🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79e51db148418ed38457312972f4d2d61773da0d4cb4697cf40a548567630ff7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79e51db148418ed38457312972f4d2d61773da0d4cb4697cf40a548567630ff7
SHA3-384 hash: efffb1210e0071e5ab9aaa7805e6340f4204181170198ed31039c1cb427019ff7da45adb5beab1d4f59060d109259e36
SHA1 hash: 21ad4958f2ed9227d059c8a7ab5eeade03ebc30f
MD5 hash: 1d9a087c88aeb10d8c8b25f185d15fed
humanhash: indigo-floor-hot-stairway
File name:79e51db148418ed38457312972f4d2d61773da0d4cb4697cf40a548567630ff7
Download: download sample
Signature Mirai
Create hunting rule
File size:1'955 bytes
First seen:2026-10-10 19:18:02 UTC
Last seen:2026-10-10 19:43:39 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:vOOS1aIOSAUCUoOSRoOSrOSq7OSZOSdOSSOSUyOl:vORxR2RRoRrRMRZRdRSRZe
TLSH T13F417085B34244357FFA5E56B9B58510BA80B9725EC49EC1D3FC38AB884DF0C7C60657
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c2hunter
Tags:sh wraith
URLMalware sample (SHA256 hash)SignatureTags
http://103.170.217.170/bins/sora.x8669c3ce17531000fb71b416fd4f1324a057bcee9ac99180f35fecf32b4091fd9b Miraiwraith
http://103.170.217.170/bins/sora.mips863225e8f04a5c54ce5e0581241c8c748a838b7962a811b5ffa5d4eea4370d13 Miraiwraith
http://103.170.217.170/bins/sora.mpseln/an/assh
http://103.170.217.170/bins/sora.arm4n/an/aelf ssh
http://103.170.217.170/bins/sora.arm5n/an/aelf ssh
http://103.170.217.170/bins/sora.arm6729238bab5e3bb8ada801a6389cf2ebcbf1d6313d772ac20f998771248f9556f Miraielf ssh
http://103.170.217.170/bins/sora.arm7n/an/aelf ssh
http://103.170.217.170/bins/sora.ppc6e28fc6c91da0bd6028f5148f9dfd9ddd873079eb887046d9f309a9b86e61ae4 Miraielf ssh
http://103.170.217.170/bins/sora.m68kde6a0b3f76eda0589d0bcd6f4308f1ba5287acd153b74d2c06af1899dabc0252 Miraielf ssh
http://103.170.217.170/bins/sora.sh49ea1f8e83c99a88df3c938529d76d343cca7fbb37c3948f1560a2b39da2bd4ab Miraielf ssh

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6aca8f7f477514f54f0dd3c1/reports/a8b0043e-b5c9-42f6-a2e7-407e685d6b96/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-10T17:21:00Z UTC
Last seen:
2026-10-12T11:46:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/79e51db148418ed38457312972f4d2d61773da0d4cb4697cf40a548567630ff7/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1c585533-407e-4057-a0d0-49dbc6297303
Behavior Graph:
Download SVG
%3 guuid=cd04cb83-1900-0000-996c-5b3ae1090000 pid=2529 /usr/bin/sudo guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536 /tmp/sample.bin guuid=cd04cb83-1900-0000-996c-5b3ae1090000 pid=2529->guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536 execve guuid=3c8f0d86-1900-0000-996c-5b3aea090000 pid=2538 /usr/bin/wget net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=3c8f0d86-1900-0000-996c-5b3aea090000 pid=2538 execve guuid=e51044ca-1900-0000-996c-5b3a690a0000 pid=2665 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=e51044ca-1900-0000-996c-5b3a690a0000 pid=2665 execve guuid=c7000417-1a00-0000-996c-5b3ada0a0000 pid=2778 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=c7000417-1a00-0000-996c-5b3ada0a0000 pid=2778 execve guuid=d66da817-1a00-0000-996c-5b3ade0a0000 pid=2782 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=d66da817-1a00-0000-996c-5b3ade0a0000 pid=2782 execve guuid=a4163918-1a00-0000-996c-5b3adf0a0000 pid=2783 /tmp/robben mprotect-exec guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=a4163918-1a00-0000-996c-5b3adf0a0000 pid=2783 execve guuid=763a941e-1a00-0000-996c-5b3ae80a0000 pid=2792 /usr/bin/wget net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=763a941e-1a00-0000-996c-5b3ae80a0000 pid=2792 execve guuid=d2932f57-1a00-0000-996c-5b3a360b0000 pid=2870 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=d2932f57-1a00-0000-996c-5b3a360b0000 pid=2870 execve guuid=d4487090-1a00-0000-996c-5b3aac0b0000 pid=2988 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=d4487090-1a00-0000-996c-5b3aac0b0000 pid=2988 execve guuid=ea36e090-1a00-0000-996c-5b3aaf0b0000 pid=2991 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=ea36e090-1a00-0000-996c-5b3aaf0b0000 pid=2991 execve guuid=7c2e7691-1a00-0000-996c-5b3ab10b0000 pid=2993 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=7c2e7691-1a00-0000-996c-5b3ab10b0000 pid=2993 clone guuid=14fac893-1a00-0000-996c-5b3ab80b0000 pid=3000 /usr/bin/wget net send-data guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=14fac893-1a00-0000-996c-5b3ab80b0000 pid=3000 execve guuid=95699aaa-1a00-0000-996c-5b3ae20b0000 pid=3042 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=95699aaa-1a00-0000-996c-5b3ae20b0000 pid=3042 execve guuid=c6c5aac4-1a00-0000-996c-5b3a010c0000 pid=3073 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=c6c5aac4-1a00-0000-996c-5b3a010c0000 pid=3073 execve guuid=c0cda1c5-1a00-0000-996c-5b3a020c0000 pid=3074 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=c0cda1c5-1a00-0000-996c-5b3a020c0000 pid=3074 execve guuid=84c416c6-1a00-0000-996c-5b3a030c0000 pid=3075 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=84c416c6-1a00-0000-996c-5b3a030c0000 pid=3075 clone guuid=d11b67c7-1a00-0000-996c-5b3a050c0000 pid=3077 /usr/bin/wget net send-data guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=d11b67c7-1a00-0000-996c-5b3a050c0000 pid=3077 execve guuid=b59c13e0-1a00-0000-996c-5b3a240c0000 pid=3108 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=b59c13e0-1a00-0000-996c-5b3a240c0000 pid=3108 execve guuid=78bcb0f8-1a00-0000-996c-5b3a2c0c0000 pid=3116 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=78bcb0f8-1a00-0000-996c-5b3a2c0c0000 pid=3116 execve guuid=cdbe25f9-1a00-0000-996c-5b3a2d0c0000 pid=3117 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=cdbe25f9-1a00-0000-996c-5b3a2d0c0000 pid=3117 execve guuid=3d5b83f9-1a00-0000-996c-5b3a2e0c0000 pid=3118 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=3d5b83f9-1a00-0000-996c-5b3a2e0c0000 pid=3118 clone guuid=db88aff9-1a00-0000-996c-5b3a2f0c0000 pid=3119 /usr/bin/wget net send-data guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=db88aff9-1a00-0000-996c-5b3a2f0c0000 pid=3119 execve guuid=b51d6410-1b00-0000-996c-5b3a4d0c0000 pid=3149 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=b51d6410-1b00-0000-996c-5b3a4d0c0000 pid=3149 execve guuid=ab68e628-1b00-0000-996c-5b3a770c0000 pid=3191 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=ab68e628-1b00-0000-996c-5b3a770c0000 pid=3191 execve guuid=c8e24a29-1b00-0000-996c-5b3a780c0000 pid=3192 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=c8e24a29-1b00-0000-996c-5b3a780c0000 pid=3192 execve guuid=b020c029-1b00-0000-996c-5b3a7a0c0000 pid=3194 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=b020c029-1b00-0000-996c-5b3a7a0c0000 pid=3194 clone guuid=0a19002a-1b00-0000-996c-5b3a7c0c0000 pid=3196 /usr/bin/wget net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=0a19002a-1b00-0000-996c-5b3a7c0c0000 pid=3196 execve guuid=d7550b62-1b00-0000-996c-5b3ae00c0000 pid=3296 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=d7550b62-1b00-0000-996c-5b3ae00c0000 pid=3296 execve guuid=6f132f9d-1b00-0000-996c-5b3a5d0d0000 pid=3421 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=6f132f9d-1b00-0000-996c-5b3a5d0d0000 pid=3421 execve guuid=e1a19f9d-1b00-0000-996c-5b3a5e0d0000 pid=3422 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=e1a19f9d-1b00-0000-996c-5b3a5e0d0000 pid=3422 execve guuid=c086029e-1b00-0000-996c-5b3a5f0d0000 pid=3423 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=c086029e-1b00-0000-996c-5b3a5f0d0000 pid=3423 clone guuid=81fe3a9f-1b00-0000-996c-5b3a640d0000 pid=3428 /usr/bin/wget net send-data guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=81fe3a9f-1b00-0000-996c-5b3a640d0000 pid=3428 execve guuid=989bf4b6-1b00-0000-996c-5b3a910d0000 pid=3473 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=989bf4b6-1b00-0000-996c-5b3a910d0000 pid=3473 execve guuid=1754bace-1b00-0000-996c-5b3abd0d0000 pid=3517 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=1754bace-1b00-0000-996c-5b3abd0d0000 pid=3517 execve guuid=e3f13fcf-1b00-0000-996c-5b3abf0d0000 pid=3519 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=e3f13fcf-1b00-0000-996c-5b3abf0d0000 pid=3519 execve guuid=848e9ecf-1b00-0000-996c-5b3ac00d0000 pid=3520 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=848e9ecf-1b00-0000-996c-5b3ac00d0000 pid=3520 clone guuid=1fd0d1cf-1b00-0000-996c-5b3ac10d0000 pid=3521 /usr/bin/wget net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=1fd0d1cf-1b00-0000-996c-5b3ac10d0000 pid=3521 execve guuid=dbedd808-1c00-0000-996c-5b3a740e0000 pid=3700 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=dbedd808-1c00-0000-996c-5b3a740e0000 pid=3700 execve guuid=8082c043-1c00-0000-996c-5b3a550f0000 pid=3925 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=8082c043-1c00-0000-996c-5b3a550f0000 pid=3925 execve guuid=13076144-1c00-0000-996c-5b3a570f0000 pid=3927 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=13076144-1c00-0000-996c-5b3a570f0000 pid=3927 execve guuid=a89aa444-1c00-0000-996c-5b3a5b0f0000 pid=3931 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=a89aa444-1c00-0000-996c-5b3a5b0f0000 pid=3931 clone guuid=c03f4445-1c00-0000-996c-5b3a600f0000 pid=3936 /usr/bin/wget net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=c03f4445-1c00-0000-996c-5b3a600f0000 pid=3936 execve guuid=a8248c92-1c00-0000-996c-5b3a68100000 pid=4200 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=a8248c92-1c00-0000-996c-5b3a68100000 pid=4200 execve guuid=d97827e1-1c00-0000-996c-5b3a62110000 pid=4450 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=d97827e1-1c00-0000-996c-5b3a62110000 pid=4450 execve guuid=c3297fe1-1c00-0000-996c-5b3a64110000 pid=4452 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=c3297fe1-1c00-0000-996c-5b3a64110000 pid=4452 execve guuid=3ebdc7e1-1c00-0000-996c-5b3a68110000 pid=4456 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=3ebdc7e1-1c00-0000-996c-5b3a68110000 pid=4456 clone guuid=5c236de2-1c00-0000-996c-5b3a6d110000 pid=4461 /usr/bin/wget net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=5c236de2-1c00-0000-996c-5b3a6d110000 pid=4461 execve guuid=a88a4430-1d00-0000-996c-5b3a5a120000 pid=4698 /usr/bin/curl net send-data write-file guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=a88a4430-1d00-0000-996c-5b3a5a120000 pid=4698 execve guuid=02f6fe80-1d00-0000-996c-5b3a53130000 pid=4947 /usr/bin/cat guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=02f6fe80-1d00-0000-996c-5b3a53130000 pid=4947 execve guuid=951d7581-1d00-0000-996c-5b3a56130000 pid=4950 /usr/bin/chmod guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=951d7581-1d00-0000-996c-5b3a56130000 pid=4950 execve guuid=4b22ce81-1d00-0000-996c-5b3a5a130000 pid=4954 /usr/bin/bash guuid=8567ae85-1900-0000-996c-5b3ae8090000 pid=2536->guuid=4b22ce81-1d00-0000-996c-5b3a5a130000 pid=4954 clone c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c 103.170.217.170:80 guuid=3c8f0d86-1900-0000-996c-5b3aea090000 pid=2538->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 143B guuid=e51044ca-1900-0000-996c-5b3a690a0000 pid=2665->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 92B guuid=763a941e-1a00-0000-996c-5b3ae80a0000 pid=2792->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 144B guuid=d2932f57-1a00-0000-996c-5b3a360b0000 pid=2870->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 93B guuid=14fac893-1a00-0000-996c-5b3ab80b0000 pid=3000->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 145B guuid=95699aaa-1a00-0000-996c-5b3ae20b0000 pid=3042->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 94B guuid=d11b67c7-1a00-0000-996c-5b3a050c0000 pid=3077->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 144B guuid=b59c13e0-1a00-0000-996c-5b3a240c0000 pid=3108->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 93B guuid=db88aff9-1a00-0000-996c-5b3a2f0c0000 pid=3119->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 144B guuid=b51d6410-1b00-0000-996c-5b3a4d0c0000 pid=3149->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 93B guuid=0a19002a-1b00-0000-996c-5b3a7c0c0000 pid=3196->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 144B guuid=d7550b62-1b00-0000-996c-5b3ae00c0000 pid=3296->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 93B guuid=81fe3a9f-1b00-0000-996c-5b3a640d0000 pid=3428->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 144B guuid=989bf4b6-1b00-0000-996c-5b3a910d0000 pid=3473->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 93B guuid=1fd0d1cf-1b00-0000-996c-5b3ac10d0000 pid=3521->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 143B guuid=dbedd808-1c00-0000-996c-5b3a740e0000 pid=3700->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 92B guuid=c03f4445-1c00-0000-996c-5b3a600f0000 pid=3936->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 144B guuid=a8248c92-1c00-0000-996c-5b3a68100000 pid=4200->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 93B guuid=5c236de2-1c00-0000-996c-5b3a6d110000 pid=4461->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 143B guuid=a88a4430-1d00-0000-996c-5b3a5a120000 pid=4698->c3aa7de0-4832-5ff7-977e-f6b0cb5ce74c send: 92B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/79e51db148418ed38457312972f4d2d61773da0d4cb4697cf40a548567630ff7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79e51db148418ed38457312972f4d2d61773da0d4cb4697cf40a548567630ff7/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-10-10 19:18:23 UTC
File Type:
Text (Shell)
AV detection:
17 of 24 (70.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=phsr3mkiighnhbcxgeuxf5gs2ylxhwqnjs2gs7hubjkikz3db73q._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
antivm defense_evasion discovery linux upx
Link:
https://tria.ge/reports/261010-xz3pfszvez/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
UPX packed file
Enumerates active TCP sockets
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (149714) amount of remote hosts
Creates a large amount of network flows
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 79e51db148418ed38457312972f4d2d61773da0d4cb4697cf40a548567630ff7

(this sample)

Mirai

elf 708f122d6e0cfa1195c457cd0ba00b23b56f22014eda4f013deeed1bd0367c8c

Mirai

elf 69c3ce17531000fb71b416fd4f1324a057bcee9ac99180f35fecf32b4091fd9b

  
Link
http://103.170.217.170/sora.sh
  
URLhaus
https://urlhaus.abuse.ch/url/3947835/
  
Delivery method
Distributed via web download
  
Dropping
MD5 7f0925d6284c03ffc883d4a83219d192
  
Dropping
SHA256 69c3ce17531000fb71b416fd4f1324a057bcee9ac99180f35fecf32b4091fd9b

Comments