0b0000 pid=3069 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=ec715927-1b00-0000-dba9-d9d4fd0b0000 pid=3069 execve guuid=a7899a2b-1b00-0000-dba9-d9d4060c0000 pid=3078 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=a7899a2b-1b00-0000-dba9-d9d4060c0000 pid=3078 execve guuid=a09c7a32-1b00-0000-dba9-d9d4170c0000 pid=3095 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=a09c7a32-1b00-0000-dba9-d9d4170c0000 pid=3095 clone guuid=486baa32-1b00-0000-dba9-d9d4180c0000 pid=3096 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=486baa32-1b00-0000-dba9-d9d4180c0000 pid=3096 execve guuid=e3614833-1b00-0000-dba9-d9d41b0c0000 pid=3099 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=e3614833-1b00-0000-dba9-d9d41b0c0000 pid=3099 execve guuid=a547af33-1b00-0000-dba9-d9d4200c0000 pid=3104 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=a547af33-1b00-0000-dba9-d9d4200c0000 pid=3104 execve guuid=25294737-1b00-0000-dba9-d9d42a0c0000 pid=3114 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=25294737-1b00-0000-dba9-d9d42a0c0000 pid=3114 execve guuid=96be293d-1b00-0000-dba9-d9d43b0c0000 pid=3131 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=96be293d-1b00-0000-dba9-d9d43b0c0000 pid=3131 clone guuid=1141523d-1b00-0000-dba9-d9d43c0c0000 pid=3132 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=1141523d-1b00-0000-dba9-d9d43c0c0000 pid=3132 execve guuid=60a7a93d-1b00-0000-dba9-d9d43e0c0000 pid=3134 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=60a7a93d-1b00-0000-dba9-d9d43e0c0000 pid=3134 execve guuid=f4020b3e-1b00-0000-dba9-d9d4430c0000 pid=3139 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=f4020b3e-1b00-0000-dba9-d9d4430c0000 pid=3139 execve guuid=d3fbee42-1b00-0000-dba9-d9d4510c0000 pid=3153 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=d3fbee42-1b00-0000-dba9-d9d4510c0000 pid=3153 execve guuid=ce463c4c-1b00-0000-dba9-d9d4650c0000 pid=3173 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=ce463c4c-1b00-0000-dba9-d9d4650c0000 pid=3173 clone guuid=45a05e4c-1b00-0000-dba9-d9d4660c0000 pid=3174 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=45a05e4c-1b00-0000-dba9-d9d4660c0000 pid=3174 execve guuid=94a9da4c-1b00-0000-dba9-d9d4690c0000 pid=3177 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=94a9da4c-1b00-0000-dba9-d9d4690c0000 pid=3177 execve guuid=b7c7334d-1b00-0000-dba9-d9d46e0c0000 pid=3182 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=b7c7334d-1b00-0000-dba9-d9d46e0c0000 pid=3182 execve guuid=cd323953-1b00-0000-dba9-d9d4780c0000 pid=3192 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=cd323953-1b00-0000-dba9-d9d4780c0000 pid=3192 execve guuid=60fc8b58-1b00-0000-dba9-d9d4880c0000 pid=3208 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=60fc8b58-1b00-0000-dba9-d9d4880c0000 pid=3208 clone guuid=9f33a458-1b00-0000-dba9-d9d48a0c0000 pid=3210 