MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9c0f6c0251df3b0cc78c1339d16ffa5ebc3baa803728980cd9a2a59675102a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9c0f6c0251df3b0cc78c1339d16ffa5ebc3baa803728980cd9a2a59675102a0
SHA3-384 hash: 221c291d6ecf0138b9389324efb3bb14568f6acc21f69b2b2548da2dfacffa0d08978ef4e39bb5f8bc58c2ac57c40217
SHA1 hash: 4a11c737b91a409ad5f6641ceb55cd1f70883476
MD5 hash: cfcc7d92e0d5e1fb0d2db975852fb49d
humanhash: don-nebraska-fanta-pizza
File name:zte
Download: download sample
Signature Mirai
Create hunting rule
File size:4'802 bytes
First seen:2025-11-24 23:48:09 UTC
Last seen:2025-11-25 13:01:39 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vUhMV4kUUq1V4AUrHrWV4bUNoV4ZUEpEEV4ENUJkV4tUq1V4AUOZV4sUzSV4LUD/:vbipFPGLqzOEpNbcZZbjD2jU1zDvDMRA
TLSH T131A1F7E674B4976A7DB0ED7375D6C652B24060ABE0D68C0BF2D2F0E9044EF61F484B82
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x8606f6c2e48fe50cc39e412f309f22053e06db1aae20c68452dbc0c813bacfaa97 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mipsabb44bb778d3eb33722c8ff7858138a4353d8f46c73995602d2d84715e295b18 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl9e715465d9cc0b6987d27bc3bdc7abe122bca168ff708d2ec0c2441263ad70fe Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm2de20b3347d90622f88ecd1675c009ab4b3a00eb12b454f72bc30d8f37511c26 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm52e1e849fc65cd435d469dcfea490d2481eff33e553e0960cd9e0456ae50c0bf9 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm619f25bc863a4691eae2074524c2f6624e9a735920f19d0adb745870addce4aa0 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm7da87a874b834cfb9fc525ce39cd6c8ac65e118c0f401a9fbe9107bdc9c61dbe2 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppc961a10b6fcdd3bf9cb2eb496ea4458bac31b6891f1cdce4af92b3aa6dfa9e93f Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68kf4b928db067a0faa140e8fa79a2338315d998130414088617eaac7cc216872f7 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc44ab9070ccf7753d5e0cd3eba8625f2eed3e4f382bcb5789049efd299d84e633 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i686f9d11add2e36cc30580e4e9ff6886a4235188b9132ce02f127ed02b06b578eee Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh479e05b52966b9df23bd75d3b953b346c354916469522876a7f1bc653f8146261 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc294e36334bce82e0ea0289773fb352aa6ebc5d3572d2d15839846a953c9469c4 Miraielf mirai ua-wget
http://158.94.210.88/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86_64n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
medusa mirai
Link:
https://www.filescan.io/uploads/6924eec7deea95d50b261bee/reports/8e2cf029-3d0a-4726-ad12-c35f32979695/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-24T22:01:00Z UTC
Last seen:
2025-11-24T23:22:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b9c0f6c0251df3b0cc78c1339d16ffa5ebc3baa803728980cd9a2a59675102a0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/25a2f3ab-b3f7-4b6d-a196-f10a4f8fedf0
Behavior Graph:
Download SVG
%3 guuid=4bbb24d1-1600-0000-928b-d19a970c0000 pid=3223 /usr/bin/sudo guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228 /tmp/sample.bin guuid=4bbb24d1-1600-0000-928b-d19a970c0000 pid=3223->guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228 execve guuid=a6502cd4-1600-0000-928b-d19a9d0c0000 pid=3229 /usr/bin/wget net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=a6502cd4-1600-0000-928b-d19a9d0c0000 pid=3229 execve guuid=865423e0-1600-0000-928b-d19aae0c0000 pid=3246 /usr/bin/curl net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=865423e0-1600-0000-928b-d19aae0c0000 pid=3246 execve guuid=19ac31f0-1600-0000-928b-d19acd0c0000 pid=3277 /usr/bin/cat guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=19ac31f0-1600-0000-928b-d19acd0c0000 pid=3277 execve guuid=366eb1f0-1600-0000-928b-d19acf0c0000 pid=3279 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=366eb1f0-1600-0000-928b-d19acf0c0000 pid=3279 execve guuid=d50814f1-1600-0000-928b-d19ad10c0000 pid=3281 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=d50814f1-1600-0000-928b-d19ad10c0000 pid=3281 execve guuid=30f687f1-1600-0000-928b-d19ad60c0000 pid=3286 /usr/bin/wget net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=30f687f1-1600-0000-928b-d19ad60c0000 pid=3286 execve guuid=58d67efd-1600-0000-928b-d19aea0c0000 pid=3306 /usr/bin/curl net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=58d67efd-1600-0000-928b-d19aea0c0000 pid=3306 execve guuid=21307f0a-1700-0000-928b-d19afc0c0000 pid=3324 /usr/bin/bash guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=21307f0a-1700-0000-928b-d19afc0c0000 pid=3324 clone guuid=c4279c0a-1700-0000-928b-d19afd0c0000 pid=3325 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=c4279c0a-1700-0000-928b-d19afd0c0000 pid=3325 execve guuid=af24f40a-1700-0000-928b-d19afe0c0000 pid=3326 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=af24f40a-1700-0000-928b-d19afe0c0000 pid=3326 execve guuid=5262663d-1800-0000-928b-d19a490f0000 pid=3913 /usr/bin/wget net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=5262663d-1800-0000-928b-d19a490f0000 pid=3913 execve guuid=78cef448-1800-0000-928b-d19a600f0000 pid=3936 /usr/bin/curl net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=78cef448-1800-0000-928b-d19a600f0000 pid=3936 execve guuid=fb461a54-1800-0000-928b-d19a860f0000 pid=3974 /usr/bin/bash guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=fb461a54-1800-0000-928b-d19a860f0000 pid=3974 clone guuid=ef9c4154-1800-0000-928b-d19a870f0000 pid=3975 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=ef9c4154-1800-0000-928b-d19a870f0000 pid=3975 execve guuid=fceca254-1800-0000-928b-d19a8b0f0000 pid=3979 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=fceca254-1800-0000-928b-d19a8b0f0000 pid=3979 execve guuid=87a0c387-1900-0000-928b-d19a84120000 pid=4740 /usr/bin/wget net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=87a0c387-1900-0000-928b-d19a84120000 pid=4740 execve guuid=2bd1679d-1900-0000-928b-d19aa3120000 pid=4771 /usr/bin/curl net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=2bd1679d-1900-0000-928b-d19aa3120000 pid=4771 execve guuid=2b189da9-1900-0000-928b-d19abe120000 pid=4798 /usr/bin/bash guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=2b189da9-1900-0000-928b-d19abe120000 pid=4798 clone guuid=bc93bea9-1900-0000-928b-d19abf120000 pid=4799 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=bc93bea9-1900-0000-928b-d19abf120000 pid=4799 execve guuid=3c0c34aa-1900-0000-928b-d19ac2120000 pid=4802 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=3c0c34aa-1900-0000-928b-d19ac2120000 pid=4802 execve guuid=4cdfdfdd-1a00-0000-928b-d19a7f140000 pid=5247 /usr/bin/wget net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=4cdfdfdd-1a00-0000-928b-d19a7f140000 pid=5247 execve guuid=53110ae0-1a00-0000-928b-d19a81140000 pid=5249 /usr/bin/curl net send-data write-file guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=53110ae0-1a00-0000-928b-d19a81140000 pid=5249 execve guuid=1e1b9fed-1a00-0000-928b-d19a82140000 pid=5250 /usr/bin/bash guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=1e1b9fed-1a00-0000-928b-d19a82140000 pid=5250 clone guuid=182cbeed-1a00-0000-928b-d19a83140000 pid=5251 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=182cbeed-1a00-0000-928b-d19a83140000 pid=5251 execve guuid=dbf10fee-1a00-0000-928b-d19a84140000 pid=5252 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=dbf10fee-1a00-0000-928b-d19a84140000 pid=5252 execve guuid=21705822-1c00-0000-928b-d19a94140000 pid=5268 /usr/bin/wget net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=21705822-1c00-0000-928b-d19a94140000 pid=5268 execve guuid=49143d23-1c00-0000-928b-d19a97140000 pid=5271 /usr/bin/curl net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=49143d23-1c00-0000-928b-d19a97140000 pid=5271 execve guuid=82c4ee24-1c00-0000-928b-d19a98140000 pid=5272 /usr/bin/bash guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=82c4ee24-1c00-0000-928b-d19a98140000 pid=5272 clone guuid=08590625-1c00-0000-928b-d19a99140000 pid=5273 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=08590625-1c00-0000-928b-d19a99140000 pid=5273 execve guuid=a6e34725-1c00-0000-928b-d19a9a140000 pid=5274 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=a6e34725-1c00-0000-928b-d19a9a140000 pid=5274 execve guuid=d8889a5b-1d00-0000-928b-d19ae9140000 pid=5353 /usr/bin/wget net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=d8889a5b-1d00-0000-928b-d19ae9140000 pid=5353 execve guuid=0c95a35c-1d00-0000-928b-d19aed140000 pid=5357 /usr/bin/curl net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=0c95a35c-1d00-0000-928b-d19aed140000 pid=5357 execve guuid=2675af5f-1d00-0000-928b-d19aee140000 pid=5358 /usr/bin/bash guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=2675af5f-1d00-0000-928b-d19aee140000 pid=5358 clone guuid=68e0d55f-1d00-0000-928b-d19aef140000 pid=5359 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=68e0d55f-1d00-0000-928b-d19aef140000 pid=5359 execve guuid=d9e44760-1d00-0000-928b-d19af0140000 pid=5360 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=d9e44760-1d00-0000-928b-d19af0140000 pid=5360 execve guuid=e9104896-1e00-0000-928b-d19af3140000 pid=5363 /usr/bin/wget net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=e9104896-1e00-0000-928b-d19af3140000 pid=5363 execve guuid=5a8b0398-1e00-0000-928b-d19af6140000 pid=5366 /usr/bin/curl net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=5a8b0398-1e00-0000-928b-d19af6140000 pid=5366 execve guuid=b4cd549a-1e00-0000-928b-d19af7140000 pid=5367 /usr/bin/bash guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=b4cd549a-1e00-0000-928b-d19af7140000 pid=5367 clone guuid=410a749a-1e00-0000-928b-d19af8140000 pid=5368 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=410a749a-1e00-0000-928b-d19af8140000 pid=5368 execve guuid=9dcfbc9a-1e00-0000-928b-d19af9140000 pid=5369 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=9dcfbc9a-1e00-0000-928b-d19af9140000 pid=5369 execve guuid=4741ebdb-2200-0000-928b-d19a62150000 pid=5474 /usr/bin/wget net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=4741ebdb-2200-0000-928b-d19a62150000 pid=5474 execve guuid=dc5b4cde-2200-0000-928b-d19a65150000 pid=5477 /usr/bin/curl net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=dc5b4cde-2200-0000-928b-d19a65150000 pid=5477 execve guuid=af7826e0-2200-0000-928b-d19a66150000 pid=5478 /usr/bin/bash guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=af7826e0-2200-0000-928b-d19a66150000 pid=5478 clone guuid=e1873ce0-2200-0000-928b-d19a67150000 pid=5479 /usr/bin/chmod guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=e1873ce0-2200-0000-928b-d19a67150000 pid=5479 execve guuid=6c8879e0-2200-0000-928b-d19a68150000 pid=5480 /tmp/76d32be0 net guuid=8535bed3-1600-0000-928b-d19a9c0c0000 pid=3228->guuid=6c8879e0-2200-0000-928b-d19a68150000 pid=5480 execve 28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 158.94.210.88:80 guuid=a6502cd4-1600-0000-928b-d19a9d0c0000 pid=3229->28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 send: 197B guuid=865423e0-1600-0000-928b-d19aae0c0000 pid=3246->28ee2c59-94a6-5756-a2b6-fa7fcfec6d46 send: 146B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=d50814f1-1600-0000-928b-d19ad10c0000 pid=3281->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e6746df1-1600-0000-928b-d19ad20c0000 pid=3282 /tmp/76d32be0 dns net send-data zombie guuid=d50814f1-1600-0000-928b-d19ad10c0000 pid=3281->guuid=e6746df1-1600-0000-928b-d19ad20c0000 pid=3282 clone guuid=e6746df1-1600-0000-928b-d19ad20c0000 pid=3282->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B 2ac2249c-25bc-5019-a88f-33a6c2731b07 cnc.504.su:56999 guuid=e6746df1-1600-0000-928b-d19ad20c0000 pid=3282->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 16B guuid=70127af1-1600-0000-928b-d19ad30c0000 pid=3283 /tmp/76d32be0 guuid=e6746df1-1600-0000-928b-d19ad20c0000 pid=3282->guuid=70127af1-1600-0000-928b-d19ad30c0000 pid=3283 clone guuid=50c77ef1-1600-0000-928b-d19ad40c0000 pid=3284 /tmp/76d32be0 net net-scan send-data guuid=e6746df1-1600-0000-928b-d19ad20c0000 pid=3282->guuid=50c77ef1-1600-0000-928b-d19ad40c0000 pid=3284 clone guuid=f50783f1-1600-0000-928b-d19ad50c0000 pid=3285 /tmp/76d32be0 guuid=e6746df1-1600-0000-928b-d19ad20c0000 pid=3282->guuid=f50783f1-1600-0000-928b-d19ad50c0000 pid=3285 clone guuid=50c77ef1-1600-0000-928b-d19ad40c0000 pid=3284->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=50c77ef1-1600-0000-928b-d19ad40c0000 pid=3284|send-data send-data to 384 IP addresses review logs to see them all guuid=50c77ef1-1600-0000-928b-d19ad40c0000 pid=3284->guuid=50c77ef1-1600-0000-928b-d19ad40c0000 pid=3284|send-data send 4bcd05e0-7ebf-53bb-9cc8-c008d3256770 cnc.504.su:80 guuid=30f687f1-1600-0000-928b-d19ad60c0000 pid=3286->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 198B guuid=58d67efd-1600-0000-928b-d19aea0c0000 pid=3306->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=af24f40a-1700-0000-928b-d19afe0c0000 pid=3326->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 5fbefa0b-74db-5ddb-909f-7c8f89ca1384 0.0.0.0:46157 guuid=af24f40a-1700-0000-928b-d19afe0c0000 pid=3326->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=b99a433d-1800-0000-928b-d19a470f0000 pid=3911 /tmp/76d32be0 dns net send-data zombie guuid=af24f40a-1700-0000-928b-d19afe0c0000 pid=3326->guuid=b99a433d-1800-0000-928b-d19a470f0000 pid=3911 clone guuid=b99a433d-1800-0000-928b-d19a470f0000 pid=3911->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=b99a433d-1800-0000-928b-d19a470f0000 pid=3911->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 16B guuid=e9ef5e3d-1800-0000-928b-d19a480f0000 pid=3912 /tmp/76d32be0 guuid=b99a433d-1800-0000-928b-d19a470f0000 pid=3911->guuid=e9ef5e3d-1800-0000-928b-d19a480f0000 pid=3912 clone guuid=642d6a3d-1800-0000-928b-d19a4a0f0000 pid=3914 /tmp/76d32be0 net net-scan send-data guuid=b99a433d-1800-0000-928b-d19a470f0000 pid=3911->guuid=642d6a3d-1800-0000-928b-d19a4a0f0000 pid=3914 clone guuid=9d0b713d-1800-0000-928b-d19a4b0f0000 pid=3915 /tmp/76d32be0 guuid=b99a433d-1800-0000-928b-d19a470f0000 pid=3911->guuid=9d0b713d-1800-0000-928b-d19a4b0f0000 pid=3915 clone guuid=5262663d-1800-0000-928b-d19a490f0000 pid=3913->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 198B guuid=642d6a3d-1800-0000-928b-d19a4a0f0000 pid=3914->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=642d6a3d-1800-0000-928b-d19a4a0f0000 pid=3914|send-data send-data to 384 IP addresses review logs to see them all guuid=642d6a3d-1800-0000-928b-d19a4a0f0000 pid=3914->guuid=642d6a3d-1800-0000-928b-d19a4a0f0000 pid=3914|send-data send guuid=78cef448-1800-0000-928b-d19a600f0000 pid=3936->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=fceca254-1800-0000-928b-d19a8b0f0000 pid=3979->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=fceca254-1800-0000-928b-d19a8b0f0000 pid=3979->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=3ac3b187-1900-0000-928b-d19a83120000 pid=4739 /tmp/76d32be0 dns net send-data zombie guuid=fceca254-1800-0000-928b-d19a8b0f0000 pid=3979->guuid=3ac3b187-1900-0000-928b-d19a83120000 pid=4739 clone guuid=3ac3b187-1900-0000-928b-d19a83120000 pid=4739->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=3ac3b187-1900-0000-928b-d19a83120000 pid=4739->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 32B guuid=1b14cc87-1900-0000-928b-d19a85120000 pid=4741 /tmp/76d32be0 guuid=3ac3b187-1900-0000-928b-d19a83120000 pid=4739->guuid=1b14cc87-1900-0000-928b-d19a85120000 pid=4741 clone guuid=98fed487-1900-0000-928b-d19a86120000 pid=4742 /tmp/76d32be0 net net-scan send-data guuid=3ac3b187-1900-0000-928b-d19a83120000 pid=4739->guuid=98fed487-1900-0000-928b-d19a86120000 pid=4742 clone guuid=c984e287-1900-0000-928b-d19a87120000 pid=4743 /tmp/76d32be0 guuid=3ac3b187-1900-0000-928b-d19a83120000 pid=4739->guuid=c984e287-1900-0000-928b-d19a87120000 pid=4743 clone guuid=87a0c387-1900-0000-928b-d19a84120000 pid=4740->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 197B guuid=98fed487-1900-0000-928b-d19a86120000 pid=4742->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=98fed487-1900-0000-928b-d19a86120000 pid=4742|send-data send-data to 384 IP addresses review logs to see them all guuid=98fed487-1900-0000-928b-d19a86120000 pid=4742->guuid=98fed487-1900-0000-928b-d19a86120000 pid=4742|send-data send guuid=2bd1679d-1900-0000-928b-d19aa3120000 pid=4771->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 146B guuid=3c0c34aa-1900-0000-928b-d19ac2120000 pid=4802->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3c0c34aa-1900-0000-928b-d19ac2120000 pid=4802->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=aed2cbdd-1a00-0000-928b-d19a7c140000 pid=5244 /tmp/76d32be0 dns net send-data zombie guuid=3c0c34aa-1900-0000-928b-d19ac2120000 pid=4802->guuid=aed2cbdd-1a00-0000-928b-d19a7c140000 pid=5244 clone guuid=aed2cbdd-1a00-0000-928b-d19a7c140000 pid=5244->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=aed2cbdd-1a00-0000-928b-d19a7c140000 pid=5244->2ac2249c-25bc-5019-a88f-33a6c2731b07 send: 16B guuid=8aa0d8dd-1a00-0000-928b-d19a7d140000 pid=5245 /tmp/76d32be0 guuid=aed2cbdd-1a00-0000-928b-d19a7c140000 pid=5244->guuid=8aa0d8dd-1a00-0000-928b-d19a7d140000 pid=5245 clone guuid=0146dedd-1a00-0000-928b-d19a7e140000 pid=5246 /tmp/76d32be0 net net-scan send-data guuid=aed2cbdd-1a00-0000-928b-d19a7c140000 pid=5244->guuid=0146dedd-1a00-0000-928b-d19a7e140000 pid=5246 clone guuid=b404e2dd-1a00-0000-928b-d19a80140000 pid=5248 /tmp/76d32be0 guuid=aed2cbdd-1a00-0000-928b-d19a7c140000 pid=5244->guuid=b404e2dd-1a00-0000-928b-d19a80140000 pid=5248 clone guuid=0146dedd-1a00-0000-928b-d19a7e140000 pid=5246->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0146dedd-1a00-0000-928b-d19a7e140000 pid=5246|send-data send-data to 384 IP addresses review logs to see them all guuid=0146dedd-1a00-0000-928b-d19a7e140000 pid=5246->guuid=0146dedd-1a00-0000-928b-d19a7e140000 pid=5246|send-data send guuid=4cdfdfdd-1a00-0000-928b-d19a7f140000 pid=5247->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=53110ae0-1a00-0000-928b-d19a81140000 pid=5249->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=dbf10fee-1a00-0000-928b-d19a84140000 pid=5252->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=dbf10fee-1a00-0000-928b-d19a84140000 pid=5252->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=de524622-1c00-0000-928b-d19a92140000 pid=5266 /tmp/76d32be0 dns net send-data zombie guuid=dbf10fee-1a00-0000-928b-d19a84140000 pid=5252->guuid=de524622-1c00-0000-928b-d19a92140000 pid=5266 clone guuid=de524622-1c00-0000-928b-d19a92140000 pid=5266->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=de524622-1c00-0000-928b-d19a92140000 pid=5266->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=a5e65522-1c00-0000-928b-d19a93140000 pid=5267 /tmp/76d32be0 guuid=de524622-1c00-0000-928b-d19a92140000 pid=5266->guuid=a5e65522-1c00-0000-928b-d19a93140000 pid=5267 clone guuid=fc305b22-1c00-0000-928b-d19a95140000 pid=5269 /tmp/76d32be0 net net-scan send-data guuid=de524622-1c00-0000-928b-d19a92140000 pid=5266->guuid=fc305b22-1c00-0000-928b-d19a95140000 pid=5269 clone guuid=94f75f22-1c00-0000-928b-d19a96140000 pid=5270 /tmp/76d32be0 guuid=de524622-1c00-0000-928b-d19a92140000 pid=5266->guuid=94f75f22-1c00-0000-928b-d19a96140000 pid=5270 clone guuid=21705822-1c00-0000-928b-d19a94140000 pid=5268->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=fc305b22-1c00-0000-928b-d19a95140000 pid=5269->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=fc305b22-1c00-0000-928b-d19a95140000 pid=5269|send-data send-data to 384 IP addresses review logs to see them all guuid=fc305b22-1c00-0000-928b-d19a95140000 pid=5269->guuid=fc305b22-1c00-0000-928b-d19a95140000 pid=5269|send-data send guuid=49143d23-1c00-0000-928b-d19a97140000 pid=5271->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=a6e34725-1c00-0000-928b-d19a9a140000 pid=5274->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a6e34725-1c00-0000-928b-d19a9a140000 pid=5274->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=34768a5b-1d00-0000-928b-d19ae8140000 pid=5352 /tmp/76d32be0 dns net send-data zombie guuid=a6e34725-1c00-0000-928b-d19a9a140000 pid=5274->guuid=34768a5b-1d00-0000-928b-d19ae8140000 pid=5352 clone guuid=34768a5b-1d00-0000-928b-d19ae8140000 pid=5352->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=34768a5b-1d00-0000-928b-d19ae8140000 pid=5352->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=9a36a45b-1d00-0000-928b-d19aea140000 pid=5354 /tmp/76d32be0 guuid=34768a5b-1d00-0000-928b-d19ae8140000 pid=5352->guuid=9a36a45b-1d00-0000-928b-d19aea140000 pid=5354 clone guuid=e429bc5b-1d00-0000-928b-d19aeb140000 pid=5355 /tmp/76d32be0 net net-scan send-data guuid=34768a5b-1d00-0000-928b-d19ae8140000 pid=5352->guuid=e429bc5b-1d00-0000-928b-d19aeb140000 pid=5355 clone guuid=8592c85b-1d00-0000-928b-d19aec140000 pid=5356 /tmp/76d32be0 guuid=34768a5b-1d00-0000-928b-d19ae8140000 pid=5352->guuid=8592c85b-1d00-0000-928b-d19aec140000 pid=5356 clone guuid=d8889a5b-1d00-0000-928b-d19ae9140000 pid=5353->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=e429bc5b-1d00-0000-928b-d19aeb140000 pid=5355->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e429bc5b-1d00-0000-928b-d19aeb140000 pid=5355|send-data send-data to 1920 IP addresses review logs to see them all guuid=e429bc5b-1d00-0000-928b-d19aeb140000 pid=5355->guuid=e429bc5b-1d00-0000-928b-d19aeb140000 pid=5355|send-data send guuid=0c95a35c-1d00-0000-928b-d19aed140000 pid=5357->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=d9e44760-1d00-0000-928b-d19af0140000 pid=5360->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d9e44760-1d00-0000-928b-d19af0140000 pid=5360->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=861b3c96-1e00-0000-928b-d19af1140000 pid=5361 /tmp/76d32be0 net send-data zombie guuid=d9e44760-1d00-0000-928b-d19af0140000 pid=5360->guuid=861b3c96-1e00-0000-928b-d19af1140000 pid=5361 clone guuid=861b3c96-1e00-0000-928b-d19af1140000 pid=5361->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=bdd34796-1e00-0000-928b-d19af2140000 pid=5362 /tmp/76d32be0 guuid=861b3c96-1e00-0000-928b-d19af1140000 pid=5361->guuid=bdd34796-1e00-0000-928b-d19af2140000 pid=5362 clone guuid=08b14a96-1e00-0000-928b-d19af4140000 pid=5364 /tmp/76d32be0 net net-scan send-data zombie guuid=861b3c96-1e00-0000-928b-d19af1140000 pid=5361->guuid=08b14a96-1e00-0000-928b-d19af4140000 pid=5364 clone guuid=dfd34f96-1e00-0000-928b-d19af5140000 pid=5365 /tmp/76d32be0 guuid=861b3c96-1e00-0000-928b-d19af1140000 pid=5361->guuid=dfd34f96-1e00-0000-928b-d19af5140000 pid=5365 clone guuid=e9104896-1e00-0000-928b-d19af3140000 pid=5363->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=08b14a96-1e00-0000-928b-d19af4140000 pid=5364->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=08b14a96-1e00-0000-928b-d19af4140000 pid=5364|send-data send-data to 4097 IP addresses review logs to see them all guuid=08b14a96-1e00-0000-928b-d19af4140000 pid=5364->guuid=08b14a96-1e00-0000-928b-d19af4140000 pid=5364|send-data send guuid=5a8b0398-1e00-0000-928b-d19af6140000 pid=5366->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=9dcfbc9a-1e00-0000-928b-d19af9140000 pid=5369->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9dcfbc9a-1e00-0000-928b-d19af9140000 pid=5369->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=ca3dc2db-2200-0000-928b-d19a60150000 pid=5472 /tmp/76d32be0 dns net send-data zombie guuid=9dcfbc9a-1e00-0000-928b-d19af9140000 pid=5369->guuid=ca3dc2db-2200-0000-928b-d19a60150000 pid=5472 clone guuid=ca3dc2db-2200-0000-928b-d19a60150000 pid=5472->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=ca3dc2db-2200-0000-928b-d19a60150000 pid=5472->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=7860e4db-2200-0000-928b-d19a61150000 pid=5473 /tmp/76d32be0 guuid=ca3dc2db-2200-0000-928b-d19a60150000 pid=5472->guuid=7860e4db-2200-0000-928b-d19a61150000 pid=5473 clone guuid=f32aecdb-2200-0000-928b-d19a63150000 pid=5475 /tmp/76d32be0 net net-scan send-data zombie guuid=ca3dc2db-2200-0000-928b-d19a60150000 pid=5472->guuid=f32aecdb-2200-0000-928b-d19a63150000 pid=5475 clone guuid=050af6db-2200-0000-928b-d19a64150000 pid=5476 /tmp/76d32be0 guuid=ca3dc2db-2200-0000-928b-d19a60150000 pid=5472->guuid=050af6db-2200-0000-928b-d19a64150000 pid=5476 clone guuid=4741ebdb-2200-0000-928b-d19a62150000 pid=5474->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=f32aecdb-2200-0000-928b-d19a63150000 pid=5475->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f32aecdb-2200-0000-928b-d19a63150000 pid=5475|send-data send-data to 4097 IP addresses review logs to see them all guuid=f32aecdb-2200-0000-928b-d19a63150000 pid=5475->guuid=f32aecdb-2200-0000-928b-d19a63150000 pid=5475|send-data send guuid=dc5b4cde-2200-0000-928b-d19a65150000 pid=5477->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=6c8879e0-2200-0000-928b-d19a68150000 pid=5480->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6c8879e0-2200-0000-928b-d19a68150000 pid=5480->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b9c0f6c0251df3b0cc78c1339d16ffa5ebc3baa803728980cd9a2a59675102a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9c0f6c0251df3b0cc78c1339d16ffa5ebc3baa803728980cd9a2a59675102a0/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-11-24 23:48:27 UTC
File Type:
Text (Shell)
AV detection:
24 of 38 (63.16%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xhapnqbfdxz3btdyyezz2fx7uxv4hovianzitagntivfsz2rakqa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:unstable antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251124-3tk54sdq3w/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
UPX packed file
Enumerates active TCP sockets
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (55683) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware Config
C2 Extraction:
cnc.504.su
scan.504.su
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b9c0f6c0251d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9c0f6c0251df3b0cc78c1339d16ffa5ebc3baa803728980cd9a2a59675102a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh b9c0f6c0251df3b0cc78c1339d16ffa5ebc3baa803728980cd9a2a59675102a0

(this sample)

Mirai

elf 4659da87326851decd5d67b743d9924f09ef8b000c91c63f15ede42a45919120

Mirai

elf 06f6c2e48fe50cc39e412f309f22053e06db1aae20c68452dbc0c813bacfaa97

  
URLhaus
https://urlhaus.abuse.ch/url/3669704/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3669712/
  
Dropping
MD5 d890af588619b95e8c751535bc58ac46
  
Dropping
SHA256 06f6c2e48fe50cc39e412f309f22053e06db1aae20c68452dbc0c813bacfaa97

Comments