🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 966b6f65a307b32ea80724fee179fd09343d20a7d95458ff502812da5f5ec6d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 966b6f65a307b32ea80724fee179fd09343d20a7d95458ff502812da5f5ec6d3
SHA3-384 hash: 3503fff4d7d3409b0cf5ec7f148cb3d74c435299c7927a4cfc000b943c74663fdfafea334093ed6f2bcb1146a3e53272
SHA1 hash: 04845d3b6397a8b7749843bdc30f7ab72ab5c34d
MD5 hash: a13e62d91f309d1bb9e72882997a3681
humanhash: solar-bluebird-one-one
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-22 08:51:34 UTC
Last seen:2026-08-23 01:57:43 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:5UXQY4HCfmKADDW5UpCuHuLnTXR2plboH:5UXQY4HgmKADDWS1OLnTh7
TLSH T1CA3181DA54005E712102CE8E7BB3315CB68EE5FB394FC3D4990D0EA9828C68CF265B9C
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/a1a0dan/an/aua-wget
http://5.182.210.174/c4878fn/an/aua-wget
http://5.182.210.174/1f4418n/an/aua-wget
http://5.182.210.174/564fd4n/an/aua-wget
http://5.182.210.174/45d4efn/an/aua-wget
http://5.182.210.174/bd742dn/an/aua-wget
http://5.182.210.174/810904n/an/aua-wget
http://5.182.210.174/a10960n/an/aua-wget
http://5.182.210.174/75fa66n/an/aua-wget
http://5.182.210.174/d70921n/an/aua-wget
http://5.182.210.174/d67e2en/an/aua-wget
http://5.182.210.174/21eb07n/an/aua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a89633a669c791cd9683b36/reports/696f07c3-1fb6-48c1-9feb-6ebf66fb5fb6/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/12a313eb-1284-4d8f-bb22-a70404576c45
Behavior Graph:
Download SVG
%3 guuid=03cf2c9a-1900-0000-1724-4049520e0000 pid=3666 /usr/bin/sudo guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677 /tmp/sample.bin guuid=03cf2c9a-1900-0000-1724-4049520e0000 pid=3666->guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677 execve guuid=80f1149e-1900-0000-1724-4049610e0000 pid=3681 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=80f1149e-1900-0000-1724-4049610e0000 pid=3681 execve guuid=d56b01a6-1900-0000-1724-4049720e0000 pid=3698 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=d56b01a6-1900-0000-1724-4049720e0000 pid=3698 execve guuid=e2ab16b2-1900-0000-1724-40497f0e0000 pid=3711 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=e2ab16b2-1900-0000-1724-40497f0e0000 pid=3711 execve guuid=2c2682b2-1900-0000-1724-4049800e0000 pid=3712 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=2c2682b2-1900-0000-1724-4049800e0000 pid=3712 clone guuid=8840c6b2-1900-0000-1724-4049830e0000 pid=3715 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=8840c6b2-1900-0000-1724-4049830e0000 pid=3715 execve guuid=3c0e14b3-1900-0000-1724-4049850e0000 pid=3717 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=3c0e14b3-1900-0000-1724-4049850e0000 pid=3717 execve guuid=dfc558b3-1900-0000-1724-4049870e0000 pid=3719 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=dfc558b3-1900-0000-1724-4049870e0000 pid=3719 execve guuid=9fce3bb6-1900-0000-1724-4049940e0000 pid=3732 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=9fce3bb6-1900-0000-1724-4049940e0000 pid=3732 execve guuid=9ecce3ba-1900-0000-1724-4049a40e0000 pid=3748 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=9ecce3ba-1900-0000-1724-4049a40e0000 pid=3748 execve guuid=124827bb-1900-0000-1724-4049a60e0000 pid=3750 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=124827bb-1900-0000-1724-4049a60e0000 pid=3750 clone guuid=8b6657bb-1900-0000-1724-4049a80e0000 pid=3752 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=8b6657bb-1900-0000-1724-4049a80e0000 pid=3752 execve guuid=29679fbb-1900-0000-1724-4049aa0e0000 pid=3754 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=29679fbb-1900-0000-1724-4049aa0e0000 pid=3754 execve guuid=2ea1e1bb-1900-0000-1724-4049ac0e0000 pid=3756 