MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9222eb19b5d55cf6c8d48db9507835cdaf7b86fa91c011574afb0f3aab7dd472. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9222eb19b5d55cf6c8d48db9507835cdaf7b86fa91c011574afb0f3aab7dd472
SHA3-384 hash: 51ab1454a918ab1e07552a7c5be2a5ab40d33caf7300f1e2e138a0a9d928d48f3bd600237f3b515af2f937fd1bef07c4
SHA1 hash: 490ba50bcc2e464600334fd2a276508403fcc5d7
MD5 hash: 6e46d63e046fcebbca2e66f3e1baf991
humanhash: mexico-wisconsin-salami-white
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-20 17:11:50 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Uak6amF3DVDJ668Dl6Xv/vN1X76Nn0wFT6FLVtLiW+FGi6+FGtreFKaX0eFE6Az8:zO8DV1/YCVtMGYGgfFncewBu8d2Dvht
TLSH T1A9312DCA84542A301107CD8EB372354C698D91F7199FE7E099486EF992497DCF3A2B4D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/b87566n/an/aua-wget
http://5.182.210.174/ae9a6bn/an/aua-wget
http://5.182.210.174/b6973an/an/aua-wget
http://5.182.210.174/982cd0n/an/aua-wget
http://5.182.210.174/d834afn/an/aua-wget
http://5.182.210.174/adb88fn/an/aua-wget
http://5.182.210.174/79743en/an/aua-wget
http://5.182.210.174/24dc12n/an/aua-wget
http://5.182.210.174/ba641bn/an/aua-wget
http://5.182.210.174/a0ec06n/an/aua-wget
http://5.182.210.174/aede8dn/an/aua-wget
http://5.182.210.174/d19a37n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a87356eab0656069e5b4cd8/reports/c3cace62-5a4c-401f-b025-10593e71eda8/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e1e3ab59-612a-4ef3-a588-a451a9281405
Behavior Graph:
Download SVG
%3 guuid=4b6c94d6-1600-0000-9549-c42a360d0000 pid=3382 /usr/bin/sudo guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390 /tmp/sample.bin guuid=4b6c94d6-1600-0000-9549-c42a360d0000 pid=3382->guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390 execve guuid=41c16cdc-1600-0000-9549-c42a3f0d0000 pid=3391 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=41c16cdc-1600-0000-9549-c42a3f0d0000 pid=3391 execve guuid=a4ab9ae0-1600-0000-9549-c42a470d0000 pid=3399 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=a4ab9ae0-1600-0000-9549-c42a470d0000 pid=3399 execve guuid=9dd7f1e7-1600-0000-9549-c42a520d0000 pid=3410 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=9dd7f1e7-1600-0000-9549-c42a520d0000 pid=3410 execve guuid=ec407ee8-1600-0000-9549-c42a530d0000 pid=3411 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=ec407ee8-1600-0000-9549-c42a530d0000 pid=3411 clone guuid=6e7017e9-1600-0000-9549-c42a560d0000 pid=3414 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=6e7017e9-1600-0000-9549-c42a560d0000 pid=3414 execve guuid=643f6ce9-1600-0000-9549-c42a570d0000 pid=3415 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=643f6ce9-1600-0000-9549-c42a570d0000 pid=3415 execve guuid=7069aee9-1600-0000-9549-c42a580d0000 pid=3416 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=7069aee9-1600-0000-9549-c42a580d0000 pid=3416 execve guuid=8a0de8ec-1600-0000-9549-c42a620d0000 pid=3426 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=8a0de8ec-1600-0000-9549-c42a620d0000 pid=3426 execve guuid=4eb9f0f1-1600-0000-9549-c42a730d0000 pid=3443 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=4eb9f0f1-1600-0000-9549-c42a730d0000 pid=3443 execve guuid=d0f236f2-1600-0000-9549-c42a750d0000 pid=3445 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=d0f236f2-1600-0000-9549-c42a750d0000 pid=3445 clone guuid=117c6cf2-1600-0000-9549-c42a780d0000 pid=3448 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=117c6cf2-1600-0000-9549-c42a780d0000 pid=3448 execve guuid=b41ab7f2-1600-0000-9549-c42a7a0d0000 pid=3450 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=b41ab7f2-1600-0000-9549-c42a7a0d0000 pid=3450 execve guuid=21c611f3-1600-0000-9549-c42a7f0d0000 pid=3455 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=21c611f3-1600-0000-9549-c42a7f0d0000 pid=3455 execve guuid=d6909bf5-1600-0000-9549-c42a860d0000 pid=3462 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=d6909bf5-1600-0000-9549-c42a860d0000 pid=3462 execve guuid=bb6c3cfa-1600-0000-9549-c42a8f0d0000 pid=3471 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=bb6c3cfa-1600-0000-9549-c42a8f0d0000 pid=3471 execve guuid=f7ba74fa-1600-0000-9549-c42a910d0000 pid=3473 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=f7ba74fa-1600-0000-9549-c42a910d0000 pid=3473 clone guuid=99b1a0fa-1600-0000-9549-c42a930d0000 pid=3475 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=99b1a0fa-1600-0000-9549-c42a930d0000 pid=3475 execve guuid=aae5d6fa-1600-0000-9549-c42a950d0000 pid=3477 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=aae5d6fa-1600-0000-9549-c42a950d0000 pid=3477 execve guuid=d3400dfb-1600-0000-9549-c42a960d0000 pid=3478 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=d3400dfb-1600-0000-9549-c42a960d0000 pid=3478 execve guuid=78fd62fd-1600-0000-9549-c42a9d0d0000 pid=3485 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=78fd62fd-1600-0000-9549-c42a9d0d0000 pid=3485 execve guuid=ce6d8b05-1700-0000-9549-c42aad0d0000 pid=3501 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=ce6d8b05-1700-0000-9549-c42aad0d0000 pid=3501 execve guuid=6259dc05-1700-0000-9549-c42aae0d0000 pid=3502 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=6259dc05-1700-0000-9549-c42aae0d0000 pid=3502 clone guuid=42f81506-1700-0000-9549-c42ab00d0000 pid=3504 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=42f81506-1700-0000-9549-c42ab00d0000 pid=3504 execve guuid=889a7506-1700-0000-9549-c42ab20d0000 pid=3506 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=889a7506-1700-0000-9549-c42ab20d0000 pid=3506 execve guuid=fa4a1907-1700-0000-9549-c42ab50d0000 pid=3509 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=fa4a1907-1700-0000-9549-c42ab50d0000 pid=3509 execve guuid=aa87d409-1700-0000-9549-c42abb0d0000 pid=3515 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=aa87d409-1700-0000-9549-c42abb0d0000 pid=3515 execve guuid=c306430e-1700-0000-9549-c42ac70d0000 pid=3527 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=c306430e-1700-0000-9549-c42ac70d0000 pid=3527 execve guuid=0ad37a0e-1700-0000-9549-c42aca0d0000 pid=3530 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=0ad37a0e-1700-0000-9549-c42aca0d0000 pid=3530 clone guuid=b8eef20e-1700-0000-9549-c42acf0d0000 pid=3535 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=b8eef20e-1700-0000-9549-c42acf0d0000 pid=3535 execve guuid=ba09510f-1700-0000-9549-c42ad00d0000 pid=3536 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=ba09510f-1700-0000-9549-c42ad00d0000 pid=3536 execve guuid=ed60b50f-1700-0000-9549-c42ad40d0000 pid=3540 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=ed60b50f-1700-0000-9549-c42ad40d0000 pid=3540 execve guuid=131a8012-1700-0000-9549-c42adf0d0000 pid=3551 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=131a8012-1700-0000-9549-c42adf0d0000 pid=3551 execve guuid=546be517-1700-0000-9549-c42aef0d0000 pid=3567 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=546be517-1700-0000-9549-c42aef0d0000 pid=3567 execve guuid=8add1c18-1700-0000-9549-c42af30d0000 pid=3571 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=8add1c18-1700-0000-9549-c42af30d0000 pid=3571 clone guuid=117a4918-1700-0000-9549-c42af50d0000 pid=3573 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=117a4918-1700-0000-9549-c42af50d0000 pid=3573 execve guuid=01938318-1700-0000-9549-c42af60d0000 pid=3574 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=01938318-1700-0000-9549-c42af60d0000 pid=3574 execve guuid=3de1bc18-1700-0000-9549-c42af70d0000 pid=3575 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=3de1bc18-1700-0000-9549-c42af70d0000 pid=3575 execve guuid=1f253d1b-1700-0000-9549-c42a000e0000 pid=3584 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=1f253d1b-1700-0000-9549-c42a000e0000 pid=3584 execve guuid=ac93c61e-1700-0000-9549-c42a050e0000 pid=3589 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=ac93c61e-1700-0000-9549-c42a050e0000 pid=3589 execve guuid=e110fa1e-1700-0000-9549-c42a060e0000 pid=3590 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=e110fa1e-1700-0000-9549-c42a060e0000 pid=3590 clone guuid=aae7271f-1700-0000-9549-c42a080e0000 pid=3592 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=aae7271f-1700-0000-9549-c42a080e0000 pid=3592 execve guuid=380a601f-1700-0000-9549-c42a0c0e0000 pid=3596 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=380a601f-1700-0000-9549-c42a0c0e0000 pid=3596 execve guuid=ea8a951f-1700-0000-9549-c42a0d0e0000 pid=3597 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=ea8a951f-1700-0000-9549-c42a0d0e0000 pid=3597 execve guuid=5a10ed21-1700-0000-9549-c42a140e0000 pid=3604 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=5a10ed21-1700-0000-9549-c42a140e0000 pid=3604 execve guuid=3c2c4f25-1700-0000-9549-c42a230e0000 pid=3619 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=3c2c4f25-1700-0000-9549-c42a230e0000 pid=3619 execve guuid=c7ed8f25-1700-0000-9549-c42a240e0000 pid=3620 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=c7ed8f25-1700-0000-9549-c42a240e0000 pid=3620 clone guuid=2caad125-1700-0000-9549-c42a260e0000 pid=3622 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=2caad125-1700-0000-9549-c42a260e0000 pid=3622 execve guuid=e6aedb28-1700-0000-9549-c42a270e0000 pid=3623 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=e6aedb28-1700-0000-9549-c42a270e0000 pid=3623 execve guuid=69f65029-1700-0000-9549-c42a290e0000 pid=3625 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=69f65029-1700-0000-9549-c42a290e0000 pid=3625 execve guuid=4a277a2c-1700-0000-9549-c42a350e0000 pid=3637 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=4a277a2c-1700-0000-9549-c42a350e0000 pid=3637 execve guuid=20dc1231-1700-0000-9549-c42a4f0e0000 pid=3663 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=20dc1231-1700-0000-9549-c42a4f0e0000 pid=3663 execve guuid=c50c6731-1700-0000-9549-c42a500e0000 pid=3664 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=c50c6731-1700-0000-9549-c42a500e0000 pid=3664 clone guuid=8161a531-1700-0000-9549-c42a530e0000 pid=3667 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=8161a531-1700-0000-9549-c42a530e0000 pid=3667 execve guuid=1850ed31-1700-0000-9549-c42a540e0000 pid=3668 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=1850ed31-1700-0000-9549-c42a540e0000 pid=3668 execve guuid=78a43532-1700-0000-9549-c42a560e0000 pid=3670 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=78a43532-1700-0000-9549-c42a560e0000 pid=3670 execve guuid=3840d034-1700-0000-9549-c42a620e0000 pid=3682 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=3840d034-1700-0000-9549-c42a620e0000 pid=3682 execve guuid=fa0aa038-1700-0000-9549-c42a6d0e0000 pid=3693 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=fa0aa038-1700-0000-9549-c42a6d0e0000 pid=3693 execve guuid=2fbbef38-1700-0000-9549-c42a6f0e0000 pid=3695 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=2fbbef38-1700-0000-9549-c42a6f0e0000 pid=3695 clone guuid=61cb2c39-1700-0000-9549-c42a720e0000 pid=3698 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=61cb2c39-1700-0000-9549-c42a720e0000 pid=3698 execve guuid=f6697e39-1700-0000-9549-c42a740e0000 pid=3700 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=f6697e39-1700-0000-9549-c42a740e0000 pid=3700 execve guuid=0ac0cd39-1700-0000-9549-c42a760e0000 pid=3702 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=0ac0cd39-1700-0000-9549-c42a760e0000 pid=3702 execve guuid=9bd3b23c-1700-0000-9549-c42a7e0e0000 pid=3710 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=9bd3b23c-1700-0000-9549-c42a7e0e0000 pid=3710 execve guuid=4d98c840-1700-0000-9549-c42a930e0000 pid=3731 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=4d98c840-1700-0000-9549-c42a930e0000 pid=3731 execve guuid=831d0e41-1700-0000-9549-c42a950e0000 pid=3733 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=831d0e41-1700-0000-9549-c42a950e0000 pid=3733 clone guuid=0cc34741-1700-0000-9549-c42a980e0000 pid=3736 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=0cc34741-1700-0000-9549-c42a980e0000 pid=3736 execve guuid=6e409141-1700-0000-9549-c42a9a0e0000 pid=3738 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=6e409141-1700-0000-9549-c42a9a0e0000 pid=3738 execve guuid=2fb7cf41-1700-0000-9549-c42a9d0e0000 pid=3741 /usr/bin/wget net send-data guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=2fb7cf41-1700-0000-9549-c42a9d0e0000 pid=3741 execve guuid=28e75744-1700-0000-9549-c42aaa0e0000 pid=3754 /usr/bin/curl net send-data write-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=28e75744-1700-0000-9549-c42aaa0e0000 pid=3754 execve guuid=0ac00048-1700-0000-9549-c42ac30e0000 pid=3779 /usr/bin/chmod guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=0ac00048-1700-0000-9549-c42ac30e0000 pid=3779 execve guuid=a95a3f48-1700-0000-9549-c42ac40e0000 pid=3780 /usr/bin/bash guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=a95a3f48-1700-0000-9549-c42ac40e0000 pid=3780 clone guuid=3bfa7c48-1700-0000-9549-c42ac70e0000 pid=3783 /usr/bin/rm delete-file guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=3bfa7c48-1700-0000-9549-c42ac70e0000 pid=3783 execve guuid=4a51c648-1700-0000-9549-c42ac90e0000 pid=3785 /usr/bin/rm guuid=9255badb-1600-0000-9549-c42a3e0d0000 pid=3390->guuid=4a51c648-1700-0000-9549-c42ac90e0000 pid=3785 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=41c16cdc-1600-0000-9549-c42a3f0d0000 pid=3391->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a4ab9ae0-1600-0000-9549-c42a470d0000 pid=3399->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=10aba1e8-1600-0000-9549-c42a540d0000 pid=3412 /usr/bin/bash guuid=ec407ee8-1600-0000-9549-c42a530d0000 pid=3411->guuid=10aba1e8-1600-0000-9549-c42a540d0000 pid=3412 clone guuid=7069aee9-1600-0000-9549-c42a580d0000 pid=3416->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8a0de8ec-1600-0000-9549-c42a620d0000 pid=3426->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8a394ff2-1600-0000-9549-c42a770d0000 pid=3447 /usr/bin/bash guuid=d0f236f2-1600-0000-9549-c42a750d0000 pid=3445->guuid=8a394ff2-1600-0000-9549-c42a770d0000 pid=3447 clone guuid=21c611f3-1600-0000-9549-c42a7f0d0000 pid=3455->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d6909bf5-1600-0000-9549-c42a860d0000 pid=3462->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f8de87fa-1600-0000-9549-c42a920d0000 pid=3474 /usr/bin/bash guuid=f7ba74fa-1600-0000-9549-c42a910d0000 pid=3473->guuid=f8de87fa-1600-0000-9549-c42a920d0000 pid=3474 clone guuid=d3400dfb-1600-0000-9549-c42a960d0000 pid=3478->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=78fd62fd-1600-0000-9549-c42a9d0d0000 pid=3485->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b273fc05-1700-0000-9549-c42aaf0d0000 pid=3503 /usr/bin/bash guuid=6259dc05-1700-0000-9549-c42aae0d0000 pid=3502->guuid=b273fc05-1700-0000-9549-c42aaf0d0000 pid=3503 clone guuid=fa4a1907-1700-0000-9549-c42ab50d0000 pid=3509->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=aa87d409-1700-0000-9549-c42abb0d0000 pid=3515->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a84b9b0e-1700-0000-9549-c42acb0d0000 pid=3531 /usr/bin/bash guuid=0ad37a0e-1700-0000-9549-c42aca0d0000 pid=3530->guuid=a84b9b0e-1700-0000-9549-c42acb0d0000 pid=3531 clone guuid=ed60b50f-1700-0000-9549-c42ad40d0000 pid=3540->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=131a8012-1700-0000-9549-c42adf0d0000 pid=3551->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=132e3118-1700-0000-9549-c42af40d0000 pid=3572 /usr/bin/bash guuid=8add1c18-1700-0000-9549-c42af30d0000 pid=3571->guuid=132e3118-1700-0000-9549-c42af40d0000 pid=3572 clone guuid=3de1bc18-1700-0000-9549-c42af70d0000 pid=3575->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1f253d1b-1700-0000-9549-c42a000e0000 pid=3584->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=dcda0e1f-1700-0000-9549-c42a070e0000 pid=3591 /usr/bin/bash guuid=e110fa1e-1700-0000-9549-c42a060e0000 pid=3590->guuid=dcda0e1f-1700-0000-9549-c42a070e0000 pid=3591 clone guuid=ea8a951f-1700-0000-9549-c42a0d0e0000 pid=3597->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5a10ed21-1700-0000-9549-c42a140e0000 pid=3604->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0c09ac25-1700-0000-9549-c42a250e0000 pid=3621 /usr/bin/bash guuid=c7ed8f25-1700-0000-9549-c42a240e0000 pid=3620->guuid=0c09ac25-1700-0000-9549-c42a250e0000 pid=3621 clone guuid=69f65029-1700-0000-9549-c42a290e0000 pid=3625->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4a277a2c-1700-0000-9549-c42a350e0000 pid=3637->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3acc7e31-1700-0000-9549-c42a510e0000 pid=3665 /usr/bin/bash guuid=c50c6731-1700-0000-9549-c42a500e0000 pid=3664->guuid=3acc7e31-1700-0000-9549-c42a510e0000 pid=3665 clone guuid=78a43532-1700-0000-9549-c42a560e0000 pid=3670->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3840d034-1700-0000-9549-c42a620e0000 pid=3682->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cdc90b39-1700-0000-9549-c42a700e0000 pid=3696 /usr/bin/bash guuid=2fbbef38-1700-0000-9549-c42a6f0e0000 pid=3695->guuid=cdc90b39-1700-0000-9549-c42a700e0000 pid=3696 clone guuid=0ac0cd39-1700-0000-9549-c42a760e0000 pid=3702->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9bd3b23c-1700-0000-9549-c42a7e0e0000 pid=3710->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=45762741-1700-0000-9549-c42a960e0000 pid=3734 /usr/bin/bash guuid=831d0e41-1700-0000-9549-c42a950e0000 pid=3733->guuid=45762741-1700-0000-9549-c42a960e0000 pid=3734 clone guuid=2fb7cf41-1700-0000-9549-c42a9d0e0000 pid=3741->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=28e75744-1700-0000-9549-c42aaa0e0000 pid=3754->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=53b15548-1700-0000-9549-c42ac50e0000 pid=3781 /usr/bin/bash guuid=a95a3f48-1700-0000-9549-c42ac40e0000 pid=3780->guuid=53b15548-1700-0000-9549-c42ac50e0000 pid=3781 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9222eb19b5d55cf6c8d48db9507835cdaf7b86fa91c011574afb0f3aab7dd472
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9222eb19b5d55cf6c8d48db9507835cdaf7b86fa91c011574afb0f3aab7dd472/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-20 17:12:21 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sirowgnv2vopnsgurw4va6bvzwxxxbx2shabcv2k7mhtvk352rza._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260820-vqxqqs1hre/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/9222eb19b5d55cf6c8d48db9507835cdaf7b86fa91c011574afb0f3aab7dd472

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 9222eb19b5d55cf6c8d48db9507835cdaf7b86fa91c011574afb0f3aab7dd472

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments