🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3
SHA3-384 hash: afedba6407c1ef4727e9a6b976046968b347b57b2d9c2b8b85c1c10030a81bb1e5f2df3908b0d43704ec0c3c1b2e8979
SHA1 hash: 1136888aa04a212880e89568a95c7c6fd080dbb1
MD5 hash: e5ba60cd5bff5a07d63cba7aa5a6e894
humanhash: six-zulu-low-lemon
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'584 bytes
First seen:2026-06-22 21:25:05 UTC
Last seen:2026-06-23 10:11:28 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Us56s77dNlqL6lqxoMO0V6/wWEm6Euy2lhg6h3SreGNai6NaP8GcATWNy6NqvVHo:dVXd7lgWz2lHD6Uj0AJU5cS5Z1q5Ys
TLSH T1A631A6DF41059E3E1213CDEE73A73548B10D85EB584BCBA0CD5C5DAA9A881ECB262BC5
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/25ad59n/an/aelf ua-wget
http://5.182.210.61/b1b7f2n/an/aelf ua-wget
http://5.182.210.61/ab5a00n/an/aelf ua-wget
http://5.182.210.61/ee85c3n/an/aelf ua-wget
http://5.182.210.61/8b48e3n/an/aelf ua-wget
http://5.182.210.61/d61626n/an/aelf ua-wget
http://5.182.210.61/dcd1bdn/an/aelf ua-wget
http://5.182.210.61/4a013dn/an/aelf ua-wget
http://5.182.210.61/f9935en/an/aelf ua-wget
http://5.182.210.61/b6077fn/an/aelf ua-wget
http://5.182.210.61/f8518en/an/aelf ua-wget
http://5.182.210.61/a283ccn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a39a8569de4cf364c10f5cd/reports/651b2c3b-8668-427c-8e0c-80d5ee606915/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-22T18:37:00Z UTC
Last seen:
2026-06-22T18:51:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1dbd0d3f-8e84-4503-9723-e152f52f4fa5
Behavior Graph:
Download SVG
%3 guuid=a6d7937f-1900-0000-cab5-e2e42f140000 pid=5167 /usr/bin/sudo guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168 /tmp/sample.bin guuid=a6d7937f-1900-0000-cab5-e2e42f140000 pid=5167->guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168 execve guuid=f025dc83-1900-0000-cab5-e2e431140000 pid=5169 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=f025dc83-1900-0000-cab5-e2e431140000 pid=5169 execve guuid=434f69be-1900-0000-cab5-e2e432140000 pid=5170 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=434f69be-1900-0000-cab5-e2e432140000 pid=5170 execve guuid=1109afee-1900-0000-cab5-e2e433140000 pid=5171 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=1109afee-1900-0000-cab5-e2e433140000 pid=5171 execve guuid=658326ef-1900-0000-cab5-e2e434140000 pid=5172 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=658326ef-1900-0000-cab5-e2e434140000 pid=5172 clone guuid=ec768def-1900-0000-cab5-e2e436140000 pid=5174 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=ec768def-1900-0000-cab5-e2e436140000 pid=5174 execve guuid=d3b6edef-1900-0000-cab5-e2e437140000 pid=5175 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=d3b6edef-1900-0000-cab5-e2e437140000 pid=5175 execve guuid=e0d74bf0-1900-0000-cab5-e2e438140000 pid=5176 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=e0d74bf0-1900-0000-cab5-e2e438140000 pid=5176 execve guuid=1366eff2-1900-0000-cab5-e2e43a140000 pid=5178 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=1366eff2-1900-0000-cab5-e2e43a140000 pid=5178 execve guuid=5a708df7-1900-0000-cab5-e2e441140000 pid=5185 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=5a708df7-1900-0000-cab5-e2e441140000 pid=5185 execve guuid=5db5a3f8-1900-0000-cab5-e2e442140000 pid=5186 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=5db5a3f8-1900-0000-cab5-e2e442140000 pid=5186 clone guuid=7e8d56f9-1900-0000-cab5-e2e444140000 pid=5188 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=7e8d56f9-1900-0000-cab5-e2e444140000 pid=5188 execve guuid=025aa2f9-1900-0000-cab5-e2e445140000 pid=5189 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=025aa2f9-1900-0000-cab5-e2e445140000 pid=5189 execve guuid=8fccfff9-1900-0000-cab5-e2e446140000 pid=5190 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=8fccfff9-1900-0000-cab5-e2e446140000 pid=5190 execve guuid=0b8fe9fc-1900-0000-cab5-e2e447140000 pid=5191 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=0b8fe9fc-1900-0000-cab5-e2e447140000 pid=5191 execve guuid=347c1e01-1a00-0000-cab5-e2e448140000 pid=5192 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=347c1e01-1a00-0000-cab5-e2e448140000 pid=5192 execve guuid=ae919301-1a00-0000-cab5-e2e449140000 pid=5193 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=ae919301-1a00-0000-cab5-e2e449140000 pid=5193 clone guuid=69122102-1a00-0000-cab5-e2e44b140000 pid=5195 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=69122102-1a00-0000-cab5-e2e44b140000 pid=5195 execve guuid=26038e02-1a00-0000-cab5-e2e44c140000 pid=5196 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=26038e02-1a00-0000-cab5-e2e44c140000 pid=5196 execve guuid=e4bceb02-1a00-0000-cab5-e2e44d140000 pid=5197 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=e4bceb02-1a00-0000-cab5-e2e44d140000 pid=5197 execve guuid=5950d205-1a00-0000-cab5-e2e44e140000 pid=5198 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=5950d205-1a00-0000-cab5-e2e44e140000 pid=5198 execve guuid=e770c109-1a00-0000-cab5-e2e44f140000 pid=5199 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=e770c109-1a00-0000-cab5-e2e44f140000 pid=5199 execve guuid=c09d1c0a-1a00-0000-cab5-e2e450140000 pid=5200 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=c09d1c0a-1a00-0000-cab5-e2e450140000 pid=5200 clone guuid=8aa0a00a-1a00-0000-cab5-e2e452140000 pid=5202 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=8aa0a00a-1a00-0000-cab5-e2e452140000 pid=5202 execve guuid=4fa2040b-1a00-0000-cab5-e2e453140000 pid=5203 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=4fa2040b-1a00-0000-cab5-e2e453140000 pid=5203 execve guuid=79d75f0b-1a00-0000-cab5-e2e454140000 pid=5204 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=79d75f0b-1a00-0000-cab5-e2e454140000 pid=5204 execve guuid=39081a0e-1a00-0000-cab5-e2e455140000 pid=5205 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=39081a0e-1a00-0000-cab5-e2e455140000 pid=5205 execve guuid=b3b33912-1a00-0000-cab5-e2e456140000 pid=5206 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=b3b33912-1a00-0000-cab5-e2e456140000 pid=5206 execve guuid=5c469d12-1a00-0000-cab5-e2e457140000 pid=5207 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=5c469d12-1a00-0000-cab5-e2e457140000 pid=5207 clone guuid=5c6c2913-1a00-0000-cab5-e2e459140000 pid=5209 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=5c6c2913-1a00-0000-cab5-e2e459140000 pid=5209 execve guuid=8cc18313-1a00-0000-cab5-e2e45a140000 pid=5210 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=8cc18313-1a00-0000-cab5-e2e45a140000 pid=5210 execve guuid=e8cad713-1a00-0000-cab5-e2e45b140000 pid=5211 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=e8cad713-1a00-0000-cab5-e2e45b140000 pid=5211 execve guuid=752c2a18-1a00-0000-cab5-e2e45c140000 pid=5212 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=752c2a18-1a00-0000-cab5-e2e45c140000 pid=5212 execve guuid=63fe0f22-1a00-0000-cab5-e2e45d140000 pid=5213 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=63fe0f22-1a00-0000-cab5-e2e45d140000 pid=5213 execve guuid=6bc70623-1a00-0000-cab5-e2e45e140000 pid=5214 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=6bc70623-1a00-0000-cab5-e2e45e140000 pid=5214 clone guuid=d7288b23-1a00-0000-cab5-e2e460140000 pid=5216 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=d7288b23-1a00-0000-cab5-e2e460140000 pid=5216 execve guuid=f76d1824-1a00-0000-cab5-e2e461140000 pid=5217 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=f76d1824-1a00-0000-cab5-e2e461140000 pid=5217 execve guuid=77398c24-1a00-0000-cab5-e2e462140000 pid=5218 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=77398c24-1a00-0000-cab5-e2e462140000 pid=5218 execve guuid=85ee0528-1a00-0000-cab5-e2e463140000 pid=5219 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=85ee0528-1a00-0000-cab5-e2e463140000 pid=5219 execve guuid=2b0f3443-1a00-0000-cab5-e2e464140000 pid=5220 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=2b0f3443-1a00-0000-cab5-e2e464140000 pid=5220 execve guuid=ad71ea43-1a00-0000-cab5-e2e465140000 pid=5221 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=ad71ea43-1a00-0000-cab5-e2e465140000 pid=5221 clone guuid=18fa8d44-1a00-0000-cab5-e2e467140000 pid=5223 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=18fa8d44-1a00-0000-cab5-e2e467140000 pid=5223 execve guuid=61e43a45-1a00-0000-cab5-e2e468140000 pid=5224 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=61e43a45-1a00-0000-cab5-e2e468140000 pid=5224 execve guuid=361bd045-1a00-0000-cab5-e2e469140000 pid=5225 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=361bd045-1a00-0000-cab5-e2e469140000 pid=5225 execve guuid=44d98a4b-1a00-0000-cab5-e2e46a140000 pid=5226 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=44d98a4b-1a00-0000-cab5-e2e46a140000 pid=5226 execve guuid=9f98e655-1a00-0000-cab5-e2e46b140000 pid=5227 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=9f98e655-1a00-0000-cab5-e2e46b140000 pid=5227 execve guuid=d2545b56-1a00-0000-cab5-e2e46c140000 pid=5228 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=d2545b56-1a00-0000-cab5-e2e46c140000 pid=5228 clone guuid=a3c1ca56-1a00-0000-cab5-e2e46e140000 pid=5230 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=a3c1ca56-1a00-0000-cab5-e2e46e140000 pid=5230 execve guuid=00b94657-1a00-0000-cab5-e2e46f140000 pid=5231 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=00b94657-1a00-0000-cab5-e2e46f140000 pid=5231 execve guuid=2056b757-1a00-0000-cab5-e2e470140000 pid=5232 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=2056b757-1a00-0000-cab5-e2e470140000 pid=5232 execve guuid=3422f95a-1a00-0000-cab5-e2e471140000 pid=5233 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=3422f95a-1a00-0000-cab5-e2e471140000 pid=5233 execve guuid=db671f62-1a00-0000-cab5-e2e472140000 pid=5234 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=db671f62-1a00-0000-cab5-e2e472140000 pid=5234 execve guuid=5b13a062-1a00-0000-cab5-e2e473140000 pid=5235 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=5b13a062-1a00-0000-cab5-e2e473140000 pid=5235 clone guuid=cb7c0a63-1a00-0000-cab5-e2e475140000 pid=5237 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=cb7c0a63-1a00-0000-cab5-e2e475140000 pid=5237 execve guuid=53f96c63-1a00-0000-cab5-e2e476140000 pid=5238 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=53f96c63-1a00-0000-cab5-e2e476140000 pid=5238 execve guuid=6b7fcc63-1a00-0000-cab5-e2e477140000 pid=5239 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=6b7fcc63-1a00-0000-cab5-e2e477140000 pid=5239 execve guuid=da36fc66-1a00-0000-cab5-e2e478140000 pid=5240 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=da36fc66-1a00-0000-cab5-e2e478140000 pid=5240 execve guuid=3bbef36d-1a00-0000-cab5-e2e479140000 pid=5241 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=3bbef36d-1a00-0000-cab5-e2e479140000 pid=5241 execve guuid=55db4a6e-1a00-0000-cab5-e2e47a140000 pid=5242 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=55db4a6e-1a00-0000-cab5-e2e47a140000 pid=5242 