MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85ef1ba8342949fb167257617684adb06e8a08132f4f88455cdd4423a1723da1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85ef1ba8342949fb167257617684adb06e8a08132f4f88455cdd4423a1723da1
SHA3-384 hash: 2d52ef8bc37c7cc104deb44d297b810869399c00d6be9c7159383fccc8231f3f2f29c9f30224f3c368878f317e14a11d
SHA1 hash: 0f090efcdb3dea617234125aacd71138b2cf9f92
MD5 hash: eb0f02136c0f7d20bf3045fc0252229e
humanhash: lamp-rugby-gee-oven
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'959 bytes
First seen:2025-08-06 07:59:22 UTC
Last seen:2025-08-06 19:46:30 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:iSNxNhmlSNTNnElSN6NCXlSNuNePlSNaXNazvZlSNa9NaFvjlSN9N1N9z4gelSNA:iSbfmlSBRElSMgXlS04PlScXczvZlSc+
TLSH T15B514ECB226105312E77BE23FEBA8F9C3181619268F1EF0455DD34B5528CEA8F096A47
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://67.211.216.57/hiddenbin/Space.arcn/an/aelf ua-wget
http://67.211.216.57/hiddenbin/Space.x86911b426670513d423cdf8710e673b8d0753ea34ba71b60bf78ac78f834c6c9ad Miraimirai
http://67.211.216.57/hiddenbin/Space.x86_64n/an/aelf ua-wget
http://67.211.216.57/hiddenbin/Space.i686a2094e890494457c6e8d997fcc1b9461ab8b4e8b4a1b6fff783d6fd8446d4c91 Miraimirai
http://67.211.216.57/hiddenbin/Space.mips8f0484e010f85acfdffcfb315d89d0a9dfd61635d6e47453261e4bee5efe4359 Miraimirai
http://67.211.216.57/hiddenbin/Space.mips64n/an/aelf ua-wget
http://67.211.216.57/hiddenbin/Space.mpsln/an/aelf ua-wget
http://67.211.216.57/hiddenbin/Space.armn/an/aelf ua-wget
http://67.211.216.57/hiddenbin/Space.arm5n/an/aelf ua-wget
http://67.211.216.57/hiddenbin/Space.arm698f6eb636832e43224c90d5155a81449e55711d58730032b42b2cac6c22fd178 Miraimirai
http://67.211.216.57/hiddenbin/Space.arm7106897c6d275b67781760a8367bad06f98f3fe8fc00e29f7926afe64fabaafb6 Miraimirai
http://67.211.216.57/hiddenbin/Space.ppc802b809fd820e3bfdb7ccd1f12e1d67800834563ebed30bf195c7baaf61b6f17 Miraimirai
http://67.211.216.57/hiddenbin/Space.sparcn/an/aelf ua-wget
http://67.211.216.57/hiddenbin/Space.m68k58574f2a99d2d951a4f1384a2695d634635d79f68985dafefd69b573a222c6c6 Miraimirai
http://67.211.216.57/hiddenbin/Space.sh4n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
32
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c43530db-085e-4d7f-b6b3-f06b161fbcbe
Behavior Graph:
Download SVG
%3 guuid=e403b30f-1d00-0000-918d-c40d34070000 pid=1844 /usr/bin/sudo guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850 /tmp/sample.bin guuid=e403b30f-1d00-0000-918d-c40d34070000 pid=1844->guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850 execve guuid=dd93d011-1d00-0000-918d-c40d3d070000 pid=1853 /usr/bin/cp guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=dd93d011-1d00-0000-918d-c40d3d070000 pid=1853 execve guuid=31e3fa15-1d00-0000-918d-c40d43070000 pid=1859 /usr/bin/wget net send-data guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=31e3fa15-1d00-0000-918d-c40d43070000 pid=1859 execve guuid=19164324-1d00-0000-918d-c40d5e070000 pid=1886 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=19164324-1d00-0000-918d-c40d5e070000 pid=1886 execve guuid=35b1a938-1d00-0000-918d-c40d7f070000 pid=1919 /usr/bin/cat guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=35b1a938-1d00-0000-918d-c40d7f070000 pid=1919 execve guuid=934f1239-1d00-0000-918d-c40d80070000 pid=1920 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=934f1239-1d00-0000-918d-c40d80070000 pid=1920 execve guuid=ffd45f39-1d00-0000-918d-c40d81070000 pid=1921 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=ffd45f39-1d00-0000-918d-c40d81070000 pid=1921 clone guuid=7a9c8239-1d00-0000-918d-c40d82070000 pid=1922 /usr/bin/wget net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=7a9c8239-1d00-0000-918d-c40d82070000 pid=1922 execve guuid=982d70be-1d00-0000-918d-c40d2c080000 pid=2092 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=982d70be-1d00-0000-918d-c40d2c080000 pid=2092 execve guuid=8b61fcdb-1d00-0000-918d-c40d62080000 pid=2146 /usr/bin/cat guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=8b61fcdb-1d00-0000-918d-c40d62080000 pid=2146 execve guuid=4df84fdc-1d00-0000-918d-c40d64080000 pid=2148 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=4df84fdc-1d00-0000-918d-c40d64080000 pid=2148 execve guuid=a00993dc-1d00-0000-918d-c40d66080000 pid=2150 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=a00993dc-1d00-0000-918d-c40d66080000 pid=2150 execve guuid=318c2009-1f00-0000-918d-c40d0d0b0000 pid=2829 /usr/bin/wget net send-data guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=318c2009-1f00-0000-918d-c40d0d0b0000 pid=2829 execve guuid=03304315-1f00-0000-918d-c40d280b0000 pid=2856 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=03304315-1f00-0000-918d-c40d280b0000 pid=2856 execve guuid=e4d9eb23-1f00-0000-918d-c40d470b0000 pid=2887 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=e4d9eb23-1f00-0000-918d-c40d470b0000 pid=2887 clone guuid=48161a24-1f00-0000-918d-c40d490b0000 pid=2889 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=48161a24-1f00-0000-918d-c40d490b0000 pid=2889 execve guuid=4a2b9124-1f00-0000-918d-c40d4b0b0000 pid=2891 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=4a2b9124-1f00-0000-918d-c40d4b0b0000 pid=2891 execve guuid=7af17a51-2000-0000-918d-c40d230d0000 pid=3363 /usr/bin/wget net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=7af17a51-2000-0000-918d-c40d230d0000 pid=3363 execve guuid=6d71c367-2000-0000-918d-c40d4f0d0000 pid=3407 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=6d71c367-2000-0000-918d-c40d4f0d0000 pid=3407 execve guuid=132e7b81-2000-0000-918d-c40d770d0000 pid=3447 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=132e7b81-2000-0000-918d-c40d770d0000 pid=3447 clone guuid=bc8bb481-2000-0000-918d-c40d780d0000 pid=3448 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=bc8bb481-2000-0000-918d-c40d780d0000 pid=3448 execve guuid=451fda82-2000-0000-918d-c40d7b0d0000 pid=3451 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=451fda82-2000-0000-918d-c40d7b0d0000 pid=3451 execve guuid=b97757b0-2100-0000-918d-c40d5c100000 pid=4188 /usr/bin/wget net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=b97757b0-2100-0000-918d-c40d5c100000 pid=4188 execve guuid=f3b7f60f-2200-0000-918d-c40d77110000 pid=4471 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=f3b7f60f-2200-0000-918d-c40d77110000 pid=4471 execve guuid=72b15e2a-2200-0000-918d-c40dbd110000 pid=4541 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=72b15e2a-2200-0000-918d-c40dbd110000 pid=4541 clone guuid=0f498c2a-2200-0000-918d-c40dbe110000 pid=4542 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=0f498c2a-2200-0000-918d-c40dbe110000 pid=4542 execve guuid=38c3f42a-2200-0000-918d-c40dc2110000 pid=4546 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=38c3f42a-2200-0000-918d-c40dc2110000 pid=4546 execve guuid=3be26a58-2300-0000-918d-c40d8d140000 pid=5261 /usr/bin/wget net send-data guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=3be26a58-2300-0000-918d-c40d8d140000 pid=5261 execve guuid=50a86164-2300-0000-918d-c40d8e140000 pid=5262 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=50a86164-2300-0000-918d-c40d8e140000 pid=5262 execve guuid=900fec71-2300-0000-918d-c40d8f140000 pid=5263 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=900fec71-2300-0000-918d-c40d8f140000 pid=5263 clone guuid=77401f72-2300-0000-918d-c40d90140000 pid=5264 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=77401f72-2300-0000-918d-c40d90140000 pid=5264 execve guuid=a5a07272-2300-0000-918d-c40d91140000 pid=5265 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=a5a07272-2300-0000-918d-c40d91140000 pid=5265 execve guuid=5a3a9d9f-2400-0000-918d-c40da6140000 pid=5286 /usr/bin/wget net send-data guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=5a3a9d9f-2400-0000-918d-c40da6140000 pid=5286 execve guuid=c555baac-2400-0000-918d-c40da7140000 pid=5287 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=c555baac-2400-0000-918d-c40da7140000 pid=5287 execve guuid=47534abc-2400-0000-918d-c40da8140000 pid=5288 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=47534abc-2400-0000-918d-c40da8140000 pid=5288 clone guuid=10af9cbc-2400-0000-918d-c40da9140000 pid=5289 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=10af9cbc-2400-0000-918d-c40da9140000 pid=5289 execve guuid=aa43bebd-2400-0000-918d-c40daa140000 pid=5290 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=aa43bebd-2400-0000-918d-c40daa140000 pid=5290 execve guuid=d6b272eb-2500-0000-918d-c40dbf140000 pid=5311 /usr/bin/wget net send-data guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=d6b272eb-2500-0000-918d-c40dbf140000 pid=5311 execve guuid=7b7abcf6-2500-0000-918d-c40dc1140000 pid=5313 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=7b7abcf6-2500-0000-918d-c40dc1140000 pid=5313 execve guuid=8626e302-2600-0000-918d-c40dcc140000 pid=5324 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=8626e302-2600-0000-918d-c40dcc140000 pid=5324 clone guuid=f39bfb02-2600-0000-918d-c40dcd140000 pid=5325 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=f39bfb02-2600-0000-918d-c40dcd140000 pid=5325 execve guuid=575e3c03-2600-0000-918d-c40dcf140000 pid=5327 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=575e3c03-2600-0000-918d-c40dcf140000 pid=5327 execve guuid=281b842f-2700-0000-918d-c40dda140000 pid=5338 /usr/bin/wget net send-data guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=281b842f-2700-0000-918d-c40dda140000 pid=5338 execve guuid=e6801b3b-2700-0000-918d-c40ddb140000 pid=5339 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=e6801b3b-2700-0000-918d-c40ddb140000 pid=5339 execve guuid=44e00685-2700-0000-918d-c40ddc140000 pid=5340 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=44e00685-2700-0000-918d-c40ddc140000 pid=5340 clone guuid=82722a85-2700-0000-918d-c40ddd140000 pid=5341 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=82722a85-2700-0000-918d-c40ddd140000 pid=5341 execve guuid=64d57e85-2700-0000-918d-c40dde140000 pid=5342 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=64d57e85-2700-0000-918d-c40dde140000 pid=5342 execve guuid=73f2e8b1-2800-0000-918d-c40de4140000 pid=5348 /usr/bin/wget net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=73f2e8b1-2800-0000-918d-c40de4140000 pid=5348 execve guuid=d9b488c7-2800-0000-918d-c40de5140000 pid=5349 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=d9b488c7-2800-0000-918d-c40de5140000 pid=5349 execve guuid=047ebedf-2800-0000-918d-c40de6140000 pid=5350 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=047ebedf-2800-0000-918d-c40de6140000 pid=5350 clone guuid=ed17eadf-2800-0000-918d-c40de7140000 pid=5351 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=ed17eadf-2800-0000-918d-c40de7140000 pid=5351 execve guuid=d08e3be0-2800-0000-918d-c40de8140000 pid=5352 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=d08e3be0-2800-0000-918d-c40de8140000 pid=5352 execve guuid=9ce5640e-2a00-0000-918d-c40dee140000 pid=5358 /usr/bin/wget net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=9ce5640e-2a00-0000-918d-c40dee140000 pid=5358 execve guuid=f49dff2e-2a00-0000-918d-c40def140000 pid=5359 /usr/bin/curl net send-data write-file guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=f49dff2e-2a00-0000-918d-c40def140000 pid=5359 execve guuid=5a645451-2a00-0000-918d-c40df0140000 pid=5360 /usr/bin/bash guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=5a645451-2a00-0000-918d-c40df0140000 pid=5360 clone guuid=894c9051-2a00-0000-918d-c40df1140000 pid=5361 /usr/bin/chmod guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=894c9051-2a00-0000-918d-c40df1140000 pid=5361 execve guuid=b5852552-2a00-0000-918d-c40df2140000 pid=5362 /tmp/Space net guuid=05a05b11-1d00-0000-918d-c40d3a070000 pid=1850->guuid=b5852552-2a00-0000-918d-c40df2140000 pid=5362 execve e0bbff35-760d-5374-96c2-6a4c5f25a645 67.211.216.57:80 guuid=31e3fa15-1d00-0000-918d-c40d43070000 pid=1859->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 147B guuid=19164324-1d00-0000-918d-c40d5e070000 pid=1886->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 96B guuid=7a9c8239-1d00-0000-918d-c40d82070000 pid=1922->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 147B guuid=982d70be-1d00-0000-918d-c40d2c080000 pid=2092->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 96B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=a00993dc-1d00-0000-918d-c40d66080000 pid=2150->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6aaf10dd-1d00-0000-918d-c40d68080000 pid=2152 /tmp/Space guuid=a00993dc-1d00-0000-918d-c40d66080000 pid=2150->guuid=6aaf10dd-1d00-0000-918d-c40d68080000 pid=2152 clone guuid=8fc00309-1f00-0000-918d-c40d0b0b0000 pid=2827 /tmp/Space guuid=a00993dc-1d00-0000-918d-c40d66080000 pid=2150->guuid=8fc00309-1f00-0000-918d-c40d0b0b0000 pid=2827 clone guuid=965b0909-1f00-0000-918d-c40d0c0b0000 pid=2828 /tmp/Space net send-data zombie guuid=a00993dc-1d00-0000-918d-c40d66080000 pid=2150->guuid=965b0909-1f00-0000-918d-c40d0c0b0000 pid=2828 clone guuid=b1a218dd-1d00-0000-918d-c40d69080000 pid=2153 /tmp/Space guuid=6aaf10dd-1d00-0000-918d-c40d68080000 pid=2152->guuid=b1a218dd-1d00-0000-918d-c40d69080000 pid=2153 clone guuid=5c3f1fdd-1d00-0000-918d-c40d6a080000 pid=2154 /tmp/Space net send-data zombie guuid=6aaf10dd-1d00-0000-918d-c40d68080000 pid=2152->guuid=5c3f1fdd-1d00-0000-918d-c40d6a080000 pid=2154 clone guuid=5c3f1fdd-1d00-0000-918d-c40d6a080000 pid=2154->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 70526f79-017c-5e8c-885a-fd4188280584 67.211.216.57:3778 guuid=5c3f1fdd-1d00-0000-918d-c40d6a080000 pid=2154->70526f79-017c-5e8c-885a-fd4188280584 send: 520B guuid=965b0909-1f00-0000-918d-c40d0c0b0000 pid=2828->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=965b0909-1f00-0000-918d-c40d0c0b0000 pid=2828->70526f79-017c-5e8c-885a-fd4188280584 send: 480B guuid=318c2009-1f00-0000-918d-c40d0d0b0000 pid=2829->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 150B guuid=03304315-1f00-0000-918d-c40d280b0000 pid=2856->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 99B guuid=4a2b9124-1f00-0000-918d-c40d4b0b0000 pid=2891->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3d7f4025-1f00-0000-918d-c40d4d0b0000 pid=2893 /tmp/Space guuid=4a2b9124-1f00-0000-918d-c40d4b0b0000 pid=2891->guuid=3d7f4025-1f00-0000-918d-c40d4d0b0000 pid=2893 clone guuid=362e6751-2000-0000-918d-c40d210d0000 pid=3361 /tmp/Space guuid=4a2b9124-1f00-0000-918d-c40d4b0b0000 pid=2891->guuid=362e6751-2000-0000-918d-c40d210d0000 pid=3361 clone guuid=dbce6c51-2000-0000-918d-c40d220d0000 pid=3362 /tmp/Space net send-data zombie guuid=4a2b9124-1f00-0000-918d-c40d4b0b0000 pid=2891->guuid=dbce6c51-2000-0000-918d-c40d220d0000 pid=3362 clone guuid=df594525-1f00-0000-918d-c40d4e0b0000 pid=2894 /tmp/Space guuid=3d7f4025-1f00-0000-918d-c40d4d0b0000 pid=2893->guuid=df594525-1f00-0000-918d-c40d4e0b0000 pid=2894 clone guuid=94ca5025-1f00-0000-918d-c40d4f0b0000 pid=2895 /tmp/Space net send-data zombie guuid=3d7f4025-1f00-0000-918d-c40d4d0b0000 pid=2893->guuid=94ca5025-1f00-0000-918d-c40d4f0b0000 pid=2895 clone guuid=94ca5025-1f00-0000-918d-c40d4f0b0000 pid=2895->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=94ca5025-1f00-0000-918d-c40d4f0b0000 pid=2895->70526f79-017c-5e8c-885a-fd4188280584 send: 450B guuid=dbce6c51-2000-0000-918d-c40d220d0000 pid=3362->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=dbce6c51-2000-0000-918d-c40d220d0000 pid=3362->70526f79-017c-5e8c-885a-fd4188280584 send: 390B guuid=7af17a51-2000-0000-918d-c40d230d0000 pid=3363->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 148B guuid=6d71c367-2000-0000-918d-c40d4f0d0000 pid=3407->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 97B guuid=451fda82-2000-0000-918d-c40d7b0d0000 pid=3451->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1ad48e83-2000-0000-918d-c40d7d0d0000 pid=3453 /tmp/Space guuid=451fda82-2000-0000-918d-c40d7b0d0000 pid=3451->guuid=1ad48e83-2000-0000-918d-c40d7d0d0000 pid=3453 clone guuid=90a42cb0-2100-0000-918d-c40d5a100000 pid=4186 /tmp/Space guuid=451fda82-2000-0000-918d-c40d7b0d0000 pid=3451->guuid=90a42cb0-2100-0000-918d-c40d5a100000 pid=4186 clone guuid=eb053ab0-2100-0000-918d-c40d5b100000 pid=4187 /tmp/Space net send-data zombie guuid=451fda82-2000-0000-918d-c40d7b0d0000 pid=3451->guuid=eb053ab0-2100-0000-918d-c40d5b100000 pid=4187 clone guuid=80209683-2000-0000-918d-c40d7e0d0000 pid=3454 /tmp/Space guuid=1ad48e83-2000-0000-918d-c40d7d0d0000 pid=3453->guuid=80209683-2000-0000-918d-c40d7e0d0000 pid=3454 clone guuid=7f1c9a83-2000-0000-918d-c40d7f0d0000 pid=3455 /tmp/Space net send-data zombie guuid=1ad48e83-2000-0000-918d-c40d7d0d0000 pid=3453->guuid=7f1c9a83-2000-0000-918d-c40d7f0d0000 pid=3455 clone guuid=7f1c9a83-2000-0000-918d-c40d7f0d0000 pid=3455->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7f1c9a83-2000-0000-918d-c40d7f0d0000 pid=3455->70526f79-017c-5e8c-885a-fd4188280584 send: 395B guuid=eb053ab0-2100-0000-918d-c40d5b100000 pid=4187->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=eb053ab0-2100-0000-918d-c40d5b100000 pid=4187->70526f79-017c-5e8c-885a-fd4188280584 send: 360B guuid=b97757b0-2100-0000-918d-c40d5c100000 pid=4188->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 148B guuid=f3b7f60f-2200-0000-918d-c40d77110000 pid=4471->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 97B guuid=38c3f42a-2200-0000-918d-c40dc2110000 pid=4546->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a90d742b-2200-0000-918d-c40dc5110000 pid=4549 /tmp/Space guuid=38c3f42a-2200-0000-918d-c40dc2110000 pid=4546->guuid=a90d742b-2200-0000-918d-c40dc5110000 pid=4549 clone guuid=bd944d58-2300-0000-918d-c40d8b140000 pid=5259 /tmp/Space guuid=38c3f42a-2200-0000-918d-c40dc2110000 pid=4546->guuid=bd944d58-2300-0000-918d-c40d8b140000 pid=5259 clone guuid=f6325258-2300-0000-918d-c40d8c140000 pid=5260 /tmp/Space net send-data zombie guuid=38c3f42a-2200-0000-918d-c40dc2110000 pid=4546->guuid=f6325258-2300-0000-918d-c40d8c140000 pid=5260 clone guuid=3bc27a2b-2200-0000-918d-c40dc6110000 pid=4550 /tmp/Space guuid=a90d742b-2200-0000-918d-c40dc5110000 pid=4549->guuid=3bc27a2b-2200-0000-918d-c40dc6110000 pid=4550 clone guuid=02f57f2b-2200-0000-918d-c40dc7110000 pid=4551 /tmp/Space net send-data zombie guuid=a90d742b-2200-0000-918d-c40dc5110000 pid=4549->guuid=02f57f2b-2200-0000-918d-c40dc7110000 pid=4551 clone guuid=02f57f2b-2200-0000-918d-c40dc7110000 pid=4551->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=02f57f2b-2200-0000-918d-c40dc7110000 pid=4551->70526f79-017c-5e8c-885a-fd4188280584 send: 360B guuid=f6325258-2300-0000-918d-c40d8c140000 pid=5260->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f6325258-2300-0000-918d-c40d8c140000 pid=5260->70526f79-017c-5e8c-885a-fd4188280584 send: 290B guuid=3be26a58-2300-0000-918d-c40d8d140000 pid=5261->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 150B guuid=50a86164-2300-0000-918d-c40d8e140000 pid=5262->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 99B guuid=a5a07272-2300-0000-918d-c40d91140000 pid=5265->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=15f80473-2300-0000-918d-c40d92140000 pid=5266 /tmp/Space guuid=a5a07272-2300-0000-918d-c40d91140000 pid=5265->guuid=15f80473-2300-0000-918d-c40d92140000 pid=5266 clone guuid=12911d9f-2400-0000-918d-c40da4140000 pid=5284 /tmp/Space guuid=a5a07272-2300-0000-918d-c40d91140000 pid=5265->guuid=12911d9f-2400-0000-918d-c40da4140000 pid=5284 clone guuid=f6d7279f-2400-0000-918d-c40da5140000 pid=5285 /tmp/Space net send-data zombie guuid=a5a07272-2300-0000-918d-c40d91140000 pid=5265->guuid=f6d7279f-2400-0000-918d-c40da5140000 pid=5285 clone guuid=9ee90e73-2300-0000-918d-c40d93140000 pid=5267 /tmp/Space guuid=15f80473-2300-0000-918d-c40d92140000 pid=5266->guuid=9ee90e73-2300-0000-918d-c40d93140000 pid=5267 clone guuid=e54c1373-2300-0000-918d-c40d94140000 pid=5268 /tmp/Space net send-data zombie guuid=15f80473-2300-0000-918d-c40d92140000 pid=5266->guuid=e54c1373-2300-0000-918d-c40d94140000 pid=5268 clone guuid=e54c1373-2300-0000-918d-c40d94140000 pid=5268->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e54c1373-2300-0000-918d-c40d94140000 pid=5268->70526f79-017c-5e8c-885a-fd4188280584 send: 300B guuid=f6d7279f-2400-0000-918d-c40da5140000 pid=5285->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f6d7279f-2400-0000-918d-c40da5140000 pid=5285->70526f79-017c-5e8c-885a-fd4188280584 send: 260B guuid=5a3a9d9f-2400-0000-918d-c40da6140000 pid=5286->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 148B guuid=c555baac-2400-0000-918d-c40da7140000 pid=5287->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 97B guuid=aa43bebd-2400-0000-918d-c40daa140000 pid=5290->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=32d18dbe-2400-0000-918d-c40dab140000 pid=5291 /tmp/Space guuid=aa43bebd-2400-0000-918d-c40daa140000 pid=5290->guuid=32d18dbe-2400-0000-918d-c40dab140000 pid=5291 clone guuid=794e5beb-2500-0000-918d-c40dbd140000 pid=5309 /tmp/Space guuid=aa43bebd-2400-0000-918d-c40daa140000 pid=5290->guuid=794e5beb-2500-0000-918d-c40dbd140000 pid=5309 clone guuid=b21161eb-2500-0000-918d-c40dbe140000 pid=5310 /tmp/Space net send-data zombie guuid=aa43bebd-2400-0000-918d-c40daa140000 pid=5290->guuid=b21161eb-2500-0000-918d-c40dbe140000 pid=5310 clone guuid=f3c44ebf-2400-0000-918d-c40dac140000 pid=5292 /tmp/Space guuid=32d18dbe-2400-0000-918d-c40dab140000 pid=5291->guuid=f3c44ebf-2400-0000-918d-c40dac140000 pid=5292 clone guuid=f9cc55bf-2400-0000-918d-c40dad140000 pid=5293 /tmp/Space net send-data zombie guuid=32d18dbe-2400-0000-918d-c40dab140000 pid=5291->guuid=f9cc55bf-2400-0000-918d-c40dad140000 pid=5293 clone guuid=f9cc55bf-2400-0000-918d-c40dad140000 pid=5293->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f9cc55bf-2400-0000-918d-c40dad140000 pid=5293->70526f79-017c-5e8c-885a-fd4188280584 send: 250B guuid=b21161eb-2500-0000-918d-c40dbe140000 pid=5310->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=b21161eb-2500-0000-918d-c40dbe140000 pid=5310->70526f79-017c-5e8c-885a-fd4188280584 send: 215B guuid=d6b272eb-2500-0000-918d-c40dbf140000 pid=5311->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 147B guuid=7b7abcf6-2500-0000-918d-c40dc1140000 pid=5313->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 96B guuid=575e3c03-2600-0000-918d-c40dcf140000 pid=5327->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9272ab03-2600-0000-918d-c40dd0140000 pid=5328 /tmp/Space guuid=575e3c03-2600-0000-918d-c40dcf140000 pid=5327->guuid=9272ab03-2600-0000-918d-c40dd0140000 pid=5328 clone guuid=4398692f-2700-0000-918d-c40dd8140000 pid=5336 /tmp/Space guuid=575e3c03-2600-0000-918d-c40dcf140000 pid=5327->guuid=4398692f-2700-0000-918d-c40dd8140000 pid=5336 clone guuid=e119702f-2700-0000-918d-c40dd9140000 pid=5337 /tmp/Space net send-data zombie guuid=575e3c03-2600-0000-918d-c40dcf140000 pid=5327->guuid=e119702f-2700-0000-918d-c40dd9140000 pid=5337 clone guuid=d61ccf03-2600-0000-918d-c40dd2140000 pid=5330 /tmp/Space guuid=9272ab03-2600-0000-918d-c40dd0140000 pid=5328->guuid=d61ccf03-2600-0000-918d-c40dd2140000 pid=5330 clone guuid=267ed203-2600-0000-918d-c40dd3140000 pid=5331 /tmp/Space net send-data zombie guuid=9272ab03-2600-0000-918d-c40dd0140000 pid=5328->guuid=267ed203-2600-0000-918d-c40dd3140000 pid=5331 clone guuid=267ed203-2600-0000-918d-c40dd3140000 pid=5331->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=267ed203-2600-0000-918d-c40dd3140000 pid=5331->70526f79-017c-5e8c-885a-fd4188280584 send: 205B guuid=e119702f-2700-0000-918d-c40dd9140000 pid=5337->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e119702f-2700-0000-918d-c40dd9140000 pid=5337->70526f79-017c-5e8c-885a-fd4188280584 send: 165B guuid=281b842f-2700-0000-918d-c40dda140000 pid=5338->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 148B guuid=e6801b3b-2700-0000-918d-c40ddb140000 pid=5339->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 97B guuid=64d57e85-2700-0000-918d-c40dde140000 pid=5342->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=57bbf785-2700-0000-918d-c40ddf140000 pid=5343 /tmp/Space guuid=64d57e85-2700-0000-918d-c40dde140000 pid=5342->guuid=57bbf785-2700-0000-918d-c40ddf140000 pid=5343 clone guuid=c4e2d3b1-2800-0000-918d-c40de2140000 pid=5346 /tmp/Space guuid=64d57e85-2700-0000-918d-c40dde140000 pid=5342->guuid=c4e2d3b1-2800-0000-918d-c40de2140000 pid=5346 clone guuid=740ddab1-2800-0000-918d-c40de3140000 pid=5347 /tmp/Space net send-data zombie guuid=64d57e85-2700-0000-918d-c40dde140000 pid=5342->guuid=740ddab1-2800-0000-918d-c40de3140000 pid=5347 clone guuid=63fdfd85-2700-0000-918d-c40de0140000 pid=5344 /tmp/Space guuid=57bbf785-2700-0000-918d-c40ddf140000 pid=5343->guuid=63fdfd85-2700-0000-918d-c40de0140000 pid=5344 clone guuid=1ee80186-2700-0000-918d-c40de1140000 pid=5345 /tmp/Space net send-data zombie guuid=57bbf785-2700-0000-918d-c40ddf140000 pid=5343->guuid=1ee80186-2700-0000-918d-c40de1140000 pid=5345 clone guuid=1ee80186-2700-0000-918d-c40de1140000 pid=5345->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1ee80186-2700-0000-918d-c40de1140000 pid=5345->70526f79-017c-5e8c-885a-fd4188280584 send: 160B guuid=740ddab1-2800-0000-918d-c40de3140000 pid=5347->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=740ddab1-2800-0000-918d-c40de3140000 pid=5347->70526f79-017c-5e8c-885a-fd4188280584 send: 95B guuid=73f2e8b1-2800-0000-918d-c40de4140000 pid=5348->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 148B guuid=d9b488c7-2800-0000-918d-c40de5140000 pid=5349->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 97B guuid=d08e3be0-2800-0000-918d-c40de8140000 pid=5352->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=819a2ce1-2800-0000-918d-c40de9140000 pid=5353 /tmp/Space guuid=d08e3be0-2800-0000-918d-c40de8140000 pid=5352->guuid=819a2ce1-2800-0000-918d-c40de9140000 pid=5353 clone guuid=a7d9410e-2a00-0000-918d-c40dec140000 pid=5356 /tmp/Space guuid=d08e3be0-2800-0000-918d-c40de8140000 pid=5352->guuid=a7d9410e-2a00-0000-918d-c40dec140000 pid=5356 clone guuid=7fff4f0e-2a00-0000-918d-c40ded140000 pid=5357 /tmp/Space net send-data zombie guuid=d08e3be0-2800-0000-918d-c40de8140000 pid=5352->guuid=7fff4f0e-2a00-0000-918d-c40ded140000 pid=5357 clone guuid=c1a437e1-2800-0000-918d-c40dea140000 pid=5354 /tmp/Space guuid=819a2ce1-2800-0000-918d-c40de9140000 pid=5353->guuid=c1a437e1-2800-0000-918d-c40dea140000 pid=5354 clone guuid=f6073ce1-2800-0000-918d-c40deb140000 pid=5355 /tmp/Space net send-data zombie guuid=819a2ce1-2800-0000-918d-c40de9140000 pid=5353->guuid=f6073ce1-2800-0000-918d-c40deb140000 pid=5355 clone guuid=f6073ce1-2800-0000-918d-c40deb140000 pid=5355->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f6073ce1-2800-0000-918d-c40deb140000 pid=5355->70526f79-017c-5e8c-885a-fd4188280584 send: 90B guuid=7fff4f0e-2a00-0000-918d-c40ded140000 pid=5357->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7fff4f0e-2a00-0000-918d-c40ded140000 pid=5357->70526f79-017c-5e8c-885a-fd4188280584 send: 45B guuid=9ce5640e-2a00-0000-918d-c40dee140000 pid=5358->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 148B guuid=f49dff2e-2a00-0000-918d-c40def140000 pid=5359->e0bbff35-760d-5374-96c2-6a4c5f25a645 send: 97B guuid=b5852552-2a00-0000-918d-c40df2140000 pid=5362->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8aee3d53-2a00-0000-918d-c40df3140000 pid=5363 /tmp/Space guuid=b5852552-2a00-0000-918d-c40df2140000 pid=5362->guuid=8aee3d53-2a00-0000-918d-c40df3140000 pid=5363 clone guuid=edf44a53-2a00-0000-918d-c40df4140000 pid=5364 /tmp/Space guuid=8aee3d53-2a00-0000-918d-c40df3140000 pid=5363->guuid=edf44a53-2a00-0000-918d-c40df4140000 pid=5364 clone guuid=dc255153-2a00-0000-918d-c40df5140000 pid=5365 /tmp/Space net send-data zombie guuid=8aee3d53-2a00-0000-918d-c40df3140000 pid=5363->guuid=dc255153-2a00-0000-918d-c40df5140000 pid=5365 clone guuid=dc255153-2a00-0000-918d-c40df5140000 pid=5365->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=dc255153-2a00-0000-918d-c40df5140000 pid=5365->70526f79-017c-5e8c-885a-fd4188280584 send: 40B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/85ef1ba8342949fb167257617684adb06e8a08132f4f88455cdd4423a1723da1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85ef1ba8342949fb167257617684adb06e8a08132f4f88455cdd4423a1723da1/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/85ef1ba8342949fb167257617684adb06e8a08132f4f88455cdd4423a1723da1
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-08-06 06:09:02 UTC
File Type:
Text (Shell)
AV detection:
23 of 38 (60.53%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxxrxkbuffe7wftsk5qxnbfnwbxiucatf5hyqrk43vcchilshwqq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/250806-jvnsvaxjv4/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Mirai
Mirai family
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/85ef1ba83429/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/85ef1ba8342949fb167257617684adb06e8a08132f4f88455cdd4423a1723da1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 85ef1ba8342949fb167257617684adb06e8a08132f4f88455cdd4423a1723da1

(this sample)

Mirai

elf 911b426670513d423cdf8710e673b8d0753ea34ba71b60bf78ac78f834c6c9ad

  
URLhaus
https://urlhaus.abuse.ch/url/3597448/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d1340120d1e4b619fe37e7b17b4b0074
  
Dropping
SHA256 911b426670513d423cdf8710e673b8d0753ea34ba71b60bf78ac78f834c6c9ad

Comments