MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f8428c7b5aff816430749bdee66f029be2a141137464b2e15fa8e692bb8d67d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f8428c7b5aff816430749bdee66f029be2a141137464b2e15fa8e692bb8d67d
SHA3-384 hash: a9a46fe5200d270a4f5361a0a07792008082dc276309690b3926d6444c1da44f61df466cbdb1d7491a0d88e14245893e
SHA1 hash: c1959fc69686b2ad7e6d51f261d2cb9628a05138
MD5 hash: 3ea6948a60add9101fc92bb779c68969
humanhash: ack-triple-maryland-december
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'944 bytes
First seen:2025-07-18 18:26:22 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:irOMlrs0lrycynXlrNelrEyElZlrEAEzjlrPNoPGgelrowlrNOlrJyJUZlr7elr7:irOMlrs0lrlOlrNelrEyElZlrEAEzjlr
TLSH T193515CC50F9342722C76AE37F9BE0A483E9598A378C46D5794EC3CEB518DE4430A0E63
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://161.97.77.188/HBTs/top1miku.arc380cdfff39fab66e0d2f0e3217f0e2573374ebbde28f6a96343e2cb72c0ca944 Miraielf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.x8664aa14e4bba9920161c083819452da01e173458619866025b454e29117f427c3 Miraielf mirai opendir ua-wget x86
http://161.97.77.188/HBTs/top1miku.x86_645c03e74290ffbc6332f3d357d54853000ea53f19ee0fa3fb36d466989c48826f Miraielf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.i686b80576044beece1b4d384a03a1cf722b0859177e554946eb0a6b0c96ae98d92d Miraielf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.mips6dba5a43486ad2c883f236754e25806a860f5063fcf73e225f4f86c1c1741ead Miraielf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.mips64n/an/aua-wget
http://161.97.77.188/HBTs/top1miku.mpsln/an/aua-wget
http://161.97.77.188/HBTs/top1miku.armn/an/aua-wget
http://161.97.77.188/HBTs/top1miku.arm5n/an/aua-wget
http://161.97.77.188/HBTs/top1miku.arm6n/an/aua-wget
http://161.97.77.188/HBTs/top1miku.arm7n/an/aua-wget
http://161.97.77.188/HBTs/top1miku.ppcn/an/aua-wget
http://161.97.77.188/HBTs/top1miku.sparcn/an/aua-wget
http://161.97.77.188/HBTs/top1miku.m68kaf5ef5773b4f244557be125fa269d59bfa897f6ad5ddbbd600a224a7fe38fdb8 Miraielf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.sh4200f50c4e8e10d7cd12823b2ff9dcc4fd4643094ee0cb1bbd321a636af1acdc4 Miraielf mirai opendir ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
27
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4061980a-599a-41c1-9534-ee2b5b759523
Behavior Graph:
Download SVG
%3 guuid=0865a738-1800-0000-5c78-866a87090000 pid=2439 /usr/bin/sudo guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447 /tmp/sample.bin guuid=0865a738-1800-0000-5c78-866a87090000 pid=2439->guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447 execve guuid=aae4203c-1800-0000-5c78-866a92090000 pid=2450 /usr/bin/cp guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=aae4203c-1800-0000-5c78-866a92090000 pid=2450 execve guuid=955b1542-1800-0000-5c78-866aa1090000 pid=2465 /usr/bin/wget net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=955b1542-1800-0000-5c78-866aa1090000 pid=2465 execve guuid=d6cf104c-1800-0000-5c78-866ab6090000 pid=2486 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=d6cf104c-1800-0000-5c78-866ab6090000 pid=2486 execve guuid=e731416b-1800-0000-5c78-866aed090000 pid=2541 /usr/bin/cat guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=e731416b-1800-0000-5c78-866aed090000 pid=2541 execve guuid=a20ab46b-1800-0000-5c78-866aef090000 pid=2543 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=a20ab46b-1800-0000-5c78-866aef090000 pid=2543 execve guuid=2e06276c-1800-0000-5c78-866af1090000 pid=2545 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=2e06276c-1800-0000-5c78-866af1090000 pid=2545 clone guuid=249d1d6e-1800-0000-5c78-866af7090000 pid=2551 /usr/bin/wget net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=249d1d6e-1800-0000-5c78-866af7090000 pid=2551 execve guuid=60655d75-1800-0000-5c78-866a100a0000 pid=2576 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=60655d75-1800-0000-5c78-866a100a0000 pid=2576 execve guuid=2feda57a-1800-0000-5c78-866a1f0a0000 pid=2591 /usr/bin/cat guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=2feda57a-1800-0000-5c78-866a1f0a0000 pid=2591 execve guuid=018b067b-1800-0000-5c78-866a220a0000 pid=2594 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=018b067b-1800-0000-5c78-866a220a0000 pid=2594 execve guuid=e3827c7b-1800-0000-5c78-866a240a0000 pid=2596 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=e3827c7b-1800-0000-5c78-866a240a0000 pid=2596 execve guuid=cfd6b17b-1800-0000-5c78-866a260a0000 pid=2598 /usr/bin/wget net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=cfd6b17b-1800-0000-5c78-866a260a0000 pid=2598 execve guuid=ab2c2d7f-1800-0000-5c78-866a320a0000 pid=2610 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=ab2c2d7f-1800-0000-5c78-866a320a0000 pid=2610 execve guuid=4b300e84-1800-0000-5c78-866a470a0000 pid=2631 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=4b300e84-1800-0000-5c78-866a470a0000 pid=2631 clone guuid=4137d484-1800-0000-5c78-866a4b0a0000 pid=2635 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=4137d484-1800-0000-5c78-866a4b0a0000 pid=2635 execve guuid=33b63f85-1800-0000-5c78-866a4d0a0000 pid=2637 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=33b63f85-1800-0000-5c78-866a4d0a0000 pid=2637 execve guuid=4e4f6785-1800-0000-5c78-866a500a0000 pid=2640 /usr/bin/wget net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=4e4f6785-1800-0000-5c78-866a500a0000 pid=2640 execve guuid=13a5f58d-1800-0000-5c78-866a720a0000 pid=2674 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=13a5f58d-1800-0000-5c78-866a720a0000 pid=2674 execve guuid=b81ec397-1800-0000-5c78-866a990a0000 pid=2713 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=b81ec397-1800-0000-5c78-866a990a0000 pid=2713 clone guuid=ba671e98-1800-0000-5c78-866a9c0a0000 pid=2716 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=ba671e98-1800-0000-5c78-866a9c0a0000 pid=2716 execve guuid=8300a198-1800-0000-5c78-866a9f0a0000 pid=2719 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=8300a198-1800-0000-5c78-866a9f0a0000 pid=2719 execve guuid=9b01fe98-1800-0000-5c78-866aa20a0000 pid=2722 /usr/bin/wget net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=9b01fe98-1800-0000-5c78-866aa20a0000 pid=2722 execve guuid=257c5a9f-1800-0000-5c78-866abc0a0000 pid=2748 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=257c5a9f-1800-0000-5c78-866abc0a0000 pid=2748 execve guuid=90982aa4-1800-0000-5c78-866ac80a0000 pid=2760 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=90982aa4-1800-0000-5c78-866ac80a0000 pid=2760 clone guuid=736f47a4-1800-0000-5c78-866aca0a0000 pid=2762 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=736f47a4-1800-0000-5c78-866aca0a0000 pid=2762 execve guuid=6a3d8aa4-1800-0000-5c78-866acb0a0000 pid=2763 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=6a3d8aa4-1800-0000-5c78-866acb0a0000 pid=2763 execve guuid=963df0a4-1800-0000-5c78-866acf0a0000 pid=2767 /usr/bin/wget net send-data guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=963df0a4-1800-0000-5c78-866acf0a0000 pid=2767 execve guuid=3cfd69a7-1800-0000-5c78-866ad50a0000 pid=2773 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=3cfd69a7-1800-0000-5c78-866ad50a0000 pid=2773 execve guuid=835d41b0-1800-0000-5c78-866aec0a0000 pid=2796 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=835d41b0-1800-0000-5c78-866aec0a0000 pid=2796 clone guuid=bb1e86b0-1800-0000-5c78-866aee0a0000 pid=2798 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=bb1e86b0-1800-0000-5c78-866aee0a0000 pid=2798 execve guuid=bfdd07b1-1800-0000-5c78-866aef0a0000 pid=2799 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=bfdd07b1-1800-0000-5c78-866aef0a0000 pid=2799 execve guuid=cde4aab1-1800-0000-5c78-866af20a0000 pid=2802 /usr/bin/wget net send-data guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=cde4aab1-1800-0000-5c78-866af20a0000 pid=2802 execve guuid=099ee8b4-1800-0000-5c78-866afb0a0000 pid=2811 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=099ee8b4-1800-0000-5c78-866afb0a0000 pid=2811 execve guuid=16a1f1bf-1800-0000-5c78-866a1d0b0000 pid=2845 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=16a1f1bf-1800-0000-5c78-866a1d0b0000 pid=2845 clone guuid=d27f0ec0-1800-0000-5c78-866a1e0b0000 pid=2846 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=d27f0ec0-1800-0000-5c78-866a1e0b0000 pid=2846 execve guuid=494c84c0-1800-0000-5c78-866a1f0b0000 pid=2847 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=494c84c0-1800-0000-5c78-866a1f0b0000 pid=2847 execve guuid=673ebfc0-1800-0000-5c78-866a220b0000 pid=2850 /usr/bin/wget net send-data guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=673ebfc0-1800-0000-5c78-866a220b0000 pid=2850 execve guuid=77a6afc3-1800-0000-5c78-866a250b0000 pid=2853 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=77a6afc3-1800-0000-5c78-866a250b0000 pid=2853 execve guuid=758557cc-1800-0000-5c78-866a3e0b0000 pid=2878 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=758557cc-1800-0000-5c78-866a3e0b0000 pid=2878 clone guuid=24e57dcc-1800-0000-5c78-866a400b0000 pid=2880 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=24e57dcc-1800-0000-5c78-866a400b0000 pid=2880 execve guuid=c462cbcc-1800-0000-5c78-866a410b0000 pid=2881 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=c462cbcc-1800-0000-5c78-866a410b0000 pid=2881 execve guuid=34ee02cd-1800-0000-5c78-866a440b0000 pid=2884 /usr/bin/wget net send-data guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=34ee02cd-1800-0000-5c78-866a440b0000 pid=2884 execve guuid=55bc35cf-1800-0000-5c78-866a4b0b0000 pid=2891 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=55bc35cf-1800-0000-5c78-866a4b0b0000 pid=2891 execve guuid=5654fdd6-1800-0000-5c78-866a5f0b0000 pid=2911 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=5654fdd6-1800-0000-5c78-866a5f0b0000 pid=2911 clone guuid=bd7523d7-1800-0000-5c78-866a600b0000 pid=2912 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=bd7523d7-1800-0000-5c78-866a600b0000 pid=2912 execve guuid=faefa7d7-1800-0000-5c78-866a620b0000 pid=2914 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=faefa7d7-1800-0000-5c78-866a620b0000 pid=2914 execve guuid=04af2bd9-1800-0000-5c78-866a6b0b0000 pid=2923 /usr/bin/wget net send-data guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=04af2bd9-1800-0000-5c78-866a6b0b0000 pid=2923 execve guuid=c4122cdc-1800-0000-5c78-866a750b0000 pid=2933 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=c4122cdc-1800-0000-5c78-866a750b0000 pid=2933 execve guuid=1368c4e1-1800-0000-5c78-866a900b0000 pid=2960 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=1368c4e1-1800-0000-5c78-866a900b0000 pid=2960 clone guuid=8bc5a8e2-1800-0000-5c78-866a950b0000 pid=2965 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=8bc5a8e2-1800-0000-5c78-866a950b0000 pid=2965 execve guuid=482cf0e2-1800-0000-5c78-866a980b0000 pid=2968 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=482cf0e2-1800-0000-5c78-866a980b0000 pid=2968 execve guuid=4d6116e3-1800-0000-5c78-866a9b0b0000 pid=2971 /usr/bin/wget net send-data guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=4d6116e3-1800-0000-5c78-866a9b0b0000 pid=2971 execve guuid=e7774ee9-1800-0000-5c78-866aad0b0000 pid=2989 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=e7774ee9-1800-0000-5c78-866aad0b0000 pid=2989 execve guuid=039e99ee-1800-0000-5c78-866ab90b0000 pid=3001 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=039e99ee-1800-0000-5c78-866ab90b0000 pid=3001 clone guuid=f9ac4def-1800-0000-5c78-866abd0b0000 pid=3005 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=f9ac4def-1800-0000-5c78-866abd0b0000 pid=3005 execve guuid=5c27adef-1800-0000-5c78-866abe0b0000 pid=3006 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=5c27adef-1800-0000-5c78-866abe0b0000 pid=3006 execve guuid=5eb5d5ef-1800-0000-5c78-866ac10b0000 pid=3009 /usr/bin/wget net send-data guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=5eb5d5ef-1800-0000-5c78-866ac10b0000 pid=3009 execve guuid=fd0309f9-1800-0000-5c78-866aca0b0000 pid=3018 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=fd0309f9-1800-0000-5c78-866aca0b0000 pid=3018 execve guuid=35712e02-1900-0000-5c78-866adf0b0000 pid=3039 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=35712e02-1900-0000-5c78-866adf0b0000 pid=3039 clone guuid=90a24c02-1900-0000-5c78-866ae00b0000 pid=3040 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=90a24c02-1900-0000-5c78-866ae00b0000 pid=3040 execve guuid=066f8d02-1900-0000-5c78-866ae10b0000 pid=3041 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=066f8d02-1900-0000-5c78-866ae10b0000 pid=3041 execve guuid=9a5dc102-1900-0000-5c78-866ae30b0000 pid=3043 /usr/bin/wget net send-data guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=9a5dc102-1900-0000-5c78-866ae30b0000 pid=3043 execve guuid=49455507-1900-0000-5c78-866aee0b0000 pid=3054 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=49455507-1900-0000-5c78-866aee0b0000 pid=3054 execve guuid=47bdb00c-1900-0000-5c78-866afc0b0000 pid=3068 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=47bdb00c-1900-0000-5c78-866afc0b0000 pid=3068 clone guuid=74b5dc0c-1900-0000-5c78-866afe0b0000 pid=3070 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=74b5dc0c-1900-0000-5c78-866afe0b0000 pid=3070 execve guuid=ab4fcb0e-1900-0000-5c78-866a050c0000 pid=3077 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=ab4fcb0e-1900-0000-5c78-866a050c0000 pid=3077 execve guuid=362f100f-1900-0000-5c78-866a070c0000 pid=3079 /usr/bin/wget net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=362f100f-1900-0000-5c78-866a070c0000 pid=3079 execve guuid=0ec5b71a-1900-0000-5c78-866a270c0000 pid=3111 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=0ec5b71a-1900-0000-5c78-866a270c0000 pid=3111 execve guuid=4a69192a-1900-0000-5c78-866a420c0000 pid=3138 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=4a69192a-1900-0000-5c78-866a420c0000 pid=3138 clone guuid=cbd0612b-1900-0000-5c78-866a470c0000 pid=3143 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=cbd0612b-1900-0000-5c78-866a470c0000 pid=3143 execve guuid=51879d2c-1900-0000-5c78-866a4c0c0000 pid=3148 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=51879d2c-1900-0000-5c78-866a4c0c0000 pid=3148 execve guuid=7321952d-1900-0000-5c78-866a510c0000 pid=3153 /usr/bin/wget net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=7321952d-1900-0000-5c78-866a510c0000 pid=3153 execve guuid=a4ca6134-1900-0000-5c78-866a6e0c0000 pid=3182 /usr/bin/curl net send-data write-file guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=a4ca6134-1900-0000-5c78-866a6e0c0000 pid=3182 execve guuid=82452340-1900-0000-5c78-866a990c0000 pid=3225 /usr/bin/bash guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=82452340-1900-0000-5c78-866a990c0000 pid=3225 clone guuid=a1174840-1900-0000-5c78-866a9b0c0000 pid=3227 /usr/bin/chmod guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=a1174840-1900-0000-5c78-866a9b0c0000 pid=3227 execve guuid=acedca42-1900-0000-5c78-866aa40c0000 pid=3236 /tmp/Space net guuid=4529373b-1800-0000-5c78-866a8f090000 pid=2447->guuid=acedca42-1900-0000-5c78-866aa40c0000 pid=3236 execve 7a155949-225c-5534-9d46-ce85bc851092 161.97.77.188:80 guuid=955b1542-1800-0000-5c78-866aa1090000 pid=2465->7a155949-225c-5534-9d46-ce85bc851092 send: 145B guuid=d6cf104c-1800-0000-5c78-866ab6090000 pid=2486->7a155949-225c-5534-9d46-ce85bc851092 send: 94B guuid=249d1d6e-1800-0000-5c78-866af7090000 pid=2551->7a155949-225c-5534-9d46-ce85bc851092 send: 145B guuid=60655d75-1800-0000-5c78-866a100a0000 pid=2576->7a155949-225c-5534-9d46-ce85bc851092 send: 94B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=e3827c7b-1800-0000-5c78-866a240a0000 pid=2596->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e257a87b-1800-0000-5c78-866a250a0000 pid=2597 /tmp/Space guuid=e3827c7b-1800-0000-5c78-866a240a0000 pid=2596->guuid=e257a87b-1800-0000-5c78-866a250a0000 pid=2597 clone guuid=cb13bd7b-1800-0000-5c78-866a270a0000 pid=2599 /tmp/Space write-config zombie guuid=e257a87b-1800-0000-5c78-866a250a0000 pid=2597->guuid=cb13bd7b-1800-0000-5c78-866a270a0000 pid=2599 clone guuid=cfd6b17b-1800-0000-5c78-866a260a0000 pid=2598->7a155949-225c-5534-9d46-ce85bc851092 send: 148B guuid=ba593180-1800-0000-5c78-866a370a0000 pid=2615 /usr/bin/dash guuid=cb13bd7b-1800-0000-5c78-866a270a0000 pid=2599->guuid=ba593180-1800-0000-5c78-866a370a0000 pid=2615 execve guuid=f1d84983-1800-0000-5c78-866a430a0000 pid=2627 /tmp/Space delete-file guuid=cb13bd7b-1800-0000-5c78-866a270a0000 pid=2599->guuid=f1d84983-1800-0000-5c78-866a430a0000 pid=2627 clone guuid=22ce4f20-1c00-0000-5c78-866a0b140000 pid=5131 /tmp/Space guuid=cb13bd7b-1800-0000-5c78-866a270a0000 pid=2599->guuid=22ce4f20-1c00-0000-5c78-866a0b140000 pid=5131 clone guuid=380b7bd2-1f00-0000-5c78-866a23150000 pid=5411 /tmp/Space guuid=cb13bd7b-1800-0000-5c78-866a270a0000 pid=2599->guuid=380b7bd2-1f00-0000-5c78-866a23150000 pid=5411 clone guuid=d3ce5476-2300-0000-5c78-866a30150000 