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=9f33a458-1b00-0000-dba9-d9d48a0c0000 pid=3210 execve guuid=f220f058-1b00-0000-dba9-d9d48b0c0000 pid=3211 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=f220f058-1b00-0000-dba9-d9d48b0c0000 pid=3211 execve guuid=8b2b3359-1b00-0000-dba9-d9d4900c0000 pid=3216 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=8b2b3359-1b00-0000-dba9-d9d4900c0000 pid=3216 execve guuid=b2909d5c-1b00-0000-dba9-d9d49a0c0000 pid=3226 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=b2909d5c-1b00-0000-dba9-d9d49a0c0000 pid=3226 execve guuid=d1c58f61-1b00-0000-dba9-d9d4aa0c0000 pid=3242 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=d1c58f61-1b00-0000-dba9-d9d4aa0c0000 pid=3242 clone guuid=707aa961-1b00-0000-dba9-d9d4ab0c0000 pid=3243 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=707aa961-1b00-0000-dba9-d9d4ab0c0000 pid=3243 execve guuid=fa40f161-1b00-0000-dba9-d9d4ad0c0000 pid=3245 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=fa40f161-1b00-0000-dba9-d9d4ad0c0000 pid=3245 execve guuid=94642d62-1b00-0000-dba9-d9d4b10c0000 pid=3249 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=94642d62-1b00-0000-dba9-d9d4b10c0000 pid=3249 execve guuid=6c9e5766-1b00-0000-dba9-d9d4bd0c0000 pid=3261 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=6c9e5766-1b00-0000-dba9-d9d4bd0c0000 pid=3261 execve guuid=f0c5c16b-1b00-0000-dba9-d9d4ca0c0000 pid=3274 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=f0c5c16b-1b00-0000-dba9-d9d4ca0c0000 pid=3274 clone guuid=cc15ea6b-1b00-0000-dba9-d9d4cc0c0000 pid=3276 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=cc15ea6b-1b00-0000-dba9-d9d4cc0c0000 pid=3276 execve guuid=6246686c-1b00-0000-dba9-d9d4ce0c0000 pid=3278 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=6246686c-1b00-0000-dba9-d9d4ce0c0000 pid=3278 execve guuid=8eb7d06c-1b00-0000-dba9-d9d4d20c0000 pid=3282 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=8eb7d06c-1b00-0000-dba9-d9d4d20c0000 pid=3282 execve guuid=ed2d5f71-1b00-0000-dba9-d9d4d70c0000 pid=3287 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=ed2d5f71-1b00-0000-dba9-d9d4d70c0000 pid=3287 execve guuid=1225c278-1b00-0000-dba9-d9d4e20c0000 pid=3298 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=1225c278-1b00-0000-dba9-d9d4e20c0000 pid=3298 clone guuid=91aff778-1b00-0000-dba9-d9d4e30c0000 pid=3299 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=91aff778-1b00-0000-dba9-d9d4e30c0000 pid=3299 execve guuid=98e8b679-1b00-0000-dba9-d9d4e40c0000 pid=3300 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=98e8b679-1b00-0000-dba9-d9d4e40c0000 pid=3300 execve guuid=c94f457a-1b00-0000-dba9-d9d4e80c0000 pid=3304 /usr/bin/wget net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=c94f457a-1b00-0000-dba9-d9d4e80c0000 pid=3304 execve guuid=891cee80-1b00-0000-dba9-d9d4e90c0000 pid=3305 /usr/bin/curl net send-data write-file guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=891cee80-1b00-0000-dba9-d9d4e90c0000 pid=3305 execve guuid=a51cc988-1b00-0000-dba9-d9d4ea0c0000 pid=3306 /usr/bin/bash guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=a51cc988-1b00-0000-dba9-d9d4ea0c0000 pid=3306 clone guuid=5215ee88-1b00-0000-dba9-d9d4eb0c0000 pid=3307 /usr/bin/chmod guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=5215ee88-1b00-0000-dba9-d9d4eb0c0000 pid=3307 execve guuid=00a95a89-1b00-0000-dba9-d9d4ec0c0000 pid=3308 /tmp/WTF net guuid=cb538eda-1a00-0000-dba9-d9d44e0b0000 pid=2894->guuid=00a95a89-1b00-0000-dba9-d9d4ec0c0000 pid=3308 execve 40d66be2-de25-513e-9984-047c1ab266b3 176.65.139.81:80 guuid=1f4704db-1a00-0000-dba9-d9d4510b0000 pid=2897->40d66be2-de25-513e-9984-047c1ab266b3 send: 149B guuid=4ab62ee0-1a00-0000-dba9-d9d4600b0000 pid=2912->40d66be2-de25-513e-9984-047c1ab266b3 send: 98B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=deb339ed-1a00-0000-dba9-d9d47b0b0000 pid=2939->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=367d78ed-1a00-0000-dba9-d9d47c0b0000 pid=2940 /tmp/WTF guuid=deb339ed-1a00-0000-dba9-d9d47b0b0000 pid=2939->guuid=367d78ed-1a00-0000-dba9-d9d47c0b0000 pid=2940 clone guuid=f0c880ed-1a00-0000-dba9-d9d47d0b0000 pid=2941 /tmp/WTF guuid=deb339ed-1a00-0000-dba9-d9d47b0b0000 pid=2939->guuid=f0c880ed-1a00-0000-dba9-d9d47d0b0000 pid=2941 clone guuid=d9118aed-1a00-0000-dba9-d9d47e0b0000 pid=2942 /tmp/WTF net send-data zombie guuid=deb339ed-1a00-0000-dba9-d9d47b0b0000 pid=2939->guuid=d9118aed-1a00-0000-dba9-d9d47e0b0000 pid=2942 clone guuid=d9118aed-1a00-0000-dba9-d9d47e0b0000 pid=2942->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con ca6eb703-52b1-5df7-b46e-190fd0fd968a 176.65.139.81:3778 guuid=d9118aed-1a00-0000-dba9-d9d47e0b0000 pid=2942->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=d27f9fed-1a00-0000-dba9-d9d47f0b0000 pid=2943->40d66be2-de25-513e-9984-047c1ab266b3 send: 150B guuid=7891a6f1-1a00-0000-dba9-d9d4800b0000 pid=2944->40d66be2-de25-513e-9984-047c1ab266b3 send: 99B guuid=39aa78f8-1a00-0000-dba9-d9d4850b0000 pid=2949->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9a8bb9f8-1a00-0000-dba9-d9d4860b0000 pid=2950 /tmp/WTF guuid=39aa78f8-1a00-0000-dba9-d9d4850b0000 pid=2949->guuid=9a8bb9f8-1a00-0000-dba9-d9d4860b0000 pid=2950 clone guuid=2eacbcf8-1a00-0000-dba9-d9d4870b0000 pid=2951 /tmp/WTF guuid=39aa78f8-1a00-0000-dba9-d9d4850b0000 pid=2949->guuid=2eacbcf8-1a00-0000-dba9-d9d4870b0000 pid=2951 clone guuid=5cd2c1f8-1a00-0000-dba9-d9d4880b0000 pid=2952 /tmp/WTF net send-data zombie guuid=39aa78f8-1a00-0000-dba9-d9d4850b0000 pid=2949->guuid=5cd2c1f8-1a00-0000-dba9-d9d4880b0000 pid=2952 clone guuid=5cd2c1f8-1a00-0000-dba9-d9d4880b0000 pid=2952->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5cd2c1f8-1a00-0000-dba9-d9d4880b0000 pid=2952->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=2619cdf8-1a00-0000-dba9-d9d48a0b0000 pid=2954->40d66be2-de25-513e-9984-047c1ab266b3 send: 149B guuid=0fe3b8fb-1a00-0000-dba9-d9d4900b0000 pid=2960->40d66be2-de25-513e-9984-047c1ab266b3 send: 98B guuid=579cd0ff-1a00-0000-dba9-d9d49c0b0000 pid=2972->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=24001e00-1b00-0000-dba9-d9d49e0b0000 pid=2974 /tmp/WTF guuid=579cd0ff-1a00-0000-dba9-d9d49c0b0000 pid=2972->guuid=24001e00-1b00-0000-dba9-d9d49e0b0000 pid=2974 clone guuid=98122400-1b00-0000-dba9-d9d49f0b0000 pid=2975 /tmp/WTF guuid=579cd0ff-1a00-0000-dba9-d9d49c0b0000 pid=2972->guuid=98122400-1b00-0000-dba9-d9d49f0b0000 pid=2975 clone guuid=31cb2800-1b00-0000-dba9-d9d4a00b0000 pid=2976 /tmp/WTF net send-data zombie guuid=579cd0ff-1a00-0000-dba9-d9d49c0b0000 pid=2972->guuid=31cb2800-1b00-0000-dba9-d9d4a00b0000 pid=2976 clone guuid=31cb2800-1b00-0000-dba9-d9d4a00b0000 pid=2976->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=31cb2800-1b00-0000-dba9-d9d4a00b0000 pid=2976->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=1ae33600-1b00-0000-dba9-d9d4a10b0000 pid=2977->40d66be2-de25-513e-9984-047c1ab266b3 send: 150B guuid=4c841b03-1b00-0000-dba9-d9d4a50b0000 pid=2981->40d66be2-de25-513e-9984-047c1ab266b3 send: 99B guuid=3d08ab08-1b00-0000-dba9-d9d4af0b0000 pid=2991->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0dedf008-1b00-0000-dba9-d9d4b10b0000 pid=2993 /tmp/WTF guuid=3d08ab08-1b00-0000-dba9-d9d4af0b0000 pid=2991->guuid=0dedf008-1b00-0000-dba9-d9d4b10b0000 pid=2993 clone guuid=6dc0f408-1b00-0000-dba9-d9d4b20b0000 pid=2994 /tmp/WTF guuid=3d08ab08-1b00-0000-dba9-d9d4af0b0000 pid=2991->guuid=6dc0f408-1b00-0000-dba9-d9d4b20b0000 pid=2994 clone guuid=ebf9f808-1b00-0000-dba9-d9d4b30b0000 pid=2995 /tmp/WTF net send-data zombie guuid=3d08ab08-1b00-0000-dba9-d9d4af0b0000 pid=2991->guuid=ebf9f808-1b00-0000-dba9-d9d4b30b0000 pid=2995 clone guuid=ebf9f808-1b00-0000-dba9-d9d4b30b0000 pid=2995->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ebf9f808-1b00-0000-dba9-d9d4b30b0000 pid=2995->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=c5460c09-1b00-0000-dba9-d9d4b40b0000 pid=2996->40d66be2-de25-513e-9984-047c1ab266b3 send: 150B guuid=e81a8f0e-1b00-0000-dba9-d9d4c00b0000 pid=3008->40d66be2-de25-513e-9984-047c1ab266b3 send: 99B guuid=91afdc13-1b00-0000-dba9-d9d4cb0b0000 pid=3019->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cc1d1414-1b00-0000-dba9-d9d4cc0b0000 pid=3020 /tmp/WTF guuid=91afdc13-1b00-0000-dba9-d9d4cb0b0000 pid=3019->guuid=cc1d1414-1b00-0000-dba9-d9d4cc0b0000 pid=3020 clone guuid=402c1814-1b00-0000-dba9-d9d4cd0b0000 pid=3021 /tmp/WTF guuid=91afdc13-1b00-0000-dba9-d9d4cb0b0000 pid=3019->guuid=402c1814-1b00-0000-dba9-d9d4cd0b0000 pid=3021 clone guuid=699a1b14-1b00-0000-dba9-d9d4ce0b0000 pid=3022 /tmp/WTF net send-data zombie guuid=91afdc13-1b00-0000-dba9-d9d4cb0b0000 