MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3d0aeabcaf687d25e611b701068516cebf074cb8bcc35a2454618d558f423d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3d0aeabcaf687d25e611b701068516cebf074cb8bcc35a2454618d558f423d3
SHA3-384 hash: e44df115d6d79e755568b5a0d5e0a6609f48e205f63fd65671ea0264a9666dec81b4e74ef65d19b19cb0396b91cd9bf3
SHA1 hash: 2f540a5aa07e70cbd089e2ced792cd74630301ef
MD5 hash: 2579f523a24ebebe9b97f064c044de5e
humanhash: avocado-bakerloo-lactose-montana
File name:and
Download: download sample
Signature Mirai
Create hunting rule
File size:3'284 bytes
First seen:2025-07-09 08:50:20 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:ItKmbZsKNsbhK49kK5glfKjamsKbyTKQnQGgJKOj6KTqnLKGnGNIpKksKpwMEKD9:iWFUdbDZQ1i/LkJRBwP6BgJspk
TLSH T1ED615DFE33410633ADB6C9E37AA8C40462C4419B58CE3F755BEC68B58D8CEC93D41A5A
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://87.121.84.44/00101010101001/morte.x862640512201ae2a0f515b0cc9d8cb8bba20c440aef5c91d0f7632d5f12b1bc01e Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.mipsb3211943b1a91fb0f11eb32a0d5e74ae9eb4ae7df45daf3f368ba6216c63a739 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.arcac411a17498b1006b712d89d16ab8b0c863435addd667aac4000dff0100bf23a Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.i468ac5c338c558a7b2679876efa6965ad0fa2868cd2d42288e2492113c619622134 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.i686bb0a72d9394c27afafbe882da58449ad8bb538e05ed478897028db9efb1837bb Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.x86_644fa0b919f29ce04e492564cdc7fd04493f3c0fe4936f540b832fbbbb91ebd224 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.mpsl388fca18d135e0355f1d8f0b6d72583d868fdedfd94e4433c13cabf2e22293ac Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.armc323ffb320b490e697419b50310aa8c2ac72447123f637404aab870431f2af02 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.arm50af60479a4f52295d54a989ef3857f327e29129759094bd299d232f6b7b27396 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.arm6c0a05e039d5c3eb2be10b4bf48a58684466b52387506db4ca927b34220777c49 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.arm7aa7a00f2e8fa6079833b368bb53e0379df669d09f5490e578568e00c3b486f17 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.ppcb05136041ee5e91d5a13ef2e542bd5e2a99a7c671a7b223db60edfc83e0ed94c Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.spca5096a6f6f1d1a3a6cec37e9739eec6a57b20cb9a36cc36c36b6ad5b5876b953 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.m68kac5c338c558a7b2679876efa6965ad0fa2868cd2d42288e2492113c619622134 Miraielf mirai ua-wget
http://87.121.84.44/00101010101001/morte.sh4ba212c7156c961b97874657e81393cb6b94eef969c3e0b6e744956770d8f394a Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
20
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686e2d5f900df8e7f868eebalinux22vpnfull_triage
Tags:
downloader ransomware agent
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c869b209-5788-4633-b2d9-92d69eacae0b
Behavior Graph:
Download SVG
%3 guuid=42fe7802-1a00-0000-eabd-bb30da070000 pid=2010 /usr/bin/sudo guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017 /tmp/sample.bin guuid=42fe7802-1a00-0000-eabd-bb30da070000 pid=2010->guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017 execve guuid=f5e41306-1a00-0000-eabd-bb30e3070000 pid=2019 /usr/bin/cp guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=f5e41306-1a00-0000-eabd-bb30e3070000 pid=2019 execve guuid=0e42fa0b-1a00-0000-eabd-bb30eb070000 pid=2027 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=0e42fa0b-1a00-0000-eabd-bb30eb070000 pid=2027 execve guuid=a282ca11-1a00-0000-eabd-bb30f8070000 pid=2040 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=a282ca11-1a00-0000-eabd-bb30f8070000 pid=2040 execve guuid=d9d0ac1d-1a00-0000-eabd-bb300b080000 pid=2059 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=d9d0ac1d-1a00-0000-eabd-bb300b080000 pid=2059 execve guuid=1759f81d-1a00-0000-eabd-bb300d080000 pid=2061 /tmp/morte.x86 net guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=1759f81d-1a00-0000-eabd-bb300d080000 pid=2061 execve guuid=13ea471e-1a00-0000-eabd-bb3011080000 pid=2065 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=13ea471e-1a00-0000-eabd-bb3011080000 pid=2065 execve guuid=af88b51e-1a00-0000-eabd-bb3013080000 pid=2067 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=af88b51e-1a00-0000-eabd-bb3013080000 pid=2067 execve guuid=e83d1123-1a00-0000-eabd-bb301b080000 pid=2075 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=e83d1123-1a00-0000-eabd-bb301b080000 pid=2075 execve guuid=f38e012b-1a00-0000-eabd-bb3027080000 pid=2087 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=f38e012b-1a00-0000-eabd-bb3027080000 pid=2087 execve guuid=2e1e522b-1a00-0000-eabd-bb3028080000 pid=2088 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=2e1e522b-1a00-0000-eabd-bb3028080000 pid=2088 clone guuid=073c3a2c-1a00-0000-eabd-bb302d080000 pid=2093 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=073c3a2c-1a00-0000-eabd-bb302d080000 pid=2093 execve guuid=0b0f952c-1a00-0000-eabd-bb302f080000 pid=2095 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=0b0f952c-1a00-0000-eabd-bb302f080000 pid=2095 execve guuid=9a702633-1a00-0000-eabd-bb303c080000 pid=2108 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=9a702633-1a00-0000-eabd-bb303c080000 pid=2108 execve guuid=54fd133b-1a00-0000-eabd-bb304a080000 pid=2122 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=54fd133b-1a00-0000-eabd-bb304a080000 pid=2122 execve guuid=a49c8f3b-1a00-0000-eabd-bb304c080000 pid=2124 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=a49c8f3b-1a00-0000-eabd-bb304c080000 pid=2124 clone guuid=43e0383c-1a00-0000-eabd-bb3050080000 pid=2128 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=43e0383c-1a00-0000-eabd-bb3050080000 pid=2128 execve guuid=839aa43c-1a00-0000-eabd-bb3051080000 pid=2129 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=839aa43c-1a00-0000-eabd-bb3051080000 pid=2129 execve guuid=7fee8c44-1a00-0000-eabd-bb3061080000 pid=2145 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=7fee8c44-1a00-0000-eabd-bb3061080000 pid=2145 execve guuid=4f678a4c-1a00-0000-eabd-bb3074080000 pid=2164 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=4f678a4c-1a00-0000-eabd-bb3074080000 pid=2164 execve guuid=f070db4c-1a00-0000-eabd-bb3076080000 pid=2166 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=f070db4c-1a00-0000-eabd-bb3076080000 pid=2166 clone guuid=0e0d964d-1a00-0000-eabd-bb307a080000 pid=2170 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=0e0d964d-1a00-0000-eabd-bb307a080000 pid=2170 execve guuid=026bdf4d-1a00-0000-eabd-bb307c080000 pid=2172 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=026bdf4d-1a00-0000-eabd-bb307c080000 pid=2172 execve guuid=0caeb252-1a00-0000-eabd-bb3088080000 pid=2184 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=0caeb252-1a00-0000-eabd-bb3088080000 pid=2184 execve guuid=e621085b-1a00-0000-eabd-bb30a3080000 pid=2211 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=e621085b-1a00-0000-eabd-bb30a3080000 pid=2211 execve guuid=d6895e5b-1a00-0000-eabd-bb30a5080000 pid=2213 /tmp/morte.i686 net guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=d6895e5b-1a00-0000-eabd-bb30a5080000 pid=2213 execve guuid=0c92f4d2-1a00-0000-eabd-bb3089090000 pid=2441 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=0c92f4d2-1a00-0000-eabd-bb3089090000 pid=2441 execve guuid=032f41d3-1a00-0000-eabd-bb308b090000 pid=2443 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=032f41d3-1a00-0000-eabd-bb308b090000 pid=2443 execve guuid=bc39d8db-1a00-0000-eabd-bb30a3090000 pid=2467 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=bc39d8db-1a00-0000-eabd-bb30a3090000 pid=2467 execve guuid=e7bb5ee4-1a00-0000-eabd-bb30b2090000 pid=2482 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=e7bb5ee4-1a00-0000-eabd-bb30b2090000 pid=2482 execve guuid=7bf2a9e4-1a00-0000-eabd-bb30b3090000 pid=2483 /tmp/morte.x86_64 mprotect-exec net guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=7bf2a9e4-1a00-0000-eabd-bb30b3090000 pid=2483 execve guuid=4c916e5c-1b00-0000-eabd-bb30f00a0000 pid=2800 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=4c916e5c-1b00-0000-eabd-bb30f00a0000 pid=2800 execve guuid=15ddbc5c-1b00-0000-eabd-bb30f20a0000 pid=2802 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=15ddbc5c-1b00-0000-eabd-bb30f20a0000 pid=2802 execve guuid=705d5563-1b00-0000-eabd-bb30030b0000 pid=2819 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=705d5563-1b00-0000-eabd-bb30030b0000 pid=2819 execve guuid=a9453b6b-1b00-0000-eabd-bb300b0b0000 pid=2827 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=a9453b6b-1b00-0000-eabd-bb300b0b0000 pid=2827 execve guuid=a0978c6b-1b00-0000-eabd-bb300c0b0000 pid=2828 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=a0978c6b-1b00-0000-eabd-bb300c0b0000 pid=2828 clone guuid=ddd3416c-1b00-0000-eabd-bb300e0b0000 pid=2830 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=ddd3416c-1b00-0000-eabd-bb300e0b0000 pid=2830 execve guuid=619ec56c-1b00-0000-eabd-bb300f0b0000 pid=2831 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=619ec56c-1b00-0000-eabd-bb300f0b0000 pid=2831 execve guuid=d0ba6d72-1b00-0000-eabd-bb30180b0000 pid=2840 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=d0ba6d72-1b00-0000-eabd-bb30180b0000 pid=2840 execve guuid=fe1cb277-1b00-0000-eabd-bb30240b0000 pid=2852 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=fe1cb277-1b00-0000-eabd-bb30240b0000 pid=2852 execve guuid=6d1e4c78-1b00-0000-eabd-bb30260b0000 pid=2854 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=6d1e4c78-1b00-0000-eabd-bb30260b0000 pid=2854 clone guuid=2864d678-1b00-0000-eabd-bb302a0b0000 pid=2858 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=2864d678-1b00-0000-eabd-bb302a0b0000 pid=2858 execve guuid=cbbef685-1b00-0000-eabd-bb302b0b0000 pid=2859 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=cbbef685-1b00-0000-eabd-bb302b0b0000 pid=2859 execve guuid=cebc198c-1b00-0000-eabd-bb303b0b0000 pid=2875 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=cebc198c-1b00-0000-eabd-bb303b0b0000 pid=2875 execve guuid=85582a92-1b00-0000-eabd-bb304d0b0000 pid=2893 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=85582a92-1b00-0000-eabd-bb304d0b0000 pid=2893 execve guuid=ceb76c92-1b00-0000-eabd-bb304f0b0000 pid=2895 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=ceb76c92-1b00-0000-eabd-bb304f0b0000 pid=2895 clone guuid=0e744a93-1b00-0000-eabd-bb30540b0000 pid=2900 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=0e744a93-1b00-0000-eabd-bb30540b0000 pid=2900 execve guuid=14999193-1b00-0000-eabd-bb30560b0000 pid=2902 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=14999193-1b00-0000-eabd-bb30560b0000 pid=2902 execve guuid=46275197-1b00-0000-eabd-bb30620b0000 pid=2914 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=46275197-1b00-0000-eabd-bb30620b0000 pid=2914 execve guuid=816f34a0-1b00-0000-eabd-bb307a0b0000 pid=2938 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=816f34a0-1b00-0000-eabd-bb307a0b0000 pid=2938 execve guuid=e59b7ea0-1b00-0000-eabd-bb307b0b0000 pid=2939 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=e59b7ea0-1b00-0000-eabd-bb307b0b0000 pid=2939 clone guuid=9df81ea1-1b00-0000-eabd-bb307e0b0000 pid=2942 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=9df81ea1-1b00-0000-eabd-bb307e0b0000 pid=2942 execve guuid=7fda2aa2-1b00-0000-eabd-bb307f0b0000 pid=2943 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=7fda2aa2-1b00-0000-eabd-bb307f0b0000 pid=2943 execve guuid=a2638aa7-1b00-0000-eabd-bb308d0b0000 pid=2957 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=a2638aa7-1b00-0000-eabd-bb308d0b0000 pid=2957 execve guuid=88958cb1-1b00-0000-eabd-bb309a0b0000 pid=2970 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=88958cb1-1b00-0000-eabd-bb309a0b0000 pid=2970 execve guuid=81b3d3b1-1b00-0000-eabd-bb309c0b0000 pid=2972 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=81b3d3b1-1b00-0000-eabd-bb309c0b0000 pid=2972 clone guuid=d98578b2-1b00-0000-eabd-bb309f0b0000 pid=2975 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=d98578b2-1b00-0000-eabd-bb309f0b0000 pid=2975 execve guuid=7450b9b3-1b00-0000-eabd-bb30a00b0000 pid=2976 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=7450b9b3-1b00-0000-eabd-bb30a00b0000 pid=2976 execve guuid=d823c9b7-1b00-0000-eabd-bb30a20b0000 pid=2978 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=d823c9b7-1b00-0000-eabd-bb30a20b0000 pid=2978 execve guuid=5bf7fbbe-1b00-0000-eabd-bb30ae0b0000 pid=2990 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=5bf7fbbe-1b00-0000-eabd-bb30ae0b0000 pid=2990 execve guuid=cac241bf-1b00-0000-eabd-bb30b00b0000 pid=2992 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=cac241bf-1b00-0000-eabd-bb30b00b0000 pid=2992 clone guuid=4e54bbc0-1b00-0000-eabd-bb30b30b0000 pid=2995 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=4e54bbc0-1b00-0000-eabd-bb30b30b0000 pid=2995 execve guuid=59ba04c1-1b00-0000-eabd-bb30b50b0000 pid=2997 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=59ba04c1-1b00-0000-eabd-bb30b50b0000 pid=2997 execve guuid=f40a05c8-1b00-0000-eabd-bb30be0b0000 pid=3006 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=f40a05c8-1b00-0000-eabd-bb30be0b0000 pid=3006 execve guuid=8b916dd2-1b00-0000-eabd-bb30d20b0000 pid=3026 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=8b916dd2-1b00-0000-eabd-bb30d20b0000 pid=3026 execve guuid=dc49fdd2-1b00-0000-eabd-bb30d40b0000 pid=3028 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=dc49fdd2-1b00-0000-eabd-bb30d40b0000 pid=3028 clone guuid=07d821d4-1b00-0000-eabd-bb30d90b0000 pid=3033 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=07d821d4-1b00-0000-eabd-bb30d90b0000 pid=3033 execve guuid=046391d4-1b00-0000-eabd-bb30db0b0000 pid=3035 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=046391d4-1b00-0000-eabd-bb30db0b0000 pid=3035 execve guuid=2a8e96da-1b00-0000-eabd-bb30e60b0000 pid=3046 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=2a8e96da-1b00-0000-eabd-bb30e60b0000 pid=3046 execve guuid=49587ce1-1b00-0000-eabd-bb30f60b0000 pid=3062 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=49587ce1-1b00-0000-eabd-bb30f60b0000 pid=3062 execve guuid=bdb0d1e1-1b00-0000-eabd-bb30f80b0000 pid=3064 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=bdb0d1e1-1b00-0000-eabd-bb30f80b0000 pid=3064 clone guuid=231078e2-1b00-0000-eabd-bb30fb0b0000 pid=3067 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=231078e2-1b00-0000-eabd-bb30fb0b0000 pid=3067 execve guuid=ba97dfe2-1b00-0000-eabd-bb30fd0b0000 pid=3069 /usr/bin/wget net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=ba97dfe2-1b00-0000-eabd-bb30fd0b0000 pid=3069 execve guuid=954fb9e8-1b00-0000-eabd-bb300c0c0000 pid=3084 /usr/bin/curl net send-data write-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=954fb9e8-1b00-0000-eabd-bb300c0c0000 pid=3084 execve guuid=1a1eb9ef-1b00-0000-eabd-bb301d0c0000 pid=3101 /usr/bin/chmod guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=1a1eb9ef-1b00-0000-eabd-bb301d0c0000 pid=3101 execve guuid=60dc3af0-1b00-0000-eabd-bb301f0c0000 pid=3103 /usr/bin/bash guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=60dc3af0-1b00-0000-eabd-bb301f0c0000 pid=3103 clone guuid=f622f7f0-1b00-0000-eabd-bb30230c0000 pid=3107 /usr/bin/rm delete-file guuid=30e30405-1a00-0000-eabd-bb30e1070000 pid=2017->guuid=f622f7f0-1b00-0000-eabd-bb30230c0000 pid=3107 execve 11793493-ec19-521c-b424-e4936d1f1fea 87.121.84.44:80 guuid=0e42fa0b-1a00-0000-eabd-bb30eb070000 pid=2027->11793493-ec19-521c-b424-e4936d1f1fea send: 151B guuid=a282ca11-1a00-0000-eabd-bb30f8070000 pid=2040->11793493-ec19-521c-b424-e4936d1f1fea send: 100B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=1759f81d-1a00-0000-eabd-bb300d080000 pid=2061->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5fa9391e-1a00-0000-eabd-bb300e080000 pid=2062 /tmp/morte.x86 guuid=1759f81d-1a00-0000-eabd-bb300d080000 pid=2061->guuid=5fa9391e-1a00-0000-eabd-bb300e080000 pid=2062 clone guuid=7bdb3d1e-1a00-0000-eabd-bb300f080000 pid=2063 /tmp/morte.x86 dns net send-data zombie guuid=1759f81d-1a00-0000-eabd-bb300d080000 pid=2061->guuid=7bdb3d1e-1a00-0000-eabd-bb300f080000 pid=2063 clone guuid=7bdb3d1e-1a00-0000-eabd-bb300f080000 pid=2063->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 39B c704064b-1a2c-51c7-9b3a-3e87e81215f5 bot.nightbotnet.my.id:12121 guuid=7bdb3d1e-1a00-0000-eabd-bb300f080000 pid=2063->c704064b-1a2c-51c7-9b3a-3e87e81215f5 send: 15B ee5cff79-d1e5-59fd-8763-15423efcfc34 bot.nightbotnet.my.id:80 guuid=af88b51e-1a00-0000-eabd-bb3013080000 pid=2067->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 152B guuid=e83d1123-1a00-0000-eabd-bb301b080000 pid=2075->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 101B guuid=0b0f952c-1a00-0000-eabd-bb302f080000 pid=2095->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 151B guuid=9a702633-1a00-0000-eabd-bb303c080000 pid=2108->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 100B guuid=839aa43c-1a00-0000-eabd-bb3051080000 pid=2129->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 152B guuid=7fee8c44-1a00-0000-eabd-bb3061080000 pid=2145->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 101B guuid=026bdf4d-1a00-0000-eabd-bb307c080000 pid=2172->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 152B guuid=0caeb252-1a00-0000-eabd-bb3088080000 pid=2184->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 101B guuid=d6895e5b-1a00-0000-eabd-bb30a5080000 pid=2213->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con f77ebf5e-2af7-5b09-86f4-388588a8b445 0.0.0.0:12121 guuid=d6895e5b-1a00-0000-eabd-bb30a5080000 pid=2213->f77ebf5e-2af7-5b09-86f4-388588a8b445 con guuid=032f41d3-1a00-0000-eabd-bb308b090000 pid=2443->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 154B guuid=bc39d8db-1a00-0000-eabd-bb30a3090000 pid=2467->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 103B guuid=7bf2a9e4-1a00-0000-eabd-bb30b3090000 pid=2483->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7bf2a9e4-1a00-0000-eabd-bb30b3090000 pid=2483->f77ebf5e-2af7-5b09-86f4-388588a8b445 con guuid=15ddbc5c-1b00-0000-eabd-bb30f20a0000 pid=2802->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 152B guuid=705d5563-1b00-0000-eabd-bb30030b0000 pid=2819->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 101B guuid=619ec56c-1b00-0000-eabd-bb300f0b0000 pid=2831->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 151B guuid=d0ba6d72-1b00-0000-eabd-bb30180b0000 pid=2840->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 100B guuid=cbbef685-1b00-0000-eabd-bb302b0b0000 pid=2859->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 152B guuid=cebc198c-1b00-0000-eabd-bb303b0b0000 pid=2875->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 101B guuid=14999193-1b00-0000-eabd-bb30560b0000 pid=2902->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 152B guuid=46275197-1b00-0000-eabd-bb30620b0000 pid=2914->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 101B guuid=7fda2aa2-1b00-0000-eabd-bb307f0b0000 pid=2943->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 152B guuid=a2638aa7-1b00-0000-eabd-bb308d0b0000 pid=2957->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 101B guuid=7450b9b3-1b00-0000-eabd-bb30a00b0000 pid=2976->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 151B guuid=d823c9b7-1b00-0000-eabd-bb30a20b0000 pid=2978->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 100B guuid=59ba04c1-1b00-0000-eabd-bb30b50b0000 pid=2997->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 151B guuid=f40a05c8-1b00-0000-eabd-bb30be0b0000 pid=3006->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 100B guuid=046391d4-1b00-0000-eabd-bb30db0b0000 pid=3035->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 152B guuid=2a8e96da-1b00-0000-eabd-bb30e60b0000 pid=3046->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 101B guuid=ba97dfe2-1b00-0000-eabd-bb30fd0b0000 pid=3069->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 151B guuid=954fb9e8-1b00-0000-eabd-bb300c0c0000 pid=3084->ee5cff79-d1e5-59fd-8763-15423efcfc34 send: 100B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b3d0aeabcaf687d25e611b701068516cebf074cb8bcc35a2454618d558f423d3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3d0aeabcaf687d25e611b701068516cebf074cb8bcc35a2454618d558f423d3/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-07-08 21:37:35 UTC
File Type:
Text (Shell)
AV detection:
22 of 38 (57.89%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpik5k6k62d5extbdnyba2crntv7a5glrpgdlisfiymnkwhuepjq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/250709-krvmnawtgy/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Mirai
Mirai family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3d0aeabcaf687d25e611b701068516cebf074cb8bcc35a2454618d558f423d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh b3d0aeabcaf687d25e611b701068516cebf074cb8bcc35a2454618d558f423d3

(this sample)

Mirai

elf 2640512201ae2a0f515b0cc9d8cb8bba20c440aef5c91d0f7632d5f12b1bc01e

  
URLhaus
https://urlhaus.abuse.ch/url/3579488/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3579544/
  
Dropping
MD5 2c782d575bca7c228ceae6fcbf9c6824
  
Dropping
SHA256 2640512201ae2a0f515b0cc9d8cb8bba20c440aef5c91d0f7632d5f12b1bc01e

Comments