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=2ea1e1bb-1900-0000-1724-4049ac0e0000 pid=3756 execve guuid=13b363bf-1900-0000-1724-4049b50e0000 pid=3765 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=13b363bf-1900-0000-1724-4049b50e0000 pid=3765 execve guuid=ceeae9c6-1900-0000-1724-4049cf0e0000 pid=3791 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=ceeae9c6-1900-0000-1724-4049cf0e0000 pid=3791 execve guuid=fd1526c7-1900-0000-1724-4049d20e0000 pid=3794 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=fd1526c7-1900-0000-1724-4049d20e0000 pid=3794 clone guuid=68bd77c7-1900-0000-1724-4049d40e0000 pid=3796 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=68bd77c7-1900-0000-1724-4049d40e0000 pid=3796 execve guuid=c9a3c5c7-1900-0000-1724-4049d60e0000 pid=3798 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=c9a3c5c7-1900-0000-1724-4049d60e0000 pid=3798 execve guuid=f39f10c8-1900-0000-1724-4049d80e0000 pid=3800 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=f39f10c8-1900-0000-1724-4049d80e0000 pid=3800 execve guuid=ee1734cb-1900-0000-1724-4049df0e0000 pid=3807 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=ee1734cb-1900-0000-1724-4049df0e0000 pid=3807 execve guuid=166054d1-1900-0000-1724-4049f20e0000 pid=3826 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=166054d1-1900-0000-1724-4049f20e0000 pid=3826 execve guuid=d42192d1-1900-0000-1724-4049f60e0000 pid=3830 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=d42192d1-1900-0000-1724-4049f60e0000 pid=3830 clone guuid=b945e8d1-1900-0000-1724-4049f80e0000 pid=3832 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=b945e8d1-1900-0000-1724-4049f80e0000 pid=3832 execve guuid=307a2fd2-1900-0000-1724-4049fa0e0000 pid=3834 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=307a2fd2-1900-0000-1724-4049fa0e0000 pid=3834 execve guuid=913e92d2-1900-0000-1724-4049fc0e0000 pid=3836 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=913e92d2-1900-0000-1724-4049fc0e0000 pid=3836 execve guuid=dc0d45d5-1900-0000-1724-4049090f0000 pid=3849 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=dc0d45d5-1900-0000-1724-4049090f0000 pid=3849 execve guuid=864c6cda-1900-0000-1724-4049120f0000 pid=3858 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=864c6cda-1900-0000-1724-4049120f0000 pid=3858 execve guuid=938b55db-1900-0000-1724-4049160f0000 pid=3862 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=938b55db-1900-0000-1724-4049160f0000 pid=3862 clone guuid=d8900fdc-1900-0000-1724-40491a0f0000 pid=3866 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=d8900fdc-1900-0000-1724-40491a0f0000 pid=3866 execve guuid=42cb83dc-1900-0000-1724-40491c0f0000 pid=3868 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=42cb83dc-1900-0000-1724-40491c0f0000 pid=3868 execve guuid=3ca8efdc-1900-0000-1724-40491d0f0000 pid=3869 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=3ca8efdc-1900-0000-1724-40491d0f0000 pid=3869 execve guuid=42f2fbe0-1900-0000-1724-4049270f0000 pid=3879 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=42f2fbe0-1900-0000-1724-4049270f0000 pid=3879 execve guuid=362d60e6-1900-0000-1724-4049360f0000 pid=3894 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=362d60e6-1900-0000-1724-4049360f0000 pid=3894 execve guuid=688dd6e6-1900-0000-1724-4049380f0000 pid=3896 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=688dd6e6-1900-0000-1724-4049380f0000 pid=3896 clone guuid=d9c22de7-1900-0000-1724-40493b0f0000 pid=3899 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=d9c22de7-1900-0000-1724-40493b0f0000 pid=3899 execve guuid=d9c4a4e7-1900-0000-1724-40493d0f0000 pid=3901 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=d9c4a4e7-1900-0000-1724-40493d0f0000 