pid=3019->guuid=699a1b14-1b00-0000-dba9-d9d4ce0b0000 pid=3022 clone guuid=699a1b14-1b00-0000-dba9-d9d4ce0b0000 pid=3022->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=699a1b14-1b00-0000-dba9-d9d4ce0b0000 pid=3022->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=6bdc2c14-1b00-0000-dba9-d9d4cf0b0000 pid=3023->40d66be2-de25-513e-9984-047c1ab266b3 send: 152B guuid=0237ec18-1b00-0000-dba9-d9d4d00b0000 pid=3024->40d66be2-de25-513e-9984-047c1ab266b3 send: 101B guuid=a9c90b1e-1b00-0000-dba9-d9d4e10b0000 pid=3041->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d8973f1e-1b00-0000-dba9-d9d4e30b0000 pid=3043 /tmp/WTF guuid=a9c90b1e-1b00-0000-dba9-d9d4e10b0000 pid=3041->guuid=d8973f1e-1b00-0000-dba9-d9d4e30b0000 pid=3043 clone guuid=cf78431e-1b00-0000-dba9-d9d4e40b0000 pid=3044 /tmp/WTF guuid=a9c90b1e-1b00-0000-dba9-d9d4e10b0000 pid=3041->guuid=cf78431e-1b00-0000-dba9-d9d4e40b0000 pid=3044 clone guuid=1f5b481e-1b00-0000-dba9-d9d4e50b0000 pid=3045 /tmp/WTF net send-data zombie guuid=a9c90b1e-1b00-0000-dba9-d9d4e10b0000 pid=3041->guuid=1f5b481e-1b00-0000-dba9-d9d4e50b0000 pid=3045 clone guuid=1f5b481e-1b00-0000-dba9-d9d4e50b0000 pid=3045->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1f5b481e-1b00-0000-dba9-d9d4e50b0000 pid=3045->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=e9e7571e-1b00-0000-dba9-d9d4e60b0000 pid=3046->40d66be2-de25-513e-9984-047c1ab266b3 send: 150B guuid=d475e121-1b00-0000-dba9-d9d4ec0b0000 pid=3052->40d66be2-de25-513e-9984-047c1ab266b3 send: 99B guuid=7265f126-1b00-0000-dba9-d9d4f90b0000 pid=3065->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=86592b27-1b00-0000-dba9-d9d4fa0b0000 pid=3066 /tmp/WTF guuid=7265f126-1b00-0000-dba9-d9d4f90b0000 pid=3065->guuid=86592b27-1b00-0000-dba9-d9d4fa0b0000 pid=3066 clone guuid=fe8b4327-1b00-0000-dba9-d9d4fb0b0000 pid=3067 /tmp/WTF guuid=7265f126-1b00-0000-dba9-d9d4f90b0000 pid=3065->guuid=fe8b4327-1b00-0000-dba9-d9d4fb0b0000 pid=3067 clone guuid=c8854727-1b00-0000-dba9-d9d4fc0b0000 pid=3068 /tmp/WTF net send-data zombie guuid=7265f126-1b00-0000-dba9-d9d4f90b0000 pid=3065->guuid=c8854727-1b00-0000-dba9-d9d4fc0b0000 pid=3068 clone guuid=c8854727-1b00-0000-dba9-d9d4fc0b0000 pid=3068->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c8854727-1b00-0000-dba9-d9d4fc0b0000 pid=3068->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=ec715927-1b00-0000-dba9-d9d4fd0b0000 pid=3069->40d66be2-de25-513e-9984-047c1ab266b3 send: 149B guuid=a7899a2b-1b00-0000-dba9-d9d4060c0000 pid=3078->40d66be2-de25-513e-9984-047c1ab266b3 send: 98B guuid=e3614833-1b00-0000-dba9-d9d41b0c0000 pid=3099->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a83d9b33-1b00-0000-dba9-d9d41c0c0000 pid=3100 /tmp/WTF guuid=e3614833-1b00-0000-dba9-d9d41b0c0000 pid=3099->guuid=a83d9b33-1b00-0000-dba9-d9d41c0c0000 pid=3100 clone guuid=c84a9f33-1b00-0000-dba9-d9d41d0c0000 pid=3101 /tmp/WTF guuid=e3614833-1b00-0000-dba9-d9d41b0c0000 pid=3099->guuid=c84a9f33-1b00-0000-dba9-d9d41d0c0000 pid=3101 clone guuid=37dfa333-1b00-0000-dba9-d9d41f0c0000 pid=3103 /tmp/WTF net send-data zombie guuid=e3614833-1b00-0000-dba9-d9d41b0c0000 pid=3099->guuid=37dfa333-1b00-0000-dba9-d9d41f0c0000 pid=3103 clone guuid=37dfa333-1b00-0000-dba9-d9d41f0c0000 pid=3103->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=37dfa333-1b00-0000-dba9-d9d41f0c0000 pid=3103->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=a547af33-1b00-0000-dba9-d9d4200c0000 pid=3104->40d66be2-de25-513e-9984-047c1ab266b3 send: 150B guuid=25294737-1b00-0000-dba9-d9d42a0c0000 pid=3114->40d66be2-de25-513e-9984-047c1ab266b3 send: 99B guuid=60a7a93d-1b00-0000-dba9-d9d43e0c0000 pid=3134->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5b6df03d-1b00-0000-dba9-d9d4400c0000 pid=3136 /tmp/WTF guuid=60a7a93d-1b00-0000-dba9-d9d43e0c0000 pid=3134->guuid=5b6df03d-1b00-0000-dba9-d9d4400c0000 pid=3136 clone guuid=ad53f63d-1b00-0000-dba9-d9d4410c0000 pid=3137 /tmp/WTF guuid=60a7a93d-1b00-0000-dba9-d9d43e0c0000 pid=3134->guuid=ad53f63d-1b00-0000-dba9-d9d4410c0000 pid=3137 clone guuid=e72dfe3d-1b00-0000-dba9-d9d4420c0000 pid=3138 /tmp/WTF net send-data zombie guuid=60a7a93d-1b00-0000-dba9-d9d43e0c0000 pid=3134->guuid=e72dfe3d-1b00-0000-dba9-d9d4420c0000 pid=3138 clone guuid=e72dfe3d-1b00-0000-dba9-d9d4420c0000 pid=3138->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e72dfe3d-1b00-0000-dba9-d9d4420c0000 pid=3138->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=f4020b3e-1b00-0000-dba9-d9d4430c0000 pid=3139->40d66be2-de25-513e-9984-047c1ab266b3 send: 150B guuid=d3fbee42-1b00-0000-dba9-d9d4510c0000 pid=3153->40d66be2-de25-513e-9984-047c1ab266b3 send: 99B guuid=94a9da4c-1b00-0000-dba9-d9d4690c0000 pid=3177->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=52671a4d-1b00-0000-dba9-d9d46a0c0000 pid=3178 /tmp/WTF guuid=94a9da4c-1b00-0000-dba9-d9d4690c0000 pid=3177->guuid=52671a4d-1b00-0000-dba9-d9d46a0c0000 pid=3178 clone guuid=49f81f4d-1b00-0000-dba9-d9d46b0c0000 pid=3179 /tmp/WTF guuid=94a9da4c-1b00-0000-dba9-d9d4690c0000 pid=3177->guuid=49f81f4d-1b00-0000-dba9-d9d46b0c0000 pid=3179 clone guuid=7a65274d-1b00-0000-dba9-d9d46c0c0000 pid=3180 /tmp/WTF net send-data zombie guuid=94a9da4c-1b00-0000-dba9-d9d4690c0000 pid=3177->guuid=7a65274d-1b00-0000-dba9-d9d46c0c0000 pid=3180 clone guuid=7a65274d-1b00-0000-dba9-d9d46c0c0000 pid=3180->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7a65274d-1b00-0000-dba9-d9d46c0c0000 pid=3180->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=b7c7334d-1b00-0000-dba9-d9d46e0c0000 pid=3182->40d66be2-de25-513e-9984-047c1ab266b3 send: 150B guuid=cd323953-1b00-0000-dba9-d9d4780c0000 pid=3192->40d66be2-de25-513e-9984-047c1ab266b3 send: 99B guuid=f220f058-1b00-0000-dba9-d9d48b0c0000 