MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a607b3d80f2636dc75e3d09b82ce6bb78e558346f03edb8375240a4c850017a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a607b3d80f2636dc75e3d09b82ce6bb78e558346f03edb8375240a4c850017a3
SHA3-384 hash: aca9187dfc2f2c2b93eec534e5c7a394fa1686b295e5c7a3db8fa8914a62a20d933a012591d93701c02fa4f9f191edc6
SHA1 hash: 81e592be1a425962d387dc18154648e17808911a
MD5 hash: 6d8d72ce53e72534392523fd2ad76992
humanhash: arkansas-fourteen-mexico-chicken
File name:ohshit.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'000 bytes
First seen:2025-09-21 06:31:45 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vqs7ps7N7hqsgs6GqsgYszPqswsKWqs2soUqs72s7o7UqsfTs3bqsZs9RqsCscgz:vz7u7N7hzJ6GzgxzPz5KWzHoUz7H7o76
TLSH T12A51258583E84C702DE3EA13F6B6492832D599D388F1EF95DDE8BAE0064EE187540773
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://163.227.230.253/hiddenbin/boatnet.x86af426babc8e24f4cb6cbf35167828d4d3eb055d2529da0768417271adea126f9 Miraielf geofenced mirai ua-wget USA x86
http://163.227.230.253/hiddenbin/boatnet.mips616f4b853cc70e57f0d765164912d8d9759a8ddb6602e2c054dc7713c09978dc Miraielf geofenced mips mirai ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.arcf0fec23945be66cc15a64affbe124209f2b889cbcdcec81848d7838b07e8fb20 Miraiarc elf geofenced mirai ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.i468n/an/aelf ua-wget
http://163.227.230.253/hiddenbin/boatnet.i686n/an/aelf ua-wget
http://163.227.230.253/hiddenbin/boatnet.x86_64n/an/aelf ua-wget
http://163.227.230.253/hiddenbin/boatnet.mpsld9eb1bb32bb07a38c6338bb4ee71362c8e4592ae8ffb5aa650d36498a200c1c8 Miraielf geofenced mips mirai ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.armcb225473655ac08d26585fc4e08da247af4cb12b900a7f6f4759a1eecbac7922 Miraiarm elf geofenced mirai ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.arm561d23efb68c9a03b37a2892d27cebf2a6db37460aee2d7e642ca65232cb7bf58 Miraiarm elf geofenced mirai ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.arm6a4dec50eeb503d935a9a724ae7c29ed788af9ec1cec5a42f3633b300e2553853 Miraiarm elf geofenced mirai ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.arm7af7b2a5f910c06373700188ce365cf79773da3ae94f427225c530c3befa8a6b2 Miraiarm elf geofenced mirai ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.ppc026f6621e7687accad288db16f2f9f5a00b2fa37cc694a68e71caa29b12acd3d Miraielf geofenced mirai PowerPC ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.spc910a082d421725994071c49b9ba60973270b372e63368c61db1027341a2578e7 Miraielf geofenced mirai sparc ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.m68kc218fd0a716ee2b91b9716d729c2cde176331357ced4ec015248ea555a86083e Miraielf geofenced m68k mirai ua-wget USA
http://163.227.230.253/hiddenbin/boatnet.sh44a2c7a6e46e499f35dd3a1771e672e021ef5266de34e91523013816b787026d2 Miraielf geofenced mirai SuperH ua-wget USA

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-21T03:50:00Z UTC
Last seen:
2025-09-21T03:50:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/a607b3d80f2636dc75e3d09b82ce6bb78e558346f03edb8375240a4c850017a3/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1c6bd474-4637-4516-be96-df9203ee6756
Behavior Graph:
Download SVG
%3 guuid=95ef060a-1a00-0000-57f2-599552090000 pid=2386 /usr/bin/sudo guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395 /tmp/sample.bin guuid=95ef060a-1a00-0000-57f2-599552090000 pid=2386->guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395 execve guuid=2bb8570d-1a00-0000-57f2-59955d090000 pid=2397 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=2bb8570d-1a00-0000-57f2-59955d090000 pid=2397 execve guuid=fa3d6e3a-1a00-0000-57f2-5995b4090000 pid=2484 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=fa3d6e3a-1a00-0000-57f2-5995b4090000 pid=2484 execve guuid=ee8be96c-1a00-0000-57f2-5995020a0000 pid=2562 /usr/bin/cat guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=ee8be96c-1a00-0000-57f2-5995020a0000 pid=2562 execve guuid=7801bb6d-1a00-0000-57f2-5995040a0000 pid=2564 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=7801bb6d-1a00-0000-57f2-5995040a0000 pid=2564 