pid=3901 execve guuid=ad9c14e8-1900-0000-1724-40493f0f0000 pid=3903 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=ad9c14e8-1900-0000-1724-40493f0f0000 pid=3903 execve guuid=9f1351eb-1900-0000-1724-40494a0f0000 pid=3914 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=9f1351eb-1900-0000-1724-40494a0f0000 pid=3914 execve guuid=605bd6f0-1900-0000-1724-40495b0f0000 pid=3931 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=605bd6f0-1900-0000-1724-40495b0f0000 pid=3931 execve guuid=de5041f1-1900-0000-1724-40495f0f0000 pid=3935 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=de5041f1-1900-0000-1724-40495f0f0000 pid=3935 clone guuid=59078bf1-1900-0000-1724-4049610f0000 pid=3937 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=59078bf1-1900-0000-1724-4049610f0000 pid=3937 execve guuid=d5f1e2f1-1900-0000-1724-4049630f0000 pid=3939 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=d5f1e2f1-1900-0000-1724-4049630f0000 pid=3939 execve guuid=ea2644f2-1900-0000-1724-4049650f0000 pid=3941 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=ea2644f2-1900-0000-1724-4049650f0000 pid=3941 execve guuid=7d18f6f4-1900-0000-1724-4049720f0000 pid=3954 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=7d18f6f4-1900-0000-1724-4049720f0000 pid=3954 execve guuid=c83e8df8-1900-0000-1724-4049800f0000 pid=3968 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=c83e8df8-1900-0000-1724-4049800f0000 pid=3968 execve guuid=e314ebf8-1900-0000-1724-4049810f0000 pid=3969 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=e314ebf8-1900-0000-1724-4049810f0000 pid=3969 clone guuid=934336f9-1900-0000-1724-4049840f0000 pid=3972 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=934336f9-1900-0000-1724-4049840f0000 pid=3972 execve guuid=90bb90f9-1900-0000-1724-4049860f0000 pid=3974 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=90bb90f9-1900-0000-1724-4049860f0000 pid=3974 execve guuid=b70ae3f9-1900-0000-1724-4049880f0000 pid=3976 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=b70ae3f9-1900-0000-1724-4049880f0000 pid=3976 execve guuid=9f9d03fd-1900-0000-1724-4049920f0000 pid=3986 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=9f9d03fd-1900-0000-1724-4049920f0000 pid=3986 execve guuid=08acf901-1a00-0000-1724-40499e0f0000 pid=3998 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=08acf901-1a00-0000-1724-40499e0f0000 pid=3998 execve guuid=fe394602-1a00-0000-1724-40499f0f0000 pid=3999 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=fe394602-1a00-0000-1724-40499f0f0000 pid=3999 clone guuid=a8b08b02-1a00-0000-1724-4049a20f0000 pid=4002 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=a8b08b02-1a00-0000-1724-4049a20f0000 pid=4002 execve guuid=ce9b5403-1a00-0000-1724-4049a30f0000 pid=4003 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=ce9b5403-1a00-0000-1724-4049a30f0000 pid=4003 execve guuid=ab4ef203-1a00-0000-1724-4049a40f0000 pid=4004 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=ab4ef203-1a00-0000-1724-4049a40f0000 pid=4004 execve guuid=606d9a07-1a00-0000-1724-4049a80f0000 pid=4008 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=606d9a07-1a00-0000-1724-4049a80f0000 pid=4008 execve guuid=8092f90a-1a00-0000-1724-4049b70f0000 pid=4023 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=8092f90a-1a00-0000-1724-4049b70f0000 pid=4023 execve guuid=4b87360b-1a00-0000-1724-4049bb0f0000 pid=4027 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=4b87360b-1a00-0000-1724-4049bb0f0000 pid=4027 clone guuid=879e6e0b-1a00-0000-1724-4049be0f0000 pid=4030 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=879e6e0b-1a00-0000-1724-4049be0f0000 pid=4030 execve guuid=6eb7b10b-1a00-0000-1724-4049c10f0000 pid=4033 