MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c
SHA3-384 hash: 2f29e9be9f27dac6542f235b9143833ae802a27de8a4f38cc639819fb55bc7e88b9f40c7a51c30849493eb2242372a2d
SHA1 hash: b40ebe4704de6c132e0d2a45ccd4fa4289a7d2b6
MD5 hash: b2813f453349253af9449adb54820784
humanhash: tango-crazy-dakota-pennsylvania
File name:ohshit.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'007 bytes
First seen:2026-01-15 12:16:08 UTC
Last seen:2026-01-15 22:33:03 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:iQ7f7N7hQ66GQgCzPQqKWQcoUQ7c7o7UQf93bQv9RQ4cgQjpVQCSOQG+CQNfTQ1Y:iQ7f7N7hQ66GQgCzPQqKWQcoUQ7c7o7o
TLSH T11951B4C583A82C706C636B13E7F6C16830C596D318EAAF95DAD8BAF8825ED343D41753
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://216.126.224.83/hiddenbin/boatnet.x86237c93fcf0bf76e3caf620641472356b8cf6c8653cbc7508967f1aab9d0280c3 Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.mips1c18cd9df0e6f58d0e4269c83613847ad76b23eca3daa3963bdb5bdef4e56748 Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.arcec799238ec87f7c18eab46ff359babec1282a8f6c557dc8a98e65d50a71f17f8 Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.i468n/an/aelf ua-wget
http://216.126.224.83/hiddenbin/boatnet.i686n/an/aelf ua-wget
http://216.126.224.83/hiddenbin/boatnet.x86_64n/an/aelf ua-wget
http://216.126.224.83/hiddenbin/boatnet.mpslb9c47335932c912967bd8160969b0bddc41e1db8641619fbbd12986a03d908cd Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.arm64cf51ace5d900adb59f8149dab10f092030e930112777d12a9ad3ec8914d27b Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.arm53304d935bcea36bd5840d156ad29411c1862205222c7ec9f317e11def8bc92b7 Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.arm69557ceec64b2582ba43430450f17be208937c3d755fbf4149f10d0c81db2fec3 Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.arm72454b591827e78bf8ff728ef6bda5caf8b240c6ed856c718407a957e4b8b240c Mirai32-bit elf mirai Mozi
http://216.126.224.83/hiddenbin/boatnet.ppc66bd83b5473da7930905033d5371b95b56e5221aa3f11dc256bb290f2bc5ec87 Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.spcb232f0abccc6e5c3b7f3237fcb358bd5f6bd74aabb2fb6a4494ce71178ca3b88 Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.m68k2c8905321589a0b8cd0e70ff3ebd5e5f5131f3a5319ace6061cfdeae378cd52c Miraielf mirai ua-wget
http://216.126.224.83/hiddenbin/boatnet.sh44f7d1e0b0bb7f8e460ecf7c375d7e19c35589d7e2f685f93ed3bddaf30b7b7c7 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox medusa mirai
Link:
https://www.filescan.io/uploads/6968da99584f1963ad548718/reports/2b820ccf-4c4b-4303-ab12-d1be8da7731e/overview
Result
Gathering data
Verdict:
Malicious
File Type:
Script
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/9997afa2-caab-423c-852b-2b5e8414e8c5
Behavior Graph:
Download SVG
%3 guuid=96b32f75-1500-0000-e276-92f1580c0000 pid=3160 /usr/bin/sudo guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162 /tmp/sample.bin guuid=96b32f75-1500-0000-e276-92f1580c0000 pid=3160->guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162 execve guuid=adccde77-1500-0000-e276-92f15b0c0000 pid=3163 /usr/bin/cp guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=adccde77-1500-0000-e276-92f15b0c0000 pid=3163 execve guuid=1257f37c-1500-0000-e276-92f15c0c0000 pid=3164 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=1257f37c-1500-0000-e276-92f15c0c0000 pid=3164 execve guuid=a98f129f-1500-0000-e276-92f1810c0000 pid=3201 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=a98f129f-1500-0000-e276-92f1810c0000 pid=3201 execve guuid=1c787ac4-1500-0000-e276-92f1a40c0000 pid=3236 /usr/bin/cat guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=1c787ac4-1500-0000-e276-92f1a40c0000 pid=3236 execve guuid=6eb5c8c4-1500-0000-e276-92f1a60c0000 pid=3238 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=6eb5c8c4-1500-0000-e276-92f1a60c0000 pid=3238 execve guuid=110f32c5-1500-0000-e276-92f1a70c0000 pid=3239 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=110f32c5-1500-0000-e276-92f1a70c0000 pid=3239 execve guuid=bfb85dc6-1500-0000-e276-92f1ab0c0000 pid=3243 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=bfb85dc6-1500-0000-e276-92f1ab0c0000 pid=3243 execve guuid=8ae229e7-1500-0000-e276-92f1d90c0000 pid=3289 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=8ae229e7-1500-0000-e276-92f1d90c0000 pid=3289 execve guuid=e2cf820a-1600-0000-e276-92f1080d0000 pid=3336 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=e2cf820a-1600-0000-e276-92f1080d0000 pid=3336 clone guuid=9459b70a-1600-0000-e276-92f1090d0000 pid=3337 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=9459b70a-1600-0000-e276-92f1090d0000 pid=3337 execve guuid=a233240b-1600-0000-e276-92f10c0d0000 pid=3340 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=a233240b-1600-0000-e276-92f10c0d0000 pid=3340 execve guuid=7614460c-1600-0000-e276-92f1130d0000 pid=3347 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=7614460c-1600-0000-e276-92f1130d0000 pid=3347 execve guuid=6ceaa534-1600-0000-e276-92f16c0d0000 pid=3436 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=6ceaa534-1600-0000-e276-92f16c0d0000 pid=3436 execve guuid=2a730961-1600-0000-e276-92f1c50d0000 pid=3525 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=2a730961-1600-0000-e276-92f1c50d0000 pid=3525 clone guuid=d4d72161-1600-0000-e276-92f1c60d0000 pid=3526 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=d4d72161-1600-0000-e276-92f1c60d0000 pid=3526 execve guuid=62068161-1600-0000-e276-92f1c70d0000 pid=3527 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=62068161-1600-0000-e276-92f1c70d0000 pid=3527 execve guuid=1ba24662-1600-0000-e276-92f1cb0d0000 pid=3531 /usr/bin/wget net send-data guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=1ba24662-1600-0000-e276-92f1cb0d0000 pid=3531 execve guuid=929f0173-1600-0000-e276-92f1f30d0000 pid=3571 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=929f0173-1600-0000-e276-92f1f30d0000 pid=3571 execve guuid=6df58684-1600-0000-e276-92f11d0e0000 pid=3613 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=6df58684-1600-0000-e276-92f11d0e0000 pid=3613 clone guuid=4598a184-1600-0000-e276-92f11e0e0000 pid=3614 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=4598a184-1600-0000-e276-92f11e0e0000 pid=3614 execve guuid=2cae1585-1600-0000-e276-92f1200e0000 pid=3616 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=2cae1585-1600-0000-e276-92f1200e0000 pid=3616 execve guuid=c3ca4f86-1600-0000-e276-92f1270e0000 pid=3623 /usr/bin/wget net send-data guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=c3ca4f86-1600-0000-e276-92f1270e0000 pid=3623 execve guuid=06b64597-1600-0000-e276-92f15d0e0000 pid=3677 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=06b64597-1600-0000-e276-92f15d0e0000 pid=3677 execve guuid=9cf61aaa-1600-0000-e276-92f1700e0000 pid=3696 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=9cf61aaa-1600-0000-e276-92f1700e0000 pid=3696 clone guuid=c78d40aa-1600-0000-e276-92f1710e0000 pid=3697 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=c78d40aa-1600-0000-e276-92f1710e0000 pid=3697 execve guuid=8af0d2aa-1600-0000-e276-92f1720e0000 pid=3698 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=8af0d2aa-1600-0000-e276-92f1720e0000 pid=3698 execve guuid=bfd549ac-1600-0000-e276-92f17a0e0000 pid=3706 /usr/bin/wget net send-data guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=bfd549ac-1600-0000-e276-92f17a0e0000 pid=3706 execve guuid=54d7e2bc-1600-0000-e276-92f1af0e0000 pid=3759 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=54d7e2bc-1600-0000-e276-92f1af0e0000 pid=3759 execve guuid=571491d0-1600-0000-e276-92f1fb0e0000 pid=3835 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=571491d0-1600-0000-e276-92f1fb0e0000 pid=3835 clone guuid=1cfdaad0-1600-0000-e276-92f1fd0e0000 pid=3837 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=1cfdaad0-1600-0000-e276-92f1fd0e0000 pid=3837 execve guuid=c1312ed1-1600-0000-e276-92f1000f0000 pid=3840 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=c1312ed1-1600-0000-e276-92f1000f0000 pid=3840 execve guuid=564d97d2-1600-0000-e276-92f10b0f0000 pid=3851 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=564d97d2-1600-0000-e276-92f10b0f0000 pid=3851 execve guuid=6f7f8ef4-1600-0000-e276-92f1640f0000 pid=3940 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=6f7f8ef4-1600-0000-e276-92f1640f0000 pid=3940 execve guuid=31b07319-1700-0000-e276-92f1cf0f0000 pid=4047 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=31b07319-1700-0000-e276-92f1cf0f0000 pid=4047 clone guuid=878e9119-1700-0000-e276-92f1d00f0000 pid=4048 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=878e9119-1700-0000-e276-92f1d00f0000 pid=4048 execve guuid=cda9ec19-1700-0000-e276-92f1d20f0000 pid=4050 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=cda9ec19-1700-0000-e276-92f1d20f0000 pid=4050 execve guuid=1ddcce1a-1700-0000-e276-92f1d80f0000 pid=4056 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=1ddcce1a-1700-0000-e276-92f1d80f0000 pid=4056 execve guuid=806eb43a-1700-0000-e276-92f150100000 pid=4176 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=806eb43a-1700-0000-e276-92f150100000 pid=4176 execve guuid=4fccb15b-1700-0000-e276-92f1c3100000 pid=4291 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=4fccb15b-1700-0000-e276-92f1c3100000 pid=4291 clone guuid=7470dc5b-1700-0000-e276-92f1c6100000 pid=4294 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=7470dc5b-1700-0000-e276-92f1c6100000 pid=4294 execve guuid=12fb275c-1700-0000-e276-92f1c7100000 pid=4295 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=12fb275c-1700-0000-e276-92f1c7100000 pid=4295 execve guuid=8bd2e35c-1700-0000-e276-92f1ce100000 pid=4302 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=8bd2e35c-1700-0000-e276-92f1ce100000 pid=4302 execve guuid=9f0b0576-1700-0000-e276-92f11e110000 pid=4382 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=9f0b0576-1700-0000-e276-92f11e110000 pid=4382 execve guuid=8b3a428f-1700-0000-e276-92f18d110000 pid=4493 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=8b3a428f-1700-0000-e276-92f18d110000 pid=4493 clone guuid=a4e25f8f-1700-0000-e276-92f18e110000 pid=4494 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=a4e25f8f-1700-0000-e276-92f18e110000 pid=4494 execve guuid=0ca3a88f-1700-0000-e276-92f190110000 pid=4496 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=0ca3a88f-1700-0000-e276-92f190110000 pid=4496 execve guuid=0d7f7190-1700-0000-e276-92f19a110000 pid=4506 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=0d7f7190-1700-0000-e276-92f19a110000 pid=4506 execve guuid=cf71e3b0-1700-0000-e276-92f1fd110000 pid=4605 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=cf71e3b0-1700-0000-e276-92f1fd110000 pid=4605 execve guuid=dc5962d2-1700-0000-e276-92f182120000 pid=4738 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=dc5962d2-1700-0000-e276-92f182120000 pid=4738 clone guuid=be798bd2-1700-0000-e276-92f183120000 pid=4739 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=be798bd2-1700-0000-e276-92f183120000 pid=4739 execve guuid=37dff5d2-1700-0000-e276-92f184120000 pid=4740 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=37dff5d2-1700-0000-e276-92f184120000 pid=4740 execve guuid=589ea5d3-1700-0000-e276-92f18b120000 pid=4747 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=589ea5d3-1700-0000-e276-92f18b120000 pid=4747 execve guuid=95aa9af3-1700-0000-e276-92f1eb120000 pid=4843 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=95aa9af3-1700-0000-e276-92f1eb120000 pid=4843 execve guuid=f9c90916-1800-0000-e276-92f154130000 pid=4948 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=f9c90916-1800-0000-e276-92f154130000 pid=4948 clone guuid=9c982a16-1800-0000-e276-92f155130000 pid=4949 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=9c982a16-1800-0000-e276-92f155130000 pid=4949 execve guuid=fd38aa16-1800-0000-e276-92f158130000 pid=4952 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=fd38aa16-1800-0000-e276-92f158130000 pid=4952 execve guuid=b898ae17-1800-0000-e276-92f161130000 pid=4961 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=b898ae17-1800-0000-e276-92f161130000 pid=4961 execve guuid=da98c137-1800-0000-e276-92f1e9130000 pid=5097 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=da98c137-1800-0000-e276-92f1e9130000 pid=5097 execve guuid=6303075c-1800-0000-e276-92f160140000 pid=5216 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=6303075c-1800-0000-e276-92f160140000 pid=5216 clone guuid=80e2245c-1800-0000-e276-92f161140000 pid=5217 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=80e2245c-1800-0000-e276-92f161140000 pid=5217 execve guuid=a14b925c-1800-0000-e276-92f163140000 pid=5219 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=a14b925c-1800-0000-e276-92f163140000 pid=5219 execve guuid=363d815d-1800-0000-e276-92f16b140000 pid=5227 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=363d815d-1800-0000-e276-92f16b140000 pid=5227 execve guuid=7b6f877e-1800-0000-e276-92f1b2140000 pid=5298 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=7b6f877e-1800-0000-e276-92f1b2140000 pid=5298 execve guuid=05c429a1-1800-0000-e276-92f1be140000 pid=5310 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=05c429a1-1800-0000-e276-92f1be140000 pid=5310 clone guuid=a0f252a1-1800-0000-e276-92f1bf140000 pid=5311 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=a0f252a1-1800-0000-e276-92f1bf140000 pid=5311 execve guuid=cd17c8a1-1800-0000-e276-92f1c0140000 pid=5312 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=cd17c8a1-1800-0000-e276-92f1c0140000 pid=5312 execve guuid=d186d2a2-1800-0000-e276-92f1c4140000 pid=5316 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=d186d2a2-1800-0000-e276-92f1c4140000 pid=5316 execve guuid=092f3dcc-1800-0000-e276-92f1c5140000 pid=5317 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=092f3dcc-1800-0000-e276-92f1c5140000 pid=5317 execve guuid=93a65ff7-1800-0000-e276-92f1c6140000 pid=5318 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=93a65ff7-1800-0000-e276-92f1c6140000 pid=5318 clone guuid=1c017df7-1800-0000-e276-92f1c7140000 pid=5319 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=1c017df7-1800-0000-e276-92f1c7140000 pid=5319 execve guuid=620ed0f7-1800-0000-e276-92f1c8140000 pid=5320 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=620ed0f7-1800-0000-e276-92f1c8140000 pid=5320 execve guuid=62ed87f8-1800-0000-e276-92f1cc140000 pid=5324 /usr/bin/wget net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=62ed87f8-1800-0000-e276-92f1cc140000 pid=5324 execve guuid=c8333c21-1900-0000-e276-92f1cd140000 pid=5325 /usr/bin/curl net send-data write-file guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=c8333c21-1900-0000-e276-92f1cd140000 pid=5325 execve guuid=d53d394a-1900-0000-e276-92f1ce140000 pid=5326 /usr/bin/bash guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=d53d394a-1900-0000-e276-92f1ce140000 pid=5326 clone guuid=b1385c4a-1900-0000-e276-92f1cf140000 pid=5327 /usr/bin/chmod guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=b1385c4a-1900-0000-e276-92f1cf140000 pid=5327 execve guuid=1babb94a-1900-0000-e276-92f1d0140000 pid=5328 /tmp/WTF net guuid=ee667777-1500-0000-e276-92f15a0c0000 pid=3162->guuid=1babb94a-1900-0000-e276-92f1d0140000 pid=5328 execve 26db1fad-1066-5d83-859b-2e3526ca2b53 216.126.224.83:80 guuid=1257f37c-1500-0000-e276-92f15c0c0000 pid=3164->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 150B guuid=a98f129f-1500-0000-e276-92f1810c0000 pid=3201->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 99B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=110f32c5-1500-0000-e276-92f1a70c0000 pid=3239->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a7da43c6-1500-0000-e276-92f1a80c0000 pid=3240 /tmp/WTF guuid=110f32c5-1500-0000-e276-92f1a70c0000 pid=3239->guuid=a7da43c6-1500-0000-e276-92f1a80c0000 pid=3240 clone guuid=cc5d4dc6-1500-0000-e276-92f1a90c0000 pid=3241 /tmp/WTF guuid=110f32c5-1500-0000-e276-92f1a70c0000 pid=3239->guuid=cc5d4dc6-1500-0000-e276-92f1a90c0000 pid=3241 clone guuid=1f4b52c6-1500-0000-e276-92f1aa0c0000 pid=3242 /tmp/WTF net send-data zombie guuid=110f32c5-1500-0000-e276-92f1a70c0000 pid=3239->guuid=1f4b52c6-1500-0000-e276-92f1aa0c0000 pid=3242 clone guuid=1f4b52c6-1500-0000-e276-92f1aa0c0000 pid=3242->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 619239fa-1301-50f0-ad67-2b4dfb258a68 144.172.110.33:3778 guuid=1f4b52c6-1500-0000-e276-92f1aa0c0000 pid=3242->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=bfb85dc6-1500-0000-e276-92f1ab0c0000 pid=3243->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 151B guuid=8ae229e7-1500-0000-e276-92f1d90c0000 pid=3289->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 100B guuid=a233240b-1600-0000-e276-92f10c0d0000 pid=3340->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1e6b2e0c-1600-0000-e276-92f10f0d0000 pid=3343 /tmp/WTF guuid=a233240b-1600-0000-e276-92f10c0d0000 pid=3340->guuid=1e6b2e0c-1600-0000-e276-92f10f0d0000 pid=3343 clone guuid=260a340c-1600-0000-e276-92f1100d0000 pid=3344 /tmp/WTF guuid=a233240b-1600-0000-e276-92f10c0d0000 pid=3340->guuid=260a340c-1600-0000-e276-92f1100d0000 pid=3344 clone guuid=ca00390c-1600-0000-e276-92f1120d0000 pid=3346 /tmp/WTF net send-data zombie guuid=a233240b-1600-0000-e276-92f10c0d0000 pid=3340->guuid=ca00390c-1600-0000-e276-92f1120d0000 pid=3346 clone guuid=ca00390c-1600-0000-e276-92f1120d0000 pid=3346->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ca00390c-1600-0000-e276-92f1120d0000 pid=3346->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=7614460c-1600-0000-e276-92f1130d0000 pid=3347->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 150B guuid=6ceaa534-1600-0000-e276-92f16c0d0000 pid=3436->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 99B guuid=62068161-1600-0000-e276-92f1c70d0000 pid=3527->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=2c261f62-1600-0000-e276-92f1c80d0000 pid=3528 /tmp/WTF guuid=62068161-1600-0000-e276-92f1c70d0000 pid=3527->guuid=2c261f62-1600-0000-e276-92f1c80d0000 pid=3528 clone guuid=ba7e2a62-1600-0000-e276-92f1c90d0000 pid=3529 /tmp/WTF guuid=62068161-1600-0000-e276-92f1c70d0000 pid=3527->guuid=ba7e2a62-1600-0000-e276-92f1c90d0000 pid=3529 clone guuid=d4a43062-1600-0000-e276-92f1ca0d0000 pid=3530 /tmp/WTF net send-data zombie guuid=62068161-1600-0000-e276-92f1c70d0000 pid=3527->guuid=d4a43062-1600-0000-e276-92f1ca0d0000 pid=3530 clone guuid=d4a43062-1600-0000-e276-92f1ca0d0000 pid=3530->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d4a43062-1600-0000-e276-92f1ca0d0000 pid=3530->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=1ba24662-1600-0000-e276-92f1cb0d0000 pid=3531->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 151B guuid=929f0173-1600-0000-e276-92f1f30d0000 pid=3571->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 100B guuid=2cae1585-1600-0000-e276-92f1200e0000 pid=3616->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c62a3486-1600-0000-e276-92f1230e0000 pid=3619 /tmp/WTF guuid=2cae1585-1600-0000-e276-92f1200e0000 pid=3616->guuid=c62a3486-1600-0000-e276-92f1230e0000 pid=3619 clone guuid=347f3b86-1600-0000-e276-92f1240e0000 pid=3620 /tmp/WTF guuid=2cae1585-1600-0000-e276-92f1200e0000 pid=3616->guuid=347f3b86-1600-0000-e276-92f1240e0000 pid=3620 clone guuid=d5d34186-1600-0000-e276-92f1260e0000 pid=3622 /tmp/WTF net send-data zombie guuid=2cae1585-1600-0000-e276-92f1200e0000 pid=3616->guuid=d5d34186-1600-0000-e276-92f1260e0000 pid=3622 clone guuid=d5d34186-1600-0000-e276-92f1260e0000 pid=3622->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d5d34186-1600-0000-e276-92f1260e0000 pid=3622->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=c3ca4f86-1600-0000-e276-92f1270e0000 pid=3623->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 151B guuid=06b64597-1600-0000-e276-92f15d0e0000 pid=3677->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 100B guuid=8af0d2aa-1600-0000-e276-92f1720e0000 pid=3698->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ef4526ac-1600-0000-e276-92f1770e0000 pid=3703 /tmp/WTF guuid=8af0d2aa-1600-0000-e276-92f1720e0000 pid=3698->guuid=ef4526ac-1600-0000-e276-92f1770e0000 pid=3703 clone guuid=41f02eac-1600-0000-e276-92f1780e0000 pid=3704 /tmp/WTF guuid=8af0d2aa-1600-0000-e276-92f1720e0000 pid=3698->guuid=41f02eac-1600-0000-e276-92f1780e0000 pid=3704 clone guuid=6e5934ac-1600-0000-e276-92f1790e0000 pid=3705 /tmp/WTF net send-data zombie guuid=8af0d2aa-1600-0000-e276-92f1720e0000 pid=3698->guuid=6e5934ac-1600-0000-e276-92f1790e0000 pid=3705 clone guuid=6e5934ac-1600-0000-e276-92f1790e0000 pid=3705->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6e5934ac-1600-0000-e276-92f1790e0000 pid=3705->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=bfd549ac-1600-0000-e276-92f17a0e0000 pid=3706->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 153B guuid=54d7e2bc-1600-0000-e276-92f1af0e0000 pid=3759->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 102B guuid=c1312ed1-1600-0000-e276-92f1000f0000 pid=3840->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1fc57ed2-1600-0000-e276-92f1080f0000 pid=3848 /tmp/WTF guuid=c1312ed1-1600-0000-e276-92f1000f0000 pid=3840->guuid=1fc57ed2-1600-0000-e276-92f1080f0000 pid=3848 clone guuid=6e5484d2-1600-0000-e276-92f1090f0000 pid=3849 /tmp/WTF guuid=c1312ed1-1600-0000-e276-92f1000f0000 pid=3840->guuid=6e5484d2-1600-0000-e276-92f1090f0000 pid=3849 clone guuid=c40a89d2-1600-0000-e276-92f10a0f0000 pid=3850 /tmp/WTF net send-data zombie guuid=c1312ed1-1600-0000-e276-92f1000f0000 pid=3840->guuid=c40a89d2-1600-0000-e276-92f10a0f0000 pid=3850 clone guuid=c40a89d2-1600-0000-e276-92f10a0f0000 pid=3850->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c40a89d2-1600-0000-e276-92f10a0f0000 pid=3850->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=564d97d2-1600-0000-e276-92f10b0f0000 pid=3851->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 151B guuid=6f7f8ef4-1600-0000-e276-92f1640f0000 pid=3940->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 100B guuid=cda9ec19-1700-0000-e276-92f1d20f0000 pid=4050->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=19f4b21a-1700-0000-e276-92f1d50f0000 pid=4053 /tmp/WTF guuid=cda9ec19-1700-0000-e276-92f1d20f0000 pid=4050->guuid=19f4b21a-1700-0000-e276-92f1d50f0000 pid=4053 clone guuid=4aeeb71a-1700-0000-e276-92f1d60f0000 pid=4054 /tmp/WTF guuid=cda9ec19-1700-0000-e276-92f1d20f0000 pid=4050->guuid=4aeeb71a-1700-0000-e276-92f1d60f0000 pid=4054 clone guuid=3ed6bb1a-1700-0000-e276-92f1d70f0000 pid=4055 /tmp/WTF net send-data zombie guuid=cda9ec19-1700-0000-e276-92f1d20f0000 pid=4050->guuid=3ed6bb1a-1700-0000-e276-92f1d70f0000 pid=4055 clone guuid=3ed6bb1a-1700-0000-e276-92f1d70f0000 pid=4055->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3ed6bb1a-1700-0000-e276-92f1d70f0000 pid=4055->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=1ddcce1a-1700-0000-e276-92f1d80f0000 pid=4056->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 150B guuid=806eb43a-1700-0000-e276-92f150100000 pid=4176->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 99B guuid=12fb275c-1700-0000-e276-92f1c7100000 pid=4295->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6c37c25c-1700-0000-e276-92f1cb100000 pid=4299 /tmp/WTF guuid=12fb275c-1700-0000-e276-92f1c7100000 pid=4295->guuid=6c37c25c-1700-0000-e276-92f1cb100000 pid=4299 clone guuid=b1cdc65c-1700-0000-e276-92f1cc100000 pid=4300 /tmp/WTF guuid=12fb275c-1700-0000-e276-92f1c7100000 pid=4295->guuid=b1cdc65c-1700-0000-e276-92f1cc100000 pid=4300 clone guuid=9d60cc5c-1700-0000-e276-92f1cd100000 pid=4301 /tmp/WTF net send-data zombie guuid=12fb275c-1700-0000-e276-92f1c7100000 pid=4295->guuid=9d60cc5c-1700-0000-e276-92f1cd100000 pid=4301 clone guuid=9d60cc5c-1700-0000-e276-92f1cd100000 pid=4301->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9d60cc5c-1700-0000-e276-92f1cd100000 pid=4301->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=8bd2e35c-1700-0000-e276-92f1ce100000 pid=4302->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 151B guuid=9f0b0576-1700-0000-e276-92f11e110000 pid=4382->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 100B guuid=0ca3a88f-1700-0000-e276-92f190110000 pid=4496->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=822a4c90-1700-0000-e276-92f197110000 pid=4503 /tmp/WTF guuid=0ca3a88f-1700-0000-e276-92f190110000 pid=4496->guuid=822a4c90-1700-0000-e276-92f197110000 pid=4503 clone guuid=e12d5090-1700-0000-e276-92f198110000 pid=4504 /tmp/WTF guuid=0ca3a88f-1700-0000-e276-92f190110000 pid=4496->guuid=e12d5090-1700-0000-e276-92f198110000 pid=4504 clone guuid=23765390-1700-0000-e276-92f199110000 pid=4505 /tmp/WTF net send-data zombie guuid=0ca3a88f-1700-0000-e276-92f190110000 pid=4496->guuid=23765390-1700-0000-e276-92f199110000 pid=4505 clone guuid=23765390-1700-0000-e276-92f199110000 pid=4505->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=23765390-1700-0000-e276-92f199110000 pid=4505->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=0d7f7190-1700-0000-e276-92f19a110000 pid=4506->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 151B guuid=cf71e3b0-1700-0000-e276-92f1fd110000 pid=4605->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 100B guuid=37dff5d2-1700-0000-e276-92f184120000 pid=4740->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4ee593d3-1700-0000-e276-92f188120000 pid=4744 /tmp/WTF guuid=37dff5d2-1700-0000-e276-92f184120000 pid=4740->guuid=4ee593d3-1700-0000-e276-92f188120000 pid=4744 clone guuid=6a9797d3-1700-0000-e276-92f189120000 pid=4745 /tmp/WTF guuid=37dff5d2-1700-0000-e276-92f184120000 pid=4740->guuid=6a9797d3-1700-0000-e276-92f189120000 pid=4745 clone guuid=75f89ad3-1700-0000-e276-92f18a120000 pid=4746 /tmp/WTF net send-data zombie guuid=37dff5d2-1700-0000-e276-92f184120000 pid=4740->guuid=75f89ad3-1700-0000-e276-92f18a120000 pid=4746 clone guuid=75f89ad3-1700-0000-e276-92f18a120000 pid=4746->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=75f89ad3-1700-0000-e276-92f18a120000 pid=4746->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=589ea5d3-1700-0000-e276-92f18b120000 pid=4747->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 151B guuid=95aa9af3-1700-0000-e276-92f1eb120000 pid=4843->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 100B guuid=fd38aa16-1800-0000-e276-92f158130000 pid=4952->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=76039617-1800-0000-e276-92f15e130000 pid=4958 /tmp/WTF guuid=fd38aa16-1800-0000-e276-92f158130000 pid=4952->guuid=76039617-1800-0000-e276-92f15e130000 pid=4958 clone guuid=9ad19a17-1800-0000-e276-92f15f130000 pid=4959 /tmp/WTF guuid=fd38aa16-1800-0000-e276-92f158130000 pid=4952->guuid=9ad19a17-1800-0000-e276-92f15f130000 pid=4959 clone guuid=7c40a017-1800-0000-e276-92f160130000 pid=4960 /tmp/WTF net send-data zombie guuid=fd38aa16-1800-0000-e276-92f158130000 pid=4952->guuid=7c40a017-1800-0000-e276-92f160130000 pid=4960 clone guuid=7c40a017-1800-0000-e276-92f160130000 pid=4960->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7c40a017-1800-0000-e276-92f160130000 pid=4960->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=b898ae17-1800-0000-e276-92f161130000 pid=4961->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 150B guuid=da98c137-1800-0000-e276-92f1e9130000 pid=5097->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 99B guuid=a14b925c-1800-0000-e276-92f163140000 pid=5219->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=47435c5d-1800-0000-e276-92f167140000 pid=5223 /tmp/WTF guuid=a14b925c-1800-0000-e276-92f163140000 pid=5219->guuid=47435c5d-1800-0000-e276-92f167140000 pid=5223 clone guuid=71d9625d-1800-0000-e276-92f168140000 pid=5224 /tmp/WTF guuid=a14b925c-1800-0000-e276-92f163140000 pid=5219->guuid=71d9625d-1800-0000-e276-92f168140000 pid=5224 clone guuid=fa93685d-1800-0000-e276-92f169140000 pid=5225 /tmp/WTF net send-data zombie guuid=a14b925c-1800-0000-e276-92f163140000 pid=5219->guuid=fa93685d-1800-0000-e276-92f169140000 pid=5225 clone guuid=fa93685d-1800-0000-e276-92f169140000 pid=5225->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=fa93685d-1800-0000-e276-92f169140000 pid=5225->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=363d815d-1800-0000-e276-92f16b140000 pid=5227->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 150B guuid=7b6f877e-1800-0000-e276-92f1b2140000 pid=5298->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 99B guuid=cd17c8a1-1800-0000-e276-92f1c0140000 pid=5312->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3aea99a2-1800-0000-e276-92f1c1140000 pid=5313 /tmp/WTF guuid=cd17c8a1-1800-0000-e276-92f1c0140000 pid=5312->guuid=3aea99a2-1800-0000-e276-92f1c1140000 pid=5313 clone guuid=29aaaea2-1800-0000-e276-92f1c2140000 pid=5314 /tmp/WTF guuid=cd17c8a1-1800-0000-e276-92f1c0140000 pid=5312->guuid=29aaaea2-1800-0000-e276-92f1c2140000 pid=5314 clone guuid=567db7a2-1800-0000-e276-92f1c3140000 pid=5315 /tmp/WTF net send-data zombie guuid=cd17c8a1-1800-0000-e276-92f1c0140000 pid=5312->guuid=567db7a2-1800-0000-e276-92f1c3140000 pid=5315 clone guuid=567db7a2-1800-0000-e276-92f1c3140000 pid=5315->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=567db7a2-1800-0000-e276-92f1c3140000 pid=5315->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=d186d2a2-1800-0000-e276-92f1c4140000 pid=5316->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 151B guuid=092f3dcc-1800-0000-e276-92f1c5140000 pid=5317->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 100B guuid=620ed0f7-1800-0000-e276-92f1c8140000 pid=5320->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e3216cf8-1800-0000-e276-92f1c9140000 pid=5321 /tmp/WTF guuid=620ed0f7-1800-0000-e276-92f1c8140000 pid=5320->guuid=e3216cf8-1800-0000-e276-92f1c9140000 pid=5321 clone guuid=c31170f8-1800-0000-e276-92f1ca140000 pid=5322 /tmp/WTF guuid=620ed0f7-1800-0000-e276-92f1c8140000 pid=5320->guuid=c31170f8-1800-0000-e276-92f1ca140000 pid=5322 clone guuid=cbfd73f8-1800-0000-e276-92f1cb140000 pid=5323 /tmp/WTF net send-data zombie guuid=620ed0f7-1800-0000-e276-92f1c8140000 pid=5320->guuid=cbfd73f8-1800-0000-e276-92f1cb140000 pid=5323 clone guuid=cbfd73f8-1800-0000-e276-92f1cb140000 pid=5323->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cbfd73f8-1800-0000-e276-92f1cb140000 pid=5323->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B guuid=62ed87f8-1800-0000-e276-92f1cc140000 pid=5324->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 150B guuid=c8333c21-1900-0000-e276-92f1cd140000 pid=5325->26db1fad-1066-5d83-859b-2e3526ca2b53 send: 99B guuid=1babb94a-1900-0000-e276-92f1d0140000 pid=5328->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0aea654b-1900-0000-e276-92f1d1140000 pid=5329 /tmp/WTF guuid=1babb94a-1900-0000-e276-92f1d0140000 pid=5328->guuid=0aea654b-1900-0000-e276-92f1d1140000 pid=5329 clone guuid=65d16a4b-1900-0000-e276-92f1d2140000 pid=5330 /tmp/WTF guuid=1babb94a-1900-0000-e276-92f1d0140000 pid=5328->guuid=65d16a4b-1900-0000-e276-92f1d2140000 pid=5330 clone guuid=7879724b-1900-0000-e276-92f1d3140000 pid=5331 /tmp/WTF net send-data zombie guuid=1babb94a-1900-0000-e276-92f1d0140000 pid=5328->guuid=7879724b-1900-0000-e276-92f1d3140000 pid=5331 clone guuid=7879724b-1900-0000-e276-92f1d3140000 pid=5331->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7879724b-1900-0000-e276-92f1d3140000 pid=5331->619239fa-1301-50f0-ad67-2b4dfb258a68 send: 7B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2026-01-15 12:09:45 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n6sb3zyovkr676lfxcp556xvi6rcieb64yicivnz7f3qya7x7woa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260115-pfn3ysev3b/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6fa41de70eaa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.36
Link:
https://yomi.yoroi.company/submissions/6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 6fa41de70eaaa3eff965b89fdefaf547a224103ee6102455b9f9770c03f7fd9c

(this sample)

Mirai

elf ba856ab36ca260bfb770a7470b5de562475883cb58e306d9abeebfd0514a97af

Mirai

elf 237c93fcf0bf76e3caf620641472356b8cf6c8653cbc7508967f1aab9d0280c3

  
URLhaus
https://urlhaus.abuse.ch/url/3758553/
  
Delivery method
Distributed via web download
  
Dropping
MD5 5b2dcd1e8440e626afdfea9ce876d00e
  
Dropping
SHA256 237c93fcf0bf76e3caf620641472356b8cf6c8653cbc7508967f1aab9d0280c3

Comments