execve guuid=510b406e-1a00-0000-57f2-5995060a0000 pid=2566 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=510b406e-1a00-0000-57f2-5995060a0000 pid=2566 execve guuid=faccd86e-1a00-0000-57f2-59950c0a0000 pid=2572 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=faccd86e-1a00-0000-57f2-59950c0a0000 pid=2572 execve guuid=a7cab89a-1a00-0000-57f2-5995730a0000 pid=2675 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=a7cab89a-1a00-0000-57f2-5995730a0000 pid=2675 execve guuid=89450ecb-1a00-0000-57f2-5995ca0a0000 pid=2762 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=89450ecb-1a00-0000-57f2-5995ca0a0000 pid=2762 clone guuid=e2653bcb-1a00-0000-57f2-5995cb0a0000 pid=2763 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=e2653bcb-1a00-0000-57f2-5995cb0a0000 pid=2763 execve guuid=2a4bbccb-1a00-0000-57f2-5995cd0a0000 pid=2765 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=2a4bbccb-1a00-0000-57f2-5995cd0a0000 pid=2765 execve guuid=d4dc12cc-1a00-0000-57f2-5995d20a0000 pid=2770 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=d4dc12cc-1a00-0000-57f2-5995d20a0000 pid=2770 execve guuid=e7262514-1b00-0000-57f2-5995130b0000 pid=2835 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=e7262514-1b00-0000-57f2-5995130b0000 pid=2835 execve guuid=609fcf5d-1b00-0000-57f2-5995820b0000 pid=2946 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=609fcf5d-1b00-0000-57f2-5995820b0000 pid=2946 clone guuid=3237f35d-1b00-0000-57f2-5995830b0000 pid=2947 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=3237f35d-1b00-0000-57f2-5995830b0000 pid=2947 execve guuid=1465635e-1b00-0000-57f2-5995850b0000 pid=2949 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=1465635e-1b00-0000-57f2-5995850b0000 pid=2949 execve guuid=6595c05e-1b00-0000-57f2-59958a0b0000 pid=2954 /usr/bin/wget net send-data guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=6595c05e-1b00-0000-57f2-59958a0b0000 pid=2954 execve guuid=09fbeb7c-1b00-0000-57f2-5995b90b0000 pid=3001 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=09fbeb7c-1b00-0000-57f2-5995b90b0000 pid=3001 execve guuid=aabfd79d-1b00-0000-57f2-5995150c0000 pid=3093 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=aabfd79d-1b00-0000-57f2-5995150c0000 pid=3093 clone guuid=9b40fc9d-1b00-0000-57f2-5995160c0000 pid=3094 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=9b40fc9d-1b00-0000-57f2-5995160c0000 pid=3094 execve guuid=cd447e9e-1b00-0000-57f2-5995180c0000 pid=3096 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=cd447e9e-1b00-0000-57f2-5995180c0000 pid=3096 execve guuid=74e1e69e-1b00-0000-57f2-59951d0c0000 pid=3101 /usr/bin/wget net send-data guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=74e1e69e-1b00-0000-57f2-59951d0c0000 pid=3101 execve guuid=d13184bd-1b00-0000-57f2-59955a0c0000 pid=3162 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=d13184bd-1b00-0000-57f2-59955a0c0000 pid=3162 execve guuid=c76ae3dc-1b00-0000-57f2-5995930c0000 pid=3219 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=c76ae3dc-1b00-0000-57f2-5995930c0000 pid=3219 clone guuid=320dfadc-1b00-0000-57f2-5995940c0000 pid=3220 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=320dfadc-1b00-0000-57f2-5995940c0000 pid=3220 execve guuid=da1e45dd-1b00-0000-57f2-5995950c0000 pid=3221 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=da1e45dd-1b00-0000-57f2-5995950c0000 pid=3221 execve guuid=648588dd-1b00-0000-57f2-59959a0c0000 pid=3226 /usr/bin/wget net send-data guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=648588dd-1b00-0000-57f2-59959a0c0000 pid=3226 execve guuid=0e4509fa-1b00-0000-57f2-5995ca0c0000 pid=3274 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=0e4509fa-1b00-0000-57f2-5995ca0c0000 pid=3274 execve guuid=6841d31a-1c00-0000-57f2-5995f80c0000 pid=3320 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=6841d31a-1c00-0000-57f2-5995f80c0000 pid=3320 clone guuid=c38b0c1b-1c00-0000-57f2-5995fa0c0000 pid=3322 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=c38b0c1b-1c00-0000-57f2-5995fa0c0000 pid=3322 execve guuid=b8658b1b-1c00-0000-57f2-5995fc0c0000 pid=3324 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=b8658b1b-1c00-0000-57f2-5995fc0c0000 pid=3324 execve guuid=51e21a1c-1c00-0000-57f2-5995010d0000 pid=3329 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=51e21a1c-1c00-0000-57f2-5995010d0000 pid=3329 execve guuid=530c7a4a-1c00-0000-57f2-5995480d0000 pid=3400 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=530c7a4a-1c00-0000-57f2-5995480d0000 pid=3400 execve guuid=4c1a4d79-1c00-0000-57f2-5995af0d0000 pid=3503 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=4c1a4d79-1c00-0000-57f2-5995af0d0000 pid=3503 clone guuid=10f37e79-1c00-0000-57f2-5995b00d0000 pid=3504 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=10f37e79-1c00-0000-57f2-5995b00d0000 pid=3504 execve guuid=001a1f7a-1c00-0000-57f2-5995b30d0000 pid=3507 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=001a1f7a-1c00-0000-57f2-5995b30d0000 pid=3507 execve guuid=6536967a-1c00-0000-57f2-5995b80d0000 pid=3512 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=6536967a-1c00-0000-57f2-5995b80d0000 pid=3512 execve guuid=d367cfa6-1c00-0000-57f2-5995fe0d0000 pid=3582 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=d367cfa6-1c00-0000-57f2-5995fe0d0000 pid=3582 execve guuid=3c238fd3-1c00-0000-57f2-59956a0e0000 pid=3690 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=3c238fd3-1c00-0000-57f2-59956a0e0000 pid=3690 clone guuid=b51edbd3-1c00-0000-57f2-59956b0e0000 pid=3691 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=b51edbd3-1c00-0000-57f2-59956b0e0000 pid=3691 execve guuid=592266d4-1c00-0000-57f2-59956d0e0000 pid=3693 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=592266d4-1c00-0000-57f2-59956d0e0000 pid=3693 execve guuid=9c7dd6d4-1c00-0000-57f2-5995730e0000 pid=3699 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=9c7dd6d4-1c00-0000-57f2-5995730e0000 pid=3699 execve guuid=d11dd301-1d00-0000-57f2-5995bd0e0000 pid=3773 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=d11dd301-1d00-0000-57f2-5995bd0e0000 pid=3773 execve guuid=97a2a42f-1d00-0000-57f2-5995450f0000 pid=3909 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=97a2a42f-1d00-0000-57f2-5995450f0000 pid=3909 clone guuid=d12bcb2f-1d00-0000-57f2-5995460f0000 pid=3910 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=d12bcb2f-1d00-0000-57f2-5995460f0000 pid=3910 execve guuid=78a05930-1d00-0000-57f2-5995480f0000 pid=3912 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=78a05930-1d00-0000-57f2-5995480f0000 pid=3912 execve guuid=5f26b130-1d00-0000-57f2-59954e0f0000 pid=3918 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=5f26b130-1d00-0000-57f2-59954e0f0000 pid=3918 execve guuid=92456a5c-1d00-0000-57f2-5995b90f0000 pid=4025 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=92456a5c-1d00-0000-57f2-5995b90f0000 pid=4025 execve guuid=322c968c-1d00-0000-57f2-599552100000 pid=4178 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=322c968c-1d00-0000-57f2-599552100000 pid=4178 clone guuid=d6bab58c-1d00-0000-57f2-599553100000 pid=4179 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=d6bab58c-1d00-0000-57f2-599553100000 pid=4179 execve guuid=c97f278d-1d00-0000-57f2-599554100000 pid=4180 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=c97f278d-1d00-0000-57f2-599554100000 pid=4180 execve guuid=5087898d-1d00-0000-57f2-599558100000 pid=4184 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=5087898d-1d00-0000-57f2-599558100000 pid=4184 execve guuid=5fef1bc8-1d00-0000-57f2-59950b110000 pid=4363 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=5fef1bc8-1d00-0000-57f2-59950b110000 pid=4363 execve guuid=92ff4f05-1e00-0000-57f2-5995c0110000 pid=4544 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=92ff4f05-1e00-0000-57f2-5995c0110000 pid=4544 clone guuid=8ce06505-1e00-0000-57f2-5995c1110000 pid=4545 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=8ce06505-1e00-0000-57f2-5995c1110000 pid=4545 execve guuid=caf1d505-1e00-0000-57f2-5995c4110000 pid=4548 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=caf1d505-1e00-0000-57f2-5995c4110000 pid=4548 execve guuid=88154806-1e00-0000-57f2-5995ca110000 pid=4554 