pid=5424 /tmp/Space guuid=cb13bd7b-1800-0000-5c78-866a270a0000 pid=2599->guuid=d3ce5476-2300-0000-5c78-866a30150000 pid=5424 clone guuid=ab2c2d7f-1800-0000-5c78-866a320a0000 pid=2610->7a155949-225c-5534-9d46-ce85bc851092 send: 97B guuid=9ef45c80-1800-0000-5c78-866a390a0000 pid=2617 /usr/bin/cp guuid=ba593180-1800-0000-5c78-866a370a0000 pid=2615->guuid=9ef45c80-1800-0000-5c78-866a390a0000 pid=2617 execve guuid=33b63f85-1800-0000-5c78-866a4d0a0000 pid=2637->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c1155f85-1800-0000-5c78-866a4e0a0000 pid=2638 /tmp/Space guuid=33b63f85-1800-0000-5c78-866a4d0a0000 pid=2637->guuid=c1155f85-1800-0000-5c78-866a4e0a0000 pid=2638 clone guuid=2cedd285-1800-0000-5c78-866a520a0000 pid=2642 /tmp/Space write-config zombie guuid=c1155f85-1800-0000-5c78-866a4e0a0000 pid=2638->guuid=2cedd285-1800-0000-5c78-866a520a0000 pid=2642 clone guuid=4e4f6785-1800-0000-5c78-866a500a0000 pid=2640->7a155949-225c-5534-9d46-ce85bc851092 send: 146B guuid=9c5cc589-1800-0000-5c78-866a5f0a0000 pid=2655 /usr/bin/dash guuid=2cedd285-1800-0000-5c78-866a520a0000 pid=2642->guuid=9c5cc589-1800-0000-5c78-866a5f0a0000 pid=2655 execve guuid=ee19158c-1800-0000-5c78-866a6a0a0000 pid=2666 /tmp/Space delete-file dns net send-data guuid=2cedd285-1800-0000-5c78-866a520a0000 pid=2642->guuid=ee19158c-1800-0000-5c78-866a6a0a0000 pid=2666 clone guuid=64b3aec7-1e00-0000-5c78-866a21150000 pid=5409 /tmp/Space guuid=2cedd285-1800-0000-5c78-866a520a0000 pid=2642->guuid=64b3aec7-1e00-0000-5c78-866a21150000 pid=5409 clone guuid=5ee15077-2200-0000-5c78-866a2e150000 pid=5422 /tmp/Space dns net send-data guuid=2cedd285-1800-0000-5c78-866a520a0000 pid=2642->guuid=5ee15077-2200-0000-5c78-866a2e150000 pid=5422 clone guuid=cd39ee89-1800-0000-5c78-866a610a0000 pid=2657 /usr/bin/cp guuid=9c5cc589-1800-0000-5c78-866a5f0a0000 pid=2655->guuid=cd39ee89-1800-0000-5c78-866a610a0000 pid=2657 execve guuid=ee19158c-1800-0000-5c78-866a6a0a0000 pid=2666->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 76B a1cb65f6-afd3-5a3a-9fa0-f13741392136 top1miku.duckdns.org:2004 guuid=ee19158c-1800-0000-5c78-866a6a0a0000 pid=2666->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=13a5f58d-1800-0000-5c78-866a720a0000 pid=2674->7a155949-225c-5534-9d46-ce85bc851092 send: 95B guuid=8300a198-1800-0000-5c78-866a9f0a0000 pid=2719->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6768bf98-1800-0000-5c78-866aa00a0000 pid=2720 /tmp/Space guuid=8300a198-1800-0000-5c78-866a9f0a0000 pid=2719->guuid=6768bf98-1800-0000-5c78-866aa00a0000 pid=2720 clone guuid=4f6f9c99-1800-0000-5c78-866aa40a0000 pid=2724 /tmp/Space write-config zombie guuid=6768bf98-1800-0000-5c78-866aa00a0000 pid=2720->guuid=4f6f9c99-1800-0000-5c78-866aa40a0000 pid=2724 clone guuid=9b01fe98-1800-0000-5c78-866aa20a0000 pid=2722->7a155949-225c-5534-9d46-ce85bc851092 send: 146B guuid=67ec3c9f-1800-0000-5c78-866abb0a0000 pid=2747 /usr/bin/dash guuid=4f6f9c99-1800-0000-5c78-866aa40a0000 pid=2724->guuid=67ec3c9f-1800-0000-5c78-866abb0a0000 pid=2747 execve guuid=f02124a2-1800-0000-5c78-866ac30a0000 pid=2755 /tmp/Space delete-file guuid=4f6f9c99-1800-0000-5c78-866aa40a0000 pid=2724->guuid=f02124a2-1800-0000-5c78-866ac30a0000 pid=2755 clone guuid=c8e1bd3e-1c00-0000-5c78-866a7b140000 pid=5243 /tmp/Space dns net send-data guuid=4f6f9c99-1800-0000-5c78-866aa40a0000 pid=2724->guuid=c8e1bd3e-1c00-0000-5c78-866a7b140000 pid=5243 clone guuid=2f0b66d4-2000-0000-5c78-866a2a150000 pid=5418 /tmp/Space guuid=4f6f9c99-1800-0000-5c78-866aa40a0000 pid=2724->guuid=2f0b66d4-2000-0000-5c78-866a2a150000 pid=5418 clone guuid=336c6f6e-2400-0000-5c78-866a34150000 pid=5428 /tmp/Space guuid=4f6f9c99-1800-0000-5c78-866aa40a0000 pid=2724->guuid=336c6f6e-2400-0000-5c78-866a34150000 pid=5428 clone guuid=e0617c9f-1800-0000-5c78-866abd0a0000 pid=2749 /usr/bin/cp guuid=67ec3c9f-1800-0000-5c78-866abb0a0000 pid=2747->guuid=e0617c9f-1800-0000-5c78-866abd0a0000 pid=2749 execve guuid=257c5a9f-1800-0000-5c78-866abc0a0000 pid=2748->7a155949-225c-5534-9d46-ce85bc851092 send: 95B guuid=6a3d8aa4-1800-0000-5c78-866acb0a0000 pid=2763->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=2e8ae8a4-1800-0000-5c78-866ace0a0000 pid=2766 /tmp/Space guuid=6a3d8aa4-1800-0000-5c78-866acb0a0000 pid=2763->guuid=2e8ae8a4-1800-0000-5c78-866ace0a0000 pid=2766 clone guuid=af1bf9a4-1800-0000-5c78-866ad00a0000 pid=2768 /tmp/Space write-config zombie guuid=2e8ae8a4-1800-0000-5c78-866ace0a0000 pid=2766->guuid=af1bf9a4-1800-0000-5c78-866ad00a0000 pid=2768 clone guuid=963df0a4-1800-0000-5c78-866acf0a0000 pid=2767->7a155949-225c-5534-9d46-ce85bc851092 send: 148B guuid=e930e3a8-1800-0000-5c78-866ad80a0000 pid=2776 /usr/bin/dash guuid=af1bf9a4-1800-0000-5c78-866ad00a0000 pid=2768->guuid=e930e3a8-1800-0000-5c78-866ad80a0000 pid=2776 execve guuid=718f63ab-1800-0000-5c78-866ae10a0000 pid=2785 /tmp/Space delete-file dns net send-data guuid=af1bf9a4-1800-0000-5c78-866ad00a0000 pid=2768->guuid=718f63ab-1800-0000-5c78-866ae10a0000 pid=2785 clone guuid=b8814554-1f00-0000-5c78-866a22150000 pid=5410 /tmp/Space guuid=af1bf9a4-1800-0000-5c78-866ad00a0000 pid=2768->guuid=b8814554-1f00-0000-5c78-866a22150000 pid=5410 clone guuid=118f7c06-2300-0000-5c78-866a2f150000 pid=5423 /tmp/Space dns net send-data guuid=af1bf9a4-1800-0000-5c78-866ad00a0000 pid=2768->guuid=118f7c06-2300-0000-5c78-866a2f150000 pid=5423 clone guuid=3cfd69a7-1800-0000-5c78-866ad50a0000 pid=2773->7a155949-225c-5534-9d46-ce85bc851092 send: 97B guuid=a4f507a9-1800-0000-5c78-866ada0a0000 pid=2778 /usr/bin/cp guuid=e930e3a8-1800-0000-5c78-866ad80a0000 pid=2776->guuid=a4f507a9-1800-0000-5c78-866ada0a0000 pid=2778 execve guuid=718f63ab-1800-0000-5c78-866ae10a0000 pid=2785->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 76B guuid=718f63ab-1800-0000-5c78-866ae10a0000 pid=2785->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=bfdd07b1-1800-0000-5c78-866aef0a0000 pid=2799->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=00fa9cb1-1800-0000-5c78-866af10a0000 pid=2801 /tmp/Space guuid=bfdd07b1-1800-0000-5c78-866aef0a0000 pid=2799->guuid=00fa9cb1-1800-0000-5c78-866af10a0000 pid=2801 clone guuid=ccb62fb3-1800-0000-5c78-866af50a0000 pid=2805 /tmp/Space write-config zombie guuid=00fa9cb1-1800-0000-5c78-866af10a0000 pid=2801->guuid=ccb62fb3-1800-0000-5c78-866af50a0000 pid=2805 clone guuid=cde4aab1-1800-0000-5c78-866af20a0000 pid=2802->7a155949-225c-5534-9d46-ce85bc851092 send: 146B guuid=90e04ebc-1800-0000-5c78-866a100b0000 pid=2832 /usr/bin/dash guuid=ccb62fb3-1800-0000-5c78-866af50a0000 pid=2805->guuid=90e04ebc-1800-0000-5c78-866a100b0000 pid=2832 execve guuid=c498b3c0-1800-0000-5c78-866a210b0000 pid=2849 /tmp/Space delete-file guuid=ccb62fb3-1800-0000-5c78-866af50a0000 pid=2805->guuid=c498b3c0-1800-0000-5c78-866a210b0000 pid=2849 clone guuid=fdc91563-1c00-0000-5c78-866aeb140000 pid=5355 /tmp/Space guuid=ccb62fb3-1800-0000-5c78-866af50a0000 pid=2805->guuid=fdc91563-1c00-0000-5c78-866aeb140000 pid=5355 clone guuid=2f47ec15-2000-0000-5c78-866a25150000 pid=5413 /tmp/Space guuid=ccb62fb3-1800-0000-5c78-866af50a0000 pid=2805->guuid=2f47ec15-2000-0000-5c78-866a25150000 pid=5413 clone guuid=5e6fd0d8-2300-0000-5c78-866a31150000 pid=5425 /tmp/Space guuid=ccb62fb3-1800-0000-5c78-866af50a0000 pid=2805->guuid=5e6fd0d8-2300-0000-5c78-866a31150000 pid=5425 clone guuid=099ee8b4-1800-0000-5c78-866afb0a0000 pid=2811->7a155949-225c-5534-9d46-ce85bc851092 send: 95B guuid=9f847abc-1800-0000-5c78-866a120b0000 pid=2834 /usr/bin/cp guuid=90e04ebc-1800-0000-5c78-866a100b0000 pid=2832->guuid=9f847abc-1800-0000-5c78-866a120b0000 pid=2834 execve guuid=494c84c0-1800-0000-5c78-866a1f0b0000 pid=2847->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8996afc0-1800-0000-5c78-866a200b0000 pid=2848 /tmp/Space guuid=494c84c0-1800-0000-5c78-866a1f0b0000 pid=2847->guuid=8996afc0-1800-0000-5c78-866a200b0000 pid=2848 clone guuid=5013f4c0-1800-0000-5c78-866a230b0000 pid=2851 /tmp/Space write-config zombie guuid=8996afc0-1800-0000-5c78-866a200b0000 pid=2848->guuid=5013f4c0-1800-0000-5c78-866a230b0000 pid=2851 clone guuid=673ebfc0-1800-0000-5c78-866a220b0000 pid=2850->7a155949-225c-5534-9d46-ce85bc851092 send: 145B guuid=cf6dfac5-1800-0000-5c78-866a2c0b0000 pid=2860 /usr/bin/dash guuid=5013f4c0-1800-0000-5c78-866a230b0000 pid=2851->guuid=cf6dfac5-1800-0000-5c78-866a2c0b0000 pid=2860 execve guuid=f0fb8cc9-1800-0000-5c78-866a380b0000 pid=2872 /tmp/Space dns net send-data guuid=5013f4c0-1800-0000-5c78-866a230b0000 pid=2851->guuid=f0fb8cc9-1800-0000-5c78-866a380b0000 pid=2872 clone guuid=649199e4-1f00-0000-5c78-866a24150000 pid=5412 /tmp/Space dns net send-data guuid=5013f4c0-1800-0000-5c78-866a230b0000 pid=2851->guuid=649199e4-1f00-0000-5c78-866a24150000 pid=5412 clone guuid=cda9c389-2400-0000-5c78-866a35150000 pid=5429 /tmp/Space dns net send-data guuid=5013f4c0-1800-0000-5c78-866a230b0000 pid=2851->guuid=cda9c389-2400-0000-5c78-866a35150000 pid=5429 clone guuid=77a6afc3-1800-0000-5c78-866a250b0000 pid=2853->7a155949-225c-5534-9d46-ce85bc851092 send: 94B guuid=ae6b6fc6-1800-0000-5c78-866a2e0b0000 pid=2862 /usr/bin/cp guuid=cf6dfac5-1800-0000-5c78-866a2c0b0000 pid=2860->guuid=ae6b6fc6-1800-0000-5c78-866a2e0b0000 pid=2862 execve guuid=f0fb8cc9-1800-0000-5c78-866a380b0000 pid=2872->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 114B guuid=f0fb8cc9-1800-0000-5c78-866a380b0000 pid=2872->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=c462cbcc-1800-0000-5c78-866a410b0000 pid=2881->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=33bff7cc-1800-0000-5c78-866a420b0000 pid=2882 /tmp/Space guuid=c462cbcc-1800-0000-5c78-866a410b0000 pid=2881->guuid=33bff7cc-1800-0000-5c78-866a420b0000 pid=2882 clone guuid=2ded1acd-1800-0000-5c78-866a450b0000 pid=2885 /tmp/Space write-config zombie guuid=33bff7cc-1800-0000-5c78-866a420b0000 pid=2882->guuid=2ded1acd-1800-0000-5c78-866a450b0000 pid=2885 clone guuid=34ee02cd-1800-0000-5c78-866a440b0000 pid=2884->7a155949-225c-5534-9d46-ce85bc851092 send: 146B guuid=101edcd2-1800-0000-5c78-866a550b0000 pid=2901 /usr/bin/dash guuid=2ded1acd-1800-0000-5c78-866a450b0000 pid=2885->guuid=101edcd2-1800-0000-5c78-866a550b0000 pid=2901 execve guuid=df34b8d6-1800-0000-5c78-866a5e0b0000 pid=2910 /tmp/Space delete-file guuid=2ded1acd-1800-0000-5c78-866a450b0000 pid=2885->guuid=df34b8d6-1800-0000-5c78-866a5e0b0000 pid=2910 clone guuid=a9901482-1c00-0000-5c78-866af4140000 pid=5364 /tmp/Space dns net send-data guuid=2ded1acd-1800-0000-5c78-866a450b0000 pid=2885->guuid=a9901482-1c00-0000-5c78-866af4140000 pid=5364 clone guuid=e15ccf70-2100-0000-5c78-866a2c150000 pid=5420 /tmp/Space dns net send-data guuid=2ded1acd-1800-0000-5c78-866a450b0000 pid=2885->guuid=e15ccf70-2100-0000-5c78-866a2c150000 pid=5420 clone guuid=55bc35cf-1800-0000-5c78-866a4b0b0000 pid=2891->7a155949-225c-5534-9d46-ce85bc851092 send: 95B guuid=171608d3-1800-0000-5c78-866a560b0000 pid=2902 /usr/bin/cp guuid=101edcd2-1800-0000-5c78-866a550b0000 pid=2901->guuid=171608d3-1800-0000-5c78-866a560b0000 pid=2902 execve guuid=faefa7d7-1800-0000-5c78-866a620b0000 pid=2914->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8fd01ed9-1800-0000-5c78-866a690b0000 pid=2921 /tmp/Space guuid=faefa7d7-1800-0000-5c78-866a620b0000 pid=2914->guuid=8fd01ed9-1800-0000-5c78-866a690b0000 pid=2921 clone guuid=c74727d9-1800-0000-5c78-866a6a0b0000 pid=2922 /tmp/Space write-config zombie guuid=8fd01ed9-1800-0000-5c78-866a690b0000 pid=2921->guuid=c74727d9-1800-0000-5c78-866a6a0b0000 pid=2922 clone guuid=014601e0-1800-0000-5c78-866a870b0000 pid=2951 /usr/bin/dash guuid=c74727d9-1800-0000-5c78-866a6a0b0000 pid=2922->guuid=014601e0-1800-0000-5c78-866a870b0000 pid=2951 execve guuid=7891b4e2-1800-0000-5c78-866a960b0000 pid=2966 /tmp/Space delete-file dns net send-data guuid=c74727d9-1800-0000-5c78-866a6a0b0000 pid=2922->guuid=7891b4e2-1800-0000-5c78-866a960b0000 pid=2966 clone guuid=1b3371a1-2000-0000-5c78-866a29150000 pid=5417 /tmp/Space dns net send-data guuid=c74727d9-1800-0000-5c78-866a6a0b0000 pid=2922->guuid=1b3371a1-2000-0000-5c78-866a29150000 pid=5417 clone guuid=81329341-2500-0000-5c78-866a38150000 pid=5432 /tmp/Space dns net send-data guuid=c74727d9-1800-0000-5c78-866a6a0b0000 pid=2922->guuid=81329341-2500-0000-5c78-866a38150000 pid=5432 clone guuid=04af2bd9-1800-0000-5c78-866a6b0b0000 pid=2923->7a155949-225c-5534-9d46-ce85bc851092 send: 146B guuid=c4122cdc-1800-0000-5c78-866a750b0000 pid=2933->7a155949-225c-5534-9d46-ce85bc851092 send: 95B guuid=561f36e0-1800-0000-5c78-866a880b0000 pid=2952 /usr/bin/cp guuid=014601e0-1800-0000-5c78-866a870b0000 pid=2951->guuid=561f36e0-1800-0000-5c78-866a880b0000 pid=2952 execve guuid=7891b4e2-1800-0000-5c78-866a960b0000 pid=2966->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 152B guuid=7891b4e2-1800-0000-5c78-866a960b0000 pid=2966->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=482cf0e2-1800-0000-5c78-866a980b0000 pid=2968->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a3880fe3-1800-0000-5c78-866a9a0b0000 pid=2970 /tmp/Space guuid=482cf0e2-1800-0000-5c78-866a980b0000 pid=2968->guuid=a3880fe3-1800-0000-5c78-866a9a0b0000 pid=2970 clone guuid=369c1fe3-1800-0000-5c78-866a9c0b0000 pid=2972 /tmp/Space write-config zombie guuid=a3880fe3-1800-0000-5c78-866a9a0b0000 pid=2970->guuid=369c1fe3-1800-0000-5c78-866a9c0b0000 pid=2972 clone guuid=4d6116e3-1800-0000-5c78-866a9b0b0000 pid=2971->7a155949-225c-5534-9d46-ce85bc851092 send: 146B guuid=b2427ee7-1800-0000-5c78-866aaa0b0000 pid=2986 /usr/bin/dash guuid=369c1fe3-1800-0000-5c78-866a9c0b0000 pid=2972->guuid=b2427ee7-1800-0000-5c78-866aaa0b0000 pid=2986 execve guuid=c17d39ec-1800-0000-5c78-866ab50b0000 pid=2997 /tmp/Space guuid=369c1fe3-1800-0000-5c78-866a9c0b0000 pid=2972->guuid=c17d39ec-1800-0000-5c78-866ab50b0000 pid=2997 clone guuid=38a0fb93-1c00-0000-5c78-866af5140000 pid=5365 /tmp/Space guuid=369c1fe3-1800-0000-5c78-866a9c0b0000 pid=2972->guuid=38a0fb93-1c00-0000-5c78-866af5140000 pid=5365 clone guuid=2c01c748-2000-0000-5c78-866a26150000 pid=5414 /tmp/Space dns net send-data guuid=369c1fe3-1800-0000-5c78-866a9c0b0000 pid=2972->guuid=2c01c748-2000-0000-5c78-866a26150000 pid=5414 clone guuid=2376c200-2500-0000-5c78-866a37150000 pid=5431 /tmp/Space dns net send-data guuid=369c1fe3-1800-0000-5c78-866a9c0b0000 pid=2972->guuid=2376c200-2500-0000-5c78-866a37150000 pid=5431 clone guuid=17edbde7-1800-0000-5c78-866aab0b0000 pid=2987 /usr/bin/cp guuid=b2427ee7-1800-0000-5c78-866aaa0b0000 pid=2986->guuid=17edbde7-1800-0000-5c78-866aab0b0000 pid=2987 execve guuid=e7774ee9-1800-0000-5c78-866aad0b0000 pid=2989->7a155949-225c-5534-9d46-ce85bc851092 send: 95B guuid=5c27adef-1800-0000-5c78-866abe0b0000 pid=3006->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=2a54ceef-1800-0000-5c78-866ac00b0000 pid=3008 /tmp/Space guuid=5c27adef-1800-0000-5c78-866abe0b0000 pid=3006->guuid=2a54ceef-1800-0000-5c78-866ac00b0000 pid=3008 clone guuid=79e4eaef-1800-0000-5c78-866ac20b0000 pid=3010 /tmp/Space write-config zombie guuid=2a54ceef-1800-0000-5c78-866ac00b0000 pid=3008->guuid=79e4eaef-1800-0000-5c78-866ac20b0000 pid=3010 clone guuid=5eb5d5ef-1800-0000-5c78-866ac10b0000 pid=3009->7a155949-225c-5534-9d46-ce85bc851092 send: 145B guuid=89161cfd-1800-0000-5c78-866ad20b0000 pid=3026 /usr/bin/dash guuid=79e4eaef-1800-0000-5c78-866ac20b0000 pid=3010->guuid=89161cfd-1800-0000-5c78-866ad20b0000 pid=3026 execve guuid=0e497a00-1900-0000-5c78-866ad80b0000 pid=3032 /tmp/Space delete-file guuid=79e4eaef-1800-0000-5c78-866ac20b0000 pid=3010->guuid=0e497a00-1900-0000-5c78-866ad80b0000 pid=3032 clone guuid=bdee06cb-1c00-0000-5c78-866af7140000 pid=5367 /tmp/Space guuid=79e4eaef-1800-0000-5c78-866ac20b0000 pid=3010->guuid=bdee06cb-1c00-0000-5c78-866af7140000 pid=5367 clone guuid=b5369266-2000-0000-5c78-866a27150000 pid=5415 /tmp/Space guuid=79e4eaef-1800-0000-5c78-866ac20b0000 pid=3010->guuid=b5369266-2000-0000-5c78-866a27150000 pid=5415 clone guuid=6b903cfe-2300-0000-5c78-866a32150000 pid=5426 /tmp/Space dns net send-data guuid=79e4eaef-1800-0000-5c78-866ac20b0000 pid=3010->guuid=6b903cfe-2300-0000-5c78-866a32150000 pid=5426 clone guuid=fd0309f9-1800-0000-5c78-866aca0b0000 pid=3018->7a155949-225c-5534-9d46-ce85bc851092 send: 94B guuid=107359fd-1800-0000-5c78-866ad40b0000 pid=3028 /usr/bin/cp guuid=89161cfd-1800-0000-5c78-866ad20b0000 pid=3026->guuid=107359fd-1800-0000-5c78-866ad40b0000 pid=3028 execve guuid=066f8d02-1900-0000-5c78-866ae10b0000 pid=3041->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=2d1cb302-1900-0000-5c78-866ae20b0000 pid=3042 /tmp/Space guuid=066f8d02-1900-0000-5c78-866ae10b0000 pid=3041->guuid=2d1cb302-1900-0000-5c78-866ae20b0000 pid=3042 clone guuid=8499ff02-1900-0000-5c78-866ae50b0000 pid=3045 /tmp/Space write-config zombie guuid=2d1cb302-1900-0000-5c78-866ae20b0000 pid=3042->guuid=8499ff02-1900-0000-5c78-866ae50b0000 pid=3045 clone guuid=9a5dc102-1900-0000-5c78-866ae30b0000 pid=3043->7a155949-225c-5534-9d46-ce85bc851092 send: 147B guuid=7a923909-1900-0000-5c78-866af30b0000 pid=3059 /usr/bin/dash guuid=8499ff02-1900-0000-5c78-866ae50b0000 pid=3045->guuid=7a923909-1900-0000-5c78-866af30b0000 pid=3059 execve guuid=68d96b0f-1900-0000-5c78-866a080c0000 pid=3080 /tmp/Space delete-file guuid=8499ff02-1900-0000-5c78-866ae50b0000 pid=3045->guuid=68d96b0f-1900-0000-5c78-866a080c0000 pid=3080 clone guuid=d90c50b3-1c00-0000-5c78-866af6140000 pid=5366 /tmp/Space dns net send-data guuid=8499ff02-1900-0000-5c78-866ae50b0000 pid=3045->guuid=d90c50b3-1c00-0000-5c78-866af6140000 pid=5366 clone guuid=7ffdfd87-2500-0000-5c78-866a39150000 pid=5433 /tmp/Space dns net send-data guuid=8499ff02-1900-0000-5c78-866ae50b0000 pid=3045->guuid=7ffdfd87-2500-0000-5c78-866a39150000 pid=5433 clone guuid=49455507-1900-0000-5c78-866aee0b0000 pid=3054->7a155949-225c-5534-9d46-ce85bc851092 send: 96B guuid=8bf99009-1900-0000-5c78-866af50b0000 pid=3061 /usr/bin/cp guuid=7a923909-1900-0000-5c78-866af30b0000 pid=3059->guuid=8bf99009-1900-0000-5c78-866af50b0000 pid=3061 execve guuid=ab4fcb0e-1900-0000-5c78-866a050c0000 pid=3077->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=283c060f-1900-0000-5c78-866a060c0000 pid=3078 /tmp/Space guuid=ab4fcb0e-1900-0000-5c78-866a050c0000 pid=3077->guuid=283c060f-1900-0000-5c78-866a060c0000 pid=3078 clone guuid=5be21a10-1900-0000-5c78-866a0a0c0000 pid=3082 /tmp/Space write-config zombie guuid=283c060f-1900-0000-5c78-866a060c0000 pid=3078->guuid=5be21a10-1900-0000-5c78-866a0a0c0000 pid=3082 clone guuid=362f100f-1900-0000-5c78-866a070c0000 pid=3079->7a155949-225c-5534-9d46-ce85bc851092 send: 146B guuid=a7cf8317-1900-0000-5c78-866a1d0c0000 pid=3101 /usr/bin/dash guuid=5be21a10-1900-0000-5c78-866a0a0c0000 pid=3082->guuid=a7cf8317-1900-0000-5c78-866a1d0c0000 pid=3101 execve guuid=c8c3ef1c-1900-0000-5c78-866a2b0c0000 pid=3115 /tmp/Space delete-file dns net send-data guuid=5be21a10-1900-0000-5c78-866a0a0c0000 pid=3082->guuid=c8c3ef1c-1900-0000-5c78-866a2b0c0000 pid=3115 clone guuid=e16c461b-2100-0000-5c78-866a2b150000 pid=5419 /tmp/Space guuid=5be21a10-1900-0000-5c78-866a0a0c0000 pid=3082->guuid=e16c461b-2100-0000-5c78-866a2b150000 pid=5419 clone guuid=d0a583b7-2400-0000-5c78-866a36150000 pid=5430 /tmp/Space dns net send-data guuid=5be21a10-1900-0000-5c78-866a0a0c0000 pid=3082->guuid=d0a583b7-2400-0000-5c78-866a36150000 pid=5430 clone guuid=b5d1bf17-1900-0000-5c78-866a1f0c0000 pid=3103 /usr/bin/cp guuid=a7cf8317-1900-0000-5c78-866a1d0c0000 pid=3101->guuid=b5d1bf17-1900-0000-5c78-866a1f0c0000 pid=3103 execve guuid=0ec5b71a-1900-0000-5c78-866a270c0000 pid=3111->7a155949-225c-5534-9d46-ce85bc851092 send: 95B guuid=c8c3ef1c-1900-0000-5c78-866a2b0c0000 pid=3115->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 76B guuid=c8c3ef1c-1900-0000-5c78-866a2b0c0000 pid=3115->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=51879d2c-1900-0000-5c78-866a4c0c0000 pid=3148->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a29f892d-1900-0000-5c78-866a500c0000 pid=3152 /tmp/Space guuid=51879d2c-1900-0000-5c78-866a4c0c0000 pid=3148->guuid=a29f892d-1900-0000-5c78-866a500c0000 pid=3152 clone guuid=616fbf2d-1900-0000-5c78-866a530c0000 pid=3155 /tmp/Space write-config zombie guuid=a29f892d-1900-0000-5c78-866a500c0000 pid=3152->guuid=616fbf2d-1900-0000-5c78-866a530c0000 pid=3155 clone guuid=7321952d-1900-0000-5c78-866a510c0000 pid=3153->7a155949-225c-5534-9d46-ce85bc851092 send: 145B guuid=14c38e31-1900-0000-5c78-866a620c0000 pid=3170 /usr/bin/dash guuid=616fbf2d-1900-0000-5c78-866a530c0000 pid=3155->guuid=14c38e31-1900-0000-5c78-866a620c0000 pid=3170 execve guuid=f49e0d35-1900-0000-5c78-866a720c0000 pid=3186 /tmp/Space delete-file guuid=616fbf2d-1900-0000-5c78-866a530c0000 pid=3155->guuid=f49e0d35-1900-0000-5c78-866a720c0000 pid=3186 clone guuid=f16b6fd3-1c00-0000-5c78-866af8140000 pid=5368 /tmp/Space dns net send-data guuid=616fbf2d-1900-0000-5c78-866a530c0000 pid=3155->guuid=f16b6fd3-1c00-0000-5c78-866af8140000 pid=5368 clone guuid=8c048bfd-2100-0000-5c78-866a2d150000 pid=5421 /tmp/Space dns net send-data guuid=616fbf2d-1900-0000-5c78-866a530c0000 pid=3155->guuid=8c048bfd-2100-0000-5c78-866a2d150000 pid=5421 clone guuid=2b084403-2600-0000-5c78-866a3a150000 pid=5434 /tmp/Space guuid=616fbf2d-1900-0000-5c78-866a530c0000 pid=3155->guuid=2b084403-2600-0000-5c78-866a3a150000 pid=5434 clone guuid=58cb0032-1900-0000-5c78-866a650c0000 pid=3173 /usr/bin/cp guuid=14c38e31-1900-0000-5c78-866a620c0000 pid=3170->guuid=58cb0032-1900-0000-5c78-866a650c0000 pid=3173 execve guuid=a4ca6134-1900-0000-5c78-866a6e0c0000 pid=3182->7a155949-225c-5534-9d46-ce85bc851092 send: 94B guuid=acedca42-1900-0000-5c78-866aa40c0000 pid=3236->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e6be7b43-1900-0000-5c78-866aa70c0000 pid=3239 /tmp/Space guuid=acedca42-1900-0000-5c78-866aa40c0000 pid=3236->guuid=e6be7b43-1900-0000-5c78-866aa70c0000 pid=3239 clone guuid=500c0945-1900-0000-5c78-866aae0c0000 pid=3246 /tmp/Space write-config zombie guuid=e6be7b43-1900-0000-5c78-866aa70c0000 pid=3239->guuid=500c0945-1900-0000-5c78-866aae0c0000 pid=3246 clone guuid=99c9d54b-1900-0000-5c78-866ac70c0000 pid=3271 /usr/bin/dash guuid=500c0945-1900-0000-5c78-866aae0c0000 pid=3246->guuid=99c9d54b-1900-0000-5c78-866ac70c0000 pid=3271 execve guuid=3cba524e-1900-0000-5c78-866ad10c0000 pid=3281 /tmp/Space guuid=500c0945-1900-0000-5c78-866aae0c0000 pid=3246->guuid=3cba524e-1900-0000-5c78-866ad10c0000 pid=3281 clone guuid=7fb455ed-1c00-0000-5c78-866af9140000 pid=5369 /tmp/Space guuid=500c0945-1900-0000-5c78-866aae0c0000 pid=3246->guuid=7fb455ed-1c00-0000-5c78-866af9140000 pid=5369 clone guuid=23d5f68a-2000-0000-5c78-866a28150000 pid=5416 /tmp/Space guuid=500c0945-1900-0000-5c78-866aae0c0000 pid=3246->guuid=23d5f68a-2000-0000-5c78-866a28150000 pid=5416 clone guuid=675cbf2f-2400-0000-5c78-866a33150000 pid=5427 /tmp/Space dns net send-data guuid=500c0945-1900-0000-5c78-866aae0c0000 pid=3246->guuid=675cbf2f-2400-0000-5c78-866a33150000 pid=5427 clone guuid=db94174c-1900-0000-5c78-866ac90c0000 pid=3273 /usr/bin/cp guuid=99c9d54b-1900-0000-5c78-866ac70c0000 pid=3271->guuid=db94174c-1900-0000-5c78-866ac90c0000 pid=3273 execve guuid=c8e1bd3e-1c00-0000-5c78-866a7b140000 pid=5243->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=c8e1bd3e-1c00-0000-5c78-866a7b140000 pid=5243->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=a9901482-1c00-0000-5c78-866af4140000 pid=5364->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=a9901482-1c00-0000-5c78-866af4140000 pid=5364->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=d90c50b3-1c00-0000-5c78-866af6140000 pid=5366->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 76B guuid=d90c50b3-1c00-0000-5c78-866af6140000 pid=5366->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 10B guuid=f16b6fd3-1c00-0000-5c78-866af8140000 pid=5368->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 76B guuid=f16b6fd3-1c00-0000-5c78-866af8140000 pid=5368->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 10B guuid=649199e4-1f00-0000-5c78-866a24150000 pid=5412->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=649199e4-1f00-0000-5c78-866a24150000 pid=5412->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=2c01c748-2000-0000-5c78-866a26150000 pid=5414->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=2c01c748-2000-0000-5c78-866a26150000 pid=5414->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=1b3371a1-2000-0000-5c78-866a29150000 pid=5417->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=1b3371a1-2000-0000-5c78-866a29150000 pid=5417->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=e15ccf70-2100-0000-5c78-866a2c150000 pid=5420->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=e15ccf70-2100-0000-5c78-866a2c150000 pid=5420->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=8c048bfd-2100-0000-5c78-866a2d150000 pid=5421->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=8c048bfd-2100-0000-5c78-866a2d150000 pid=5421->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=5ee15077-2200-0000-5c78-866a2e150000 pid=5422->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=5ee15077-2200-0000-5c78-866a2e150000 pid=5422->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=118f7c06-2300-0000-5c78-866a2f150000 pid=5423->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=118f7c06-2300-0000-5c78-866a2f150000 pid=5423->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=6b903cfe-2300-0000-5c78-866a32150000 pid=5426->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=6b903cfe-2300-0000-5c78-866a32150000 pid=5426->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=675cbf2f-2400-0000-5c78-866a33150000 pid=5427->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=675cbf2f-2400-0000-5c78-866a33150000 pid=5427->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=cda9c389-2400-0000-5c78-866a35150000 pid=5429->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=cda9c389-2400-0000-5c78-866a35150000 pid=5429->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=d0a583b7-2400-0000-5c78-866a36150000 pid=5430->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=d0a583b7-2400-0000-5c78-866a36150000 pid=5430->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=2376c200-2500-0000-5c78-866a37150000 pid=5431->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=2376c200-2500-0000-5c78-866a37150000 pid=5431->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=81329341-2500-0000-5c78-866a38150000 pid=5432->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=81329341-2500-0000-5c78-866a38150000 pid=5432->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B guuid=7ffdfd87-2500-0000-5c78-866a39150000 pid=5433->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B guuid=7ffdfd87-2500-0000-5c78-866a39150000 pid=5433->a1cb65f6-afd3-5a3a-9fa0-f13741392136 send: 5B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9f8428c7b5aff816430749bdee66f029be2a141137464b2e15fa8e692bb8d67d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f8428c7b5aff816430749bdee66f029be2a141137464b2e15fa8e692bb8d67d/
Verdict:
Malicious
Threat:
Linux.Downloader.Medusa
Link:
https://tip.neiki.dev/file/9f8428c7b5aff816430749bdee66f029be2a141137464b2e15fa8e692bb8d67d
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-07-18 18:27:26 UTC
File Type:
Text (Shell)
AV detection:
23 of 38 (60.53%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t6ccrr5vv74bmqyhjg664zxqfg7cufarg5dewlqv7khgsk5y2z6q._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet credential_access defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/250718-w3ydga1ze1/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Reads process memory
Enumerates active TCP sockets
Enumerates running processes
Modifies init.d
Modifies rc script
File and Directory Permissions Modification
Executes dropped EXE
Mirai
Mirai family
Malware Config
C2 Extraction:
top1miku.duckdns.org
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
Link:
https://yomi.yoroi.company/submissions/9f8428c7b5aff816430749bdee66f029be2a141137464b2e15fa8e692bb8d67d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 9f8428c7b5aff816430749bdee66f029be2a141137464b2e15fa8e692bb8d67d

(this sample)

Mirai

elf 380cdfff39fab66e0d2f0e3217f0e2573374ebbde28f6a96343e2cb72c0ca944

  
URLhaus
https://urlhaus.abuse.ch/url/3584327/
  
Delivery method
Distributed via web download
  
Dropping
MD5 905013b7c3593e1de6763b433ddf9f26
  
Dropping
SHA256 380cdfff39fab66e0d2f0e3217f0e2573374ebbde28f6a96343e2cb72c0ca944

Comments