MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 925d0e32511e0d952206421262363033ea8332b4443b7ea35ba5e20d8e1fc4cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 925d0e32511e0d952206421262363033ea8332b4443b7ea35ba5e20d8e1fc4cd
SHA3-384 hash: cd52bb333ab5c630f3487a763bf0adeeae1098f1ebe90e91de3bb3e70886f7842bd620921ec2df689a7d7af073a16877
SHA1 hash: 4bf64604098c66586e63d6d6633dbc2feb5e6f9d
MD5 hash: 49f62e68ec8b33fcadd200fd2a2f692f
humanhash: ceiling-cat-fourteen-michigan
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'007 bytes
First seen:2025-12-12 11:49:56 UTC
Last seen:2025-12-13 05:39:42 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:i1X7GX7N7h1XnX6G1XgvXzP1XXXKW1XpXoU1X7pX7o7U1XfEX3b1XWX9R1X9Xcg1:i1X7GX7N7h1XnX6G1XgvXzP1XXXKW1XF
TLSH T15C51E18562068D3C29676A13E7B6437C3482949AECEAFFA5DDC8BBE9074ED107140753
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://103.77.241.135/hiddenbin/boatnet.x868b97a460bb5c6cad1e98fffeeac6c411d249d38f8ecd9e806c202436951dc4f7 Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.mipsb50876dc532be316f2812835f6a6d2ff42d9057ea34cb455bdfb40eb7b8f93c7 Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.arccf54b67bd24bbd1a7ebcc65abe86275fc0c2bc69fc6912afb26efab37d33bd58 Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.i468n/an/aelf ua-wget
http://103.77.241.135/hiddenbin/boatnet.i686n/an/aelf ua-wget
http://103.77.241.135/hiddenbin/boatnet.x86_64n/an/aelf ua-wget
http://103.77.241.135/hiddenbin/boatnet.mpslc5456e817b94091f2f8c8c4d4f633f15378858e1b8d24c2a5f7994801c64cabd Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.armd8e818c376ee627a2f47d37a7280f09bd2278736107f79b4f422baca914ea9bd Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.arm5964882f6083f58c7958936dc02588d28189395dea96c871ad290e5310f42780f Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.arm63fe2332910508a9a1aaee8070e0d1464867d63e7109b5cd66e794687d3fe1e54 Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.arm75826df0a54951635aee2bf55ddb89c8f2a9175d9caf507d9e15c3166d5b95766 Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.ppc7a209d85dec255fc66b77d4c43c15998dfb3a9398ab1e0516feefa8364c9fed6 Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.spcn/an/aelf ua-wget
http://103.77.241.135/hiddenbin/boatnet.m68kd08b3f8a3428b00f84a020c9e4c4f122d3f7b1426f6b281df41480c3013557e6 Miraielf mirai ua-wget
http://103.77.241.135/hiddenbin/boatnet.sh4ee73b7f42bc517466d7f725b816ca3d8cf3e8dab0f652ea35fd378516285e62e Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox medusa mirai
Link:
https://www.filescan.io/uploads/693c017d1eac7b9b76a78c03/reports/b74e49bf-0118-4204-8239-fac8df729692/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-12-12T10:02:00Z UTC
Last seen:
2025-12-12T11:51:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/925d0e32511e0d952206421262363033ea8332b4443b7ea35ba5e20d8e1fc4cd/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/84e9bde0-8eb9-40e6-824d-67f49b76a143
Behavior Graph:
Download SVG
%3 guuid=293ce1c2-1500-0000-b666-1d08c00c0000 pid=3264 /usr/bin/sudo guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272 /tmp/sample.bin guuid=293ce1c2-1500-0000-b666-1d08c00c0000 pid=3264->guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272 execve guuid=8dc16ec5-1500-0000-b666-1d08ca0c0000 pid=3274 /usr/bin/cp guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=8dc16ec5-1500-0000-b666-1d08ca0c0000 pid=3274 execve guuid=8ba7c9c9-1500-0000-b666-1d08d30c0000 pid=3283 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=8ba7c9c9-1500-0000-b666-1d08d30c0000 pid=3283 execve guuid=88734902-1600-0000-b666-1d08210d0000 pid=3361 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=88734902-1600-0000-b666-1d08210d0000 pid=3361 execve guuid=e908a839-1600-0000-b666-1d08890d0000 pid=3465 /usr/bin/cat guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=e908a839-1600-0000-b666-1d08890d0000 pid=3465 execve guuid=cce53f3a-1600-0000-b666-1d088b0d0000 pid=3467 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=cce53f3a-1600-0000-b666-1d088b0d0000 pid=3467 execve guuid=669ab53a-1600-0000-b666-1d088d0d0000 pid=3469 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=669ab53a-1600-0000-b666-1d088d0d0000 pid=3469 execve guuid=ffd0dc3b-1600-0000-b666-1d08930d0000 pid=3475 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=ffd0dc3b-1600-0000-b666-1d08930d0000 pid=3475 execve guuid=a6882878-1600-0000-b666-1d08e50d0000 pid=3557 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=a6882878-1600-0000-b666-1d08e50d0000 pid=3557 execve guuid=ccd6cad4-1600-0000-b666-1d08730e0000 pid=3699 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=ccd6cad4-1600-0000-b666-1d08730e0000 pid=3699 clone guuid=a06d03d5-1600-0000-b666-1d08740e0000 pid=3700 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=a06d03d5-1600-0000-b666-1d08740e0000 pid=3700 execve guuid=599a83d5-1600-0000-b666-1d08750e0000 pid=3701 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=599a83d5-1600-0000-b666-1d08750e0000 pid=3701 execve guuid=138296d6-1600-0000-b666-1d087f0e0000 pid=3711 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=138296d6-1600-0000-b666-1d087f0e0000 pid=3711 execve guuid=14188723-1700-0000-b666-1d08320f0000 pid=3890 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=14188723-1700-0000-b666-1d08320f0000 pid=3890 execve guuid=970e136f-1700-0000-b666-1d08fa0f0000 pid=4090 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=970e136f-1700-0000-b666-1d08fa0f0000 pid=4090 clone guuid=3858446f-1700-0000-b666-1d08fb0f0000 pid=4091 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=3858446f-1700-0000-b666-1d08fb0f0000 pid=4091 execve guuid=dc2bc86f-1700-0000-b666-1d08fd0f0000 pid=4093 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=dc2bc86f-1700-0000-b666-1d08fd0f0000 pid=4093 execve guuid=7bdafa70-1700-0000-b666-1d0803100000 pid=4099 /usr/bin/wget net send-data guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=7bdafa70-1700-0000-b666-1d0803100000 pid=4099 execve guuid=0358748c-1700-0000-b666-1d0847100000 pid=4167 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=0358748c-1700-0000-b666-1d0847100000 pid=4167 execve guuid=b137c6a8-1700-0000-b666-1d0891100000 pid=4241 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=b137c6a8-1700-0000-b666-1d0891100000 pid=4241 clone guuid=9e74f3a8-1700-0000-b666-1d0892100000 pid=4242 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=9e74f3a8-1700-0000-b666-1d0892100000 pid=4242 execve guuid=43cc6fa9-1700-0000-b666-1d0894100000 pid=4244 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=43cc6fa9-1700-0000-b666-1d0894100000 pid=4244 execve guuid=18a988aa-1700-0000-b666-1d089c100000 pid=4252 /usr/bin/wget net send-data guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=18a988aa-1700-0000-b666-1d089c100000 pid=4252 execve guuid=186449c6-1700-0000-b666-1d08e4100000 pid=4324 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=186449c6-1700-0000-b666-1d08e4100000 pid=4324 execve guuid=abc6d3e3-1700-0000-b666-1d0838110000 pid=4408 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=abc6d3e3-1700-0000-b666-1d0838110000 pid=4408 clone guuid=481309e4-1700-0000-b666-1d0839110000 pid=4409 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=481309e4-1700-0000-b666-1d0839110000 pid=4409 execve guuid=fccd8ce4-1700-0000-b666-1d083b110000 pid=4411 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=fccd8ce4-1700-0000-b666-1d083b110000 pid=4411 execve guuid=8ec1d6e5-1700-0000-b666-1d0843110000 pid=4419 /usr/bin/wget net send-data guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=8ec1d6e5-1700-0000-b666-1d0843110000 pid=4419 execve guuid=9b54bb04-1800-0000-b666-1d089c110000 pid=4508 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=9b54bb04-1800-0000-b666-1d089c110000 pid=4508 execve guuid=ed9adf21-1800-0000-b666-1d080e120000 pid=4622 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=ed9adf21-1800-0000-b666-1d080e120000 pid=4622 clone guuid=4e17fc21-1800-0000-b666-1d080f120000 pid=4623 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=4e17fc21-1800-0000-b666-1d080f120000 pid=4623 execve guuid=d0f04022-1800-0000-b666-1d0811120000 pid=4625 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=d0f04022-1800-0000-b666-1d0811120000 pid=4625 execve guuid=087ef822-1800-0000-b666-1d0819120000 pid=4633 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=087ef822-1800-0000-b666-1d0819120000 pid=4633 execve guuid=ca3c3c57-1800-0000-b666-1d0896120000 pid=4758 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=ca3c3c57-1800-0000-b666-1d0896120000 pid=4758 execve guuid=f6c4478f-1800-0000-b666-1d080b130000 pid=4875 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=f6c4478f-1800-0000-b666-1d080b130000 pid=4875 clone guuid=fc357d8f-1800-0000-b666-1d080c130000 pid=4876 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=fc357d8f-1800-0000-b666-1d080c130000 pid=4876 execve guuid=dce72e90-1800-0000-b666-1d080f130000 pid=4879 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=dce72e90-1800-0000-b666-1d080f130000 pid=4879 execve guuid=9f1c8c91-1800-0000-b666-1d0816130000 pid=4886 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=9f1c8c91-1800-0000-b666-1d0816130000 pid=4886 execve guuid=abffdac6-1800-0000-b666-1d088a130000 pid=5002 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=abffdac6-1800-0000-b666-1d088a130000 pid=5002 execve guuid=06fcfe08-1900-0000-b666-1d08c4130000 pid=5060 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=06fcfe08-1900-0000-b666-1d08c4130000 pid=5060 clone guuid=f4e43809-1900-0000-b666-1d08c5130000 pid=5061 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=f4e43809-1900-0000-b666-1d08c5130000 pid=5061 execve guuid=bf7bed09-1900-0000-b666-1d08c8130000 pid=5064 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=bf7bed09-1900-0000-b666-1d08c8130000 pid=5064 execve guuid=2f83590b-1900-0000-b666-1d08ce130000 pid=5070 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=2f83590b-1900-0000-b666-1d08ce130000 pid=5070 execve guuid=60229e34-1900-0000-b666-1d082c140000 pid=5164 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=60229e34-1900-0000-b666-1d082c140000 pid=5164 execve guuid=5415285f-1900-0000-b666-1d088f140000 pid=5263 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=5415285f-1900-0000-b666-1d088f140000 pid=5263 clone guuid=cbf9585f-1900-0000-b666-1d0890140000 pid=5264 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=cbf9585f-1900-0000-b666-1d0890140000 pid=5264 execve guuid=9b33e15f-1900-0000-b666-1d0893140000 pid=5267 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=9b33e15f-1900-0000-b666-1d0893140000 pid=5267 execve guuid=3cd24761-1900-0000-b666-1d0899140000 pid=5273 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=3cd24761-1900-0000-b666-1d0899140000 pid=5273 execve guuid=0b94d195-1900-0000-b666-1d08a6140000 pid=5286 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=0b94d195-1900-0000-b666-1d08a6140000 pid=5286 execve guuid=6505b9d5-1900-0000-b666-1d08a7140000 pid=5287 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=6505b9d5-1900-0000-b666-1d08a7140000 pid=5287 clone guuid=8390f5d5-1900-0000-b666-1d08a8140000 pid=5288 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=8390f5d5-1900-0000-b666-1d08a8140000 pid=5288 execve guuid=bcb8abd6-1900-0000-b666-1d08a9140000 pid=5289 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=bcb8abd6-1900-0000-b666-1d08a9140000 pid=5289 execve guuid=328e35d8-1900-0000-b666-1d08ad140000 pid=5293 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=328e35d8-1900-0000-b666-1d08ad140000 pid=5293 execve guuid=3c79530c-1a00-0000-b666-1d08ae140000 pid=5294 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=3c79530c-1a00-0000-b666-1d08ae140000 pid=5294 execve guuid=3e6e0b48-1a00-0000-b666-1d08b4140000 pid=5300 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=3e6e0b48-1a00-0000-b666-1d08b4140000 pid=5300 clone guuid=259d2848-1a00-0000-b666-1d08b5140000 pid=5301 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=259d2848-1a00-0000-b666-1d08b5140000 pid=5301 execve guuid=7a438c48-1a00-0000-b666-1d08b6140000 pid=5302 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=7a438c48-1a00-0000-b666-1d08b6140000 pid=5302 execve guuid=32187049-1a00-0000-b666-1d08ba140000 pid=5306 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=32187049-1a00-0000-b666-1d08ba140000 pid=5306 execve guuid=3c682883-1a00-0000-b666-1d08bd140000 pid=5309 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=3c682883-1a00-0000-b666-1d08bd140000 pid=5309 execve guuid=d33e87ca-1a00-0000-b666-1d08be140000 pid=5310 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=d33e87ca-1a00-0000-b666-1d08be140000 pid=5310 clone guuid=6a0f0bcd-1a00-0000-b666-1d08bf140000 pid=5311 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=6a0f0bcd-1a00-0000-b666-1d08bf140000 pid=5311 execve guuid=2cc387cd-1a00-0000-b666-1d08c0140000 pid=5312 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=2cc387cd-1a00-0000-b666-1d08c0140000 pid=5312 execve guuid=fea0adce-1a00-0000-b666-1d08c4140000 pid=5316 /usr/bin/wget net send-data guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=fea0adce-1a00-0000-b666-1d08c4140000 pid=5316 execve guuid=6b63f0ec-1a00-0000-b666-1d08c5140000 pid=5317 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=6b63f0ec-1a00-0000-b666-1d08c5140000 pid=5317 execve guuid=a13ee708-1b00-0000-b666-1d08c6140000 pid=5318 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=a13ee708-1b00-0000-b666-1d08c6140000 pid=5318 clone guuid=70ca2f09-1b00-0000-b666-1d08c7140000 pid=5319 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=70ca2f09-1b00-0000-b666-1d08c7140000 pid=5319 execve guuid=d233a909-1b00-0000-b666-1d08c8140000 pid=5320 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=d233a909-1b00-0000-b666-1d08c8140000 pid=5320 execve guuid=3288890a-1b00-0000-b666-1d08cc140000 pid=5324 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=3288890a-1b00-0000-b666-1d08cc140000 pid=5324 execve guuid=ceac384b-1b00-0000-b666-1d08da140000 pid=5338 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=ceac384b-1b00-0000-b666-1d08da140000 pid=5338 execve guuid=ae71a68c-1b00-0000-b666-1d08ee140000 pid=5358 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=ae71a68c-1b00-0000-b666-1d08ee140000 pid=5358 clone guuid=30b3f58c-1b00-0000-b666-1d08ef140000 pid=5359 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=30b3f58c-1b00-0000-b666-1d08ef140000 pid=5359 execve guuid=9fee8c8d-1b00-0000-b666-1d08f0140000 pid=5360 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=9fee8c8d-1b00-0000-b666-1d08f0140000 pid=5360 execve guuid=3c24f68e-1b00-0000-b666-1d08f4140000 pid=5364 /usr/bin/wget net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=3c24f68e-1b00-0000-b666-1d08f4140000 pid=5364 execve guuid=14a922d1-1b00-0000-b666-1d08f5140000 pid=5365 /usr/bin/curl net send-data write-file guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=14a922d1-1b00-0000-b666-1d08f5140000 pid=5365 execve guuid=b0d48a13-1c00-0000-b666-1d08f6140000 pid=5366 /usr/bin/bash guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=b0d48a13-1c00-0000-b666-1d08f6140000 pid=5366 clone guuid=5a2fc913-1c00-0000-b666-1d08f7140000 pid=5367 /usr/bin/chmod guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=5a2fc913-1c00-0000-b666-1d08f7140000 pid=5367 execve guuid=47236114-1c00-0000-b666-1d08f8140000 pid=5368 /tmp/WTF net guuid=632014c5-1500-0000-b666-1d08c80c0000 pid=3272->guuid=47236114-1c00-0000-b666-1d08f8140000 pid=5368 execve 017ae759-64ed-575c-af4d-3774b3807a6e 103.77.241.135:80 guuid=8ba7c9c9-1500-0000-b666-1d08d30c0000 pid=3283->017ae759-64ed-575c-af4d-3774b3807a6e send: 150B guuid=88734902-1600-0000-b666-1d08210d0000 pid=3361->017ae759-64ed-575c-af4d-3774b3807a6e send: 99B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=669ab53a-1600-0000-b666-1d088d0d0000 pid=3469->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3acabc3b-1600-0000-b666-1d08900d0000 pid=3472 /tmp/WTF guuid=669ab53a-1600-0000-b666-1d088d0d0000 pid=3469->guuid=3acabc3b-1600-0000-b666-1d08900d0000 pid=3472 clone guuid=93d1c83b-1600-0000-b666-1d08910d0000 pid=3473 /tmp/WTF guuid=669ab53a-1600-0000-b666-1d088d0d0000 pid=3469->guuid=93d1c83b-1600-0000-b666-1d08910d0000 pid=3473 clone guuid=412fce3b-1600-0000-b666-1d08920d0000 pid=3474 /tmp/WTF net send-data zombie guuid=669ab53a-1600-0000-b666-1d088d0d0000 pid=3469->guuid=412fce3b-1600-0000-b666-1d08920d0000 pid=3474 clone guuid=412fce3b-1600-0000-b666-1d08920d0000 pid=3474->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con d1133559-23b1-553f-bb9d-66b1e831d829 103.77.241.135:3778 guuid=412fce3b-1600-0000-b666-1d08920d0000 pid=3474->d1133559-23b1-553f-bb9d-66b1e831d829 send: 27B guuid=ffd0dc3b-1600-0000-b666-1d08930d0000 pid=3475->017ae759-64ed-575c-af4d-3774b3807a6e send: 151B guuid=a6882878-1600-0000-b666-1d08e50d0000 pid=3557->017ae759-64ed-575c-af4d-3774b3807a6e send: 100B guuid=599a83d5-1600-0000-b666-1d08750e0000 pid=3701->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c4ba76d6-1600-0000-b666-1d087c0e0000 pid=3708 /tmp/WTF guuid=599a83d5-1600-0000-b666-1d08750e0000 pid=3701->guuid=c4ba76d6-1600-0000-b666-1d087c0e0000 pid=3708 clone guuid=11397cd6-1600-0000-b666-1d087d0e0000 pid=3709 /tmp/WTF guuid=599a83d5-1600-0000-b666-1d08750e0000 pid=3701->guuid=11397cd6-1600-0000-b666-1d087d0e0000 pid=3709 clone guuid=162685d6-1600-0000-b666-1d087e0e0000 pid=3710 /tmp/WTF net send-data zombie guuid=599a83d5-1600-0000-b666-1d08750e0000 pid=3701->guuid=162685d6-1600-0000-b666-1d087e0e0000 pid=3710 clone guuid=162685d6-1600-0000-b666-1d087e0e0000 pid=3710->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=162685d6-1600-0000-b666-1d087e0e0000 pid=3710->d1133559-23b1-553f-bb9d-66b1e831d829 send: 12B guuid=138296d6-1600-0000-b666-1d087f0e0000 pid=3711->017ae759-64ed-575c-af4d-3774b3807a6e send: 150B guuid=14188723-1700-0000-b666-1d08320f0000 pid=3890->017ae759-64ed-575c-af4d-3774b3807a6e send: 99B guuid=dc2bc86f-1700-0000-b666-1d08fd0f0000 pid=4093->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=573ddd70-1700-0000-b666-1d0800100000 pid=4096 /tmp/WTF guuid=dc2bc86f-1700-0000-b666-1d08fd0f0000 pid=4093->guuid=573ddd70-1700-0000-b666-1d0800100000 pid=4096 clone guuid=2f28e470-1700-0000-b666-1d0801100000 pid=4097 /tmp/WTF guuid=dc2bc86f-1700-0000-b666-1d08fd0f0000 pid=4093->guuid=2f28e470-1700-0000-b666-1d0801100000 pid=4097 clone guuid=f96de970-1700-0000-b666-1d0802100000 pid=4098 /tmp/WTF net send-data zombie guuid=dc2bc86f-1700-0000-b666-1d08fd0f0000 pid=4093->guuid=f96de970-1700-0000-b666-1d0802100000 pid=4098 clone guuid=f96de970-1700-0000-b666-1d0802100000 pid=4098->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f96de970-1700-0000-b666-1d0802100000 pid=4098->d1133559-23b1-553f-bb9d-66b1e831d829 send: 12B guuid=7bdafa70-1700-0000-b666-1d0803100000 pid=4099->017ae759-64ed-575c-af4d-3774b3807a6e send: 151B guuid=0358748c-1700-0000-b666-1d0847100000 pid=4167->017ae759-64ed-575c-af4d-3774b3807a6e send: 100B guuid=43cc6fa9-1700-0000-b666-1d0894100000 pid=4244->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e5ce63aa-1700-0000-b666-1d0899100000 pid=4249 /tmp/WTF guuid=43cc6fa9-1700-0000-b666-1d0894100000 pid=4244->guuid=e5ce63aa-1700-0000-b666-1d0899100000 pid=4249 clone guuid=fb7f69aa-1700-0000-b666-1d089a100000 pid=4250 /tmp/WTF guuid=43cc6fa9-1700-0000-b666-1d0894100000 pid=4244->guuid=fb7f69aa-1700-0000-b666-1d089a100000 pid=4250 clone guuid=ee316eaa-1700-0000-b666-1d089b100000 pid=4251 /tmp/WTF net send-data zombie guuid=43cc6fa9-1700-0000-b666-1d0894100000 pid=4244->guuid=ee316eaa-1700-0000-b666-1d089b100000 pid=4251 clone guuid=ee316eaa-1700-0000-b666-1d089b100000 pid=4251->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ee316eaa-1700-0000-b666-1d089b100000 pid=4251->d1133559-23b1-553f-bb9d-66b1e831d829 send: 7B guuid=18a988aa-1700-0000-b666-1d089c100000 pid=4252->017ae759-64ed-575c-af4d-3774b3807a6e send: 151B guuid=186449c6-1700-0000-b666-1d08e4100000 pid=4324->017ae759-64ed-575c-af4d-3774b3807a6e send: 100B guuid=fccd8ce4-1700-0000-b666-1d083b110000 pid=4411->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a0a0b6e5-1700-0000-b666-1d0840110000 pid=4416 /tmp/WTF guuid=fccd8ce4-1700-0000-b666-1d083b110000 pid=4411->guuid=a0a0b6e5-1700-0000-b666-1d0840110000 pid=4416 clone guuid=e0c5bde5-1700-0000-b666-1d0841110000 pid=4417 /tmp/WTF guuid=fccd8ce4-1700-0000-b666-1d083b110000 pid=4411->guuid=e0c5bde5-1700-0000-b666-1d0841110000 pid=4417 clone guuid=1141c2e5-1700-0000-b666-1d0842110000 pid=4418 /tmp/WTF net send-data zombie guuid=fccd8ce4-1700-0000-b666-1d083b110000 pid=4411->guuid=1141c2e5-1700-0000-b666-1d0842110000 pid=4418 clone guuid=1141c2e5-1700-0000-b666-1d0842110000 pid=4418->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1141c2e5-1700-0000-b666-1d0842110000 pid=4418->d1133559-23b1-553f-bb9d-66b1e831d829 send: 12B guuid=8ec1d6e5-1700-0000-b666-1d0843110000 pid=4419->017ae759-64ed-575c-af4d-3774b3807a6e send: 153B guuid=9b54bb04-1800-0000-b666-1d089c110000 pid=4508->017ae759-64ed-575c-af4d-3774b3807a6e send: 102B guuid=d0f04022-1800-0000-b666-1d0811120000 pid=4625->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e45fe022-1800-0000-b666-1d0816120000 pid=4630 /tmp/WTF guuid=d0f04022-1800-0000-b666-1d0811120000 pid=4625->guuid=e45fe022-1800-0000-b666-1d0816120000 pid=4630 clone guuid=fc6fe522-1800-0000-b666-1d0817120000 pid=4631 /tmp/WTF guuid=d0f04022-1800-0000-b666-1d0811120000 pid=4625->guuid=fc6fe522-1800-0000-b666-1d0817120000 pid=4631 clone guuid=2e17e922-1800-0000-b666-1d0818120000 pid=4632 /tmp/WTF net send-data zombie guuid=d0f04022-1800-0000-b666-1d0811120000 pid=4625->guuid=2e17e922-1800-0000-b666-1d0818120000 pid=4632 clone guuid=2e17e922-1800-0000-b666-1d0818120000 pid=4632->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=2e17e922-1800-0000-b666-1d0818120000 pid=4632->d1133559-23b1-553f-bb9d-66b1e831d829 send: 12B guuid=087ef822-1800-0000-b666-1d0819120000 pid=4633->017ae759-64ed-575c-af4d-3774b3807a6e send: 151B guuid=ca3c3c57-1800-0000-b666-1d0896120000 pid=4758->017ae759-64ed-575c-af4d-3774b3807a6e send: 100B guuid=dce72e90-1800-0000-b666-1d080f130000 pid=4879->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=09b25091-1800-0000-b666-1d0813130000 pid=4883 /tmp/WTF guuid=dce72e90-1800-0000-b666-1d080f130000 pid=4879->guuid=09b25091-1800-0000-b666-1d0813130000 pid=4883 clone guuid=eef65f91-1800-0000-b666-1d0814130000 pid=4884 /tmp/WTF guuid=dce72e90-1800-0000-b666-1d080f130000 pid=4879->guuid=eef65f91-1800-0000-b666-1d0814130000 pid=4884 clone guuid=5de76b91-1800-0000-b666-1d0815130000 pid=4885 /tmp/WTF net send-data zombie guuid=dce72e90-1800-0000-b666-1d080f130000 pid=4879->guuid=5de76b91-1800-0000-b666-1d0815130000 pid=4885 clone guuid=5de76b91-1800-0000-b666-1d0815130000 pid=4885->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5de76b91-1800-0000-b666-1d0815130000 pid=4885->d1133559-23b1-553f-bb9d-66b1e831d829 send: 7B guuid=9f1c8c91-1800-0000-b666-1d0816130000 pid=4886->017ae759-64ed-575c-af4d-3774b3807a6e send: 150B guuid=abffdac6-1800-0000-b666-1d088a130000 pid=5002->017ae759-64ed-575c-af4d-3774b3807a6e send: 99B guuid=bf7bed09-1900-0000-b666-1d08c8130000 pid=5064->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=b1cb390b-1900-0000-b666-1d08cb130000 pid=5067 /tmp/WTF guuid=bf7bed09-1900-0000-b666-1d08c8130000 pid=5064->guuid=b1cb390b-1900-0000-b666-1d08cb130000 pid=5067 clone guuid=33a93f0b-1900-0000-b666-1d08cc130000 pid=5068 /tmp/WTF guuid=bf7bed09-1900-0000-b666-1d08c8130000 pid=5064->guuid=33a93f0b-1900-0000-b666-1d08cc130000 pid=5068 clone guuid=5c7a450b-1900-0000-b666-1d08cd130000 pid=5069 /tmp/WTF net send-data zombie guuid=bf7bed09-1900-0000-b666-1d08c8130000 pid=5064->guuid=5c7a450b-1900-0000-b666-1d08cd130000 pid=5069 clone guuid=5c7a450b-1900-0000-b666-1d08cd130000 pid=5069->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5c7a450b-1900-0000-b666-1d08cd130000 pid=5069->d1133559-23b1-553f-bb9d-66b1e831d829 send: 12B guuid=2f83590b-1900-0000-b666-1d08ce130000 pid=5070->017ae759-64ed-575c-af4d-3774b3807a6e send: 151B guuid=60229e34-1900-0000-b666-1d082c140000 pid=5164->017ae759-64ed-575c-af4d-3774b3807a6e send: 100B guuid=9b33e15f-1900-0000-b666-1d0893140000 pid=5267->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a7831d61-1900-0000-b666-1d0896140000 pid=5270 /tmp/WTF guuid=9b33e15f-1900-0000-b666-1d0893140000 pid=5267->guuid=a7831d61-1900-0000-b666-1d0896140000 pid=5270 clone guuid=4de92461-1900-0000-b666-1d0897140000 pid=5271 /tmp/WTF guuid=9b33e15f-1900-0000-b666-1d0893140000 pid=5267->guuid=4de92461-1900-0000-b666-1d0897140000 pid=5271 clone guuid=93af3661-1900-0000-b666-1d0898140000 pid=5272 /tmp/WTF net send-data zombie guuid=9b33e15f-1900-0000-b666-1d0893140000 pid=5267->guuid=93af3661-1900-0000-b666-1d0898140000 pid=5272 clone guuid=93af3661-1900-0000-b666-1d0898140000 pid=5272->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=93af3661-1900-0000-b666-1d0898140000 pid=5272->d1133559-23b1-553f-bb9d-66b1e831d829 send: 12B guuid=3cd24761-1900-0000-b666-1d0899140000 pid=5273->017ae759-64ed-575c-af4d-3774b3807a6e send: 151B guuid=0b94d195-1900-0000-b666-1d08a6140000 pid=5286->017ae759-64ed-575c-af4d-3774b3807a6e send: 100B guuid=bcb8abd6-1900-0000-b666-1d08a9140000 pid=5289->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=055211d8-1900-0000-b666-1d08aa140000 pid=5290 /tmp/WTF guuid=bcb8abd6-1900-0000-b666-1d08a9140000 pid=5289->guuid=055211d8-1900-0000-b666-1d08aa140000 pid=5290 clone guuid=0de919d8-1900-0000-b666-1d08ab140000 pid=5291 /tmp/WTF guuid=bcb8abd6-1900-0000-b666-1d08a9140000 pid=5289->guuid=0de919d8-1900-0000-b666-1d08ab140000 pid=5291 clone guuid=6f2a26d8-1900-0000-b666-1d08ac140000 pid=5292 /tmp/WTF net send-data zombie guuid=bcb8abd6-1900-0000-b666-1d08a9140000 pid=5289->guuid=6f2a26d8-1900-0000-b666-1d08ac140000 pid=5292 clone guuid=6f2a26d8-1900-0000-b666-1d08ac140000 pid=5292->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6f2a26d8-1900-0000-b666-1d08ac140000 pid=5292->d1133559-23b1-553f-bb9d-66b1e831d829 send: 7B guuid=328e35d8-1900-0000-b666-1d08ad140000 pid=5293->017ae759-64ed-575c-af4d-3774b3807a6e send: 151B guuid=3c79530c-1a00-0000-b666-1d08ae140000 pid=5294->017ae759-64ed-575c-af4d-3774b3807a6e send: 100B guuid=7a438c48-1a00-0000-b666-1d08b6140000 pid=5302->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c06d5249-1a00-0000-b666-1d08b7140000 pid=5303 /tmp/WTF guuid=7a438c48-1a00-0000-b666-1d08b6140000 pid=5302->guuid=c06d5249-1a00-0000-b666-1d08b7140000 pid=5303 clone guuid=5d705949-1a00-0000-b666-1d08b8140000 pid=5304 /tmp/WTF guuid=7a438c48-1a00-0000-b666-1d08b6140000 pid=5302->guuid=5d705949-1a00-0000-b666-1d08b8140000 pid=5304 clone guuid=68356149-1a00-0000-b666-1d08b9140000 pid=5305 /tmp/WTF net send-data zombie guuid=7a438c48-1a00-0000-b666-1d08b6140000 pid=5302->guuid=68356149-1a00-0000-b666-1d08b9140000 pid=5305 clone guuid=68356149-1a00-0000-b666-1d08b9140000 pid=5305->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=68356149-1a00-0000-b666-1d08b9140000 pid=5305->d1133559-23b1-553f-bb9d-66b1e831d829 send: 7B guuid=32187049-1a00-0000-b666-1d08ba140000 pid=5306->017ae759-64ed-575c-af4d-3774b3807a6e send: 150B guuid=3c682883-1a00-0000-b666-1d08bd140000 pid=5309->017ae759-64ed-575c-af4d-3774b3807a6e send: 99B guuid=2cc387cd-1a00-0000-b666-1d08c0140000 pid=5312->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=884e8bce-1a00-0000-b666-1d08c1140000 pid=5313 /tmp/WTF guuid=2cc387cd-1a00-0000-b666-1d08c0140000 pid=5312->guuid=884e8bce-1a00-0000-b666-1d08c1140000 pid=5313 clone guuid=7e1f95ce-1a00-0000-b666-1d08c2140000 pid=5314 /tmp/WTF guuid=2cc387cd-1a00-0000-b666-1d08c0140000 pid=5312->guuid=7e1f95ce-1a00-0000-b666-1d08c2140000 pid=5314 clone guuid=becb9ace-1a00-0000-b666-1d08c3140000 pid=5315 /tmp/WTF net send-data zombie guuid=2cc387cd-1a00-0000-b666-1d08c0140000 pid=5312->guuid=becb9ace-1a00-0000-b666-1d08c3140000 pid=5315 clone guuid=becb9ace-1a00-0000-b666-1d08c3140000 pid=5315->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=becb9ace-1a00-0000-b666-1d08c3140000 pid=5315->d1133559-23b1-553f-bb9d-66b1e831d829 send: 7B guuid=fea0adce-1a00-0000-b666-1d08c4140000 pid=5316->017ae759-64ed-575c-af4d-3774b3807a6e send: 150B guuid=6b63f0ec-1a00-0000-b666-1d08c5140000 pid=5317->017ae759-64ed-575c-af4d-3774b3807a6e send: 99B guuid=d233a909-1b00-0000-b666-1d08c8140000 pid=5320->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f503340a-1b00-0000-b666-1d08c9140000 pid=5321 /tmp/WTF guuid=d233a909-1b00-0000-b666-1d08c8140000 pid=5320->guuid=f503340a-1b00-0000-b666-1d08c9140000 pid=5321 clone guuid=d5b7380a-1b00-0000-b666-1d08ca140000 pid=5322 /tmp/WTF guuid=d233a909-1b00-0000-b666-1d08c8140000 pid=5320->guuid=d5b7380a-1b00-0000-b666-1d08ca140000 pid=5322 clone guuid=f5c83b0a-1b00-0000-b666-1d08cb140000 pid=5323 /tmp/WTF net send-data zombie guuid=d233a909-1b00-0000-b666-1d08c8140000 pid=5320->guuid=f5c83b0a-1b00-0000-b666-1d08cb140000 pid=5323 clone guuid=f5c83b0a-1b00-0000-b666-1d08cb140000 pid=5323->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f5c83b0a-1b00-0000-b666-1d08cb140000 pid=5323->d1133559-23b1-553f-bb9d-66b1e831d829 send: 12B guuid=3288890a-1b00-0000-b666-1d08cc140000 pid=5324->017ae759-64ed-575c-af4d-3774b3807a6e send: 151B guuid=ceac384b-1b00-0000-b666-1d08da140000 pid=5338->017ae759-64ed-575c-af4d-3774b3807a6e send: 100B guuid=9fee8c8d-1b00-0000-b666-1d08f0140000 pid=5360->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=020bc48e-1b00-0000-b666-1d08f1140000 pid=5361 /tmp/WTF guuid=9fee8c8d-1b00-0000-b666-1d08f0140000 pid=5360->guuid=020bc48e-1b00-0000-b666-1d08f1140000 pid=5361 clone guuid=a93dce8e-1b00-0000-b666-1d08f2140000 pid=5362 /tmp/WTF guuid=9fee8c8d-1b00-0000-b666-1d08f0140000 pid=5360->guuid=a93dce8e-1b00-0000-b666-1d08f2140000 pid=5362 clone guuid=81c8dd8e-1b00-0000-b666-1d08f3140000 pid=5363 /tmp/WTF net send-data zombie guuid=9fee8c8d-1b00-0000-b666-1d08f0140000 pid=5360->guuid=81c8dd8e-1b00-0000-b666-1d08f3140000 pid=5363 clone guuid=81c8dd8e-1b00-0000-b666-1d08f3140000 pid=5363->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=81c8dd8e-1b00-0000-b666-1d08f3140000 pid=5363->d1133559-23b1-553f-bb9d-66b1e831d829 send: 7B guuid=3c24f68e-1b00-0000-b666-1d08f4140000 pid=5364->017ae759-64ed-575c-af4d-3774b3807a6e send: 150B guuid=14a922d1-1b00-0000-b666-1d08f5140000 pid=5365->017ae759-64ed-575c-af4d-3774b3807a6e send: 99B guuid=47236114-1c00-0000-b666-1d08f8140000 pid=5368->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1d8f9715-1c00-0000-b666-1d08f9140000 pid=5369 /tmp/WTF guuid=47236114-1c00-0000-b666-1d08f8140000 pid=5368->guuid=1d8f9715-1c00-0000-b666-1d08f9140000 pid=5369 clone guuid=de9fa115-1c00-0000-b666-1d08fa140000 pid=5370 /tmp/WTF guuid=47236114-1c00-0000-b666-1d08f8140000 pid=5368->guuid=de9fa115-1c00-0000-b666-1d08fa140000 pid=5370 clone guuid=31e6ac15-1c00-0000-b666-1d08fb140000 pid=5371 /tmp/WTF net send-data zombie guuid=47236114-1c00-0000-b666-1d08f8140000 pid=5368->guuid=31e6ac15-1c00-0000-b666-1d08fb140000 pid=5371 clone guuid=31e6ac15-1c00-0000-b666-1d08fb140000 pid=5371->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=31e6ac15-1c00-0000-b666-1d08fb140000 pid=5371->d1133559-23b1-553f-bb9d-66b1e831d829 send: 12B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/925d0e32511e0d952206421262363033ea8332b4443b7ea35ba5e20d8e1fc4cd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/925d0e32511e0d952206421262363033ea8332b4443b7ea35ba5e20d8e1fc4cd/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-12-12 12:25:06 UTC
AV detection:
23 of 37 (62.16%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sjoq4msrdygzkiqgiijgenrqgpvigmvuiq5x5i23uxra3dq7ytgq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251212-nzrgracn2x/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/925d0e32511e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/925d0e32511e0d952206421262363033ea8332b4443b7ea35ba5e20d8e1fc4cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 925d0e32511e0d952206421262363033ea8332b4443b7ea35ba5e20d8e1fc4cd

(this sample)

Mirai

elf db4e828af42c4a0e0f567a58ee4f0853d253637ae7d2e7cf4680aaee435b4a7d

Mirai

elf 8b97a460bb5c6cad1e98fffeeac6c411d249d38f8ecd9e806c202436951dc4f7

  
URLhaus
https://urlhaus.abuse.ch/url/3727052/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3725189/
  
Dropping
MD5 d180a1b5e59b425c744c6e3c6ee80270
  
Dropping
SHA256 8b97a460bb5c6cad1e98fffeeac6c411d249d38f8ecd9e806c202436951dc4f7

Comments