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=88154806-1e00-0000-57f2-5995ca110000 pid=4554 execve guuid=0606a837-1e00-0000-57f2-59955a120000 pid=4698 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=0606a837-1e00-0000-57f2-59955a120000 pid=4698 execve guuid=44b49f66-1e00-0000-57f2-5995dd120000 pid=4829 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=44b49f66-1e00-0000-57f2-5995dd120000 pid=4829 clone guuid=77a9c266-1e00-0000-57f2-5995de120000 pid=4830 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=77a9c266-1e00-0000-57f2-5995de120000 pid=4830 execve guuid=c8df1f67-1e00-0000-57f2-5995e0120000 pid=4832 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=c8df1f67-1e00-0000-57f2-5995e0120000 pid=4832 execve guuid=b4588067-1e00-0000-57f2-5995e6120000 pid=4838 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=b4588067-1e00-0000-57f2-5995e6120000 pid=4838 execve guuid=e82b74a2-1e00-0000-57f2-599596130000 pid=5014 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=e82b74a2-1e00-0000-57f2-599596130000 pid=5014 execve guuid=46bed1dd-1e00-0000-57f2-599538140000 pid=5176 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=46bed1dd-1e00-0000-57f2-599538140000 pid=5176 clone guuid=a0caefdd-1e00-0000-57f2-599539140000 pid=5177 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=a0caefdd-1e00-0000-57f2-599539140000 pid=5177 execve guuid=15a83cde-1e00-0000-57f2-59953d140000 pid=5181 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=15a83cde-1e00-0000-57f2-59953d140000 pid=5181 execve guuid=7cdb8fde-1e00-0000-57f2-599542140000 pid=5186 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=7cdb8fde-1e00-0000-57f2-599542140000 pid=5186 execve guuid=4afd441a-1f00-0000-57f2-5995c9140000 pid=5321 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=4afd441a-1f00-0000-57f2-5995c9140000 pid=5321 execve guuid=49dce254-1f00-0000-57f2-5995d2140000 pid=5330 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=49dce254-1f00-0000-57f2-5995d2140000 pid=5330 clone guuid=a2d20355-1f00-0000-57f2-5995d3140000 pid=5331 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=a2d20355-1f00-0000-57f2-5995d3140000 pid=5331 execve guuid=54a66255-1f00-0000-57f2-5995d4140000 pid=5332 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=54a66255-1f00-0000-57f2-5995d4140000 pid=5332 execve guuid=7381b755-1f00-0000-57f2-5995d8140000 pid=5336 /usr/bin/wget net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=7381b755-1f00-0000-57f2-5995d8140000 pid=5336 execve guuid=10259692-1f00-0000-57f2-5995d9140000 pid=5337 /usr/bin/curl net send-data write-file guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=10259692-1f00-0000-57f2-5995d9140000 pid=5337 execve guuid=3623afe3-1f00-0000-57f2-5995da140000 pid=5338 /usr/bin/bash guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=3623afe3-1f00-0000-57f2-5995da140000 pid=5338 clone guuid=bbc4d6e3-1f00-0000-57f2-5995db140000 pid=5339 /usr/bin/chmod guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=bbc4d6e3-1f00-0000-57f2-5995db140000 pid=5339 execve guuid=b2f549e4-1f00-0000-57f2-5995dc140000 pid=5340 /tmp/WTF net guuid=9795c40c-1a00-0000-57f2-59955b090000 pid=2395->guuid=b2f549e4-1f00-0000-57f2-5995dc140000 pid=5340 execve 1c88832a-ffa5-5d1a-82f5-e1b834d455c8 163.227.230.253:80 guuid=2bb8570d-1a00-0000-57f2-59955d090000 pid=2397->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 151B guuid=fa3d6e3a-1a00-0000-57f2-5995b4090000 pid=2484->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 100B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=510b406e-1a00-0000-57f2-5995060a0000 pid=2566->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=42a7ad6e-1a00-0000-57f2-5995080a0000 pid=2568 /tmp/WTF guuid=510b406e-1a00-0000-57f2-5995060a0000 pid=2566->guuid=42a7ad6e-1a00-0000-57f2-5995080a0000 pid=2568 clone guuid=6235b36e-1a00-0000-57f2-59950a0a0000 pid=2570 /tmp/WTF guuid=510b406e-1a00-0000-57f2-5995060a0000 pid=2566->guuid=6235b36e-1a00-0000-57f2-59950a0a0000 pid=2570 clone guuid=4a52ba6e-1a00-0000-57f2-59950b0a0000 pid=2571 /tmp/WTF net send-data zombie guuid=510b406e-1a00-0000-57f2-5995060a0000 pid=2566->guuid=4a52ba6e-1a00-0000-57f2-59950b0a0000 