MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bb2941f72000c36d9cbe0f2a510f87d1033d08d088ed9e98fb0c633cd27168a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bb2941f72000c36d9cbe0f2a510f87d1033d08d088ed9e98fb0c633cd27168a
SHA3-384 hash: a6e9fb9e20455c325e3678bf558d59f9ab86187fcf6208c768eb8742d727dd5ed1436450d14364b027e880d99826c498
SHA1 hash: 3c985d13e2737a2667d168432fd47315accac895
MD5 hash: 3c4886f7f73ed14790c09e659858fff3
humanhash: wyoming-december-six-romeo
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'989 bytes
First seen:2025-11-18 17:23:52 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:ii3hmlilnEliKCXlimePliaxazvZlia7aFvjli9NT9z4geliBjcli6Svlijxjzqc:i2mlaElOXlyPlb4zvZlb2FvjlMrz4Zlf
TLSH T138514CD712B14ABE2C72BAA3FDBD8F2C358154D29CE5AF045AFE34A5528CD983044B47
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://74.208.158.106/hiddenbin/Space.arcbe058672e84f8bb0e4f5d3ceb006bc67f03897ddb2b47b49a0ff06f942eb3143 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.x86e9ff0ebafa075d067642d2a3ea7f4b51795c0ab4dc6d7fd8b3511e2a93115bed Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.x86_6435b614387178f43684fd2e520397ac9c230b1dc752b0bec946b5fafd72942f44 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.i686a14577cd889ef69d4047f728167a07cea3355964ddc4abdec6c0e8ed469c1623 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.mips375539ff4cec00b1a8f3e08ea21c05c24dafad890cf508043ca510ee934d5dc6 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.mips64n/an/aelf ua-wget
http://74.208.158.106/hiddenbin/Space.mpsl60f609510eef0ecb325276e74089f8f1f9c2e30cb479a4421c77cfa6a94fa0c2 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.arm5949c7e586abdb1762cffe77b3d81202c61bd5c93c0a4ab4d1108998d8a64a78 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.arm5f364d817110291939703e8c4112e73cff275c782373fe81f9fa0a38763573ee6 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.arm687b1e06ce497bb152b71531e7244d6eb7f3a57621f4691cb0642ac26ddab4127 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.arm74dc241ac2c932d17f3f5da9cfa801ce5935ab83a3f2bee131f8953efd638560b Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.ppc664a1d55316206a935187647e9671b4dc78ccb8d7e0599f3848db58b6f6f66d2 Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.sparcn/an/aelf ua-wget
http://74.208.158.106/hiddenbin/Space.m68kde3c2c384c01b40559fd0988af28716cfa1bf45537636631e6ba845f48b1461c Miraimirai opendir
http://74.208.158.106/hiddenbin/Space.sh49a02fd6ddca6c7968107cea0d19df7720b159e6706cc01d31e155609962a3b73 Miraimirai opendir

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
busybox
Link:
https://www.filescan.io/uploads/691cac4795709d0fdece703e/reports/9e051579-bb2f-4623-bcff-b3cef4f11add/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-18T15:17:00Z UTC
Last seen:
2025-11-18T17:49:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8bb2941f72000c36d9cbe0f2a510f87d1033d08d088ed9e98fb0c633cd27168a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/06b9027b-0399-49eb-b9db-a9d6138d683e
Behavior Graph:
Download SVG
%3 guuid=11afb8b0-1a00-0000-897a-5911030a0000 pid=2563 /usr/bin/sudo guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573 /tmp/sample.bin guuid=11afb8b0-1a00-0000-897a-5911030a0000 pid=2563->guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573 execve guuid=f82154b4-1a00-0000-897a-5911100a0000 pid=2576 /usr/bin/cp guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=f82154b4-1a00-0000-897a-5911100a0000 pid=2576 execve guuid=be9ffcb6-1a00-0000-897a-5911170a0000 pid=2583 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=be9ffcb6-1a00-0000-897a-5911170a0000 pid=2583 execve guuid=f8e67fda-1a00-0000-897a-59117d0a0000 pid=2685 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=f8e67fda-1a00-0000-897a-59117d0a0000 pid=2685 execve guuid=99859604-1b00-0000-897a-5911db0a0000 pid=2779 /usr/bin/cat guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=99859604-1b00-0000-897a-5911db0a0000 pid=2779 execve guuid=3602f604-1b00-0000-897a-5911dd0a0000 pid=2781 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=3602f604-1b00-0000-897a-5911dd0a0000 pid=2781 execve guuid=bb325905-1b00-0000-897a-5911de0a0000 pid=2782 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=bb325905-1b00-0000-897a-5911de0a0000 pid=2782 clone guuid=a34d8707-1b00-0000-897a-5911e20a0000 pid=2786 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=a34d8707-1b00-0000-897a-5911e20a0000 pid=2786 execve guuid=9c479d1c-1b00-0000-897a-59110b0b0000 pid=2827 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=9c479d1c-1b00-0000-897a-59110b0b0000 pid=2827 execve guuid=6ad97e35-1b00-0000-897a-5911430b0000 pid=2883 /usr/bin/cat guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=6ad97e35-1b00-0000-897a-5911430b0000 pid=2883 execve guuid=2f0bf235-1b00-0000-897a-5911460b0000 pid=2886 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=2f0bf235-1b00-0000-897a-5911460b0000 pid=2886 execve guuid=909e6d36-1b00-0000-897a-5911470b0000 pid=2887 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=909e6d36-1b00-0000-897a-5911470b0000 pid=2887 execve guuid=a0e1a364-1c00-0000-897a-59116c0d0000 pid=3436 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=a0e1a364-1c00-0000-897a-59116c0d0000 pid=3436 execve guuid=42f9837a-1c00-0000-897a-59118f0d0000 pid=3471 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=42f9837a-1c00-0000-897a-59118f0d0000 pid=3471 execve guuid=6e5dea94-1c00-0000-897a-5911bf0d0000 pid=3519 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=6e5dea94-1c00-0000-897a-5911bf0d0000 pid=3519 clone guuid=f9745495-1c00-0000-897a-5911c00d0000 pid=3520 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=f9745495-1c00-0000-897a-5911c00d0000 pid=3520 execve guuid=4fe3f795-1c00-0000-897a-5911c10d0000 pid=3521 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=4fe3f795-1c00-0000-897a-5911c10d0000 pid=3521 execve guuid=ec9bb5c2-1d00-0000-897a-5911c5100000 pid=4293 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=ec9bb5c2-1d00-0000-897a-5911c5100000 pid=4293 execve guuid=77dd30d9-1d00-0000-897a-591115110000 pid=4373 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=77dd30d9-1d00-0000-897a-591115110000 pid=4373 execve guuid=a06caaef-1d00-0000-897a-591175110000 pid=4469 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=a06caaef-1d00-0000-897a-591175110000 pid=4469 clone guuid=dd23ccef-1d00-0000-897a-591177110000 pid=4471 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=dd23ccef-1d00-0000-897a-591177110000 pid=4471 execve guuid=bc7b1cf0-1d00-0000-897a-591179110000 pid=4473 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=bc7b1cf0-1d00-0000-897a-591179110000 pid=4473 execve guuid=43bcef1c-1f00-0000-897a-59118b140000 pid=5259 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=43bcef1c-1f00-0000-897a-59118b140000 pid=5259 execve guuid=88568232-1f00-0000-897a-59118c140000 pid=5260 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=88568232-1f00-0000-897a-59118c140000 pid=5260 execve guuid=e08bb24a-1f00-0000-897a-59118d140000 pid=5261 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=e08bb24a-1f00-0000-897a-59118d140000 pid=5261 clone guuid=635dd14a-1f00-0000-897a-59118e140000 pid=5262 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=635dd14a-1f00-0000-897a-59118e140000 pid=5262 execve guuid=7c67214b-1f00-0000-897a-59118f140000 pid=5263 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=7c67214b-1f00-0000-897a-59118f140000 pid=5263 execve guuid=0666ce77-2000-0000-897a-59119c140000 pid=5276 /usr/bin/wget net send-data guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=0666ce77-2000-0000-897a-59119c140000 pid=5276 execve guuid=e39d3987-2000-0000-897a-59119d140000 pid=5277 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=e39d3987-2000-0000-897a-59119d140000 pid=5277 execve guuid=5573ef99-2000-0000-897a-59119e140000 pid=5278 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=5573ef99-2000-0000-897a-59119e140000 pid=5278 clone guuid=5186609a-2000-0000-897a-59119f140000 pid=5279 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=5186609a-2000-0000-897a-59119f140000 pid=5279 execve guuid=e0aad69a-2000-0000-897a-5911a0140000 pid=5280 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=e0aad69a-2000-0000-897a-5911a0140000 pid=5280 execve guuid=78970dc8-2100-0000-897a-5911c6140000 pid=5318 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=78970dc8-2100-0000-897a-5911c6140000 pid=5318 execve guuid=fb6613de-2100-0000-897a-5911c7140000 pid=5319 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=fb6613de-2100-0000-897a-5911c7140000 pid=5319 execve guuid=0370c8f5-2100-0000-897a-5911c8140000 pid=5320 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=0370c8f5-2100-0000-897a-5911c8140000 pid=5320 clone guuid=41a302f6-2100-0000-897a-5911c9140000 pid=5321 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=41a302f6-2100-0000-897a-5911c9140000 pid=5321 execve guuid=8af68df6-2100-0000-897a-5911ca140000 pid=5322 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=8af68df6-2100-0000-897a-5911ca140000 pid=5322 execve guuid=55034524-2300-0000-897a-5911d0140000 pid=5328 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=55034524-2300-0000-897a-5911d0140000 pid=5328 execve guuid=26f7a13a-2300-0000-897a-5911d1140000 pid=5329 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=26f7a13a-2300-0000-897a-5911d1140000 pid=5329 execve guuid=a84b6552-2300-0000-897a-5911d2140000 pid=5330 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=a84b6552-2300-0000-897a-5911d2140000 pid=5330 clone guuid=d909a952-2300-0000-897a-5911d3140000 pid=5331 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=d909a952-2300-0000-897a-5911d3140000 pid=5331 execve guuid=ed373d53-2300-0000-897a-5911d4140000 pid=5332 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=ed373d53-2300-0000-897a-5911d4140000 pid=5332 execve guuid=675b7f81-2400-0000-897a-5911da140000 pid=5338 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=675b7f81-2400-0000-897a-5911da140000 pid=5338 execve guuid=3a6e9a97-2400-0000-897a-5911db140000 pid=5339 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=3a6e9a97-2400-0000-897a-5911db140000 pid=5339 execve guuid=4b255db1-2400-0000-897a-5911dc140000 pid=5340 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=4b255db1-2400-0000-897a-5911dc140000 pid=5340 clone guuid=a8eb96b1-2400-0000-897a-5911dd140000 pid=5341 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=a8eb96b1-2400-0000-897a-5911dd140000 pid=5341 execve guuid=301b29b2-2400-0000-897a-5911de140000 pid=5342 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=301b29b2-2400-0000-897a-5911de140000 pid=5342 execve guuid=195d32e0-2500-0000-897a-5911e4140000 pid=5348 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=195d32e0-2500-0000-897a-5911e4140000 pid=5348 execve guuid=7b052ef5-2500-0000-897a-5911e5140000 pid=5349 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=7b052ef5-2500-0000-897a-5911e5140000 pid=5349 execve guuid=332cb90b-2600-0000-897a-5911e6140000 pid=5350 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=332cb90b-2600-0000-897a-5911e6140000 pid=5350 clone guuid=b74ff90b-2600-0000-897a-5911e7140000 pid=5351 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=b74ff90b-2600-0000-897a-5911e7140000 pid=5351 execve guuid=86dead0c-2600-0000-897a-5911e8140000 pid=5352 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=86dead0c-2600-0000-897a-5911e8140000 pid=5352 execve guuid=4b8f913a-2700-0000-897a-5911ee140000 pid=5358 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=4b8f913a-2700-0000-897a-5911ee140000 pid=5358 execve guuid=75629d57-2700-0000-897a-5911ef140000 pid=5359 /usr/bin/curl net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=75629d57-2700-0000-897a-5911ef140000 pid=5359 execve guuid=87de0475-2700-0000-897a-5911f0140000 pid=5360 /usr/bin/bash guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=87de0475-2700-0000-897a-5911f0140000 pid=5360 clone guuid=ebd32a75-2700-0000-897a-5911f1140000 pid=5361 /usr/bin/chmod guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=ebd32a75-2700-0000-897a-5911f1140000 pid=5361 execve guuid=236f7675-2700-0000-897a-5911f2140000 pid=5362 /tmp/Space net guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=236f7675-2700-0000-897a-5911f2140000 pid=5362 execve guuid=23282ea2-2800-0000-897a-5911ff140000 pid=5375 /usr/bin/wget net send-data write-file guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=23282ea2-2800-0000-897a-5911ff140000 pid=5375 execve guuid=b53ea6b7-2800-0000-897a-591103150000 pid=5379 /usr/bin/curl net send-data guuid=1e4dcbb3-1a00-0000-897a-59110d0a0000 pid=2573->guuid=b53ea6b7-2800-0000-897a-591103150000 pid=5379 execve ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 74.208.158.106:80 guuid=be9ffcb6-1a00-0000-897a-5911170a0000 pid=2583->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 148B guuid=f8e67fda-1a00-0000-897a-59117d0a0000 pid=2685->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 97B guuid=a34d8707-1b00-0000-897a-5911e20a0000 pid=2786->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 148B guuid=9c479d1c-1b00-0000-897a-59110b0b0000 pid=2827->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 97B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=909e6d36-1b00-0000-897a-5911470b0000 pid=2887->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=79d71937-1b00-0000-897a-59114a0b0000 pid=2890 /tmp/Space guuid=909e6d36-1b00-0000-897a-5911470b0000 pid=2887->guuid=79d71937-1b00-0000-897a-59114a0b0000 pid=2890 clone guuid=26278364-1c00-0000-897a-59116a0d0000 pid=3434 /tmp/Space guuid=909e6d36-1b00-0000-897a-5911470b0000 pid=2887->guuid=26278364-1c00-0000-897a-59116a0d0000 pid=3434 clone guuid=29928e64-1c00-0000-897a-59116b0d0000 pid=3435 /tmp/Space net zombie guuid=909e6d36-1b00-0000-897a-5911470b0000 pid=2887->guuid=29928e64-1c00-0000-897a-59116b0d0000 pid=3435 clone guuid=f3a42037-1b00-0000-897a-59114b0b0000 pid=2891 /tmp/Space guuid=79d71937-1b00-0000-897a-59114a0b0000 pid=2890->guuid=f3a42037-1b00-0000-897a-59114b0b0000 pid=2891 clone guuid=053e2537-1b00-0000-897a-59114c0b0000 pid=2892 /tmp/Space net zombie guuid=79d71937-1b00-0000-897a-59114a0b0000 pid=2890->guuid=053e2537-1b00-0000-897a-59114c0b0000 pid=2892 clone 785a5ebf-a6f3-5e6f-996a-499b9a348e22 74.208.158.106:3778 guuid=053e2537-1b00-0000-897a-59114c0b0000 pid=2892->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=29928e64-1c00-0000-897a-59116b0d0000 pid=3435->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=a0e1a364-1c00-0000-897a-59116c0d0000 pid=3436->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 151B guuid=42f9837a-1c00-0000-897a-59118f0d0000 pid=3471->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 100B guuid=4fe3f795-1c00-0000-897a-5911c10d0000 pid=3521->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=da388296-1c00-0000-897a-5911c20d0000 pid=3522 /tmp/Space guuid=4fe3f795-1c00-0000-897a-5911c10d0000 pid=3521->guuid=da388296-1c00-0000-897a-5911c20d0000 pid=3522 clone guuid=d60fa5c2-1d00-0000-897a-5911c3100000 pid=4291 /tmp/Space guuid=4fe3f795-1c00-0000-897a-5911c10d0000 pid=3521->guuid=d60fa5c2-1d00-0000-897a-5911c3100000 pid=4291 clone guuid=1a8aa9c2-1d00-0000-897a-5911c4100000 pid=4292 /tmp/Space net zombie guuid=4fe3f795-1c00-0000-897a-5911c10d0000 pid=3521->guuid=1a8aa9c2-1d00-0000-897a-5911c4100000 pid=4292 clone guuid=6f518d96-1c00-0000-897a-5911c30d0000 pid=3523 /tmp/Space guuid=da388296-1c00-0000-897a-5911c20d0000 pid=3522->guuid=6f518d96-1c00-0000-897a-5911c30d0000 pid=3523 clone guuid=a66a9596-1c00-0000-897a-5911c40d0000 pid=3524 /tmp/Space net zombie guuid=da388296-1c00-0000-897a-5911c20d0000 pid=3522->guuid=a66a9596-1c00-0000-897a-5911c40d0000 pid=3524 clone guuid=a66a9596-1c00-0000-897a-5911c40d0000 pid=3524->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=1a8aa9c2-1d00-0000-897a-5911c4100000 pid=4292->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=ec9bb5c2-1d00-0000-897a-5911c5100000 pid=4293->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 149B guuid=77dd30d9-1d00-0000-897a-591115110000 pid=4373->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 98B guuid=bc7b1cf0-1d00-0000-897a-591179110000 pid=4473->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ab78aaf0-1d00-0000-897a-59117d110000 pid=4477 /tmp/Space guuid=bc7b1cf0-1d00-0000-897a-591179110000 pid=4473->guuid=ab78aaf0-1d00-0000-897a-59117d110000 pid=4477 clone guuid=7f05de1c-1f00-0000-897a-591189140000 pid=5257 /tmp/Space guuid=bc7b1cf0-1d00-0000-897a-591179110000 pid=4473->guuid=7f05de1c-1f00-0000-897a-591189140000 pid=5257 clone guuid=258be31c-1f00-0000-897a-59118a140000 pid=5258 /tmp/Space net zombie guuid=bc7b1cf0-1d00-0000-897a-591179110000 pid=4473->guuid=258be31c-1f00-0000-897a-59118a140000 pid=5258 clone guuid=63dab5f0-1d00-0000-897a-59117e110000 pid=4478 /tmp/Space guuid=ab78aaf0-1d00-0000-897a-59117d110000 pid=4477->guuid=63dab5f0-1d00-0000-897a-59117e110000 pid=4478 clone guuid=309cbbf0-1d00-0000-897a-59117f110000 pid=4479 /tmp/Space net zombie guuid=ab78aaf0-1d00-0000-897a-59117d110000 pid=4477->guuid=309cbbf0-1d00-0000-897a-59117f110000 pid=4479 clone guuid=309cbbf0-1d00-0000-897a-59117f110000 pid=4479->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=258be31c-1f00-0000-897a-59118a140000 pid=5258->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=43bcef1c-1f00-0000-897a-59118b140000 pid=5259->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 149B guuid=88568232-1f00-0000-897a-59118c140000 pid=5260->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 98B guuid=7c67214b-1f00-0000-897a-59118f140000 pid=5263->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=60cca44b-1f00-0000-897a-591190140000 pid=5264 /tmp/Space guuid=7c67214b-1f00-0000-897a-59118f140000 pid=5263->guuid=60cca44b-1f00-0000-897a-591190140000 pid=5264 clone guuid=b749b977-2000-0000-897a-59119a140000 pid=5274 /tmp/Space guuid=7c67214b-1f00-0000-897a-59118f140000 pid=5263->guuid=b749b977-2000-0000-897a-59119a140000 pid=5274 clone guuid=6df3be77-2000-0000-897a-59119b140000 pid=5275 /tmp/Space net zombie guuid=7c67214b-1f00-0000-897a-59118f140000 pid=5263->guuid=6df3be77-2000-0000-897a-59119b140000 pid=5275 clone guuid=6ca5ca4c-1f00-0000-897a-591191140000 pid=5265 /tmp/Space guuid=60cca44b-1f00-0000-897a-591190140000 pid=5264->guuid=6ca5ca4c-1f00-0000-897a-591191140000 pid=5265 clone guuid=46d5d04c-1f00-0000-897a-591192140000 pid=5266 /tmp/Space net zombie guuid=60cca44b-1f00-0000-897a-591190140000 pid=5264->guuid=46d5d04c-1f00-0000-897a-591192140000 pid=5266 clone guuid=46d5d04c-1f00-0000-897a-591192140000 pid=5266->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=6df3be77-2000-0000-897a-59119b140000 pid=5275->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=0666ce77-2000-0000-897a-59119c140000 pid=5276->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 151B guuid=e39d3987-2000-0000-897a-59119d140000 pid=5277->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 100B guuid=e0aad69a-2000-0000-897a-5911a0140000 pid=5280->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e4f6a49b-2000-0000-897a-5911a1140000 pid=5281 /tmp/Space guuid=e0aad69a-2000-0000-897a-5911a0140000 pid=5280->guuid=e4f6a49b-2000-0000-897a-5911a1140000 pid=5281 clone guuid=fc25e4c7-2100-0000-897a-5911c4140000 pid=5316 /tmp/Space guuid=e0aad69a-2000-0000-897a-5911a0140000 pid=5280->guuid=fc25e4c7-2100-0000-897a-5911c4140000 pid=5316 clone guuid=5b4ef1c7-2100-0000-897a-5911c5140000 pid=5317 /tmp/Space net zombie guuid=e0aad69a-2000-0000-897a-5911a0140000 pid=5280->guuid=5b4ef1c7-2100-0000-897a-5911c5140000 pid=5317 clone guuid=01d43e9c-2000-0000-897a-5911a2140000 pid=5282 /tmp/Space guuid=e4f6a49b-2000-0000-897a-5911a1140000 pid=5281->guuid=01d43e9c-2000-0000-897a-5911a2140000 pid=5282 clone guuid=a2e5449c-2000-0000-897a-5911a3140000 pid=5283 /tmp/Space net zombie guuid=e4f6a49b-2000-0000-897a-5911a1140000 pid=5281->guuid=a2e5449c-2000-0000-897a-5911a3140000 pid=5283 clone guuid=a2e5449c-2000-0000-897a-5911a3140000 pid=5283->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=5b4ef1c7-2100-0000-897a-5911c5140000 pid=5317->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=78970dc8-2100-0000-897a-5911c6140000 pid=5318->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 149B guuid=fb6613de-2100-0000-897a-5911c7140000 pid=5319->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 98B guuid=8af68df6-2100-0000-897a-5911ca140000 pid=5322->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8dfc83f7-2100-0000-897a-5911cb140000 pid=5323 /tmp/Space guuid=8af68df6-2100-0000-897a-5911ca140000 pid=5322->guuid=8dfc83f7-2100-0000-897a-5911cb140000 pid=5323 clone guuid=c2a61824-2300-0000-897a-5911ce140000 pid=5326 /tmp/Space guuid=8af68df6-2100-0000-897a-5911ca140000 pid=5322->guuid=c2a61824-2300-0000-897a-5911ce140000 pid=5326 clone guuid=c7d32324-2300-0000-897a-5911cf140000 pid=5327 /tmp/Space net zombie guuid=8af68df6-2100-0000-897a-5911ca140000 pid=5322->guuid=c7d32324-2300-0000-897a-5911cf140000 pid=5327 clone guuid=75608ff7-2100-0000-897a-5911cc140000 pid=5324 /tmp/Space guuid=8dfc83f7-2100-0000-897a-5911cb140000 pid=5323->guuid=75608ff7-2100-0000-897a-5911cc140000 pid=5324 clone guuid=47a297f7-2100-0000-897a-5911cd140000 pid=5325 /tmp/Space net zombie guuid=8dfc83f7-2100-0000-897a-5911cb140000 pid=5323->guuid=47a297f7-2100-0000-897a-5911cd140000 pid=5325 clone guuid=47a297f7-2100-0000-897a-5911cd140000 pid=5325->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=c7d32324-2300-0000-897a-5911cf140000 pid=5327->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=55034524-2300-0000-897a-5911d0140000 pid=5328->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 148B guuid=26f7a13a-2300-0000-897a-5911d1140000 pid=5329->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 97B guuid=ed373d53-2300-0000-897a-5911d4140000 pid=5332->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7fe24954-2300-0000-897a-5911d5140000 pid=5333 /tmp/Space guuid=ed373d53-2300-0000-897a-5911d4140000 pid=5332->guuid=7fe24954-2300-0000-897a-5911d5140000 pid=5333 clone guuid=6cea5581-2400-0000-897a-5911d8140000 pid=5336 /tmp/Space guuid=ed373d53-2300-0000-897a-5911d4140000 pid=5332->guuid=6cea5581-2400-0000-897a-5911d8140000 pid=5336 clone guuid=40136681-2400-0000-897a-5911d9140000 pid=5337 /tmp/Space net zombie guuid=ed373d53-2300-0000-897a-5911d4140000 pid=5332->guuid=40136681-2400-0000-897a-5911d9140000 pid=5337 clone guuid=38455954-2300-0000-897a-5911d6140000 pid=5334 /tmp/Space guuid=7fe24954-2300-0000-897a-5911d5140000 pid=5333->guuid=38455954-2300-0000-897a-5911d6140000 pid=5334 clone guuid=4fe46154-2300-0000-897a-5911d7140000 pid=5335 /tmp/Space net zombie guuid=7fe24954-2300-0000-897a-5911d5140000 pid=5333->guuid=4fe46154-2300-0000-897a-5911d7140000 pid=5335 clone guuid=4fe46154-2300-0000-897a-5911d7140000 pid=5335->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=40136681-2400-0000-897a-5911d9140000 pid=5337->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=675b7f81-2400-0000-897a-5911da140000 pid=5338->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 149B guuid=3a6e9a97-2400-0000-897a-5911db140000 pid=5339->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 98B guuid=301b29b2-2400-0000-897a-5911de140000 pid=5342->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8cab1db3-2400-0000-897a-5911df140000 pid=5343 /tmp/Space guuid=301b29b2-2400-0000-897a-5911de140000 pid=5342->guuid=8cab1db3-2400-0000-897a-5911df140000 pid=5343 clone guuid=25e91ce0-2500-0000-897a-5911e2140000 pid=5346 /tmp/Space guuid=301b29b2-2400-0000-897a-5911de140000 pid=5342->guuid=25e91ce0-2500-0000-897a-5911e2140000 pid=5346 clone guuid=9fe421e0-2500-0000-897a-5911e3140000 pid=5347 /tmp/Space net zombie guuid=301b29b2-2400-0000-897a-5911de140000 pid=5342->guuid=9fe421e0-2500-0000-897a-5911e3140000 pid=5347 clone guuid=82b42db3-2400-0000-897a-5911e0140000 pid=5344 /tmp/Space guuid=8cab1db3-2400-0000-897a-5911df140000 pid=5343->guuid=82b42db3-2400-0000-897a-5911e0140000 pid=5344 clone guuid=a28038b3-2400-0000-897a-5911e1140000 pid=5345 /tmp/Space net zombie guuid=8cab1db3-2400-0000-897a-5911df140000 pid=5343->guuid=a28038b3-2400-0000-897a-5911e1140000 pid=5345 clone guuid=a28038b3-2400-0000-897a-5911e1140000 pid=5345->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=9fe421e0-2500-0000-897a-5911e3140000 pid=5347->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=195d32e0-2500-0000-897a-5911e4140000 pid=5348->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 149B guuid=7b052ef5-2500-0000-897a-5911e5140000 pid=5349->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 98B guuid=86dead0c-2600-0000-897a-5911e8140000 pid=5352->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9781a40d-2600-0000-897a-5911e9140000 pid=5353 /tmp/Space guuid=86dead0c-2600-0000-897a-5911e8140000 pid=5352->guuid=9781a40d-2600-0000-897a-5911e9140000 pid=5353 clone guuid=35dc763a-2700-0000-897a-5911ec140000 pid=5356 /tmp/Space guuid=86dead0c-2600-0000-897a-5911e8140000 pid=5352->guuid=35dc763a-2700-0000-897a-5911ec140000 pid=5356 clone guuid=f43d7d3a-2700-0000-897a-5911ed140000 pid=5357 /tmp/Space net zombie guuid=86dead0c-2600-0000-897a-5911e8140000 pid=5352->guuid=f43d7d3a-2700-0000-897a-5911ed140000 pid=5357 clone guuid=35dab20d-2600-0000-897a-5911ea140000 pid=5354 /tmp/Space guuid=9781a40d-2600-0000-897a-5911e9140000 pid=5353->guuid=35dab20d-2600-0000-897a-5911ea140000 pid=5354 clone guuid=a38bc00d-2600-0000-897a-5911eb140000 pid=5355 /tmp/Space net zombie guuid=9781a40d-2600-0000-897a-5911e9140000 pid=5353->guuid=a38bc00d-2600-0000-897a-5911eb140000 pid=5355 clone guuid=a38bc00d-2600-0000-897a-5911eb140000 pid=5355->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=f43d7d3a-2700-0000-897a-5911ed140000 pid=5357->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=4b8f913a-2700-0000-897a-5911ee140000 pid=5358->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 149B guuid=75629d57-2700-0000-897a-5911ef140000 pid=5359->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 98B guuid=236f7675-2700-0000-897a-5911f2140000 pid=5362->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8cd40f76-2700-0000-897a-5911f3140000 pid=5363 /tmp/Space guuid=236f7675-2700-0000-897a-5911f2140000 pid=5362->guuid=8cd40f76-2700-0000-897a-5911f3140000 pid=5363 clone guuid=45e60ea2-2800-0000-897a-5911fd140000 pid=5373 /tmp/Space guuid=236f7675-2700-0000-897a-5911f2140000 pid=5362->guuid=45e60ea2-2800-0000-897a-5911fd140000 pid=5373 clone guuid=9ea116a2-2800-0000-897a-5911fe140000 pid=5374 /tmp/Space net zombie guuid=236f7675-2700-0000-897a-5911f2140000 pid=5362->guuid=9ea116a2-2800-0000-897a-5911fe140000 pid=5374 clone guuid=839f1876-2700-0000-897a-5911f4140000 pid=5364 /tmp/Space guuid=8cd40f76-2700-0000-897a-5911f3140000 pid=5363->guuid=839f1876-2700-0000-897a-5911f4140000 pid=5364 clone guuid=e7df1d76-2700-0000-897a-5911f5140000 pid=5365 /tmp/Space net zombie guuid=8cd40f76-2700-0000-897a-5911f3140000 pid=5363->guuid=e7df1d76-2700-0000-897a-5911f5140000 pid=5365 clone guuid=e7df1d76-2700-0000-897a-5911f5140000 pid=5365->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=9ea116a2-2800-0000-897a-5911fe140000 pid=5374->785a5ebf-a6f3-5e6f-996a-499b9a348e22 con guuid=23282ea2-2800-0000-897a-5911ff140000 pid=5375->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 148B guuid=b53ea6b7-2800-0000-897a-591103150000 pid=5379->ddcd0ae5-a789-53a4-a91f-12dc307ca2b4 send: 97B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8bb2941f72000c36d9cbe0f2a510f87d1033d08d088ed9e98fb0c633cd27168a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bb2941f72000c36d9cbe0f2a510f87d1033d08d088ed9e98fb0c633cd27168a/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rozjih3saagdnwol4dzkkehypuidhuenbchnt2mpwdddhtjhc2fa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251118-vzrwvagy7g/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8bb2941f7200/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/8bb2941f72000c36d9cbe0f2a510f87d1033d08d088ed9e98fb0c633cd27168a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 8bb2941f72000c36d9cbe0f2a510f87d1033d08d088ed9e98fb0c633cd27168a

(this sample)

Mirai

elf be058672e84f8bb0e4f5d3ceb006bc67f03897ddb2b47b49a0ff06f942eb3143

  
URLhaus
https://urlhaus.abuse.ch/url/3711496/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3711532/
  
Dropping
MD5 b62095dfc33ae573c86380dbf91b825d
  
Dropping
SHA256 be058672e84f8bb0e4f5d3ceb006bc67f03897ddb2b47b49a0ff06f942eb3143

Comments