pid=3211->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1cad1d59-1b00-0000-dba9-d9d48d0c0000 pid=3213 /tmp/WTF guuid=f220f058-1b00-0000-dba9-d9d48b0c0000 pid=3211->guuid=1cad1d59-1b00-0000-dba9-d9d48d0c0000 pid=3213 clone guuid=0e082159-1b00-0000-dba9-d9d48e0c0000 pid=3214 /tmp/WTF guuid=f220f058-1b00-0000-dba9-d9d48b0c0000 pid=3211->guuid=0e082159-1b00-0000-dba9-d9d48e0c0000 pid=3214 clone guuid=f4b42559-1b00-0000-dba9-d9d48f0c0000 pid=3215 /tmp/WTF net send-data zombie guuid=f220f058-1b00-0000-dba9-d9d48b0c0000 pid=3211->guuid=f4b42559-1b00-0000-dba9-d9d48f0c0000 pid=3215 clone guuid=f4b42559-1b00-0000-dba9-d9d48f0c0000 pid=3215->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f4b42559-1b00-0000-dba9-d9d48f0c0000 pid=3215->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=8b2b3359-1b00-0000-dba9-d9d4900c0000 pid=3216->40d66be2-de25-513e-9984-047c1ab266b3 send: 149B guuid=b2909d5c-1b00-0000-dba9-d9d49a0c0000 pid=3226->40d66be2-de25-513e-9984-047c1ab266b3 send: 98B guuid=fa40f161-1b00-0000-dba9-d9d4ad0c0000 pid=3245->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d04f1d62-1b00-0000-dba9-d9d4ae0c0000 pid=3246 /tmp/WTF guuid=fa40f161-1b00-0000-dba9-d9d4ad0c0000 pid=3245->guuid=d04f1d62-1b00-0000-dba9-d9d4ae0c0000 pid=3246 clone guuid=06aa2062-1b00-0000-dba9-d9d4af0c0000 pid=3247 /tmp/WTF guuid=fa40f161-1b00-0000-dba9-d9d4ad0c0000 pid=3245->guuid=06aa2062-1b00-0000-dba9-d9d4af0c0000 pid=3247 clone guuid=dddb2362-1b00-0000-dba9-d9d4b00c0000 pid=3248 /tmp/WTF net send-data zombie guuid=fa40f161-1b00-0000-dba9-d9d4ad0c0000 pid=3245->guuid=dddb2362-1b00-0000-dba9-d9d4b00c0000 pid=3248 clone guuid=dddb2362-1b00-0000-dba9-d9d4b00c0000 pid=3248->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=dddb2362-1b00-0000-dba9-d9d4b00c0000 pid=3248->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=94642d62-1b00-0000-dba9-d9d4b10c0000 pid=3249->40d66be2-de25-513e-9984-047c1ab266b3 send: 149B guuid=6c9e5766-1b00-0000-dba9-d9d4bd0c0000 pid=3261->40d66be2-de25-513e-9984-047c1ab266b3 send: 98B guuid=6246686c-1b00-0000-dba9-d9d4ce0c0000 pid=3278->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f41bad6c-1b00-0000-dba9-d9d4cf0c0000 pid=3279 /tmp/WTF guuid=6246686c-1b00-0000-dba9-d9d4ce0c0000 pid=3278->guuid=f41bad6c-1b00-0000-dba9-d9d4cf0c0000 pid=3279 clone guuid=ae76b56c-1b00-0000-dba9-d9d4d00c0000 pid=3280 /tmp/WTF guuid=6246686c-1b00-0000-dba9-d9d4ce0c0000 pid=3278->guuid=ae76b56c-1b00-0000-dba9-d9d4d00c0000 pid=3280 clone guuid=c3f9c26c-1b00-0000-dba9-d9d4d10c0000 pid=3281 /tmp/WTF net send-data zombie guuid=6246686c-1b00-0000-dba9-d9d4ce0c0000 pid=3278->guuid=c3f9c26c-1b00-0000-dba9-d9d4d10c0000 pid=3281 clone guuid=c3f9c26c-1b00-0000-dba9-d9d4d10c0000 pid=3281->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c3f9c26c-1b00-0000-dba9-d9d4d10c0000 pid=3281->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=8eb7d06c-1b00-0000-dba9-d9d4d20c0000 pid=3282->40d66be2-de25-513e-9984-047c1ab266b3 send: 150B guuid=ed2d5f71-1b00-0000-dba9-d9d4d70c0000 pid=3287->40d66be2-de25-513e-9984-047c1ab266b3 send: 99B guuid=98e8b679-1b00-0000-dba9-d9d4e40c0000 pid=3300->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a9f71d7a-1b00-0000-dba9-d9d4e50c0000 pid=3301 /tmp/WTF guuid=98e8b679-1b00-0000-dba9-d9d4e40c0000 pid=3300->guuid=a9f71d7a-1b00-0000-dba9-d9d4e50c0000 pid=3301 clone guuid=8d11247a-1b00-0000-dba9-d9d4e60c0000 pid=3302 /tmp/WTF guuid=98e8b679-1b00-0000-dba9-d9d4e40c0000 pid=3300->guuid=8d11247a-1b00-0000-dba9-d9d4e60c0000 pid=3302 clone guuid=6a37327a-1b00-0000-dba9-d9d4e70c0000 pid=3303 /tmp/WTF net send-data zombie guuid=98e8b679-1b00-0000-dba9-d9d4e40c0000 pid=3300->guuid=6a37327a-1b00-0000-dba9-d9d4e70c0000 pid=3303 clone guuid=6a37327a-1b00-0000-dba9-d9d4e70c0000 pid=3303->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6a37327a-1b00-0000-dba9-d9d4e70c0000 pid=3303->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B guuid=c94f457a-1b00-0000-dba9-d9d4e80c0000 pid=3304->40d66be2-de25-513e-9984-047c1ab266b3 send: 149B guuid=891cee80-1b00-0000-dba9-d9d4e90c0000 pid=3305->40d66be2-de25-513e-9984-047c1ab266b3 send: 98B guuid=00a95a89-1b00-0000-dba9-d9d4ec0c0000 pid=3308->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ea3da289-1b00-0000-dba9-d9d4ed0c0000 pid=3309 /tmp/WTF guuid=00a95a89-1b00-0000-dba9-d9d4ec0c0000 pid=3308->guuid=ea3da289-1b00-0000-dba9-d9d4ed0c0000 pid=3309 clone guuid=e3bbaa89-1b00-0000-dba9-d9d4ee0c0000 pid=3310 /tmp/WTF guuid=00a95a89-1b00-0000-dba9-d9d4ec0c0000 pid=3308->guuid=e3bbaa89-1b00-0000-dba9-d9d4ee0c0000 pid=3310 clone guuid=f7d6b089-1b00-0000-dba9-d9d4ef0c0000 pid=3311 /tmp/WTF net send-data zombie guuid=00a95a89-1b00-0000-dba9-d9d4ec0c0000 pid=3308->guuid=f7d6b089-1b00-0000-dba9-d9d4ef0c0000 pid=3311 clone guuid=f7d6b089-1b00-0000-dba9-d9d4ef0c0000 pid=3311->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f7d6b089-1b00-0000-dba9-d9d4ef0c0000 pid=3311->ca6eb703-52b1-5df7-b46e-190fd0fd968a send: 7B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6e6a1c99288d7838b682e95babfcd17287cff46476bf4f1e84d31bfc040ae0cb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e6a1c99288d7838b682e95babfcd17287cff46476bf4f1e84d31bfc040ae0cb/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/6e6a1c99288d7838b682e95babfcd17287cff46476bf4f1e84d31bfc040ae0cb
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nzvbzgjirv4drnuc5fn2x7grokd475deo27u6hue2mn7ybak4dfq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260328-wgfljaa12j/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6e6a1c99288d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 6e6a1c99288d7838b682e95babfcd17287cff46476bf4f1e84d31bfc040ae0cb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3807141/
  
Delivery method
Distributed via web download

Comments