MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e2235ec767a5b4596edc0109b75c82f53fde4dae3371b752b4587ca6d1b1c0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e2235ec767a5b4596edc0109b75c82f53fde4dae3371b752b4587ca6d1b1c0b
SHA3-384 hash: 48dad15b7aaa6e184fd2271b04795789a948bbc7f47fbf3dd984b0c79b1c3d8a0958545462deba30c69e4e57e87300ea
SHA1 hash: 107543b81882be0797e2ead8fe2fcadf194bcc94
MD5 hash: d7f550ffd01593ccd886736dbb27eb11
humanhash: nebraska-ohio-colorado-fanta
File name:76d32be0.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:4'746 bytes
First seen:2025-11-24 22:45:58 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vUhMV4kCUq1V4OUrHrWV4ZUNoV4HUEpEEV4EbUJkV47Uq1V4OUOZV4KUzSV4pUDx:vbIpDPcLAzOEpbbaZHbRDsjC1BD9DqRm
TLSH T1D1A1E5E674A4976A6DB1ED7371DAC542F14060ABE4D68D0BF2D2F0E4084EF61F484B83
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x860134ba0d82da47549afbf4ff619fe518bf4863eff0f49c939457cbf81c2d15b8 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips3a07b60b7bf3cbd9767a86a76a77e5fccb5adf9dee1dc7764b751c0a1f4c4d97 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsln/an/aelf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm47bc9d623a3eb1ba73c46550a4207ea095e39d40f97ce628de43834183da6ad7 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm506426a43bc706deb297ee11894e1c87acc0a4231a60b0dfbce4098b871b719b2 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm62c85afccbe6f0e275c639e98db4c4eec6d910bd277a1fe596a3252163b22d860 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7d945325d0279ea26eb1572d3454980a1953721baf9faae04fcf991d27969b6c8 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc051887bfe592e3f5059d7316f2913e13ead1da80061930de8236c4087cadc994 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k2ff7d666206bcb9e440f017a8538337330826fcf9dc1f0542ee062ebd148387d Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc4b0886c739672baa51a2b187f93271e1c15b56450a29a4d39d6b7709152aa645 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i68647e7f0fdd1ee38d00cc134014546c43db09eb2993bc1318cc76aaa64e595ea9f Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4d0f0ed32a8d834ef6c4aeaa382275e0a26f90898dd304f00fbffab51d964ec0e Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc62740c7d5c2cbaed0adbbba12ed865ee2136fae9528a50f296dee8365b488bb9 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86_648df69a4bbd21d9f80b80204e56fb586221ef559303b64eb2c443b93ea234d957 Miraimirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
medusa mirai
Link:
https://www.filescan.io/uploads/6924e03ef6a4ba1793af6e8b/reports/1290b1e7-cc59-409f-b68f-5a5bd80fadf2/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-24T20:55:00Z UTC
Last seen:
2025-11-24T23:22:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7e2235ec767a5b4596edc0109b75c82f53fde4dae3371b752b4587ca6d1b1c0b/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/bc88734b-57ef-44e6-bd24-fec871bafc85
Behavior Graph:
Download SVG
%3 guuid=7ba92fca-1700-0000-52f9-199d870c0000 pid=3207 /usr/bin/sudo guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213 /tmp/sample.bin guuid=7ba92fca-1700-0000-52f9-199d870c0000 pid=3207->guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213 execve guuid=9ec59ecc-1700-0000-52f9-199d8f0c0000 pid=3215 /usr/bin/wget net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=9ec59ecc-1700-0000-52f9-199d8f0c0000 pid=3215 execve guuid=e7655fd7-1700-0000-52f9-199d970c0000 pid=3223 /usr/bin/curl net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=e7655fd7-1700-0000-52f9-199d970c0000 pid=3223 execve guuid=990c6ee9-1700-0000-52f9-199da90c0000 pid=3241 /usr/bin/cat guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=990c6ee9-1700-0000-52f9-199da90c0000 pid=3241 execve guuid=a1f4bee9-1700-0000-52f9-199dab0c0000 pid=3243 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=a1f4bee9-1700-0000-52f9-199dab0c0000 pid=3243 execve guuid=c75b09ea-1700-0000-52f9-199dad0c0000 pid=3245 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=c75b09ea-1700-0000-52f9-199dad0c0000 pid=3245 execve guuid=583b64ea-1700-0000-52f9-199db40c0000 pid=3252 /usr/bin/wget net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=583b64ea-1700-0000-52f9-199db40c0000 pid=3252 execve guuid=0efc08f8-1700-0000-52f9-199dbf0c0000 pid=3263 /usr/bin/curl net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=0efc08f8-1700-0000-52f9-199dbf0c0000 pid=3263 execve guuid=eed25d03-1800-0000-52f9-199de30c0000 pid=3299 /usr/bin/bash guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=eed25d03-1800-0000-52f9-199de30c0000 pid=3299 clone guuid=20368803-1800-0000-52f9-199de40c0000 pid=3300 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=20368803-1800-0000-52f9-199de40c0000 pid=3300 execve guuid=0049fd03-1800-0000-52f9-199de50c0000 pid=3301 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=0049fd03-1800-0000-52f9-199de50c0000 pid=3301 execve guuid=1948ef34-1900-0000-52f9-199d320f0000 pid=3890 /usr/bin/wget net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=1948ef34-1900-0000-52f9-199d320f0000 pid=3890 execve guuid=a8c08f40-1900-0000-52f9-199d530f0000 pid=3923 /usr/bin/curl net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=a8c08f40-1900-0000-52f9-199d530f0000 pid=3923 execve guuid=2ee8194d-1900-0000-52f9-199d790f0000 pid=3961 /usr/bin/bash guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=2ee8194d-1900-0000-52f9-199d790f0000 pid=3961 clone guuid=5cd33b4d-1900-0000-52f9-199d7a0f0000 pid=3962 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=5cd33b4d-1900-0000-52f9-199d7a0f0000 pid=3962 execve guuid=429c954d-1900-0000-52f9-199d7c0f0000 pid=3964 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=429c954d-1900-0000-52f9-199d7c0f0000 pid=3964 execve guuid=d0acaf7f-1a00-0000-52f9-199da7120000 pid=4775 /usr/bin/wget net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=d0acaf7f-1a00-0000-52f9-199da7120000 pid=4775 execve guuid=c5807c8c-1a00-0000-52f9-199dd4120000 pid=4820 /usr/bin/curl net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=c5807c8c-1a00-0000-52f9-199dd4120000 pid=4820 execve guuid=bb66f498-1a00-0000-52f9-199df9120000 pid=4857 /usr/bin/bash guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=bb66f498-1a00-0000-52f9-199df9120000 pid=4857 clone guuid=c28f1599-1a00-0000-52f9-199dfb120000 pid=4859 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=c28f1599-1a00-0000-52f9-199dfb120000 pid=4859 execve guuid=d4b8d799-1a00-0000-52f9-199dfe120000 pid=4862 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=d4b8d799-1a00-0000-52f9-199dfe120000 pid=4862 execve guuid=8c16cbd0-1b00-0000-52f9-199d7e140000 pid=5246 /usr/bin/wget net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=8c16cbd0-1b00-0000-52f9-199d7e140000 pid=5246 execve guuid=6712fcdb-1b00-0000-52f9-199d82140000 pid=5250 /usr/bin/curl net send-data write-file guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=6712fcdb-1b00-0000-52f9-199d82140000 pid=5250 execve guuid=44305fe7-1b00-0000-52f9-199d83140000 pid=5251 /usr/bin/bash guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=44305fe7-1b00-0000-52f9-199d83140000 pid=5251 clone guuid=c251a1e7-1b00-0000-52f9-199d84140000 pid=5252 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=c251a1e7-1b00-0000-52f9-199d84140000 pid=5252 execve guuid=3ad806e8-1b00-0000-52f9-199d85140000 pid=5253 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=3ad806e8-1b00-0000-52f9-199d85140000 pid=5253 execve guuid=fdd9381d-1d00-0000-52f9-199d96140000 pid=5270 /usr/bin/wget net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=fdd9381d-1d00-0000-52f9-199d96140000 pid=5270 execve guuid=32577c1e-1d00-0000-52f9-199d98140000 pid=5272 /usr/bin/curl net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=32577c1e-1d00-0000-52f9-199d98140000 pid=5272 execve guuid=d5c55821-1d00-0000-52f9-199d99140000 pid=5273 /usr/bin/bash guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=d5c55821-1d00-0000-52f9-199d99140000 pid=5273 clone guuid=faba7621-1d00-0000-52f9-199d9a140000 pid=5274 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=faba7621-1d00-0000-52f9-199d9a140000 pid=5274 execve guuid=4d071a22-1d00-0000-52f9-199d9b140000 pid=5275 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=4d071a22-1d00-0000-52f9-199d9b140000 pid=5275 execve guuid=d4ca8658-1e00-0000-52f9-199db8140000 pid=5304 /usr/bin/wget net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=d4ca8658-1e00-0000-52f9-199db8140000 pid=5304 execve guuid=145e2c5c-1e00-0000-52f9-199dbb140000 pid=5307 /usr/bin/curl net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=145e2c5c-1e00-0000-52f9-199dbb140000 pid=5307 execve guuid=f4cfd65d-1e00-0000-52f9-199dbc140000 pid=5308 /usr/bin/bash guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=f4cfd65d-1e00-0000-52f9-199dbc140000 pid=5308 clone guuid=034bfd5d-1e00-0000-52f9-199dbd140000 pid=5309 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=034bfd5d-1e00-0000-52f9-199dbd140000 pid=5309 execve guuid=159f575e-1e00-0000-52f9-199dbe140000 pid=5310 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=159f575e-1e00-0000-52f9-199dbe140000 pid=5310 execve guuid=dfe0f4a0-2200-0000-52f9-199dc0140000 pid=5312 /usr/bin/wget net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=dfe0f4a0-2200-0000-52f9-199dc0140000 pid=5312 execve guuid=623ed9a2-2200-0000-52f9-199dc4140000 pid=5316 /usr/bin/curl net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=623ed9a2-2200-0000-52f9-199dc4140000 pid=5316 execve guuid=6f873ba6-2200-0000-52f9-199dc5140000 pid=5317 /usr/bin/bash guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=6f873ba6-2200-0000-52f9-199dc5140000 pid=5317 clone guuid=35f15aa6-2200-0000-52f9-199dc6140000 pid=5318 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=35f15aa6-2200-0000-52f9-199dc6140000 pid=5318 execve guuid=7cbca6a6-2200-0000-52f9-199dc7140000 pid=5319 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=7cbca6a6-2200-0000-52f9-199dc7140000 pid=5319 execve guuid=a563f9e9-2600-0000-52f9-199dc9140000 pid=5321 /usr/bin/wget net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=a563f9e9-2600-0000-52f9-199dc9140000 pid=5321 execve guuid=dba457eb-2600-0000-52f9-199dcd140000 pid=5325 /usr/bin/curl net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=dba457eb-2600-0000-52f9-199dcd140000 pid=5325 execve guuid=015411ee-2600-0000-52f9-199dce140000 pid=5326 /usr/bin/bash guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=015411ee-2600-0000-52f9-199dce140000 pid=5326 clone guuid=30ad2eee-2600-0000-52f9-199dcf140000 pid=5327 /usr/bin/chmod guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=30ad2eee-2600-0000-52f9-199dcf140000 pid=5327 execve guuid=d49b6cee-2600-0000-52f9-199dd0140000 pid=5328 /tmp/76d32be0 net guuid=3e3646cc-1700-0000-52f9-199d8d0c0000 pid=3213->guuid=d49b6cee-2600-0000-52f9-199dd0140000 pid=5328 execve 28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 158.94.210.88:80 guuid=9ec59ecc-1700-0000-52f9-199d8f0c0000 pid=3215->28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 send: 197B guuid=e7655fd7-1700-0000-52f9-199d970c0000 pid=3223->28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 send: 146B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=c75b09ea-1700-0000-52f9-199dad0c0000 pid=3245->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cde745ea-1700-0000-52f9-199daf0c0000 