clone guuid=4f3f8a6e-1a00-0000-cab5-e2e47c140000 pid=5244 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=4f3f8a6e-1a00-0000-cab5-e2e47c140000 pid=5244 execve guuid=3706e16e-1a00-0000-cab5-e2e47d140000 pid=5245 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=3706e16e-1a00-0000-cab5-e2e47d140000 pid=5245 execve guuid=21a82f6f-1a00-0000-cab5-e2e47e140000 pid=5246 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=21a82f6f-1a00-0000-cab5-e2e47e140000 pid=5246 execve guuid=526e0a72-1a00-0000-cab5-e2e47f140000 pid=5247 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=526e0a72-1a00-0000-cab5-e2e47f140000 pid=5247 execve guuid=31bb2c77-1a00-0000-cab5-e2e480140000 pid=5248 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=31bb2c77-1a00-0000-cab5-e2e480140000 pid=5248 execve guuid=481d3c78-1a00-0000-cab5-e2e481140000 pid=5249 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=481d3c78-1a00-0000-cab5-e2e481140000 pid=5249 clone guuid=067de27d-1a00-0000-cab5-e2e483140000 pid=5251 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=067de27d-1a00-0000-cab5-e2e483140000 pid=5251 execve guuid=809f697e-1a00-0000-cab5-e2e484140000 pid=5252 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=809f697e-1a00-0000-cab5-e2e484140000 pid=5252 execve guuid=a4b3d47e-1a00-0000-cab5-e2e485140000 pid=5253 /usr/bin/wget net send-data guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=a4b3d47e-1a00-0000-cab5-e2e485140000 pid=5253 execve guuid=5cbb1484-1a00-0000-cab5-e2e486140000 pid=5254 /usr/bin/curl net send-data write-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=5cbb1484-1a00-0000-cab5-e2e486140000 pid=5254 execve guuid=d6e81e8d-1a00-0000-cab5-e2e487140000 pid=5255 /usr/bin/chmod guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=d6e81e8d-1a00-0000-cab5-e2e487140000 pid=5255 execve guuid=6c35e78d-1a00-0000-cab5-e2e488140000 pid=5256 /usr/bin/bash guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=6c35e78d-1a00-0000-cab5-e2e488140000 pid=5256 clone guuid=4a14368f-1a00-0000-cab5-e2e48a140000 pid=5258 /usr/bin/rm delete-file guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=4a14368f-1a00-0000-cab5-e2e48a140000 pid=5258 execve guuid=f45bbd8f-1a00-0000-cab5-e2e48b140000 pid=5259 /usr/bin/rm guuid=6e082683-1900-0000-cab5-e2e430140000 pid=5168->guuid=f45bbd8f-1a00-0000-cab5-e2e48b140000 pid=5259 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=f025dc83-1900-0000-cab5-e2e431140000 pid=5169->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=434f69be-1900-0000-cab5-e2e432140000 pid=5170->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=46ea4cef-1900-0000-cab5-e2e435140000 pid=5173 /usr/bin/bash guuid=658326ef-1900-0000-cab5-e2e434140000 pid=5172->guuid=46ea4cef-1900-0000-cab5-e2e435140000 pid=5173 clone guuid=e0d74bf0-1900-0000-cab5-e2e438140000 pid=5176->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=1366eff2-1900-0000-cab5-e2e43a140000 pid=5178->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=0afbe8f8-1900-0000-cab5-e2e443140000 pid=5187 /usr/bin/bash guuid=5db5a3f8-1900-0000-cab5-e2e442140000 pid=5186->guuid=0afbe8f8-1900-0000-cab5-e2e443140000 pid=5187 clone guuid=8fccfff9-1900-0000-cab5-e2e446140000 pid=5190->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=0b8fe9fc-1900-0000-cab5-e2e447140000 pid=5191->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=f6e1b901-1a00-0000-cab5-e2e44a140000 pid=5194 /usr/bin/bash guuid=ae919301-1a00-0000-cab5-e2e449140000 pid=5193->guuid=f6e1b901-1a00-0000-cab5-e2e44a140000 pid=5194 clone guuid=e4bceb02-1a00-0000-cab5-e2e44d140000 pid=5197->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=5950d205-1a00-0000-cab5-e2e44e140000 pid=5198->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=3b5d3a0a-1a00-0000-cab5-e2e451140000 pid=5201 /usr/bin/bash guuid=c09d1c0a-1a00-0000-cab5-e2e450140000 pid=5200->guuid=3b5d3a0a-1a00-0000-cab5-e2e451140000 pid=5201 clone guuid=79d75f0b-1a00-0000-cab5-e2e454140000 pid=5204->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=39081a0e-1a00-0000-cab5-e2e455140000 pid=5205->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=fe24bb12-1a00-0000-cab5-e2e458140000 pid=5208 /usr/bin/bash guuid=5c469d12-1a00-0000-cab5-e2e457140000 pid=5207->guuid=fe24bb12-1a00-0000-cab5-e2e458140000 pid=5208 clone guuid=e8cad713-1a00-0000-cab5-e2e45b140000 pid=5211->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=752c2a18-1a00-0000-cab5-e2e45c140000 pid=5212->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=8e511f23-1a00-0000-cab5-e2e45f140000 pid=5215 /usr/bin/bash guuid=6bc70623-1a00-0000-cab5-e2e45e140000 pid=5214->guuid=8e511f23-1a00-0000-cab5-e2e45f140000 pid=5215 clone guuid=77398c24-1a00-0000-cab5-e2e462140000 pid=5218->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=85ee0528-1a00-0000-cab5-e2e463140000 pid=5219->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=b52f2e44-1a00-0000-cab5-e2e466140000 pid=5222 /usr/bin/bash guuid=ad71ea43-1a00-0000-cab5-e2e465140000 pid=5221->guuid=b52f2e44-1a00-0000-cab5-e2e466140000 pid=5222 clone guuid=361bd045-1a00-0000-cab5-e2e469140000 pid=5225->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=44d98a4b-1a00-0000-cab5-e2e46a140000 pid=5226->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=32439156-1a00-0000-cab5-e2e46d140000 pid=5229 /usr/bin/bash guuid=d2545b56-1a00-0000-cab5-e2e46c140000 pid=5228->guuid=32439156-1a00-0000-cab5-e2e46d140000 pid=5229 clone guuid=2056b757-1a00-0000-cab5-e2e470140000 pid=5232->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=3422f95a-1a00-0000-cab5-e2e471140000 pid=5233->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=67add862-1a00-0000-cab5-e2e474140000 pid=5236 /usr/bin/bash guuid=5b13a062-1a00-0000-cab5-e2e473140000 pid=5235->guuid=67add862-1a00-0000-cab5-e2e474140000 pid=5236 clone guuid=6b7fcc63-1a00-0000-cab5-e2e477140000 pid=5239->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=da36fc66-1a00-0000-cab5-e2e478140000 pid=5240->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=ca9f686e-1a00-0000-cab5-e2e47b140000 pid=5243 /usr/bin/bash guuid=55db4a6e-1a00-0000-cab5-e2e47a140000 pid=5242->guuid=ca9f686e-1a00-0000-cab5-e2e47b140000 pid=5243 clone guuid=21a82f6f-1a00-0000-cab5-e2e47e140000 pid=5246->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=526e0a72-1a00-0000-cab5-e2e47f140000 pid=5247->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=4d175d7d-1a00-0000-cab5-e2e482140000 pid=5250 /usr/bin/bash guuid=481d3c78-1a00-0000-cab5-e2e481140000 pid=5249->guuid=4d175d7d-1a00-0000-cab5-e2e482140000 pid=5250 clone guuid=a4b3d47e-1a00-0000-cab5-e2e485140000 pid=5253->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=5cbb1484-1a00-0000-cab5-e2e486140000 pid=5254->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=1c38128e-1a00-0000-cab5-e2e489140000 pid=5257 /usr/bin/bash guuid=6c35e78d-1a00-0000-cab5-e2e488140000 pid=5256->guuid=1c38128e-1a00-0000-cab5-e2e489140000 pid=5257 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3
Threat name:
Linux.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-22 21:28:28 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=twtiklhkcdpx6tpw32mw4qkenbibenhfh24jv4ocui4gq75gfwzq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260622-z91c7agz2t/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments