MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adb093323fb9006e784b5aee4093c6c712b2b6ee6343cd49ad323da23986c776. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: adb093323fb9006e784b5aee4093c6c712b2b6ee6343cd49ad323da23986c776
SHA3-384 hash: 37eb6a0a46c04eb5282e16f65934c8aa3fbb4814a6e9ce89d79f277b89f643919c42336dbe8e8bd1a3ea0c4b62597479
SHA1 hash: b534d7fa4fc987ba4afe92672f669d80a6950838
MD5 hash: f5afbc98340ef09fcdbeaa2553dc76c3
humanhash: glucose-golf-helium-autumn
File name:lg
Download: download sample
Signature Mirai
Create hunting rule
File size:4'779 bytes
First seen:2025-12-19 13:18:15 UTC
Last seen:2025-12-19 15:36:13 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vUhMV4k2Uq1V46UrHrWV4vUNoV4BUEpEEV4EtUJkV4NUq1V46UOZV4+UzSV4/UDY:vbgp1PsL4zOEptbOZBbnD8j21XD7Deb7
TLSH T1ECA10BE674B4977A6DB0ED7372D6C642B140A0A6E0D68C0BF2D1F0E8084EF61F484B82
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x869496e75825c687aa533f45c1ace274e64e66ff6868dc3629c1c31d77cd5b4d5e Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mipsece764c509c51eedfa0ed53ab67d87e512dcbe1acff45b6247e9a037242a6b8d Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl7a86507ef169415f0bc011136fb986505be54059fd21bdc464d9be3763554f85 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm9e8dc9042adf0ff04fd4ac0bd174648832d86913a2353683d43898a5e9373a5e Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm543119fe04a59af3be2b8c053edd3acda80a8ad02216d18fedc6e3188155fb2a4 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm67f7f5e0d1e098605dcb72f6b368bbf99e6dc60ab3b5606fce113296d8f2084ad Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm748f191a4ec10e726a6c1e0fc607d130b3f16191c85640b38b14a487b37039005 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppcefc89383d6e3e80a443673df5c538acfb8238846c67756caa924fd51ea442201 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68k2ff7d666206bcb9e440f017a8538337330826fcf9dc1f0542ee062ebd148387d Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc4b0886c739672baa51a2b187f93271e1c15b56450a29a4d39d6b7709152aa645 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i6865890413dd450f04adabe3a0c4c7b0794ecbf53740489b3c049f4653902cd39d3 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh4d0f0ed32a8d834ef6c4aeaa382275e0a26f90898dd304f00fbffab51d964ec0e Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc62740c7d5c2cbaed0adbbba12ed865ee2136fae9528a50f296dee8365b488bb9 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x6470e24bdbee9683ec1125f42429b59f1e2458566f1860ac1738fb7c2bc49fe0a4 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
medusa mirai
Link:
https://www.filescan.io/uploads/6945509be8abb702f80532dc/reports/70b906be-0980-42bd-a709-ccb863af0f74/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-12-19T10:27:00Z UTC
Last seen:
2025-12-20T00:06:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p
Link:
https://opentip.kaspersky.com/adb093323fb9006e784b5aee4093c6c712b2b6ee6343cd49ad323da23986c776/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/64fc1006-c30d-4ab4-b16c-d5eb9103af27
Behavior Graph:
Download SVG
%3 guuid=f5f89565-1900-0000-7ee8-ffa7f0100000 pid=4336 /usr/bin/sudo guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345 /tmp/sample.bin guuid=f5f89565-1900-0000-7ee8-ffa7f0100000 pid=4336->guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345 execve guuid=e3379c67-1900-0000-7ee8-ffa7fc100000 pid=4348 /usr/bin/wget net send-data write-file guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=e3379c67-1900-0000-7ee8-ffa7fc100000 pid=4348 execve guuid=fe098b75-1900-0000-7ee8-ffa737110000 pid=4407 /usr/bin/curl net send-data write-file guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=fe098b75-1900-0000-7ee8-ffa737110000 pid=4407 execve guuid=97f1de83-1900-0000-7ee8-ffa779110000 pid=4473 /usr/bin/cat guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=97f1de83-1900-0000-7ee8-ffa779110000 pid=4473 execve guuid=92593c84-1900-0000-7ee8-ffa77b110000 pid=4475 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=92593c84-1900-0000-7ee8-ffa77b110000 pid=4475 execve guuid=a16a8084-1900-0000-7ee8-ffa77d110000 pid=4477 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=a16a8084-1900-0000-7ee8-ffa77d110000 pid=4477 