MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1
SHA3-384 hash: 350cf0afdca0dacbcaf6d45e1980a0c4f0424d90722e0b5e09bfd62aa338da3502c7fc4c44920816c998d110c5d5871d
SHA1 hash: 89b18ee0d71f71e8bcaca2cda2fa76dc27476681
MD5 hash: f6579af098857b3040340825ca77df96
humanhash: football-blossom-papa-july
File name:bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-10 16:53:27 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:5nSbCsBcCBs6247sXOTmCnwXPOv9RuDMRv:kxcWY4COCCwXPBa
TLSH T1DD315D9E04111E315102EA5E72A6221CA24DA2E72C5FCBD4DE4D0FBA56C83CCF265B5E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c2hunter
Tags:mirai sh wraith
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/ea4b38n/an/aua-wget
http://5.182.210.174/ff5279n/an/aua-wget
http://5.182.210.174/45d538n/an/aua-wget
http://5.182.210.174/6441d0n/an/aua-wget
http://5.182.210.174/e00f60n/an/aua-wget
http://5.182.210.174/0654cbn/an/aua-wget
http://5.182.210.174/4850bdn/an/aua-wget
http://5.182.210.174/650040n/an/aua-wget
http://5.182.210.174/bd9da7n/an/aua-wget
http://5.182.210.174/7d8668n/an/aua-wget
http://5.182.210.174/76e8ccn/an/aua-wget
http://5.182.210.174/4a200fn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7a020e2124025db0f1f9e4/reports/693a2962-86c6-43fc-a1c8-8decc3a06a9e/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-10T14:06:00Z UTC
Last seen:
2026-08-10T14:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e02a2531-7d1d-46d7-a972-0a5b2154d790
Behavior Graph:
Download SVG
%3 guuid=b5ce2b96-1600-0000-2d82-c345350d0000 pid=3381 /usr/bin/sudo guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384 /tmp/sample.bin guuid=b5ce2b96-1600-0000-2d82-c345350d0000 pid=3381->guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384 execve guuid=b1a3ae99-1600-0000-2d82-c345390d0000 pid=3385 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=b1a3ae99-1600-0000-2d82-c345390d0000 pid=3385 execve guuid=e806969f-1600-0000-2d82-c345420d0000 pid=3394 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=e806969f-1600-0000-2d82-c345420d0000 pid=3394 execve guuid=4ddb28a5-1600-0000-2d82-c345520d0000 pid=3410 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=4ddb28a5-1600-0000-2d82-c345520d0000 pid=3410 execve guuid=94d078a5-1600-0000-2d82-c345530d0000 pid=3411 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=94d078a5-1600-0000-2d82-c345530d0000 pid=3411 clone guuid=60a9d5a5-1600-0000-2d82-c345550d0000 pid=3413 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=60a9d5a5-1600-0000-2d82-c345550d0000 pid=3413 execve guuid=afbc47a6-1600-0000-2d82-c345560d0000 pid=3414 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=afbc47a6-1600-0000-2d82-c345560d0000 pid=3414 execve guuid=25cd9ca6-1600-0000-2d82-c345570d0000 pid=3415 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=25cd9ca6-1600-0000-2d82-c345570d0000 pid=3415 execve guuid=cfa961a9-1600-0000-2d82-c3455d0d0000 pid=3421 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=cfa961a9-1600-0000-2d82-c3455d0d0000 pid=3421 execve guuid=a08cbbaf-1600-0000-2d82-c345720d0000 pid=3442 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=a08cbbaf-1600-0000-2d82-c345720d0000 pid=3442 execve guuid=03a9f4af-1600-0000-2d82-c345740d0000 pid=3444 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=03a9f4af-1600-0000-2d82-c345740d0000 pid=3444 clone guuid=6e7041b0-1600-0000-2d82-c345770d0000 pid=3447 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=6e7041b0-1600-0000-2d82-c345770d0000 pid=3447 execve guuid=862a7db0-1600-0000-2d82-c345790d0000 pid=3449 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=862a7db0-1600-0000-2d82-c345790d0000 pid=3449 execve guuid=d8efb9b0-1600-0000-2d82-c3457b0d0000 pid=3451 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=d8efb9b0-1600-0000-2d82-c3457b0d0000 pid=3451 execve guuid=252e0cb3-1600-0000-2d82-c345840d0000 pid=3460 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=252e0cb3-1600-0000-2d82-c345840d0000 pid=3460 execve guuid=55c322b6-1600-0000-2d82-c345900d0000 pid=3472 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=55c322b6-1600-0000-2d82-c345900d0000 pid=3472 execve guuid=75015ab6-1600-0000-2d82-c345920d0000 pid=3474 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=75015ab6-1600-0000-2d82-c345920d0000 pid=3474 clone guuid=abb18cb6-1600-0000-2d82-c345940d0000 pid=3476 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=abb18cb6-1600-0000-2d82-c345940d0000 pid=3476 execve guuid=5352cdb6-1600-0000-2d82-c345960d0000 pid=3478 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=5352cdb6-1600-0000-2d82-c345960d0000 pid=3478 execve guuid=752f07b7-1600-0000-2d82-c345980d0000 pid=3480 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=752f07b7-1600-0000-2d82-c345980d0000 pid=3480 execve guuid=51652bba-1600-0000-2d82-c345a50d0000 pid=3493 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=51652bba-1600-0000-2d82-c345a50d0000 pid=3493 execve guuid=f15b5abd-1600-0000-2d82-c345b00d0000 pid=3504 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=f15b5abd-1600-0000-2d82-c345b00d0000 pid=3504 execve guuid=ee0b9cbd-1600-0000-2d82-c345b20d0000 pid=3506 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=ee0b9cbd-1600-0000-2d82-c345b20d0000 pid=3506 clone guuid=e924d1bd-1600-0000-2d82-c345b40d0000 pid=3508 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=e924d1bd-1600-0000-2d82-c345b40d0000 pid=3508 execve guuid=775914be-1600-0000-2d82-c345b50d0000 pid=3509 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=775914be-1600-0000-2d82-c345b50d0000 pid=3509 execve guuid=876b5dbe-1600-0000-2d82-c345b60d0000 pid=3510 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=876b5dbe-1600-0000-2d82-c345b60d0000 pid=3510 execve guuid=f912cec0-1600-0000-2d82-c345bf0d0000 pid=3519 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=f912cec0-1600-0000-2d82-c345bf0d0000 pid=3519 execve guuid=b6eb58c5-1600-0000-2d82-c345cd0d0000 pid=3533 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=b6eb58c5-1600-0000-2d82-c345cd0d0000 pid=3533 execve guuid=e0ce96c5-1600-0000-2d82-c345d00d0000 pid=3536 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=e0ce96c5-1600-0000-2d82-c345d00d0000 pid=3536 clone guuid=1e94c2c5-1600-0000-2d82-c345d50d0000 pid=3541 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=1e94c2c5-1600-0000-2d82-c345d50d0000 pid=3541 execve guuid=678f0fc6-1600-0000-2d82-c345d60d0000 pid=3542 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=678f0fc6-1600-0000-2d82-c345d60d0000 pid=3542 execve guuid=c3d350c6-1600-0000-2d82-c345d80d0000 pid=3544 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=c3d350c6-1600-0000-2d82-c345d80d0000 pid=3544 execve guuid=906d2cc9-1600-0000-2d82-c345e40d0000 pid=3556 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=906d2cc9-1600-0000-2d82-c345e40d0000 pid=3556 execve guuid=05c2ecd0-1600-0000-2d82-c345fb0d0000 pid=3579 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=05c2ecd0-1600-0000-2d82-c345fb0d0000 pid=3579 execve guuid=83f454d1-1600-0000-2d82-c345fc0d0000 pid=3580 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=83f454d1-1600-0000-2d82-c345fc0d0000 pid=3580 clone guuid=31cea5d1-1600-0000-2d82-c345fe0d0000 pid=3582 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=31cea5d1-1600-0000-2d82-c345fe0d0000 pid=3582 execve guuid=ec5c04d2-1600-0000-2d82-c345ff0d0000 pid=3583 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=ec5c04d2-1600-0000-2d82-c345ff0d0000 pid=3583 execve guuid=f84666d2-1600-0000-2d82-c345000e0000 pid=3584 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=f84666d2-1600-0000-2d82-c345000e0000 pid=3584 execve guuid=75ff61d5-1600-0000-2d82-c345010e0000 pid=3585 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=75ff61d5-1600-0000-2d82-c345010e0000 pid=3585 execve guuid=480c89d9-1600-0000-2d82-c3450c0e0000 pid=3596 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=480c89d9-1600-0000-2d82-c3450c0e0000 pid=3596 execve guuid=e06fbfd9-1600-0000-2d82-c3450d0e0000 pid=3597 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=e06fbfd9-1600-0000-2d82-c3450d0e0000 pid=3597 clone guuid=558ef3d9-1600-0000-2d82-c345100e0000 pid=3600 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=558ef3d9-1600-0000-2d82-c345100e0000 pid=3600 execve guuid=239431da-1600-0000-2d82-c345120e0000 pid=3602 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=239431da-1600-0000-2d82-c345120e0000 pid=3602 execve guuid=326087da-1600-0000-2d82-c345130e0000 pid=3603 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=326087da-1600-0000-2d82-c345130e0000 pid=3603 execve guuid=8240a5dd-1600-0000-2d82-c345140e0000 pid=3604 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=8240a5dd-1600-0000-2d82-c345140e0000 pid=3604 execve guuid=4d9741e4-1600-0000-2d82-c345290e0000 pid=3625 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=4d9741e4-1600-0000-2d82-c345290e0000 pid=3625 execve guuid=1a9bebe4-1600-0000-2d82-c3452d0e0000 pid=3629 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=1a9bebe4-1600-0000-2d82-c3452d0e0000 pid=3629 clone guuid=891660e5-1600-0000-2d82-c345310e0000 pid=3633 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=891660e5-1600-0000-2d82-c345310e0000 pid=3633 execve guuid=ff6705e6-1600-0000-2d82-c345360e0000 pid=3638 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=ff6705e6-1600-0000-2d82-c345360e0000 pid=3638 execve guuid=9bf4c7e6-1600-0000-2d82-c3453a0e0000 pid=3642 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=9bf4c7e6-1600-0000-2d82-c3453a0e0000 pid=3642 execve guuid=3ce0d7ea-1600-0000-2d82-c3454e0e0000 pid=3662 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=3ce0d7ea-1600-0000-2d82-c3454e0e0000 pid=3662 execve guuid=ed3cc0f2-1600-0000-2d82-c3456b0e0000 pid=3691 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=ed3cc0f2-1600-0000-2d82-c3456b0e0000 pid=3691 execve guuid=b5bdfef2-1600-0000-2d82-c3456d0e0000 pid=3693 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=b5bdfef2-1600-0000-2d82-c3456d0e0000 pid=3693 clone guuid=98bb38f3-1600-0000-2d82-c345700e0000 pid=3696 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=98bb38f3-1600-0000-2d82-c345700e0000 pid=3696 execve guuid=a7187af3-1600-0000-2d82-c345710e0000 pid=3697 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=a7187af3-1600-0000-2d82-c345710e0000 pid=3697 execve guuid=b10ef8f3-1600-0000-2d82-c345740e0000 pid=3700 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=b10ef8f3-1600-0000-2d82-c345740e0000 pid=3700 execve guuid=08378bf6-1600-0000-2d82-c3457e0e0000 pid=3710 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=08378bf6-1600-0000-2d82-c3457e0e0000 pid=3710 execve guuid=430a27fa-1600-0000-2d82-c345930e0000 pid=3731 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=430a27fa-1600-0000-2d82-c345930e0000 pid=3731 execve guuid=a20064fa-1600-0000-2d82-c345960e0000 pid=3734 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=a20064fa-1600-0000-2d82-c345960e0000 pid=3734 clone guuid=0778e2fa-1600-0000-2d82-c345990e0000 pid=3737 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=0778e2fa-1600-0000-2d82-c345990e0000 pid=3737 execve guuid=e89f1afb-1600-0000-2d82-c3459c0e0000 pid=3740 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=e89f1afb-1600-0000-2d82-c3459c0e0000 pid=3740 execve guuid=04e150fb-1600-0000-2d82-c3459e0e0000 pid=3742 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=04e150fb-1600-0000-2d82-c3459e0e0000 pid=3742 execve guuid=80e6cdfd-1600-0000-2d82-c345b10e0000 pid=3761 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=80e6cdfd-1600-0000-2d82-c345b10e0000 pid=3761 execve guuid=dcc7bf02-1700-0000-2d82-c345bc0e0000 pid=3772 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=dcc7bf02-1700-0000-2d82-c345bc0e0000 pid=3772 execve guuid=5d940c03-1700-0000-2d82-c345bd0e0000 pid=3773 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=5d940c03-1700-0000-2d82-c345bd0e0000 pid=3773 clone guuid=47f95203-1700-0000-2d82-c345bf0e0000 pid=3775 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=47f95203-1700-0000-2d82-c345bf0e0000 pid=3775 execve guuid=fde4ac03-1700-0000-2d82-c345c10e0000 pid=3777 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=fde4ac03-1700-0000-2d82-c345c10e0000 pid=3777 execve guuid=34b13d04-1700-0000-2d82-c345c30e0000 pid=3779 /usr/bin/wget net send-data guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=34b13d04-1700-0000-2d82-c345c30e0000 pid=3779 execve guuid=720d6707-1700-0000-2d82-c345cc0e0000 pid=3788 /usr/bin/curl net send-data write-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=720d6707-1700-0000-2d82-c345cc0e0000 pid=3788 execve guuid=e0099516-1700-0000-2d82-c345df0e0000 pid=3807 /usr/bin/chmod guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=e0099516-1700-0000-2d82-c345df0e0000 pid=3807 execve guuid=7eeb3817-1700-0000-2d82-c345e10e0000 pid=3809 /usr/bin/bash guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=7eeb3817-1700-0000-2d82-c345e10e0000 pid=3809 clone guuid=7ee69517-1700-0000-2d82-c345e40e0000 pid=3812 /usr/bin/rm delete-file guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=7ee69517-1700-0000-2d82-c345e40e0000 pid=3812 execve guuid=a449fb17-1700-0000-2d82-c345e80e0000 pid=3816 /usr/bin/rm guuid=9e5e8e98-1600-0000-2d82-c345380d0000 pid=3384->guuid=a449fb17-1700-0000-2d82-c345e80e0000 pid=3816 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=b1a3ae99-1600-0000-2d82-c345390d0000 pid=3385->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e806969f-1600-0000-2d82-c345420d0000 pid=3394->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=045795a5-1600-0000-2d82-c345540d0000 pid=3412 /usr/bin/bash guuid=94d078a5-1600-0000-2d82-c345530d0000 pid=3411->guuid=045795a5-1600-0000-2d82-c345540d0000 pid=3412 clone guuid=25cd9ca6-1600-0000-2d82-c345570d0000 pid=3415->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cfa961a9-1600-0000-2d82-c3455d0d0000 pid=3421->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=27d00ab0-1600-0000-2d82-c345750d0000 pid=3445 /usr/bin/bash guuid=03a9f4af-1600-0000-2d82-c345740d0000 pid=3444->guuid=27d00ab0-1600-0000-2d82-c345750d0000 pid=3445 clone guuid=d8efb9b0-1600-0000-2d82-c3457b0d0000 pid=3451->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=252e0cb3-1600-0000-2d82-c345840d0000 pid=3460->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=091f6db6-1600-0000-2d82-c345930d0000 pid=3475 /usr/bin/bash guuid=75015ab6-1600-0000-2d82-c345920d0000 pid=3474->guuid=091f6db6-1600-0000-2d82-c345930d0000 pid=3475 clone guuid=752f07b7-1600-0000-2d82-c345980d0000 pid=3480->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=51652bba-1600-0000-2d82-c345a50d0000 pid=3493->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0cbdb2bd-1600-0000-2d82-c345b30d0000 pid=3507 /usr/bin/bash guuid=ee0b9cbd-1600-0000-2d82-c345b20d0000 pid=3506->guuid=0cbdb2bd-1600-0000-2d82-c345b30d0000 pid=3507 clone guuid=876b5dbe-1600-0000-2d82-c345b60d0000 pid=3510->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f912cec0-1600-0000-2d82-c345bf0d0000 pid=3519->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0a33a9c5-1600-0000-2d82-c345d10d0000 pid=3537 /usr/bin/bash guuid=e0ce96c5-1600-0000-2d82-c345d00d0000 pid=3536->guuid=0a33a9c5-1600-0000-2d82-c345d10d0000 pid=3537 clone guuid=c3d350c6-1600-0000-2d82-c345d80d0000 pid=3544->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=906d2cc9-1600-0000-2d82-c345e40d0000 pid=3556->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=82d47ad1-1600-0000-2d82-c345fd0d0000 pid=3581 /usr/bin/bash guuid=83f454d1-1600-0000-2d82-c345fc0d0000 pid=3580->guuid=82d47ad1-1600-0000-2d82-c345fd0d0000 pid=3581 clone guuid=f84666d2-1600-0000-2d82-c345000e0000 pid=3584->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=75ff61d5-1600-0000-2d82-c345010e0000 pid=3585->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8f53d5d9-1600-0000-2d82-c3450f0e0000 pid=3599 /usr/bin/bash guuid=e06fbfd9-1600-0000-2d82-c3450d0e0000 pid=3597->guuid=8f53d5d9-1600-0000-2d82-c3450f0e0000 pid=3599 clone guuid=326087da-1600-0000-2d82-c345130e0000 pid=3603->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8240a5dd-1600-0000-2d82-c345140e0000 pid=3604->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e32116e5-1600-0000-2d82-c3452e0e0000 pid=3630 /usr/bin/bash guuid=1a9bebe4-1600-0000-2d82-c3452d0e0000 pid=3629->guuid=e32116e5-1600-0000-2d82-c3452e0e0000 pid=3630 clone guuid=9bf4c7e6-1600-0000-2d82-c3453a0e0000 pid=3642->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3ce0d7ea-1600-0000-2d82-c3454e0e0000 pid=3662->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9fc415f3-1600-0000-2d82-c3456e0e0000 pid=3694 /usr/bin/bash guuid=b5bdfef2-1600-0000-2d82-c3456d0e0000 pid=3693->guuid=9fc415f3-1600-0000-2d82-c3456e0e0000 pid=3694 clone guuid=b10ef8f3-1600-0000-2d82-c345740e0000 pid=3700->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=08378bf6-1600-0000-2d82-c3457e0e0000 pid=3710->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3318b0fa-1600-0000-2d82-c345970e0000 pid=3735 /usr/bin/bash guuid=a20064fa-1600-0000-2d82-c345960e0000 pid=3734->guuid=3318b0fa-1600-0000-2d82-c345970e0000 pid=3735 clone guuid=04e150fb-1600-0000-2d82-c3459e0e0000 pid=3742->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=80e6cdfd-1600-0000-2d82-c345b10e0000 pid=3761->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c34c2c03-1700-0000-2d82-c345be0e0000 pid=3774 /usr/bin/bash guuid=5d940c03-1700-0000-2d82-c345bd0e0000 pid=3773->guuid=c34c2c03-1700-0000-2d82-c345be0e0000 pid=3774 clone guuid=34b13d04-1700-0000-2d82-c345c30e0000 pid=3779->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=720d6707-1700-0000-2d82-c345cc0e0000 pid=3788->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=98326817-1700-0000-2d82-c345e30e0000 pid=3811 /usr/bin/bash guuid=7eeb3817-1700-0000-2d82-c345e10e0000 pid=3809->guuid=98326817-1700-0000-2d82-c345e30e0000 pid=3811 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-08-10 16:54:25 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xpll6bxkkm6rx5oam3fh45amrdy5ywcfbioapcxvw6hkwkffe2qq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260810-vd8mgadl5z/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates running processes
Enumerates active TCP sockets
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Creates a large amount of network flows
Family: Mirai
Malware Config
C2 Extraction:
141.98.10.50
kappadocia.net
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/bbd6bf06ea533d1bf5c066ca7e740c88f1dc58450a1c078af5b78eab28a526a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
http://5.182.210.174/ok

Comments