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=6eb7b10b-1a00-0000-1724-4049c10f0000 pid=4033 execve guuid=998ffa0b-1a00-0000-1724-4049c30f0000 pid=4035 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=998ffa0b-1a00-0000-1724-4049c30f0000 pid=4035 execve guuid=22536f0e-1a00-0000-1724-4049ce0f0000 pid=4046 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=22536f0e-1a00-0000-1724-4049ce0f0000 pid=4046 execve guuid=e4c02312-1a00-0000-1724-4049e00f0000 pid=4064 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=e4c02312-1a00-0000-1724-4049e00f0000 pid=4064 execve guuid=86c5b912-1a00-0000-1724-4049e30f0000 pid=4067 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=86c5b912-1a00-0000-1724-4049e30f0000 pid=4067 clone guuid=d61b1813-1a00-0000-1724-4049e80f0000 pid=4072 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=d61b1813-1a00-0000-1724-4049e80f0000 pid=4072 execve guuid=f8299713-1a00-0000-1724-4049ed0f0000 pid=4077 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=f8299713-1a00-0000-1724-4049ed0f0000 pid=4077 execve guuid=aa71fd13-1a00-0000-1724-4049f20f0000 pid=4082 /usr/bin/wget net send-data guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=aa71fd13-1a00-0000-1724-4049f20f0000 pid=4082 execve guuid=4653fb16-1a00-0000-1724-404902100000 pid=4098 /usr/bin/curl net send-data write-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=4653fb16-1a00-0000-1724-404902100000 pid=4098 execve guuid=6cf9801c-1a00-0000-1724-404912100000 pid=4114 /usr/bin/chmod guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=6cf9801c-1a00-0000-1724-404912100000 pid=4114 execve guuid=93badb1c-1a00-0000-1724-404913100000 pid=4115 /usr/bin/bash guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=93badb1c-1a00-0000-1724-404913100000 pid=4115 clone guuid=88b3251d-1a00-0000-1724-404915100000 pid=4117 /usr/bin/rm delete-file guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=88b3251d-1a00-0000-1724-404915100000 pid=4117 execve guuid=94b4881d-1a00-0000-1724-404916100000 pid=4118 /usr/bin/rm guuid=334e689d-1900-0000-1724-40495d0e0000 pid=3677->guuid=94b4881d-1a00-0000-1724-404916100000 pid=4118 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=80f1149e-1900-0000-1724-4049610e0000 pid=3681->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d56b01a6-1900-0000-1724-4049720e0000 pid=3698->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a7149bb2-1900-0000-1724-4049810e0000 pid=3713 /usr/bin/bash guuid=2c2682b2-1900-0000-1724-4049800e0000 pid=3712->guuid=a7149bb2-1900-0000-1724-4049810e0000 pid=3713 clone guuid=dfc558b3-1900-0000-1724-4049870e0000 pid=3719->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9fce3bb6-1900-0000-1724-4049940e0000 pid=3732->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=83603bbb-1900-0000-1724-4049a70e0000 pid=3751 /usr/bin/bash guuid=124827bb-1900-0000-1724-4049a60e0000 pid=3750->guuid=83603bbb-1900-0000-1724-4049a70e0000 pid=3751 clone guuid=2ea1e1bb-1900-0000-1724-4049ac0e0000 pid=3756->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=13b363bf-1900-0000-1724-4049b50e0000 pid=3765->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d06849c7-1900-0000-1724-4049d30e0000 pid=3795 /usr/bin/bash guuid=fd1526c7-1900-0000-1724-4049d20e0000 pid=3794->guuid=d06849c7-1900-0000-1724-4049d30e0000 pid=3795 clone guuid=f39f10c8-1900-0000-1724-4049d80e0000 pid=3800->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ee1734cb-1900-0000-1724-4049df0e0000 pid=3807->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d036a7d1-1900-0000-1724-4049f70e0000 pid=3831 /usr/bin/bash guuid=d42192d1-1900-0000-1724-4049f60e0000 pid=3830->guuid=d036a7d1-1900-0000-1724-4049f70e0000 pid=3831 clone guuid=913e92d2-1900-0000-1724-4049fc0e0000 pid=3836->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=dc0d45d5-1900-0000-1724-4049090f0000 pid=3849->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=917ea2db-1900-0000-1724-4049180f0000 pid=3864 /usr/bin/bash guuid=938b55db-1900-0000-1724-4049160f0000 pid=3862->guuid=917ea2db-1900-0000-1724-4049180f0000 pid=3864 clone guuid=3ca8efdc-1900-0000-1724-40491d0f0000 pid=3869->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=42f2fbe0-1900-0000-1724-4049270f0000 pid=3879->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=82b4fce6-1900-0000-1724-4049390f0000 pid=3897 /usr/bin/bash guuid=688dd6e6-1900-0000-1724-4049380f0000 pid=3896->guuid=82b4fce6-1900-0000-1724-4049390f0000 pid=3897 clone guuid=ad9c14e8-1900-0000-1724-40493f0f0000 pid=3903->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9f1351eb-1900-0000-1724-40494a0f0000 pid=3914->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d3eb60f1-1900-0000-1724-4049600f0000 pid=3936 /usr/bin/bash guuid=de5041f1-1900-0000-1724-40495f0f0000 pid=3935->guuid=d3eb60f1-1900-0000-1724-4049600f0000 pid=3936 clone guuid=ea2644f2-1900-0000-1724-4049650f0000 pid=3941->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7d18f6f4-1900-0000-1724-4049720f0000 pid=3954->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1a9013f9-1900-0000-1724-4049830f0000 pid=3971 /usr/bin/bash guuid=e314ebf8-1900-0000-1724-4049810f0000 pid=3969->guuid=1a9013f9-1900-0000-1724-4049830f0000 pid=3971 clone guuid=b70ae3f9-1900-0000-1724-4049880f0000 pid=3976->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9f9d03fd-1900-0000-1724-4049920f0000 pid=3986->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d7446b02-1a00-0000-1724-4049a10f0000 pid=4001 /usr/bin/bash guuid=fe394602-1a00-0000-1724-40499f0f0000 pid=3999->guuid=d7446b02-1a00-0000-1724-4049a10f0000 pid=4001 clone guuid=ab4ef203-1a00-0000-1724-4049a40f0000 pid=4004->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=606d9a07-1a00-0000-1724-4049a80f0000 pid=4008->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bf2f4c0b-1a00-0000-1724-4049bc0f0000 pid=4028 /usr/bin/bash guuid=4b87360b-1a00-0000-1724-4049bb0f0000 pid=4027->guuid=bf2f4c0b-1a00-0000-1724-4049bc0f0000 pid=4028 clone guuid=998ffa0b-1a00-0000-1724-4049c30f0000 pid=4035->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=22536f0e-1a00-0000-1724-4049ce0f0000 pid=4046->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1074e612-1a00-0000-1724-4049e70f0000 pid=4071 /usr/bin/bash guuid=86c5b912-1a00-0000-1724-4049e30f0000 pid=4067->guuid=1074e612-1a00-0000-1724-4049e70f0000 pid=4071 clone guuid=aa71fd13-1a00-0000-1724-4049f20f0000 pid=4082->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4653fb16-1a00-0000-1724-404902100000 pid=4098->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=58e8f81c-1a00-0000-1724-404914100000 pid=4116 /usr/bin/bash guuid=93badb1c-1a00-0000-1724-404913100000 pid=4115->guuid=58e8f81c-1a00-0000-1724-404914100000 pid=4116 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/966b6f65a307b32ea80724fee179fd09343d20a7d95458ff502812da5f5ec6d3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/966b6f65a307b32ea80724fee179fd09343d20a7d95458ff502812da5f5ec6d3/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-22 08:52:18 UTC
File Type:
Text (Shell)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=szvw6znda6zs5kahet7oc6p5be2d2ifh3fkfr72qfajnux26y3jq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260822-kstfzsfq7s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/966b6f65a307b32ea80724fee179fd09343d20a7d95458ff502812da5f5ec6d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 966b6f65a307b32ea80724fee179fd09343d20a7d95458ff502812da5f5ec6d3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments