MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604
SHA3-384 hash: afbd783a6dee357d1ad6b1141611a4fb6479b21f7ba55a6aca95836493e2e3c4517bdc368b25daea37084c34dc7e2c36
SHA1 hash: 1f6ecdd88a8082c5200eb13ab7cb3f4da035e0b9
MD5 hash: f1813effbccaaf3c96a3f09d0a4aeb78
humanhash: asparagus-mango-equal-enemy
File name:lil
Download: download sample
Signature Mirai
Create hunting rule
File size:848 bytes
First seen:2026-08-02 06:50:14 UTC
Last seen:2026-08-03 03:05:15 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaKCrONFCAEFECczWNCMpkjCwVJXX:kXCKysE2hi0ziQvZohaKrFRBbshkjnXX
TLSH T18801CCC9D5548500409DC8AC29E71458F431C3C7158A4F68FFACE538AB88D04B06AE84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/EyMl3dcff7e3ded3bf19981d30151dcaf48915e545d569eb97483d70aec1b7db70cc Miraiua-wget
http://129.121.110.105/TCIi28a173f0fbd53a262bdf7eb328531879013006a65e1b8cddbf223fcfb134be50 Miraiua-wget
http://129.121.110.105/DQ07322f4ca795a8da60dfa55ade3ba04cda3338a9ad1ce3b2b45f5c09ea47c296b Miraiua-wget
http://129.121.110.105/mYH13a0764c31991c4e1a5ba79e5d2095b33f11df5f5d78232a48e9463a1b7be2d1 Miraiua-wget
http://129.121.110.105/9YZ5db021661e482c2a6c79be232b900ce9c66fcf1b78ad18ee9e3ba80a792c07d37 Miraiua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
63
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a6ee8b80f9638f5f053868a/reports/b191a36e-123e-44b8-a2c6-c6740df4e1d6/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/904ff536-5c92-4fb7-943a-27a83f42454c
Behavior Graph:
Download SVG
%3 guuid=2abae3fd-1600-0000-3602-4482440e0000 pid=3652 /usr/bin/sudo guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661 /tmp/sample.bin write-file guuid=2abae3fd-1600-0000-3602-4482440e0000 pid=3652->guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661 execve guuid=18870000-1700-0000-3602-4482500e0000 pid=3664 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=18870000-1700-0000-3602-4482500e0000 pid=3664 execve guuid=b85c5d00-1700-0000-3602-4482530e0000 pid=3667 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=b85c5d00-1700-0000-3602-4482530e0000 pid=3667 execve guuid=44871f01-1700-0000-3602-4482540e0000 pid=3668 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=44871f01-1700-0000-3602-4482540e0000 pid=3668 execve guuid=adf6d001-1700-0000-3602-4482550e0000 pid=3669 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=adf6d001-1700-0000-3602-4482550e0000 pid=3669 execve guuid=b9f32802-1700-0000-3602-4482560e0000 pid=3670 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=b9f32802-1700-0000-3602-4482560e0000 pid=3670 execve guuid=8afc8002-1700-0000-3602-4482570e0000 pid=3671 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=8afc8002-1700-0000-3602-4482570e0000 pid=3671 execve guuid=0aeddc02-1700-0000-3602-44825a0e0000 pid=3674 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=0aeddc02-1700-0000-3602-44825a0e0000 pid=3674 execve guuid=95c33503-1700-0000-3602-44825d0e0000 pid=3677 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=95c33503-1700-0000-3602-44825d0e0000 pid=3677 execve guuid=20159303-1700-0000-3602-4482610e0000 pid=3681 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=20159303-1700-0000-3602-4482610e0000 pid=3681 execve guuid=fc72f303-1700-0000-3602-4482650e0000 pid=3685 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=fc72f303-1700-0000-3602-4482650e0000 pid=3685 execve guuid=48715604-1700-0000-3602-4482680e0000 pid=3688 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=48715604-1700-0000-3602-4482680e0000 pid=3688 execve guuid=0d60b504-1700-0000-3602-44826c0e0000 pid=3692 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=0d60b504-1700-0000-3602-44826c0e0000 pid=3692 execve guuid=8c832605-1700-0000-3602-4482700e0000 pid=3696 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=8c832605-1700-0000-3602-4482700e0000 pid=3696 execve guuid=a5a88505-1700-0000-3602-4482740e0000 pid=3700 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=a5a88505-1700-0000-3602-4482740e0000 pid=3700 execve guuid=33fae205-1700-0000-3602-4482770e0000 pid=3703 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=33fae205-1700-0000-3602-4482770e0000 pid=3703 execve guuid=92634306-1700-0000-3602-44827d0e0000 pid=3709 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=92634306-1700-0000-3602-44827d0e0000 pid=3709 execve guuid=f7fa1a07-1700-0000-3602-4482800e0000 pid=3712 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=f7fa1a07-1700-0000-3602-4482800e0000 pid=3712 execve guuid=fbc48e07-1700-0000-3602-4482810e0000 pid=3713 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=fbc48e07-1700-0000-3602-4482810e0000 pid=3713 execve guuid=17300408-1700-0000-3602-4482820e0000 pid=3714 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=17300408-1700-0000-3602-4482820e0000 pid=3714 execve guuid=a6298a08-1700-0000-3602-4482830e0000 pid=3715 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=a6298a08-1700-0000-3602-4482830e0000 pid=3715 execve guuid=77cc3d09-1700-0000-3602-4482860e0000 pid=3718 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=77cc3d09-1700-0000-3602-4482860e0000 pid=3718 execve guuid=4c73b309-1700-0000-3602-4482870e0000 pid=3719 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=4c73b309-1700-0000-3602-4482870e0000 pid=3719 execve guuid=65940f0a-1700-0000-3602-4482880e0000 pid=3720 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=65940f0a-1700-0000-3602-4482880e0000 pid=3720 execve guuid=fae5980b-1700-0000-3602-4482890e0000 pid=3721 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=fae5980b-1700-0000-3602-4482890e0000 pid=3721 execve guuid=f15d100c-1700-0000-3602-44828a0e0000 pid=3722 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=f15d100c-1700-0000-3602-44828a0e0000 pid=3722 execve guuid=8320770c-1700-0000-3602-44828c0e0000 pid=3724 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=8320770c-1700-0000-3602-44828c0e0000 pid=3724 execve guuid=e048f80c-1700-0000-3602-44828f0e0000 pid=3727 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=e048f80c-1700-0000-3602-44828f0e0000 pid=3727 execve guuid=da608d0d-1700-0000-3602-4482910e0000 pid=3729 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=da608d0d-1700-0000-3602-4482910e0000 pid=3729 execve guuid=10f61c0e-1700-0000-3602-4482930e0000 pid=3731 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=10f61c0e-1700-0000-3602-4482930e0000 pid=3731 execve guuid=273aa90e-1700-0000-3602-4482960e0000 pid=3734 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=273aa90e-1700-0000-3602-4482960e0000 pid=3734 execve guuid=d097290f-1700-0000-3602-44829a0e0000 pid=3738 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=d097290f-1700-0000-3602-44829a0e0000 pid=3738 execve guuid=6035ad0f-1700-0000-3602-44829b0e0000 pid=3739 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=6035ad0f-1700-0000-3602-44829b0e0000 pid=3739 execve guuid=73b23110-1700-0000-3602-44829c0e0000 pid=3740 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=73b23110-1700-0000-3602-44829c0e0000 pid=3740 execve guuid=2322c410-1700-0000-3602-44829f0e0000 pid=3743 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=2322c410-1700-0000-3602-44829f0e0000 pid=3743 execve guuid=560c4411-1700-0000-3602-4482a10e0000 pid=3745 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=560c4411-1700-0000-3602-4482a10e0000 pid=3745 execve guuid=3a25cf11-1700-0000-3602-4482a50e0000 pid=3749 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=3a25cf11-1700-0000-3602-4482a50e0000 pid=3749 execve guuid=bd424f12-1700-0000-3602-4482a60e0000 pid=3750 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=bd424f12-1700-0000-3602-4482a60e0000 pid=3750 execve guuid=6b09d712-1700-0000-3602-4482aa0e0000 pid=3754 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=6b09d712-1700-0000-3602-4482aa0e0000 pid=3754 execve guuid=ff625413-1700-0000-3602-4482ab0e0000 pid=3755 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ff625413-1700-0000-3602-4482ab0e0000 pid=3755 execve guuid=bd1ecd13-1700-0000-3602-4482af0e0000 pid=3759 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=bd1ecd13-1700-0000-3602-4482af0e0000 pid=3759 execve guuid=2a374614-1700-0000-3602-4482b00e0000 pid=3760 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=2a374614-1700-0000-3602-4482b00e0000 pid=3760 execve guuid=a79bbf14-1700-0000-3602-4482b20e0000 pid=3762 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=a79bbf14-1700-0000-3602-4482b20e0000 pid=3762 execve guuid=180e3015-1700-0000-3602-4482b40e0000 pid=3764 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=180e3015-1700-0000-3602-4482b40e0000 pid=3764 execve guuid=ba3aae15-1700-0000-3602-4482b60e0000 pid=3766 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ba3aae15-1700-0000-3602-4482b60e0000 pid=3766 execve guuid=05c62f16-1700-0000-3602-4482b80e0000 pid=3768 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=05c62f16-1700-0000-3602-4482b80e0000 pid=3768 execve guuid=b9e7aa16-1700-0000-3602-4482ba0e0000 pid=3770 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=b9e7aa16-1700-0000-3602-4482ba0e0000 pid=3770 execve guuid=ab1c2a17-1700-0000-3602-4482bc0e0000 pid=3772 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ab1c2a17-1700-0000-3602-4482bc0e0000 pid=3772 execve guuid=8d3fb317-1700-0000-3602-4482be0e0000 pid=3774 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=8d3fb317-1700-0000-3602-4482be0e0000 pid=3774 execve guuid=a0a53118-1700-0000-3602-4482c00e0000 pid=3776 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=a0a53118-1700-0000-3602-4482c00e0000 pid=3776 execve guuid=43e4ae18-1700-0000-3602-4482c10e0000 pid=3777 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=43e4ae18-1700-0000-3602-4482c10e0000 pid=3777 execve guuid=01e22d19-1700-0000-3602-4482c40e0000 pid=3780 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=01e22d19-1700-0000-3602-4482c40e0000 pid=3780 execve guuid=2f259a19-1700-0000-3602-4482c60e0000 pid=3782 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=2f259a19-1700-0000-3602-4482c60e0000 pid=3782 execve guuid=ad950d1a-1700-0000-3602-4482c90e0000 pid=3785 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ad950d1a-1700-0000-3602-4482c90e0000 pid=3785 execve guuid=3cf3871a-1700-0000-3602-4482cb0e0000 pid=3787 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=3cf3871a-1700-0000-3602-4482cb0e0000 pid=3787 execve guuid=eff3eb1a-1700-0000-3602-4482cd0e0000 pid=3789 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=eff3eb1a-1700-0000-3602-4482cd0e0000 pid=3789 execve guuid=91bc4d1b-1700-0000-3602-4482ce0e0000 pid=3790 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=91bc4d1b-1700-0000-3602-4482ce0e0000 pid=3790 execve guuid=65a9b01b-1700-0000-3602-4482d00e0000 pid=3792 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=65a9b01b-1700-0000-3602-4482d00e0000 pid=3792 execve guuid=3367251c-1700-0000-3602-4482d20e0000 pid=3794 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=3367251c-1700-0000-3602-4482d20e0000 pid=3794 execve guuid=66f89b1c-1700-0000-3602-4482d40e0000 pid=3796 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=66f89b1c-1700-0000-3602-4482d40e0000 pid=3796 execve guuid=84c4111d-1700-0000-3602-4482d60e0000 pid=3798 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=84c4111d-1700-0000-3602-4482d60e0000 pid=3798 execve guuid=61a3721d-1700-0000-3602-4482d80e0000 pid=3800 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=61a3721d-1700-0000-3602-4482d80e0000 pid=3800 execve guuid=21f3e41d-1700-0000-3602-4482da0e0000 pid=3802 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=21f3e41d-1700-0000-3602-4482da0e0000 pid=3802 execve guuid=41a15a1e-1700-0000-3602-4482dc0e0000 pid=3804 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=41a15a1e-1700-0000-3602-4482dc0e0000 pid=3804 execve guuid=f535d61e-1700-0000-3602-4482e00e0000 pid=3808 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=f535d61e-1700-0000-3602-4482e00e0000 pid=3808 execve guuid=46b94a1f-1700-0000-3602-4482e10e0000 pid=3809 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=46b94a1f-1700-0000-3602-4482e10e0000 pid=3809 execve guuid=02ffcf1f-1700-0000-3602-4482e50e0000 pid=3813 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=02ffcf1f-1700-0000-3602-4482e50e0000 pid=3813 execve guuid=d98a4620-1700-0000-3602-4482e80e0000 pid=3816 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=d98a4620-1700-0000-3602-4482e80e0000 pid=3816 execve guuid=5491c320-1700-0000-3602-4482ec0e0000 pid=3820 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=5491c320-1700-0000-3602-4482ec0e0000 pid=3820 execve guuid=d0214521-1700-0000-3602-4482f00e0000 pid=3824 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=d0214521-1700-0000-3602-4482f00e0000 pid=3824 execve guuid=88c5ca21-1700-0000-3602-4482f30e0000 pid=3827 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=88c5ca21-1700-0000-3602-4482f30e0000 pid=3827 execve guuid=84f44522-1700-0000-3602-4482f50e0000 pid=3829 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=84f44522-1700-0000-3602-4482f50e0000 pid=3829 execve guuid=d8fbbe22-1700-0000-3602-4482f70e0000 pid=3831 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=d8fbbe22-1700-0000-3602-4482f70e0000 pid=3831 execve guuid=0a663823-1700-0000-3602-4482fa0e0000 pid=3834 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=0a663823-1700-0000-3602-4482fa0e0000 pid=3834 execve guuid=fcd8ae23-1700-0000-3602-4482fb0e0000 pid=3835 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=fcd8ae23-1700-0000-3602-4482fb0e0000 pid=3835 execve guuid=0a6c5524-1700-0000-3602-4482010f0000 pid=3841 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=0a6c5524-1700-0000-3602-4482010f0000 pid=3841 execve guuid=b363dd24-1700-0000-3602-4482040f0000 pid=3844 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=b363dd24-1700-0000-3602-4482040f0000 pid=3844 execve guuid=6e405725-1700-0000-3602-4482060f0000 pid=3846 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=6e405725-1700-0000-3602-4482060f0000 pid=3846 execve guuid=7fb4c525-1700-0000-3602-44820a0f0000 pid=3850 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=7fb4c525-1700-0000-3602-44820a0f0000 pid=3850 execve guuid=6c1d3c26-1700-0000-3602-44820c0f0000 pid=3852 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=6c1d3c26-1700-0000-3602-44820c0f0000 pid=3852 execve guuid=b939c326-1700-0000-3602-44820f0f0000 pid=3855 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=b939c326-1700-0000-3602-44820f0f0000 pid=3855 execve guuid=ce1f4227-1700-0000-3602-4482120f0000 pid=3858 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ce1f4227-1700-0000-3602-4482120f0000 pid=3858 execve guuid=c88eb027-1700-0000-3602-4482140f0000 pid=3860 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=c88eb027-1700-0000-3602-4482140f0000 pid=3860 execve guuid=83851728-1700-0000-3602-4482170f0000 pid=3863 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=83851728-1700-0000-3602-4482170f0000 pid=3863 execve guuid=edc38728-1700-0000-3602-4482190f0000 pid=3865 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=edc38728-1700-0000-3602-4482190f0000 pid=3865 execve guuid=5513fc28-1700-0000-3602-44821c0f0000 pid=3868 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=5513fc28-1700-0000-3602-44821c0f0000 pid=3868 execve guuid=560f6d29-1700-0000-3602-44821e0f0000 pid=3870 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=560f6d29-1700-0000-3602-44821e0f0000 pid=3870 execve guuid=2dc5e129-1700-0000-3602-4482200f0000 pid=3872 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=2dc5e129-1700-0000-3602-4482200f0000 pid=3872 execve guuid=45e5642a-1700-0000-3602-4482230f0000 pid=3875 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=45e5642a-1700-0000-3602-4482230f0000 pid=3875 execve guuid=0132db2a-1700-0000-3602-4482250f0000 pid=3877 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=0132db2a-1700-0000-3602-4482250f0000 pid=3877 execve guuid=44e8462b-1700-0000-3602-4482270f0000 pid=3879 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=44e8462b-1700-0000-3602-4482270f0000 pid=3879 execve guuid=9ceace2b-1700-0000-3602-44822b0f0000 pid=3883 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=9ceace2b-1700-0000-3602-44822b0f0000 pid=3883 execve guuid=7132002d-1700-0000-3602-44822e0f0000 pid=3886 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=7132002d-1700-0000-3602-44822e0f0000 pid=3886 execve guuid=8e551b2e-1700-0000-3602-4482330f0000 pid=3891 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=8e551b2e-1700-0000-3602-4482330f0000 pid=3891 execve guuid=d322a62e-1700-0000-3602-4482340f0000 pid=3892 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=d322a62e-1700-0000-3602-4482340f0000 pid=3892 execve guuid=a4071c2f-1700-0000-3602-4482350f0000 pid=3893 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=a4071c2f-1700-0000-3602-4482350f0000 pid=3893 execve guuid=cc84a92f-1700-0000-3602-4482390f0000 pid=3897 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=cc84a92f-1700-0000-3602-4482390f0000 pid=3897 execve guuid=71c2ff2f-1700-0000-3602-44823d0f0000 pid=3901 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=71c2ff2f-1700-0000-3602-44823d0f0000 pid=3901 execve guuid=23b24d30-1700-0000-3602-44823f0f0000 pid=3903 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=23b24d30-1700-0000-3602-44823f0f0000 pid=3903 execve guuid=4dc79a30-1700-0000-3602-4482410f0000 pid=3905 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=4dc79a30-1700-0000-3602-4482410f0000 pid=3905 execve guuid=a5aaea30-1700-0000-3602-4482450f0000 pid=3909 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=a5aaea30-1700-0000-3602-4482450f0000 pid=3909 execve guuid=6c4e3731-1700-0000-3602-4482490f0000 pid=3913 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=6c4e3731-1700-0000-3602-4482490f0000 pid=3913 execve guuid=e6a28b31-1700-0000-3602-44824b0f0000 pid=3915 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=e6a28b31-1700-0000-3602-44824b0f0000 pid=3915 execve guuid=9e7ada31-1700-0000-3602-44824d0f0000 pid=3917 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=9e7ada31-1700-0000-3602-44824d0f0000 pid=3917 execve guuid=c8662a32-1700-0000-3602-4482510f0000 pid=3921 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=c8662a32-1700-0000-3602-4482510f0000 pid=3921 execve guuid=682c7832-1700-0000-3602-4482530f0000 pid=3923 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=682c7832-1700-0000-3602-4482530f0000 pid=3923 execve guuid=e773c432-1700-0000-3602-4482550f0000 pid=3925 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=e773c432-1700-0000-3602-4482550f0000 pid=3925 execve guuid=41a01533-1700-0000-3602-4482580f0000 pid=3928 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=41a01533-1700-0000-3602-4482580f0000 pid=3928 execve guuid=16d96633-1700-0000-3602-44825a0f0000 pid=3930 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=16d96633-1700-0000-3602-44825a0f0000 pid=3930 execve guuid=b5f2b333-1700-0000-3602-44825c0f0000 pid=3932 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=b5f2b333-1700-0000-3602-44825c0f0000 pid=3932 execve guuid=05400334-1700-0000-3602-4482600f0000 pid=3936 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=05400334-1700-0000-3602-4482600f0000 pid=3936 execve guuid=67ad4f34-1700-0000-3602-4482610f0000 pid=3937 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=67ad4f34-1700-0000-3602-4482610f0000 pid=3937 execve guuid=60c59b34-1700-0000-3602-4482630f0000 pid=3939 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=60c59b34-1700-0000-3602-4482630f0000 pid=3939 execve guuid=937be934-1700-0000-3602-4482660f0000 pid=3942 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=937be934-1700-0000-3602-4482660f0000 pid=3942 execve guuid=9dc93a35-1700-0000-3602-44826a0f0000 pid=3946 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=9dc93a35-1700-0000-3602-44826a0f0000 pid=3946 execve guuid=513f8735-1700-0000-3602-44826e0f0000 pid=3950 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=513f8735-1700-0000-3602-44826e0f0000 pid=3950 execve guuid=6eadd435-1700-0000-3602-4482720f0000 pid=3954 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=6eadd435-1700-0000-3602-4482720f0000 pid=3954 execve guuid=af682636-1700-0000-3602-4482740f0000 pid=3956 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=af682636-1700-0000-3602-4482740f0000 pid=3956 execve guuid=590b7536-1700-0000-3602-4482760f0000 pid=3958 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=590b7536-1700-0000-3602-4482760f0000 pid=3958 execve guuid=d43cc336-1700-0000-3602-4482780f0000 pid=3960 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=d43cc336-1700-0000-3602-4482780f0000 pid=3960 execve guuid=d4b02d37-1700-0000-3602-44827b0f0000 pid=3963 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=d4b02d37-1700-0000-3602-44827b0f0000 pid=3963 execve guuid=cb0da237-1700-0000-3602-44827f0f0000 pid=3967 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=cb0da237-1700-0000-3602-44827f0f0000 pid=3967 execve guuid=3d1f0338-1700-0000-3602-4482800f0000 pid=3968 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=3d1f0338-1700-0000-3602-4482800f0000 pid=3968 execve guuid=ed695e38-1700-0000-3602-4482840f0000 pid=3972 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ed695e38-1700-0000-3602-4482840f0000 pid=3972 execve guuid=1eb8af38-1700-0000-3602-4482880f0000 pid=3976 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=1eb8af38-1700-0000-3602-4482880f0000 pid=3976 execve guuid=bac6ff38-1700-0000-3602-44828b0f0000 pid=3979 /usr/bin/ls guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=bac6ff38-1700-0000-3602-44828b0f0000 pid=3979 execve guuid=ccf24c39-1700-0000-3602-44828d0f0000 pid=3981 /usr/bin/rm guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ccf24c39-1700-0000-3602-44828d0f0000 pid=3981 execve guuid=4b4d8339-1700-0000-3602-44828f0f0000 pid=3983 /usr/bin/wget net send-data write-file guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=4b4d8339-1700-0000-3602-44828f0f0000 pid=3983 execve guuid=b66ad63d-1700-0000-3602-4482a70f0000 pid=4007 /usr/bin/chmod guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=b66ad63d-1700-0000-3602-4482a70f0000 pid=4007 execve guuid=6fbe0a3e-1700-0000-3602-4482a90f0000 pid=4009 /usr/bin/dash guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=6fbe0a3e-1700-0000-3602-4482a90f0000 pid=4009 clone guuid=22bb813e-1700-0000-3602-4482ad0f0000 pid=4013 /usr/bin/rm guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=22bb813e-1700-0000-3602-4482ad0f0000 pid=4013 execve guuid=4a94b53e-1700-0000-3602-4482b10f0000 pid=4017 /usr/bin/wget net send-data write-file guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=4a94b53e-1700-0000-3602-4482b10f0000 pid=4017 execve guuid=33584f42-1700-0000-3602-4482c30f0000 pid=4035 /usr/bin/chmod guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=33584f42-1700-0000-3602-4482c30f0000 pid=4035 execve guuid=171a9042-1700-0000-3602-4482c50f0000 pid=4037 /usr/bin/dash guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=171a9042-1700-0000-3602-4482c50f0000 pid=4037 clone guuid=aa8d1443-1700-0000-3602-4482ca0f0000 pid=4042 /usr/bin/rm guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=aa8d1443-1700-0000-3602-4482ca0f0000 pid=4042 execve guuid=34035543-1700-0000-3602-4482cc0f0000 pid=4044 /usr/bin/wget net send-data write-file guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=34035543-1700-0000-3602-4482cc0f0000 pid=4044 execve guuid=69b34549-1700-0000-3602-4482dc0f0000 pid=4060 /usr/bin/chmod guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=69b34549-1700-0000-3602-4482dc0f0000 pid=4060 execve guuid=37288c49-1700-0000-3602-4482dd0f0000 pid=4061 /usr/bin/dash guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=37288c49-1700-0000-3602-4482dd0f0000 pid=4061 clone guuid=d46f1e4a-1700-0000-3602-4482e20f0000 pid=4066 /usr/bin/rm guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=d46f1e4a-1700-0000-3602-4482e20f0000 pid=4066 execve guuid=008b654a-1700-0000-3602-4482e50f0000 pid=4069 /usr/bin/wget net send-data write-file guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=008b654a-1700-0000-3602-4482e50f0000 pid=4069 execve guuid=72b7bc4e-1700-0000-3602-4482fb0f0000 pid=4091 /usr/bin/chmod guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=72b7bc4e-1700-0000-3602-4482fb0f0000 pid=4091 execve guuid=c29cf54e-1700-0000-3602-4482fd0f0000 pid=4093 /usr/bin/dash guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=c29cf54e-1700-0000-3602-4482fd0f0000 pid=4093 clone guuid=fd196450-1700-0000-3602-448204100000 pid=4100 /usr/bin/rm guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=fd196450-1700-0000-3602-448204100000 pid=4100 execve guuid=ff6aaf50-1700-0000-3602-448207100000 pid=4103 /usr/bin/wget net send-data write-file guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ff6aaf50-1700-0000-3602-448207100000 pid=4103 execve guuid=87444555-1700-0000-3602-448214100000 pid=4116 /usr/bin/chmod guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=87444555-1700-0000-3602-448214100000 pid=4116 execve guuid=7bdcbb55-1700-0000-3602-448216100000 pid=4118 /usr/bin/dash guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=7bdcbb55-1700-0000-3602-448216100000 pid=4118 clone guuid=ffafdf56-1700-0000-3602-44821c100000 pid=4124 /usr/bin/rm delete-file guuid=001dbeff-1600-0000-3602-44824d0e0000 pid=3661->guuid=ffafdf56-1700-0000-3602-44821c100000 pid=4124 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=4b4d8339-1700-0000-3602-44828f0f0000 pid=3983->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=4a94b53e-1700-0000-3602-4482b10f0000 pid=4017->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=34035543-1700-0000-3602-4482cc0f0000 pid=4044->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=008b654a-1700-0000-3602-4482e50f0000 pid=4069->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=ff6aaf50-1700-0000-3602-448207100000 pid=4103->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B
Score:
89%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604/
Threat name:
Document-HTML.Browser.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-02 06:50:43 UTC
File Type:
Text (Shell)
AV detection:
8 of 36 (22.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q2534cr7xbzhply5gast3w4wkuxd2c74u6d5qxhddjcxxdmx4yca._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260802-hl7nxsef49/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604

(this sample)

Mirai

elf 3dcff7e3ded3bf19981d30151dcaf48915e545d569eb97483d70aec1b7db70cc

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d0bc1c7b9c20e9d7fd03c76c184b4a07
  
Dropping
SHA256 3dcff7e3ded3bf19981d30151dcaf48915e545d569eb97483d70aec1b7db70cc

Comments