pid=3247 /tmp/76d32be0 dns net send-data zombie guuid=c75b09ea-1700-0000-52f9-199dad0c0000 pid=3245->guuid=cde745ea-1700-0000-52f9-199daf0c0000 pid=3247 clone guuid=cde745ea-1700-0000-52f9-199daf0c0000 pid=3247->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B 2ac2249c-25bc-5019-a88f-33a6c2731b07 cnc.504.su:56999 guuid=cde745ea-1700-0000-52f9-199daf0c0000 pid=3247->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 12B guuid=cea74fea-1700-0000-52f9-199db00c0000 pid=3248 /tmp/76d32be0 guuid=cde745ea-1700-0000-52f9-199daf0c0000 pid=3247->guuid=cea74fea-1700-0000-52f9-199db00c0000 pid=3248 clone guuid=caf652ea-1700-0000-52f9-199db20c0000 pid=3250 /tmp/76d32be0 net net-scan send-data guuid=cde745ea-1700-0000-52f9-199daf0c0000 pid=3247->guuid=caf652ea-1700-0000-52f9-199db20c0000 pid=3250 clone guuid=6cdd56ea-1700-0000-52f9-199db30c0000 pid=3251 /tmp/76d32be0 guuid=cde745ea-1700-0000-52f9-199daf0c0000 pid=3247->guuid=6cdd56ea-1700-0000-52f9-199db30c0000 pid=3251 clone guuid=caf652ea-1700-0000-52f9-199db20c0000 pid=3250->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=caf652ea-1700-0000-52f9-199db20c0000 pid=3250|send-data send-data to 384 IP addresses review logs to see them all guuid=caf652ea-1700-0000-52f9-199db20c0000 pid=3250->guuid=caf652ea-1700-0000-52f9-199db20c0000 pid=3250|send-data send 4bcd05e0-7ebf-53bb-9cc8-c008d3256770 cnc.504.su:80 guuid=583b64ea-1700-0000-52f9-199db40c0000 pid=3252->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 198B guuid=0efc08f8-1700-0000-52f9-199dbf0c0000 pid=3263->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=0049fd03-1800-0000-52f9-199de50c0000 pid=3301->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 5fbefa0b-74db-5ddb-909f-7c8f89ca1384 0.0.0.0:46157 guuid=0049fd03-1800-0000-52f9-199de50c0000 pid=3301->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=e59ee034-1900-0000-52f9-199d300f0000 pid=3888 /tmp/76d32be0 dns net send-data zombie guuid=0049fd03-1800-0000-52f9-199de50c0000 pid=3301->guuid=e59ee034-1900-0000-52f9-199d300f0000 pid=3888 clone guuid=e59ee034-1900-0000-52f9-199d300f0000 pid=3888->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=e59ee034-1900-0000-52f9-199d300f0000 pid=3888->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 12B guuid=f468ec34-1900-0000-52f9-199d310f0000 pid=3889 /tmp/76d32be0 guuid=e59ee034-1900-0000-52f9-199d300f0000 pid=3888->guuid=f468ec34-1900-0000-52f9-199d310f0000 pid=3889 clone guuid=0599f034-1900-0000-52f9-199d330f0000 pid=3891 /tmp/76d32be0 net net-scan send-data guuid=e59ee034-1900-0000-52f9-199d300f0000 pid=3888->guuid=0599f034-1900-0000-52f9-199d330f0000 pid=3891 clone guuid=7ee3f434-1900-0000-52f9-199d340f0000 pid=3892 /tmp/76d32be0 guuid=e59ee034-1900-0000-52f9-199d300f0000 pid=3888->guuid=7ee3f434-1900-0000-52f9-199d340f0000 pid=3892 clone guuid=1948ef34-1900-0000-52f9-199d320f0000 pid=3890->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 198B guuid=0599f034-1900-0000-52f9-199d330f0000 pid=3891->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0599f034-1900-0000-52f9-199d330f0000 pid=3891|send-data send-data to 384 IP addresses review logs to see them all guuid=0599f034-1900-0000-52f9-199d330f0000 pid=3891->guuid=0599f034-1900-0000-52f9-199d330f0000 pid=3891|send-data send guuid=a8c08f40-1900-0000-52f9-199d530f0000 pid=3923->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=429c954d-1900-0000-52f9-199d7c0f0000 pid=3964->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=429c954d-1900-0000-52f9-199d7c0f0000 pid=3964->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=efdea57f-1a00-0000-52f9-199da6120000 pid=4774 /tmp/76d32be0 dns net send-data zombie guuid=429c954d-1900-0000-52f9-199d7c0f0000 pid=3964->guuid=efdea57f-1a00-0000-52f9-199da6120000 pid=4774 clone guuid=efdea57f-1a00-0000-52f9-199da6120000 pid=4774->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=efdea57f-1a00-0000-52f9-199da6120000 pid=4774->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 12B guuid=7ab5af7f-1a00-0000-52f9-199da8120000 pid=4776 /tmp/76d32be0 guuid=efdea57f-1a00-0000-52f9-199da6120000 pid=4774->guuid=7ab5af7f-1a00-0000-52f9-199da8120000 pid=4776 clone guuid=9ac9b37f-1a00-0000-52f9-199da9120000 pid=4777 /tmp/76d32be0 net net-scan send-data guuid=efdea57f-1a00-0000-52f9-199da6120000 pid=4774->guuid=9ac9b37f-1a00-0000-52f9-199da9120000 pid=4777 clone guuid=cc14b87f-1a00-0000-52f9-199daa120000 pid=4778 /tmp/76d32be0 guuid=efdea57f-1a00-0000-52f9-199da6120000 pid=4774->guuid=cc14b87f-1a00-0000-52f9-199daa120000 pid=4778 clone guuid=d0acaf7f-1a00-0000-52f9-199da7120000 pid=4775->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 197B guuid=9ac9b37f-1a00-0000-52f9-199da9120000 pid=4777->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9ac9b37f-1a00-0000-52f9-199da9120000 pid=4777|send-data send-data to 384 IP addresses review logs to see them all guuid=9ac9b37f-1a00-0000-52f9-199da9120000 pid=4777->guuid=9ac9b37f-1a00-0000-52f9-199da9120000 pid=4777|send-data send guuid=c5807c8c-1a00-0000-52f9-199dd4120000 pid=4820->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 146B guuid=d4b8d799-1a00-0000-52f9-199dfe120000 pid=4862->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d4b8d799-1a00-0000-52f9-199dfe120000 pid=4862->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=59b3b9d0-1b00-0000-52f9-199d7d140000 pid=5245 /tmp/76d32be0 dns net send-data zombie guuid=d4b8d799-1a00-0000-52f9-199dfe120000 pid=4862->guuid=59b3b9d0-1b00-0000-52f9-199d7d140000 pid=5245 clone guuid=59b3b9d0-1b00-0000-52f9-199d7d140000 pid=5245->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=59b3b9d0-1b00-0000-52f9-199d7d140000 pid=5245->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 12B guuid=d457cdd0-1b00-0000-52f9-199d7f140000 pid=5247 /tmp/76d32be0 guuid=59b3b9d0-1b00-0000-52f9-199d7d140000 pid=5245->guuid=d457cdd0-1b00-0000-52f9-199d7f140000 pid=5247 clone guuid=1425dcd0-1b00-0000-52f9-199d80140000 pid=5248 /tmp/76d32be0 net net-scan send-data guuid=59b3b9d0-1b00-0000-52f9-199d7d140000 pid=5245->guuid=1425dcd0-1b00-0000-52f9-199d80140000 pid=5248 clone guuid=35c3e5d0-1b00-0000-52f9-199d81140000 pid=5249 /tmp/76d32be0 guuid=59b3b9d0-1b00-0000-52f9-199d7d140000 pid=5245->guuid=35c3e5d0-1b00-0000-52f9-199d81140000 pid=5249 clone guuid=8c16cbd0-1b00-0000-52f9-199d7e140000 pid=5246->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 198B guuid=1425dcd0-1b00-0000-52f9-199d80140000 pid=5248->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1425dcd0-1b00-0000-52f9-199d80140000 pid=5248|send-data send-data to 384 IP addresses review logs to see them all guuid=1425dcd0-1b00-0000-52f9-199d80140000 pid=5248->guuid=1425dcd0-1b00-0000-52f9-199d80140000 pid=5248|send-data send guuid=6712fcdb-1b00-0000-52f9-199d82140000 pid=5250->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=3ad806e8-1b00-0000-52f9-199d85140000 pid=5253->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3ad806e8-1b00-0000-52f9-199d85140000 pid=5253->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=f42e1c1d-1d00-0000-52f9-199d93140000 pid=5267 /tmp/76d32be0 dns net send-data zombie guuid=3ad806e8-1b00-0000-52f9-199d85140000 pid=5253->guuid=f42e1c1d-1d00-0000-52f9-199d93140000 pid=5267 clone guuid=f42e1c1d-1d00-0000-52f9-199d93140000 pid=5267->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=f42e1c1d-1d00-0000-52f9-199d93140000 pid=5267->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=94ff2c1d-1d00-0000-52f9-199d94140000 pid=5268 /tmp/76d32be0 guuid=f42e1c1d-1d00-0000-52f9-199d93140000 pid=5267->guuid=94ff2c1d-1d00-0000-52f9-199d94140000 pid=5268 clone guuid=4871371d-1d00-0000-52f9-199d95140000 pid=5269 /tmp/76d32be0 net net-scan send-data guuid=f42e1c1d-1d00-0000-52f9-199d93140000 pid=5267->guuid=4871371d-1d00-0000-52f9-199d95140000 pid=5269 clone guuid=61623b1d-1d00-0000-52f9-199d97140000 pid=5271 /tmp/76d32be0 guuid=f42e1c1d-1d00-0000-52f9-199d93140000 pid=5267->guuid=61623b1d-1d00-0000-52f9-199d97140000 pid=5271 clone guuid=4871371d-1d00-0000-52f9-199d95140000 pid=5269->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4871371d-1d00-0000-52f9-199d95140000 pid=5269|send-data send-data to 1536 IP addresses review logs to see them all guuid=4871371d-1d00-0000-52f9-199d95140000 pid=5269->guuid=4871371d-1d00-0000-52f9-199d95140000 pid=5269|send-data send guuid=fdd9381d-1d00-0000-52f9-199d96140000 pid=5270->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=32577c1e-1d00-0000-52f9-199d98140000 pid=5272->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=4d071a22-1d00-0000-52f9-199d9b140000 pid=5275->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4d071a22-1d00-0000-52f9-199d9b140000 pid=5275->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=26d27158-1e00-0000-52f9-199db6140000 pid=5302 /tmp/76d32be0 dns net send-data zombie guuid=4d071a22-1d00-0000-52f9-199d9b140000 pid=5275->guuid=26d27158-1e00-0000-52f9-199db6140000 pid=5302 clone guuid=26d27158-1e00-0000-52f9-199db6140000 pid=5302->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=26d27158-1e00-0000-52f9-199db6140000 pid=5302->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=94d18458-1e00-0000-52f9-199db7140000 pid=5303 /tmp/76d32be0 guuid=26d27158-1e00-0000-52f9-199db6140000 pid=5302->guuid=94d18458-1e00-0000-52f9-199db7140000 pid=5303 clone guuid=e38a8d58-1e00-0000-52f9-199db9140000 pid=5305 /tmp/76d32be0 net net-scan send-data zombie guuid=26d27158-1e00-0000-52f9-199db6140000 pid=5302->guuid=e38a8d58-1e00-0000-52f9-199db9140000 pid=5305 clone guuid=f5f19158-1e00-0000-52f9-199dba140000 pid=5306 /tmp/76d32be0 guuid=26d27158-1e00-0000-52f9-199db6140000 pid=5302->guuid=f5f19158-1e00-0000-52f9-199dba140000 pid=5306 clone guuid=d4ca8658-1e00-0000-52f9-199db8140000 pid=5304->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=e38a8d58-1e00-0000-52f9-199db9140000 pid=5305->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e38a8d58-1e00-0000-52f9-199db9140000 pid=5305|send-data send-data to 4097 IP addresses review logs to see them all guuid=e38a8d58-1e00-0000-52f9-199db9140000 pid=5305->guuid=e38a8d58-1e00-0000-52f9-199db9140000 pid=5305|send-data send guuid=145e2c5c-1e00-0000-52f9-199dbb140000 pid=5307->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=159f575e-1e00-0000-52f9-199dbe140000 pid=5310->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=159f575e-1e00-0000-52f9-199dbe140000 pid=5310->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=3e17d4a0-2200-0000-52f9-199dbf140000 pid=5311 /tmp/76d32be0 net send-data zombie guuid=159f575e-1e00-0000-52f9-199dbe140000 pid=5310->guuid=3e17d4a0-2200-0000-52f9-199dbf140000 pid=5311 clone guuid=3e17d4a0-2200-0000-52f9-199dbf140000 pid=5311->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=9088fda0-2200-0000-52f9-199dc1140000 pid=5313 /tmp/76d32be0 guuid=3e17d4a0-2200-0000-52f9-199dbf140000 pid=5311->guuid=9088fda0-2200-0000-52f9-199dc1140000 pid=5313 clone guuid=1ae50fa1-2200-0000-52f9-199dc2140000 pid=5314 /tmp/76d32be0 net net-scan send-data zombie guuid=3e17d4a0-2200-0000-52f9-199dbf140000 pid=5311->guuid=1ae50fa1-2200-0000-52f9-199dc2140000 pid=5314 clone guuid=5e261da1-2200-0000-52f9-199dc3140000 pid=5315 /tmp/76d32be0 guuid=3e17d4a0-2200-0000-52f9-199dbf140000 pid=5311->guuid=5e261da1-2200-0000-52f9-199dc3140000 pid=5315 clone guuid=dfe0f4a0-2200-0000-52f9-199dc0140000 pid=5312->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=1ae50fa1-2200-0000-52f9-199dc2140000 pid=5314->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1ae50fa1-2200-0000-52f9-199dc2140000 pid=5314|send-data send-data to 4097 IP addresses review logs to see them all guuid=1ae50fa1-2200-0000-52f9-199dc2140000 pid=5314->guuid=1ae50fa1-2200-0000-52f9-199dc2140000 pid=5314|send-data send guuid=623ed9a2-2200-0000-52f9-199dc4140000 pid=5316->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=7cbca6a6-2200-0000-52f9-199dc7140000 pid=5319->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7cbca6a6-2200-0000-52f9-199dc7140000 pid=5319->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=1477eae9-2600-0000-52f9-199dc8140000 pid=5320 /tmp/76d32be0 net send-data zombie guuid=7cbca6a6-2200-0000-52f9-199dc7140000 pid=5319->guuid=1477eae9-2600-0000-52f9-199dc8140000 pid=5320 clone guuid=1477eae9-2600-0000-52f9-199dc8140000 pid=5320->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=bb5bfde9-2600-0000-52f9-199dca140000 pid=5322 /tmp/76d32be0 guuid=1477eae9-2600-0000-52f9-199dc8140000 pid=5320->guuid=bb5bfde9-2600-0000-52f9-199dca140000 pid=5322 clone guuid=304b05ea-2600-0000-52f9-199dcb140000 pid=5323 /tmp/76d32be0 net net-scan send-data guuid=1477eae9-2600-0000-52f9-199dc8140000 pid=5320->guuid=304b05ea-2600-0000-52f9-199dcb140000 pid=5323 clone guuid=41a00cea-2600-0000-52f9-199dcc140000 pid=5324 /tmp/76d32be0 guuid=1477eae9-2600-0000-52f9-199dc8140000 pid=5320->guuid=41a00cea-2600-0000-52f9-199dcc140000 pid=5324 clone guuid=a563f9e9-2600-0000-52f9-199dc9140000 pid=5321->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=304b05ea-2600-0000-52f9-199dcb140000 pid=5323->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=304b05ea-2600-0000-52f9-199dcb140000 pid=5323|send-data send-data to 1920 IP addresses review logs to see them all guuid=304b05ea-2600-0000-52f9-199dcb140000 pid=5323->guuid=304b05ea-2600-0000-52f9-199dcb140000 pid=5323|send-data send guuid=dba457eb-2600-0000-52f9-199dcd140000 pid=5325->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=d49b6cee-2600-0000-52f9-199dd0140000 pid=5328->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d49b6cee-2600-0000-52f9-199dd0140000 pid=5328->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7e2235ec767a5b4596edc0109b75c82f53fde4dae3371b752b4587ca6d1b1c0b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e2235ec767a5b4596edc0109b75c82f53fde4dae3371b752b4587ca6d1b1c0b/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-11-24 22:46:24 UTC
File Type:
Text (Shell)
AV detection:
24 of 37 (64.86%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pyrdl3dwpjnulfxnyaijw5oif5j73zg24m3rw5jliwd4u3i3dqfq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:unstable antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251124-2p4k8axjgm/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
UPX packed file
Enumerates active TCP sockets
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (55685) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware Config
C2 Extraction:
cnc.504.su
scan.504.su
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7e2235ec767a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e2235ec767a5b4596edc0109b75c82f53fde4dae3371b752b4587ca6d1b1c0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 7e2235ec767a5b4596edc0109b75c82f53fde4dae3371b752b4587ca6d1b1c0b

(this sample)

Mirai

elf 4659da87326851decd5d67b743d9924f09ef8b000c91c63f15ede42a45919120

Mirai

elf 06f6c2e48fe50cc39e412f309f22053e06db1aae20c68452dbc0c813bacfaa97

  
URLhaus
https://urlhaus.abuse.ch/url/3669702/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d890af588619b95e8c751535bc58ac46
  
Dropping
SHA256 06f6c2e48fe50cc39e412f309f22053e06db1aae20c68452dbc0c813bacfaa97

Comments