pid=2571 clone guuid=4a52ba6e-1a00-0000-57f2-59950b0a0000 pid=2571->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 0bf92710-15f4-5fe3-8595-77bb0529d2b0 163.227.230.253:3778 guuid=4a52ba6e-1a00-0000-57f2-59950b0a0000 pid=2571->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=faccd86e-1a00-0000-57f2-59950c0a0000 pid=2572->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 152B guuid=a7cab89a-1a00-0000-57f2-5995730a0000 pid=2675->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 101B guuid=2a4bbccb-1a00-0000-57f2-5995cd0a0000 pid=2765->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=61adf7cb-1a00-0000-57f2-5995ce0a0000 pid=2766 /tmp/WTF guuid=2a4bbccb-1a00-0000-57f2-5995cd0a0000 pid=2765->guuid=61adf7cb-1a00-0000-57f2-5995ce0a0000 pid=2766 clone guuid=45a7fbcb-1a00-0000-57f2-5995cf0a0000 pid=2767 /tmp/WTF guuid=2a4bbccb-1a00-0000-57f2-5995cd0a0000 pid=2765->guuid=45a7fbcb-1a00-0000-57f2-5995cf0a0000 pid=2767 clone guuid=6f7100cc-1a00-0000-57f2-5995d00a0000 pid=2768 /tmp/WTF net send-data zombie guuid=2a4bbccb-1a00-0000-57f2-5995cd0a0000 pid=2765->guuid=6f7100cc-1a00-0000-57f2-5995d00a0000 pid=2768 clone guuid=6f7100cc-1a00-0000-57f2-5995d00a0000 pid=2768->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6f7100cc-1a00-0000-57f2-5995d00a0000 pid=2768->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 12B guuid=d4dc12cc-1a00-0000-57f2-5995d20a0000 pid=2770->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 151B guuid=e7262514-1b00-0000-57f2-5995130b0000 pid=2835->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 100B guuid=1465635e-1b00-0000-57f2-5995850b0000 pid=2949->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1409a45e-1b00-0000-57f2-5995870b0000 pid=2951 /tmp/WTF guuid=1465635e-1b00-0000-57f2-5995850b0000 pid=2949->guuid=1409a45e-1b00-0000-57f2-5995870b0000 pid=2951 clone guuid=b130ac5e-1b00-0000-57f2-5995880b0000 pid=2952 /tmp/WTF guuid=1465635e-1b00-0000-57f2-5995850b0000 pid=2949->guuid=b130ac5e-1b00-0000-57f2-5995880b0000 pid=2952 clone guuid=d2f8b05e-1b00-0000-57f2-5995890b0000 pid=2953 /tmp/WTF net send-data zombie guuid=1465635e-1b00-0000-57f2-5995850b0000 pid=2949->guuid=d2f8b05e-1b00-0000-57f2-5995890b0000 pid=2953 clone guuid=d2f8b05e-1b00-0000-57f2-5995890b0000 pid=2953->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d2f8b05e-1b00-0000-57f2-5995890b0000 pid=2953->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=6595c05e-1b00-0000-57f2-59958a0b0000 pid=2954->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 152B guuid=09fbeb7c-1b00-0000-57f2-5995b90b0000 pid=3001->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 101B guuid=cd447e9e-1b00-0000-57f2-5995180c0000 pid=3096->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1262c09e-1b00-0000-57f2-5995190c0000 pid=3097 /tmp/WTF guuid=cd447e9e-1b00-0000-57f2-5995180c0000 pid=3096->guuid=1262c09e-1b00-0000-57f2-5995190c0000 pid=3097 clone guuid=387ad19e-1b00-0000-57f2-59951b0c0000 pid=3099 /tmp/WTF guuid=cd447e9e-1b00-0000-57f2-5995180c0000 pid=3096->guuid=387ad19e-1b00-0000-57f2-59951b0c0000 pid=3099 clone guuid=ffead79e-1b00-0000-57f2-59951c0c0000 pid=3100 /tmp/WTF net send-data zombie guuid=cd447e9e-1b00-0000-57f2-5995180c0000 pid=3096->guuid=ffead79e-1b00-0000-57f2-59951c0c0000 pid=3100 clone guuid=ffead79e-1b00-0000-57f2-59951c0c0000 pid=3100->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ffead79e-1b00-0000-57f2-59951c0c0000 pid=3100->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=74e1e69e-1b00-0000-57f2-59951d0c0000 pid=3101->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 152B guuid=d13184bd-1b00-0000-57f2-59955a0c0000 pid=3162->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 101B guuid=da1e45dd-1b00-0000-57f2-5995950c0000 pid=3221->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=2b9272dd-1b00-0000-57f2-5995970c0000 pid=3223 /tmp/WTF guuid=da1e45dd-1b00-0000-57f2-5995950c0000 pid=3221->guuid=2b9272dd-1b00-0000-57f2-5995970c0000 pid=3223 clone guuid=020276dd-1b00-0000-57f2-5995980c0000 pid=3224 /tmp/WTF guuid=da1e45dd-1b00-0000-57f2-5995950c0000 pid=3221->guuid=020276dd-1b00-0000-57f2-5995980c0000 pid=3224 clone guuid=ee2a79dd-1b00-0000-57f2-5995990c0000 pid=3225 /tmp/WTF net send-data zombie guuid=da1e45dd-1b00-0000-57f2-5995950c0000 pid=3221->guuid=ee2a79dd-1b00-0000-57f2-5995990c0000 pid=3225 clone guuid=ee2a79dd-1b00-0000-57f2-5995990c0000 pid=3225->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ee2a79dd-1b00-0000-57f2-5995990c0000 pid=3225->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 12B guuid=648588dd-1b00-0000-57f2-59959a0c0000 pid=3226->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 154B guuid=0e4509fa-1b00-0000-57f2-5995ca0c0000 pid=3274->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 103B guuid=b8658b1b-1c00-0000-57f2-5995fc0c0000 pid=3324->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c4fcf11b-1c00-0000-57f2-5995fe0c0000 pid=3326 /tmp/WTF guuid=b8658b1b-1c00-0000-57f2-5995fc0c0000 pid=3324->guuid=c4fcf11b-1c00-0000-57f2-5995fe0c0000 pid=3326 clone guuid=01a2fc1b-1c00-0000-57f2-5995ff0c0000 pid=3327 /tmp/WTF guuid=b8658b1b-1c00-0000-57f2-5995fc0c0000 pid=3324->guuid=01a2fc1b-1c00-0000-57f2-5995ff0c0000 pid=3327 clone guuid=8eb1021c-1c00-0000-57f2-5995000d0000 pid=3328 /tmp/WTF net send-data zombie guuid=b8658b1b-1c00-0000-57f2-5995fc0c0000 pid=3324->guuid=8eb1021c-1c00-0000-57f2-5995000d0000 pid=3328 clone guuid=8eb1021c-1c00-0000-57f2-5995000d0000 pid=3328->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8eb1021c-1c00-0000-57f2-5995000d0000 pid=3328->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=51e21a1c-1c00-0000-57f2-5995010d0000 pid=3329->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 152B guuid=530c7a4a-1c00-0000-57f2-5995480d0000 pid=3400->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 101B guuid=001a1f7a-1c00-0000-57f2-5995b30d0000 pid=3507->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=dc696a7a-1c00-0000-57f2-5995b40d0000 pid=3508 /tmp/WTF guuid=001a1f7a-1c00-0000-57f2-5995b30d0000 pid=3507->guuid=dc696a7a-1c00-0000-57f2-5995b40d0000 pid=3508 clone guuid=e8d8707a-1c00-0000-57f2-5995b50d0000 pid=3509 /tmp/WTF guuid=001a1f7a-1c00-0000-57f2-5995b30d0000 pid=3507->guuid=e8d8707a-1c00-0000-57f2-5995b50d0000 pid=3509 clone guuid=7c14767a-1c00-0000-57f2-5995b60d0000 pid=3510 /tmp/WTF net send-data zombie guuid=001a1f7a-1c00-0000-57f2-5995b30d0000 pid=3507->guuid=7c14767a-1c00-0000-57f2-5995b60d0000 pid=3510 clone guuid=7c14767a-1c00-0000-57f2-5995b60d0000 pid=3510->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7c14767a-1c00-0000-57f2-5995b60d0000 pid=3510->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=6536967a-1c00-0000-57f2-5995b80d0000 pid=3512->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 151B guuid=d367cfa6-1c00-0000-57f2-5995fe0d0000 pid=3582->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 100B guuid=592266d4-1c00-0000-57f2-59956d0e0000 pid=3693->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cb30b2d4-1c00-0000-57f2-59956e0e0000 pid=3694 /tmp/WTF guuid=592266d4-1c00-0000-57f2-59956d0e0000 pid=3693->guuid=cb30b2d4-1c00-0000-57f2-59956e0e0000 pid=3694 clone guuid=393eb5d4-1c00-0000-57f2-59956f0e0000 pid=3695 /tmp/WTF guuid=592266d4-1c00-0000-57f2-59956d0e0000 pid=3693->guuid=393eb5d4-1c00-0000-57f2-59956f0e0000 pid=3695 clone guuid=6064b8d4-1c00-0000-57f2-5995700e0000 pid=3696 /tmp/WTF net send-data zombie guuid=592266d4-1c00-0000-57f2-59956d0e0000 pid=3693->guuid=6064b8d4-1c00-0000-57f2-5995700e0000 pid=3696 clone guuid=6064b8d4-1c00-0000-57f2-5995700e0000 pid=3696->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6064b8d4-1c00-0000-57f2-5995700e0000 pid=3696->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 12B guuid=9c7dd6d4-1c00-0000-57f2-5995730e0000 pid=3699->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 152B guuid=d11dd301-1d00-0000-57f2-5995bd0e0000 pid=3773->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 101B guuid=78a05930-1d00-0000-57f2-5995480f0000 pid=3912->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a06f9230-1d00-0000-57f2-59954a0f0000 pid=3914 /tmp/WTF guuid=78a05930-1d00-0000-57f2-5995480f0000 pid=3912->guuid=a06f9230-1d00-0000-57f2-59954a0f0000 pid=3914 clone guuid=54e29830-1d00-0000-57f2-59954b0f0000 pid=3915 /tmp/WTF guuid=78a05930-1d00-0000-57f2-5995480f0000 pid=3912->guuid=54e29830-1d00-0000-57f2-59954b0f0000 pid=3915 clone guuid=c25ca030-1d00-0000-57f2-59954c0f0000 pid=3916 /tmp/WTF net send-data zombie guuid=78a05930-1d00-0000-57f2-5995480f0000 pid=3912->guuid=c25ca030-1d00-0000-57f2-59954c0f0000 pid=3916 clone guuid=c25ca030-1d00-0000-57f2-59954c0f0000 pid=3916->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c25ca030-1d00-0000-57f2-59954c0f0000 pid=3916->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=5f26b130-1d00-0000-57f2-59954e0f0000 pid=3918->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 152B guuid=92456a5c-1d00-0000-57f2-5995b90f0000 pid=4025->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 101B guuid=c97f278d-1d00-0000-57f2-599554100000 pid=4180->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e62f688d-1d00-0000-57f2-599555100000 pid=4181 /tmp/WTF guuid=c97f278d-1d00-0000-57f2-599554100000 pid=4180->guuid=e62f688d-1d00-0000-57f2-599555100000 pid=4181 clone guuid=13ff6b8d-1d00-0000-57f2-599556100000 pid=4182 /tmp/WTF guuid=c97f278d-1d00-0000-57f2-599554100000 pid=4180->guuid=13ff6b8d-1d00-0000-57f2-599556100000 pid=4182 clone guuid=5751708d-1d00-0000-57f2-599557100000 pid=4183 /tmp/WTF net send-data zombie guuid=c97f278d-1d00-0000-57f2-599554100000 pid=4180->guuid=5751708d-1d00-0000-57f2-599557100000 pid=4183 clone guuid=5751708d-1d00-0000-57f2-599557100000 pid=4183->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5751708d-1d00-0000-57f2-599557100000 pid=4183->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=5087898d-1d00-0000-57f2-599558100000 pid=4184->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 152B guuid=5fef1bc8-1d00-0000-57f2-59950b110000 pid=4363->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 101B guuid=caf1d505-1e00-0000-57f2-5995c4110000 pid=4548->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ab811a06-1e00-0000-57f2-5995c6110000 pid=4550 /tmp/WTF guuid=caf1d505-1e00-0000-57f2-5995c4110000 pid=4548->guuid=ab811a06-1e00-0000-57f2-5995c6110000 pid=4550 clone guuid=870d1f06-1e00-0000-57f2-5995c7110000 pid=4551 /tmp/WTF guuid=caf1d505-1e00-0000-57f2-5995c4110000 pid=4548->guuid=870d1f06-1e00-0000-57f2-5995c7110000 pid=4551 clone guuid=3d4f2806-1e00-0000-57f2-5995c8110000 pid=4552 /tmp/WTF net send-data zombie guuid=caf1d505-1e00-0000-57f2-5995c4110000 pid=4548->guuid=3d4f2806-1e00-0000-57f2-5995c8110000 pid=4552 clone guuid=3d4f2806-1e00-0000-57f2-5995c8110000 pid=4552->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3d4f2806-1e00-0000-57f2-5995c8110000 pid=4552->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=88154806-1e00-0000-57f2-5995ca110000 pid=4554->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 151B guuid=0606a837-1e00-0000-57f2-59955a120000 pid=4698->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 100B guuid=c8df1f67-1e00-0000-57f2-5995e0120000 pid=4832->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a4856367-1e00-0000-57f2-5995e2120000 pid=4834 /tmp/WTF guuid=c8df1f67-1e00-0000-57f2-5995e0120000 pid=4832->guuid=a4856367-1e00-0000-57f2-5995e2120000 pid=4834 clone guuid=93796967-1e00-0000-57f2-5995e3120000 pid=4835 /tmp/WTF guuid=c8df1f67-1e00-0000-57f2-5995e0120000 pid=4832->guuid=93796967-1e00-0000-57f2-5995e3120000 pid=4835 clone guuid=35f07067-1e00-0000-57f2-5995e5120000 pid=4837 /tmp/WTF net send-data zombie guuid=c8df1f67-1e00-0000-57f2-5995e0120000 pid=4832->guuid=35f07067-1e00-0000-57f2-5995e5120000 pid=4837 clone guuid=35f07067-1e00-0000-57f2-5995e5120000 pid=4837->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=35f07067-1e00-0000-57f2-5995e5120000 pid=4837->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 7B guuid=b4588067-1e00-0000-57f2-5995e6120000 pid=4838->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 151B guuid=e82b74a2-1e00-0000-57f2-599596130000 pid=5014->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 100B guuid=15a83cde-1e00-0000-57f2-59953d140000 pid=5181->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=de866cde-1e00-0000-57f2-59953e140000 pid=5182 /tmp/WTF guuid=15a83cde-1e00-0000-57f2-59953d140000 pid=5181->guuid=de866cde-1e00-0000-57f2-59953e140000 pid=5182 clone guuid=74b373de-1e00-0000-57f2-59953f140000 pid=5183 /tmp/WTF guuid=15a83cde-1e00-0000-57f2-59953d140000 pid=5181->guuid=74b373de-1e00-0000-57f2-59953f140000 pid=5183 clone guuid=9b477bde-1e00-0000-57f2-599540140000 pid=5184 /tmp/WTF net send-data zombie guuid=15a83cde-1e00-0000-57f2-59953d140000 pid=5181->guuid=9b477bde-1e00-0000-57f2-599540140000 pid=5184 clone guuid=9b477bde-1e00-0000-57f2-599540140000 pid=5184->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9b477bde-1e00-0000-57f2-599540140000 pid=5184->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 12B guuid=7cdb8fde-1e00-0000-57f2-599542140000 pid=5186->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 152B guuid=4afd441a-1f00-0000-57f2-5995c9140000 pid=5321->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 101B guuid=54a66255-1f00-0000-57f2-5995d4140000 pid=5332->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ec4c9055-1f00-0000-57f2-5995d5140000 pid=5333 /tmp/WTF guuid=54a66255-1f00-0000-57f2-5995d4140000 pid=5332->guuid=ec4c9055-1f00-0000-57f2-5995d5140000 pid=5333 clone guuid=49ac9655-1f00-0000-57f2-5995d6140000 pid=5334 /tmp/WTF guuid=54a66255-1f00-0000-57f2-5995d4140000 pid=5332->guuid=49ac9655-1f00-0000-57f2-5995d6140000 pid=5334 clone guuid=0d629f55-1f00-0000-57f2-5995d7140000 pid=5335 /tmp/WTF net send-data zombie guuid=54a66255-1f00-0000-57f2-5995d4140000 pid=5332->guuid=0d629f55-1f00-0000-57f2-5995d7140000 pid=5335 clone guuid=0d629f55-1f00-0000-57f2-5995d7140000 pid=5335->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0d629f55-1f00-0000-57f2-5995d7140000 pid=5335->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 12B guuid=7381b755-1f00-0000-57f2-5995d8140000 pid=5336->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 151B guuid=10259692-1f00-0000-57f2-5995d9140000 pid=5337->1c88832a-ffa5-5d1a-82f5-e1b834d455c8 send: 100B guuid=b2f549e4-1f00-0000-57f2-5995dc140000 pid=5340->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=35a17fe4-1f00-0000-57f2-5995dd140000 pid=5341 /tmp/WTF guuid=b2f549e4-1f00-0000-57f2-5995dc140000 pid=5340->guuid=35a17fe4-1f00-0000-57f2-5995dd140000 pid=5341 clone guuid=0b6f84e4-1f00-0000-57f2-5995de140000 pid=5342 /tmp/WTF guuid=b2f549e4-1f00-0000-57f2-5995dc140000 pid=5340->guuid=0b6f84e4-1f00-0000-57f2-5995de140000 pid=5342 clone guuid=223e89e4-1f00-0000-57f2-5995df140000 pid=5343 /tmp/WTF net send-data zombie guuid=b2f549e4-1f00-0000-57f2-5995dc140000 pid=5340->guuid=223e89e4-1f00-0000-57f2-5995df140000 pid=5343 clone guuid=223e89e4-1f00-0000-57f2-5995df140000 pid=5343->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=223e89e4-1f00-0000-57f2-5995df140000 pid=5343->0bf92710-15f4-5fe3-8595-77bb0529d2b0 send: 12B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a607b3d80f2636dc75e3d09b82ce6bb78e558346f03edb8375240a4c850017a3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a607b3d80f2636dc75e3d09b82ce6bb78e558346f03edb8375240a4c850017a3/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/a607b3d80f2636dc75e3d09b82ce6bb78e558346f03edb8375240a4c850017a3
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-09-21 06:37:11 UTC
File Type:
Text (Shell)
AV detection:
24 of 38 (63.16%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uyd3hwapey3ny5pd2cnyfttlw6hfla2g6a7nxa3veqfezbiac6rq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/250921-hb2d6avkv7/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Mirai
Mirai family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
Link:
https://yomi.yoroi.company/submissions/a607b3d80f2636dc75e3d09b82ce6bb78e558346f03edb8375240a4c850017a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh a607b3d80f2636dc75e3d09b82ce6bb78e558346f03edb8375240a4c850017a3

(this sample)

Mirai

elf af426babc8e24f4cb6cbf35167828d4d3eb055d2529da0768417271adea126f9

  
URLhaus
https://urlhaus.abuse.ch/url/3628302/
  
Delivery method
Distributed via web download
  
Dropping
MD5 79c2d91e632aa42851508175913cdaf8
  
Dropping
SHA256 af426babc8e24f4cb6cbf35167828d4d3eb055d2529da0768417271adea126f9

Comments