execve guuid=3345b384-1900-0000-7ee8-ffa780110000 pid=4480 /usr/bin/wget net send-data write-file guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=3345b384-1900-0000-7ee8-ffa780110000 pid=4480 execve guuid=9afc8d99-1900-0000-7ee8-ffa7a9110000 pid=4521 /usr/bin/curl net send-data write-file guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=9afc8d99-1900-0000-7ee8-ffa7a9110000 pid=4521 execve guuid=30cde4ac-1900-0000-7ee8-ffa7f9110000 pid=4601 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=30cde4ac-1900-0000-7ee8-ffa7f9110000 pid=4601 clone guuid=aff208ad-1900-0000-7ee8-ffa7fa110000 pid=4602 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=aff208ad-1900-0000-7ee8-ffa7fa110000 pid=4602 execve guuid=b3c174ad-1900-0000-7ee8-ffa7fb110000 pid=4603 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=b3c174ad-1900-0000-7ee8-ffa7fb110000 pid=4603 execve guuid=54af5cdd-1a00-0000-7ee8-ffa77c140000 pid=5244 /usr/bin/wget net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=54af5cdd-1a00-0000-7ee8-ffa77c140000 pid=5244 execve guuid=5e596ae5-1a00-0000-7ee8-ffa77e140000 pid=5246 /usr/bin/curl net send-data write-file guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=5e596ae5-1a00-0000-7ee8-ffa77e140000 pid=5246 execve guuid=5b41d5fb-1a00-0000-7ee8-ffa77f140000 pid=5247 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=5b41d5fb-1a00-0000-7ee8-ffa77f140000 pid=5247 clone guuid=09f100fc-1a00-0000-7ee8-ffa780140000 pid=5248 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=09f100fc-1a00-0000-7ee8-ffa780140000 pid=5248 execve guuid=7a6a78fc-1a00-0000-7ee8-ffa781140000 pid=5249 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=7a6a78fc-1a00-0000-7ee8-ffa781140000 pid=5249 execve guuid=1eb8c52d-1c00-0000-7ee8-ffa78a140000 pid=5258 /usr/bin/wget net send-data write-file guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=1eb8c52d-1c00-0000-7ee8-ffa78a140000 pid=5258 execve guuid=e775d63e-1c00-0000-7ee8-ffa78f140000 pid=5263 /usr/bin/curl net send-data write-file guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=e775d63e-1c00-0000-7ee8-ffa78f140000 pid=5263 execve guuid=6360cd51-1c00-0000-7ee8-ffa790140000 pid=5264 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=6360cd51-1c00-0000-7ee8-ffa790140000 pid=5264 clone guuid=3837fc51-1c00-0000-7ee8-ffa791140000 pid=5265 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=3837fc51-1c00-0000-7ee8-ffa791140000 pid=5265 execve guuid=e6995e52-1c00-0000-7ee8-ffa792140000 pid=5266 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=e6995e52-1c00-0000-7ee8-ffa792140000 pid=5266 execve guuid=069c8586-1d00-0000-7ee8-ffa7b4140000 pid=5300 /usr/bin/wget net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=069c8586-1d00-0000-7ee8-ffa7b4140000 pid=5300 execve guuid=08579f88-1d00-0000-7ee8-ffa7b9140000 pid=5305 /usr/bin/curl net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=08579f88-1d00-0000-7ee8-ffa7b9140000 pid=5305 execve guuid=5ea87c8b-1d00-0000-7ee8-ffa7ba140000 pid=5306 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=5ea87c8b-1d00-0000-7ee8-ffa7ba140000 pid=5306 clone guuid=92eea38b-1d00-0000-7ee8-ffa7bb140000 pid=5307 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=92eea38b-1d00-0000-7ee8-ffa7bb140000 pid=5307 execve guuid=7c7e038c-1d00-0000-7ee8-ffa7bc140000 pid=5308 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=7c7e038c-1d00-0000-7ee8-ffa7bc140000 pid=5308 execve guuid=ed6e80bf-1e00-0000-7ee8-ffa7bf140000 pid=5311 /usr/bin/wget net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=ed6e80bf-1e00-0000-7ee8-ffa7bf140000 pid=5311 execve guuid=ade1ccc0-1e00-0000-7ee8-ffa7c3140000 pid=5315 /usr/bin/curl net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=ade1ccc0-1e00-0000-7ee8-ffa7c3140000 pid=5315 execve guuid=a3f4bbc3-1e00-0000-7ee8-ffa7c4140000 pid=5316 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=a3f4bbc3-1e00-0000-7ee8-ffa7c4140000 pid=5316 clone guuid=1fb5d5c3-1e00-0000-7ee8-ffa7c5140000 pid=5317 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=1fb5d5c3-1e00-0000-7ee8-ffa7c5140000 pid=5317 execve guuid=595313c4-1e00-0000-7ee8-ffa7c6140000 pid=5318 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=595313c4-1e00-0000-7ee8-ffa7c6140000 pid=5318 execve guuid=57c5d8f8-1f00-0000-7ee8-ffa7c8140000 pid=5320 /usr/bin/wget net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=57c5d8f8-1f00-0000-7ee8-ffa7c8140000 pid=5320 execve guuid=a3b660fb-1f00-0000-7ee8-ffa7cd140000 pid=5325 /usr/bin/curl net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=a3b660fb-1f00-0000-7ee8-ffa7cd140000 pid=5325 execve guuid=270019ff-1f00-0000-7ee8-ffa7ce140000 pid=5326 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=270019ff-1f00-0000-7ee8-ffa7ce140000 pid=5326 clone guuid=f87f35ff-1f00-0000-7ee8-ffa7cf140000 pid=5327 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=f87f35ff-1f00-0000-7ee8-ffa7cf140000 pid=5327 execve guuid=16b67aff-1f00-0000-7ee8-ffa7d0140000 pid=5328 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=16b67aff-1f00-0000-7ee8-ffa7d0140000 pid=5328 execve guuid=07ca8c34-2100-0000-7ee8-ffa7d3140000 pid=5331 /usr/bin/wget net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=07ca8c34-2100-0000-7ee8-ffa7d3140000 pid=5331 execve guuid=052a8b37-2100-0000-7ee8-ffa7d7140000 pid=5335 /usr/bin/curl net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=052a8b37-2100-0000-7ee8-ffa7d7140000 pid=5335 execve guuid=56c6623a-2100-0000-7ee8-ffa7d8140000 pid=5336 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=56c6623a-2100-0000-7ee8-ffa7d8140000 pid=5336 clone guuid=fb05803a-2100-0000-7ee8-ffa7d9140000 pid=5337 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=fb05803a-2100-0000-7ee8-ffa7d9140000 pid=5337 execve guuid=c5afc03a-2100-0000-7ee8-ffa7da140000 pid=5338 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=c5afc03a-2100-0000-7ee8-ffa7da140000 pid=5338 execve guuid=1dae51e7-2600-0000-7ee8-ffa7dc140000 pid=5340 /usr/bin/wget net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=1dae51e7-2600-0000-7ee8-ffa7dc140000 pid=5340 execve guuid=39b5e9eb-2600-0000-7ee8-ffa7e1140000 pid=5345 /usr/bin/curl net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=39b5e9eb-2600-0000-7ee8-ffa7e1140000 pid=5345 execve guuid=5612efed-2600-0000-7ee8-ffa7e2140000 pid=5346 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=5612efed-2600-0000-7ee8-ffa7e2140000 pid=5346 clone guuid=798108ee-2600-0000-7ee8-ffa7e3140000 pid=5347 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=798108ee-2600-0000-7ee8-ffa7e3140000 pid=5347 execve guuid=3b5f4eee-2600-0000-7ee8-ffa7e4140000 pid=5348 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=3b5f4eee-2600-0000-7ee8-ffa7e4140000 pid=5348 execve guuid=ac62cb97-2c00-0000-7ee8-ffa7e7140000 pid=5351 /usr/bin/wget net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=ac62cb97-2c00-0000-7ee8-ffa7e7140000 pid=5351 execve guuid=39a3a898-2c00-0000-7ee8-ffa7eb140000 pid=5355 /usr/bin/curl net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=39a3a898-2c00-0000-7ee8-ffa7eb140000 pid=5355 execve guuid=827cac9a-2c00-0000-7ee8-ffa7ec140000 pid=5356 /usr/bin/bash guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=827cac9a-2c00-0000-7ee8-ffa7ec140000 pid=5356 clone guuid=a408c59a-2c00-0000-7ee8-ffa7ed140000 pid=5357 /usr/bin/chmod guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=a408c59a-2c00-0000-7ee8-ffa7ed140000 pid=5357 execve guuid=26c5fc9a-2c00-0000-7ee8-ffa7ee140000 pid=5358 /tmp/76d32be0 net guuid=455a4767-1900-0000-7ee8-ffa7f9100000 pid=4345->guuid=26c5fc9a-2c00-0000-7ee8-ffa7ee140000 pid=5358 execve 28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 158.94.210.88:80 guuid=e3379c67-1900-0000-7ee8-ffa7fc100000 pid=4348->28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 send: 197B guuid=fe098b75-1900-0000-7ee8-ffa737110000 pid=4407->28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 send: 146B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=a16a8084-1900-0000-7ee8-ffa77d110000 pid=4477->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8ae0a384-1900-0000-7ee8-ffa77e110000 pid=4478 /tmp/76d32be0 dns net send-data zombie guuid=a16a8084-1900-0000-7ee8-ffa77d110000 pid=4477->guuid=8ae0a384-1900-0000-7ee8-ffa77e110000 pid=4478 clone guuid=8ae0a384-1900-0000-7ee8-ffa77e110000 pid=4478->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B 2ac2249c-25bc-5019-a88f-33a6c2731b07 cnc.504.su:56999 guuid=8ae0a384-1900-0000-7ee8-ffa77e110000 pid=4478->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=4c80b084-1900-0000-7ee8-ffa77f110000 pid=4479 /tmp/76d32be0 guuid=8ae0a384-1900-0000-7ee8-ffa77e110000 pid=4478->guuid=4c80b084-1900-0000-7ee8-ffa77f110000 pid=4479 clone guuid=4e6bb384-1900-0000-7ee8-ffa781110000 pid=4481 /tmp/76d32be0 net net-scan send-data guuid=8ae0a384-1900-0000-7ee8-ffa77e110000 pid=4478->guuid=4e6bb384-1900-0000-7ee8-ffa781110000 pid=4481 clone guuid=6a7cb684-1900-0000-7ee8-ffa782110000 pid=4482 /tmp/76d32be0 net net-scan send-data guuid=8ae0a384-1900-0000-7ee8-ffa77e110000 pid=4478->guuid=6a7cb684-1900-0000-7ee8-ffa782110000 pid=4482 clone guuid=6b50ba84-1900-0000-7ee8-ffa783110000 pid=4483 /tmp/76d32be0 guuid=8ae0a384-1900-0000-7ee8-ffa77e110000 pid=4478->guuid=6b50ba84-1900-0000-7ee8-ffa783110000 pid=4483 clone 4bcd05e0-7ebf-53bb-9cc8-c008d3256770 cnc.504.su:80 guuid=3345b384-1900-0000-7ee8-ffa780110000 pid=4480->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 198B guuid=4e6bb384-1900-0000-7ee8-ffa781110000 pid=4481->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4e6bb384-1900-0000-7ee8-ffa781110000 pid=4481|send-data send-data to 384 IP addresses review logs to see them all guuid=4e6bb384-1900-0000-7ee8-ffa781110000 pid=4481->guuid=4e6bb384-1900-0000-7ee8-ffa781110000 pid=4481|send-data send guuid=6a7cb684-1900-0000-7ee8-ffa782110000 pid=4482->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6a7cb684-1900-0000-7ee8-ffa782110000 pid=4482|send-data send-data to 320 IP addresses review logs to see them all guuid=6a7cb684-1900-0000-7ee8-ffa782110000 pid=4482->guuid=6a7cb684-1900-0000-7ee8-ffa782110000 pid=4482|send-data send guuid=9afc8d99-1900-0000-7ee8-ffa7a9110000 pid=4521->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=b3c174ad-1900-0000-7ee8-ffa7fb110000 pid=4603->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 5fbefa0b-74db-5ddb-909f-7c8f89ca1384 0.0.0.0:46157 guuid=b3c174ad-1900-0000-7ee8-ffa7fb110000 pid=4603->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=18f541dd-1a00-0000-7ee8-ffa778140000 pid=5240 /tmp/76d32be0 dns net send-data zombie guuid=b3c174ad-1900-0000-7ee8-ffa7fb110000 pid=4603->guuid=18f541dd-1a00-0000-7ee8-ffa778140000 pid=5240 clone guuid=18f541dd-1a00-0000-7ee8-ffa778140000 pid=5240->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=18f541dd-1a00-0000-7ee8-ffa778140000 pid=5240->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 30B guuid=12f94fdd-1a00-0000-7ee8-ffa779140000 pid=5241 /tmp/76d32be0 guuid=18f541dd-1a00-0000-7ee8-ffa778140000 pid=5240->guuid=12f94fdd-1a00-0000-7ee8-ffa779140000 pid=5241 clone guuid=092354dd-1a00-0000-7ee8-ffa77a140000 pid=5242 /tmp/76d32be0 net net-scan send-data guuid=18f541dd-1a00-0000-7ee8-ffa778140000 pid=5240->guuid=092354dd-1a00-0000-7ee8-ffa77a140000 pid=5242 clone guuid=a10b58dd-1a00-0000-7ee8-ffa77b140000 pid=5243 /tmp/76d32be0 net net-scan send-data guuid=18f541dd-1a00-0000-7ee8-ffa778140000 pid=5240->guuid=a10b58dd-1a00-0000-7ee8-ffa77b140000 pid=5243 clone guuid=631d5ddd-1a00-0000-7ee8-ffa77d140000 pid=5245 /tmp/76d32be0 guuid=18f541dd-1a00-0000-7ee8-ffa778140000 pid=5240->guuid=631d5ddd-1a00-0000-7ee8-ffa77d140000 pid=5245 clone guuid=092354dd-1a00-0000-7ee8-ffa77a140000 pid=5242->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=092354dd-1a00-0000-7ee8-ffa77a140000 pid=5242|send-data send-data to 384 IP addresses review logs to see them all guuid=092354dd-1a00-0000-7ee8-ffa77a140000 pid=5242->guuid=092354dd-1a00-0000-7ee8-ffa77a140000 pid=5242|send-data send guuid=a10b58dd-1a00-0000-7ee8-ffa77b140000 pid=5243->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a10b58dd-1a00-0000-7ee8-ffa77b140000 pid=5243|send-data send-data to 320 IP addresses review logs to see them all guuid=a10b58dd-1a00-0000-7ee8-ffa77b140000 pid=5243->guuid=a10b58dd-1a00-0000-7ee8-ffa77b140000 pid=5243|send-data send guuid=54af5cdd-1a00-0000-7ee8-ffa77c140000 pid=5244->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=5e596ae5-1a00-0000-7ee8-ffa77e140000 pid=5246->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=7a6a78fc-1a00-0000-7ee8-ffa781140000 pid=5249->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7a6a78fc-1a00-0000-7ee8-ffa781140000 pid=5249->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=5ceeb92d-1c00-0000-7ee8-ffa789140000 pid=5257 /tmp/76d32be0 dns net send-data zombie guuid=7a6a78fc-1a00-0000-7ee8-ffa781140000 pid=5249->guuid=5ceeb92d-1c00-0000-7ee8-ffa789140000 pid=5257 clone guuid=5ceeb92d-1c00-0000-7ee8-ffa789140000 pid=5257->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=5ceeb92d-1c00-0000-7ee8-ffa789140000 pid=5257->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 15B guuid=ddf6e52d-1c00-0000-7ee8-ffa78b140000 pid=5259 /tmp/76d32be0 guuid=5ceeb92d-1c00-0000-7ee8-ffa789140000 pid=5257->guuid=ddf6e52d-1c00-0000-7ee8-ffa78b140000 pid=5259 clone guuid=8eece92d-1c00-0000-7ee8-ffa78c140000 pid=5260 /tmp/76d32be0 net net-scan send-data guuid=5ceeb92d-1c00-0000-7ee8-ffa789140000 pid=5257->guuid=8eece92d-1c00-0000-7ee8-ffa78c140000 pid=5260 clone guuid=d8a3ee2d-1c00-0000-7ee8-ffa78d140000 pid=5261 /tmp/76d32be0 net net-scan send-data guuid=5ceeb92d-1c00-0000-7ee8-ffa789140000 pid=5257->guuid=d8a3ee2d-1c00-0000-7ee8-ffa78d140000 pid=5261 clone guuid=d178f22d-1c00-0000-7ee8-ffa78e140000 pid=5262 /tmp/76d32be0 guuid=5ceeb92d-1c00-0000-7ee8-ffa789140000 pid=5257->guuid=d178f22d-1c00-0000-7ee8-ffa78e140000 pid=5262 clone guuid=1eb8c52d-1c00-0000-7ee8-ffa78a140000 pid=5258->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 197B guuid=8eece92d-1c00-0000-7ee8-ffa78c140000 pid=5260->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8eece92d-1c00-0000-7ee8-ffa78c140000 pid=5260|send-data send-data to 384 IP addresses review logs to see them all guuid=8eece92d-1c00-0000-7ee8-ffa78c140000 pid=5260->guuid=8eece92d-1c00-0000-7ee8-ffa78c140000 pid=5260|send-data send guuid=d8a3ee2d-1c00-0000-7ee8-ffa78d140000 pid=5261->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d8a3ee2d-1c00-0000-7ee8-ffa78d140000 pid=5261|send-data send-data to 320 IP addresses review logs to see them all guuid=d8a3ee2d-1c00-0000-7ee8-ffa78d140000 pid=5261->guuid=d8a3ee2d-1c00-0000-7ee8-ffa78d140000 pid=5261|send-data send guuid=e775d63e-1c00-0000-7ee8-ffa78f140000 pid=5263->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 146B guuid=e6995e52-1c00-0000-7ee8-ffa792140000 pid=5266->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e6995e52-1c00-0000-7ee8-ffa792140000 pid=5266->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=33d97186-1d00-0000-7ee8-ffa7b3140000 pid=5299 /tmp/76d32be0 dns net send-data zombie guuid=e6995e52-1c00-0000-7ee8-ffa792140000 pid=5266->guuid=33d97186-1d00-0000-7ee8-ffa7b3140000 pid=5299 clone guuid=33d97186-1d00-0000-7ee8-ffa7b3140000 pid=5299->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=33d97186-1d00-0000-7ee8-ffa7b3140000 pid=5299->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=aff69286-1d00-0000-7ee8-ffa7b5140000 pid=5301 /tmp/76d32be0 guuid=33d97186-1d00-0000-7ee8-ffa7b3140000 pid=5299->guuid=aff69286-1d00-0000-7ee8-ffa7b5140000 pid=5301 clone guuid=9e53a186-1d00-0000-7ee8-ffa7b6140000 pid=5302 /tmp/76d32be0 net net-scan send-data guuid=33d97186-1d00-0000-7ee8-ffa7b3140000 pid=5299->guuid=9e53a186-1d00-0000-7ee8-ffa7b6140000 pid=5302 clone guuid=418bab86-1d00-0000-7ee8-ffa7b7140000 pid=5303 /tmp/76d32be0 net net-scan send-data guuid=33d97186-1d00-0000-7ee8-ffa7b3140000 pid=5299->guuid=418bab86-1d00-0000-7ee8-ffa7b7140000 pid=5303 clone guuid=ea40b386-1d00-0000-7ee8-ffa7b8140000 pid=5304 /tmp/76d32be0 guuid=33d97186-1d00-0000-7ee8-ffa7b3140000 pid=5299->guuid=ea40b386-1d00-0000-7ee8-ffa7b8140000 pid=5304 clone guuid=069c8586-1d00-0000-7ee8-ffa7b4140000 pid=5300->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=9e53a186-1d00-0000-7ee8-ffa7b6140000 pid=5302->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9e53a186-1d00-0000-7ee8-ffa7b6140000 pid=5302|send-data send-data to 384 IP addresses review logs to see them all guuid=9e53a186-1d00-0000-7ee8-ffa7b6140000 pid=5302->guuid=9e53a186-1d00-0000-7ee8-ffa7b6140000 pid=5302|send-data send guuid=418bab86-1d00-0000-7ee8-ffa7b7140000 pid=5303->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=418bab86-1d00-0000-7ee8-ffa7b7140000 pid=5303|send-data send-data to 320 IP addresses review logs to see them all guuid=418bab86-1d00-0000-7ee8-ffa7b7140000 pid=5303->guuid=418bab86-1d00-0000-7ee8-ffa7b7140000 pid=5303|send-data send guuid=08579f88-1d00-0000-7ee8-ffa7b9140000 pid=5305->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=7c7e038c-1d00-0000-7ee8-ffa7bc140000 pid=5308->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7c7e038c-1d00-0000-7ee8-ffa7bc140000 pid=5308->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=08b471bf-1e00-0000-7ee8-ffa7bd140000 pid=5309 /tmp/76d32be0 dns net send-data zombie guuid=7c7e038c-1d00-0000-7ee8-ffa7bc140000 pid=5308->guuid=08b471bf-1e00-0000-7ee8-ffa7bd140000 pid=5309 clone guuid=08b471bf-1e00-0000-7ee8-ffa7bd140000 pid=5309->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=08b471bf-1e00-0000-7ee8-ffa7bd140000 pid=5309->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=056e7dbf-1e00-0000-7ee8-ffa7be140000 pid=5310 /tmp/76d32be0 guuid=08b471bf-1e00-0000-7ee8-ffa7bd140000 pid=5309->guuid=056e7dbf-1e00-0000-7ee8-ffa7be140000 pid=5310 clone guuid=1abe80bf-1e00-0000-7ee8-ffa7c0140000 pid=5312 /tmp/76d32be0 net net-scan send-data guuid=08b471bf-1e00-0000-7ee8-ffa7bd140000 pid=5309->guuid=1abe80bf-1e00-0000-7ee8-ffa7c0140000 pid=5312 clone guuid=c2d683bf-1e00-0000-7ee8-ffa7c1140000 pid=5313 /tmp/76d32be0 net net-scan send-data guuid=08b471bf-1e00-0000-7ee8-ffa7bd140000 pid=5309->guuid=c2d683bf-1e00-0000-7ee8-ffa7c1140000 pid=5313 clone guuid=48a388bf-1e00-0000-7ee8-ffa7c2140000 pid=5314 /tmp/76d32be0 guuid=08b471bf-1e00-0000-7ee8-ffa7bd140000 pid=5309->guuid=48a388bf-1e00-0000-7ee8-ffa7c2140000 pid=5314 clone guuid=ed6e80bf-1e00-0000-7ee8-ffa7bf140000 pid=5311->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=1abe80bf-1e00-0000-7ee8-ffa7c0140000 pid=5312->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1abe80bf-1e00-0000-7ee8-ffa7c0140000 pid=5312|send-data send-data to 165 IP addresses review logs to see them all guuid=1abe80bf-1e00-0000-7ee8-ffa7c0140000 pid=5312->guuid=1abe80bf-1e00-0000-7ee8-ffa7c0140000 pid=5312|send-data send guuid=c2d683bf-1e00-0000-7ee8-ffa7c1140000 pid=5313->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c2d683bf-1e00-0000-7ee8-ffa7c1140000 pid=5313|send-data send-data to 320 IP addresses review logs to see them all guuid=c2d683bf-1e00-0000-7ee8-ffa7c1140000 pid=5313->guuid=c2d683bf-1e00-0000-7ee8-ffa7c1140000 pid=5313|send-data send guuid=ade1ccc0-1e00-0000-7ee8-ffa7c3140000 pid=5315->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=595313c4-1e00-0000-7ee8-ffa7c6140000 pid=5318->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=595313c4-1e00-0000-7ee8-ffa7c6140000 pid=5318->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=9d27c4f8-1f00-0000-7ee8-ffa7c7140000 pid=5319 /tmp/76d32be0 dns net send-data zombie guuid=595313c4-1e00-0000-7ee8-ffa7c6140000 pid=5318->guuid=9d27c4f8-1f00-0000-7ee8-ffa7c7140000 pid=5319 clone guuid=9d27c4f8-1f00-0000-7ee8-ffa7c7140000 pid=5319->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=9d27c4f8-1f00-0000-7ee8-ffa7c7140000 pid=5319->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=383fdff8-1f00-0000-7ee8-ffa7c9140000 pid=5321 /tmp/76d32be0 guuid=9d27c4f8-1f00-0000-7ee8-ffa7c7140000 pid=5319->guuid=383fdff8-1f00-0000-7ee8-ffa7c9140000 pid=5321 clone guuid=a3ebf3f8-1f00-0000-7ee8-ffa7ca140000 pid=5322 /tmp/76d32be0 net net-scan send-data guuid=9d27c4f8-1f00-0000-7ee8-ffa7c7140000 pid=5319->guuid=a3ebf3f8-1f00-0000-7ee8-ffa7ca140000 pid=5322 clone guuid=e62cfbf8-1f00-0000-7ee8-ffa7cb140000 pid=5323 /tmp/76d32be0 net net-scan send-data guuid=9d27c4f8-1f00-0000-7ee8-ffa7c7140000 pid=5319->guuid=e62cfbf8-1f00-0000-7ee8-ffa7cb140000 pid=5323 clone guuid=d86b05f9-1f00-0000-7ee8-ffa7cc140000 pid=5324 /tmp/76d32be0 guuid=9d27c4f8-1f00-0000-7ee8-ffa7c7140000 pid=5319->guuid=d86b05f9-1f00-0000-7ee8-ffa7cc140000 pid=5324 clone guuid=57c5d8f8-1f00-0000-7ee8-ffa7c8140000 pid=5320->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=a3ebf3f8-1f00-0000-7ee8-ffa7ca140000 pid=5322->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a3ebf3f8-1f00-0000-7ee8-ffa7ca140000 pid=5322|send-data send-data to 1920 IP addresses review logs to see them all guuid=a3ebf3f8-1f00-0000-7ee8-ffa7ca140000 pid=5322->guuid=a3ebf3f8-1f00-0000-7ee8-ffa7ca140000 pid=5322|send-data send guuid=e62cfbf8-1f00-0000-7ee8-ffa7cb140000 pid=5323->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e62cfbf8-1f00-0000-7ee8-ffa7cb140000 pid=5323|send-data send-data to 1600 IP addresses review logs to see them all guuid=e62cfbf8-1f00-0000-7ee8-ffa7cb140000 pid=5323->guuid=e62cfbf8-1f00-0000-7ee8-ffa7cb140000 pid=5323|send-data send guuid=a3b660fb-1f00-0000-7ee8-ffa7cd140000 pid=5325->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=16b67aff-1f00-0000-7ee8-ffa7d0140000 pid=5328->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=16b67aff-1f00-0000-7ee8-ffa7d0140000 pid=5328->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=e49e7f34-2100-0000-7ee8-ffa7d1140000 pid=5329 /tmp/76d32be0 net send-data zombie guuid=16b67aff-1f00-0000-7ee8-ffa7d0140000 pid=5328->guuid=e49e7f34-2100-0000-7ee8-ffa7d1140000 pid=5329 clone guuid=e49e7f34-2100-0000-7ee8-ffa7d1140000 pid=5329->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=02e88a34-2100-0000-7ee8-ffa7d2140000 pid=5330 /tmp/76d32be0 guuid=e49e7f34-2100-0000-7ee8-ffa7d1140000 pid=5329->guuid=02e88a34-2100-0000-7ee8-ffa7d2140000 pid=5330 clone guuid=96f68f34-2100-0000-7ee8-ffa7d4140000 pid=5332 /tmp/76d32be0 net net-scan send-data zombie guuid=e49e7f34-2100-0000-7ee8-ffa7d1140000 pid=5329->guuid=96f68f34-2100-0000-7ee8-ffa7d4140000 pid=5332 clone guuid=20099334-2100-0000-7ee8-ffa7d5140000 pid=5333 /tmp/76d32be0 net net-scan send-data zombie guuid=e49e7f34-2100-0000-7ee8-ffa7d1140000 pid=5329->guuid=20099334-2100-0000-7ee8-ffa7d5140000 pid=5333 clone guuid=960b9934-2100-0000-7ee8-ffa7d6140000 pid=5334 /tmp/76d32be0 guuid=e49e7f34-2100-0000-7ee8-ffa7d1140000 pid=5329->guuid=960b9934-2100-0000-7ee8-ffa7d6140000 pid=5334 clone guuid=07ca8c34-2100-0000-7ee8-ffa7d3140000 pid=5331->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=96f68f34-2100-0000-7ee8-ffa7d4140000 pid=5332->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=96f68f34-2100-0000-7ee8-ffa7d4140000 pid=5332|send-data send-data to 4097 IP addresses review logs to see them all guuid=96f68f34-2100-0000-7ee8-ffa7d4140000 pid=5332->guuid=96f68f34-2100-0000-7ee8-ffa7d4140000 pid=5332|send-data send guuid=20099334-2100-0000-7ee8-ffa7d5140000 pid=5333->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=20099334-2100-0000-7ee8-ffa7d5140000 pid=5333|send-data send-data to 4097 IP addresses review logs to see them all guuid=20099334-2100-0000-7ee8-ffa7d5140000 pid=5333->guuid=20099334-2100-0000-7ee8-ffa7d5140000 pid=5333|send-data send guuid=052a8b37-2100-0000-7ee8-ffa7d7140000 pid=5335->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=c5afc03a-2100-0000-7ee8-ffa7da140000 pid=5338->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c5afc03a-2100-0000-7ee8-ffa7da140000 pid=5338->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=c30134e7-2600-0000-7ee8-ffa7db140000 pid=5339 /tmp/76d32be0 net send-data zombie guuid=c5afc03a-2100-0000-7ee8-ffa7da140000 pid=5338->guuid=c30134e7-2600-0000-7ee8-ffa7db140000 pid=5339 clone guuid=c30134e7-2600-0000-7ee8-ffa7db140000 pid=5339->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=d82a52e7-2600-0000-7ee8-ffa7dd140000 pid=5341 /tmp/76d32be0 guuid=c30134e7-2600-0000-7ee8-ffa7db140000 pid=5339->guuid=d82a52e7-2600-0000-7ee8-ffa7dd140000 pid=5341 clone guuid=38d65ae7-2600-0000-7ee8-ffa7de140000 pid=5342 /tmp/76d32be0 net net-scan send-data zombie guuid=c30134e7-2600-0000-7ee8-ffa7db140000 pid=5339->guuid=38d65ae7-2600-0000-7ee8-ffa7de140000 pid=5342 clone guuid=f9d860e7-2600-0000-7ee8-ffa7df140000 pid=5343 /tmp/76d32be0 net net-scan send-data zombie guuid=c30134e7-2600-0000-7ee8-ffa7db140000 pid=5339->guuid=f9d860e7-2600-0000-7ee8-ffa7df140000 pid=5343 clone guuid=f7006ae7-2600-0000-7ee8-ffa7e0140000 pid=5344 /tmp/76d32be0 guuid=c30134e7-2600-0000-7ee8-ffa7db140000 pid=5339->guuid=f7006ae7-2600-0000-7ee8-ffa7e0140000 pid=5344 clone guuid=1dae51e7-2600-0000-7ee8-ffa7dc140000 pid=5340->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=38d65ae7-2600-0000-7ee8-ffa7de140000 pid=5342->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=38d65ae7-2600-0000-7ee8-ffa7de140000 pid=5342|send-data send-data to 4097 IP addresses review logs to see them all guuid=38d65ae7-2600-0000-7ee8-ffa7de140000 pid=5342->guuid=38d65ae7-2600-0000-7ee8-ffa7de140000 pid=5342|send-data send guuid=f9d860e7-2600-0000-7ee8-ffa7df140000 pid=5343->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f9d860e7-2600-0000-7ee8-ffa7df140000 pid=5343|send-data send-data to 4096 IP addresses review logs to see them all guuid=f9d860e7-2600-0000-7ee8-ffa7df140000 pid=5343->guuid=f9d860e7-2600-0000-7ee8-ffa7df140000 pid=5343|send-data send guuid=39b5e9eb-2600-0000-7ee8-ffa7e1140000 pid=5345->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=3b5f4eee-2600-0000-7ee8-ffa7e4140000 pid=5348->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3b5f4eee-2600-0000-7ee8-ffa7e4140000 pid=5348->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=793ab797-2c00-0000-7ee8-ffa7e5140000 pid=5349 /tmp/76d32be0 net send-data zombie guuid=3b5f4eee-2600-0000-7ee8-ffa7e4140000 pid=5348->guuid=793ab797-2c00-0000-7ee8-ffa7e5140000 pid=5349 clone guuid=793ab797-2c00-0000-7ee8-ffa7e5140000 pid=5349->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=45cfc797-2c00-0000-7ee8-ffa7e6140000 pid=5350 /tmp/76d32be0 guuid=793ab797-2c00-0000-7ee8-ffa7e5140000 pid=5349->guuid=45cfc797-2c00-0000-7ee8-ffa7e6140000 pid=5350 clone guuid=7b9ace97-2c00-0000-7ee8-ffa7e8140000 pid=5352 /tmp/76d32be0 net net-scan send-data guuid=793ab797-2c00-0000-7ee8-ffa7e5140000 pid=5349->guuid=7b9ace97-2c00-0000-7ee8-ffa7e8140000 pid=5352 clone guuid=afa4d497-2c00-0000-7ee8-ffa7e9140000 pid=5353 /tmp/76d32be0 net net-scan send-data guuid=793ab797-2c00-0000-7ee8-ffa7e5140000 pid=5349->guuid=afa4d497-2c00-0000-7ee8-ffa7e9140000 pid=5353 clone guuid=1019db97-2c00-0000-7ee8-ffa7ea140000 pid=5354 /tmp/76d32be0 guuid=793ab797-2c00-0000-7ee8-ffa7e5140000 pid=5349->guuid=1019db97-2c00-0000-7ee8-ffa7ea140000 pid=5354 clone guuid=ac62cb97-2c00-0000-7ee8-ffa7e7140000 pid=5351->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=7b9ace97-2c00-0000-7ee8-ffa7e8140000 pid=5352->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7b9ace97-2c00-0000-7ee8-ffa7e8140000 pid=5352|send-data send-data to 768 IP addresses review logs to see them all guuid=7b9ace97-2c00-0000-7ee8-ffa7e8140000 pid=5352->guuid=7b9ace97-2c00-0000-7ee8-ffa7e8140000 pid=5352|send-data send guuid=afa4d497-2c00-0000-7ee8-ffa7e9140000 pid=5353->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=afa4d497-2c00-0000-7ee8-ffa7e9140000 pid=5353|send-data send-data to 640 IP addresses review logs to see them all guuid=afa4d497-2c00-0000-7ee8-ffa7e9140000 pid=5353->guuid=afa4d497-2c00-0000-7ee8-ffa7e9140000 pid=5353|send-data send guuid=39a3a898-2c00-0000-7ee8-ffa7eb140000 pid=5355->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=26c5fc9a-2c00-0000-7ee8-ffa7ee140000 pid=5358->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=26c5fc9a-2c00-0000-7ee8-ffa7ee140000 pid=5358->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/adb093323fb9006e784b5aee4093c6c712b2b6ee6343cd49ad323da23986c776
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/adb093323fb9006e784b5aee4093c6c712b2b6ee6343cd49ad323da23986c776/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/adb093323fb9006e784b5aee4093c6c712b2b6ee6343cd49ad323da23986c776
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-12-19 13:19:18 UTC
File Type:
Text (Shell)
AV detection:
18 of 24 (75.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vwyjgmr7xeag46clllxebe6gy4jlfnxomnb42snngi62eomgy53a._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:unstable antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/251219-qj441saz3d/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (61947) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware Config
C2 Extraction:
cnc.504.su
scan.504.su
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/adb093323fb9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/adb093323fb9006e784b5aee4093c6c712b2b6ee6343cd49ad323da23986c776

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh adb093323fb9006e784b5aee4093c6c712b2b6ee6343cd49ad323da23986c776

(this sample)

Mirai

elf 0134ba0d82da47549afbf4ff619fe518bf4863eff0f49c939457cbf81c2d15b8

  
URLhaus
https://urlhaus.abuse.ch/url/3725855/
  
Delivery method
Distributed via web download
  
Dropping
MD5 36207ad6597e99c6826a0f960122c7b6
  
Dropping
SHA256 0134ba0d82da47549afbf4ff619fe518bf4863eff0f49c939457cbf81c2d15b8
  
URLhaus
https://urlhaus.abuse.ch/url/3669711/
  
URLhaus
https://urlhaus.abuse.ch/url/3669727/

Comments