MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540
SHA3-384 hash: 5a1425661822f92be0cbafb09ff369e190ae210629e464901fc640ec0b0b792c4d0bc0c391dbd0b959b3feda4c3c5db3
SHA1 hash: 026f4bba35eff10d33437986dd9722c1d6abe1ac
MD5 hash: f226e5066a68f1ff726206c5eafb611f
humanhash: nebraska-neptune-tennessee-uranus
File name:be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540
Download: download sample
Signature Mirai
Create hunting rule
File size:1'834 bytes
First seen:2026-07-23 05:23:28 UTC
Last seen:2026-07-23 10:13:13 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:HXfNvSPGFrpUDzR1fqFmtKOtk3nbnun2an2MtyJivVtkxQFFaF2Ba:M4m7T8
TLSH T18B31F29922B09179C64DCF03B0E542C4A277F584E2B3CFFAF5C11E61585BE80B45DAB6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c2hunter
Tags:mirai sh wraith
URLMalware sample (SHA256 hash)SignatureTags
http://195.201.123.9/iran.x86_645345bd744accf98558645413cf859bc512d178ad80511e1e026055c00bf7357b Miraimirai wraith
http://195.201.123.9/iran.aarch64259f8cf64985b2f985d35e36afa3e0b65a217a9807688afd9140f553cd1937ea Miraimirai wraith
http://195.201.123.9/iran.m68k81d076bf6d02f4b5aee9e0d68cbb16321a55868d1340aa250c7f20c4fbb76191 Miraimirai wraith
http://195.201.123.9/iran.mips937577b66c6f81d3a4bc622e27d7eb012881ad9ad530e7d62aab75b0bbf0ef2e Miraimirai wraith
http://195.201.123.9/iran.mipselbd3e518d1042626505e4ba1d14746042120d85434f0ce85f39b9f553f3390647 Miraimirai wraith
http://195.201.123.9/iran.powerpce1ce5df25cf4248eb39c390785dce9630403a71500e2e49401ed1457d1945578 Miraielf mirai ua-wget
http://195.201.123.9/iran.sparce410ac279ef0b2fc204228752d50a83f1b79a4ab482cbc22234434adca56d270 Miraielf mirai ua-wget
http://195.201.123.9/iran.sh47456f5f1a44fcb5a3908c30635ab9d8d1aca4ca7d868ca55f3cb6871e350a55b Miraielf mirai ua-wget
http://195.201.123.9/iran.arc5d69793ea925cde3232142e2489e868e3b5d8f4e2e27ecc9f4e1d8995ec5d978 Miraielf mirai ua-wget
http://195.201.123.9/iran.i4863442c70a88eda52f9da13a01bab05b8f9d091303527ccfad9c7bebddffdb9c58 Miraielf mirai ua-wget
http://195.201.123.9/iran.armv4l4275b18173e133af55c6d41312d07f633672bf905bde8572966d5e890760b359 Gafgytelf ua-wget
http://195.201.123.9/iran.armv5l6cf1cfdeae6fbf86ad6536050ba4828259b18abb7832ddc8d426e9009a350e39 Miraielf mirai ua-wget
http://195.201.123.9/iran.armv6l2549be919e91b379b7e4778254d643c02090896432eab4d34bd5a87016cd32f9 Miraielf mirai ua-wget
http://195.201.123.9/iran.armv7l9c1e484d7c397d0aa527d6c8aeb674172a5c4837a54e6d3592a9d978ad353f1b Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
70
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader mirai
Link:
https://www.filescan.io/uploads/6a61a558f82efe7d3e90c667/reports/16ce0b37-ba5f-48d9-ace8-b2fc4d3cec27/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-23T00:57:00Z UTC
Last seen:
2026-07-23T01:24:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/07f09f92-8de0-434e-940d-bd6169c418a3
Behavior Graph:
Download SVG
%3 guuid=b63f13af-1b00-0000-ed09-d767460a0000 pid=2630 /usr/bin/sudo guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639 /tmp/sample.bin guuid=b63f13af-1b00-0000-ed09-d767460a0000 pid=2630->guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639 execve guuid=df0a14b3-1b00-0000-ed09-d767500a0000 pid=2640 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=df0a14b3-1b00-0000-ed09-d767500a0000 pid=2640 execve guuid=aad0a6cd-1b00-0000-ed09-d7675f0a0000 pid=2655 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=aad0a6cd-1b00-0000-ed09-d7675f0a0000 pid=2655 execve guuid=44ae34d1-1b00-0000-ed09-d767600a0000 pid=2656 /home/sandbox/x86_64 guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=44ae34d1-1b00-0000-ed09-d767600a0000 pid=2656 execve guuid=342c0ed3-1b00-0000-ed09-d767640a0000 pid=2660 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=342c0ed3-1b00-0000-ed09-d767640a0000 pid=2660 execve guuid=76aaf2dd-1b00-0000-ed09-d7677b0a0000 pid=2683 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=76aaf2dd-1b00-0000-ed09-d7677b0a0000 pid=2683 execve guuid=2a494ef0-1b00-0000-ed09-d7679a0a0000 pid=2714 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=2a494ef0-1b00-0000-ed09-d7679a0a0000 pid=2714 execve guuid=c193b0f0-1b00-0000-ed09-d7679c0a0000 pid=2716 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=c193b0f0-1b00-0000-ed09-d7679c0a0000 pid=2716 clone guuid=b940e1f1-1b00-0000-ed09-d767a00a0000 pid=2720 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=b940e1f1-1b00-0000-ed09-d767a00a0000 pid=2720 execve guuid=39c85101-1c00-0000-ed09-d767b40a0000 pid=2740 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=39c85101-1c00-0000-ed09-d767b40a0000 pid=2740 execve guuid=5f4b8901-1c00-0000-ed09-d767b60a0000 pid=2742 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=5f4b8901-1c00-0000-ed09-d767b60a0000 pid=2742 clone guuid=26f50802-1c00-0000-ed09-d767b80a0000 pid=2744 /usr/bin/wget net send-data guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=26f50802-1c00-0000-ed09-d767b80a0000 pid=2744 execve guuid=bd0f5606-1c00-0000-ed09-d767c30a0000 pid=2755 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=bd0f5606-1c00-0000-ed09-d767c30a0000 pid=2755 execve guuid=ce6fe716-1c00-0000-ed09-d767f40a0000 pid=2804 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=ce6fe716-1c00-0000-ed09-d767f40a0000 pid=2804 execve guuid=f42cfe17-1c00-0000-ed09-d767f90a0000 pid=2809 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=f42cfe17-1c00-0000-ed09-d767f90a0000 pid=2809 clone guuid=029b6619-1c00-0000-ed09-d767fc0a0000 pid=2812 /usr/bin/wget net guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=029b6619-1c00-0000-ed09-d767fc0a0000 pid=2812 execve guuid=089dab1d-1c00-0000-ed09-d767070b0000 pid=2823 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=089dab1d-1c00-0000-ed09-d767070b0000 pid=2823 execve guuid=fd8ffe30-1c00-0000-ed09-d767260b0000 pid=2854 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=fd8ffe30-1c00-0000-ed09-d767260b0000 pid=2854 execve guuid=3a086c32-1c00-0000-ed09-d767280b0000 pid=2856 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=3a086c32-1c00-0000-ed09-d767280b0000 pid=2856 clone guuid=6ee00c35-1c00-0000-ed09-d7672e0b0000 pid=2862 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=6ee00c35-1c00-0000-ed09-d7672e0b0000 pid=2862 execve guuid=7833e042-1c00-0000-ed09-d767460b0000 pid=2886 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=7833e042-1c00-0000-ed09-d767460b0000 pid=2886 execve guuid=e3502443-1c00-0000-ed09-d767470b0000 pid=2887 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=e3502443-1c00-0000-ed09-d767470b0000 pid=2887 clone guuid=7ecdaa43-1c00-0000-ed09-d7674a0b0000 pid=2890 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=7ecdaa43-1c00-0000-ed09-d7674a0b0000 pid=2890 execve guuid=8a52dd49-1c00-0000-ed09-d7675c0b0000 pid=2908 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=8a52dd49-1c00-0000-ed09-d7675c0b0000 pid=2908 execve guuid=0a589356-1c00-0000-ed09-d767790b0000 pid=2937 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=0a589356-1c00-0000-ed09-d767790b0000 pid=2937 execve guuid=3c42d956-1c00-0000-ed09-d7677b0b0000 pid=2939 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=3c42d956-1c00-0000-ed09-d7677b0b0000 pid=2939 clone guuid=bbb78957-1c00-0000-ed09-d7677f0b0000 pid=2943 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=bbb78957-1c00-0000-ed09-d7677f0b0000 pid=2943 execve guuid=44c3715e-1c00-0000-ed09-d7678d0b0000 pid=2957 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=44c3715e-1c00-0000-ed09-d7678d0b0000 pid=2957 execve guuid=b7242f6c-1c00-0000-ed09-d767ac0b0000 pid=2988 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=b7242f6c-1c00-0000-ed09-d767ac0b0000 pid=2988 execve guuid=7ef3a06c-1c00-0000-ed09-d767ae0b0000 pid=2990 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=7ef3a06c-1c00-0000-ed09-d767ae0b0000 pid=2990 clone guuid=bc1c6b6d-1c00-0000-ed09-d767b20b0000 pid=2994 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=bc1c6b6d-1c00-0000-ed09-d767b20b0000 pid=2994 execve guuid=d0a97c74-1c00-0000-ed09-d767c60b0000 pid=3014 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=d0a97c74-1c00-0000-ed09-d767c60b0000 pid=3014 execve guuid=b6616d84-1c00-0000-ed09-d767e70b0000 pid=3047 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=b6616d84-1c00-0000-ed09-d767e70b0000 pid=3047 execve guuid=c569d984-1c00-0000-ed09-d767e90b0000 pid=3049 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=c569d984-1c00-0000-ed09-d767e90b0000 pid=3049 clone guuid=0050a085-1c00-0000-ed09-d767ed0b0000 pid=3053 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=0050a085-1c00-0000-ed09-d767ed0b0000 pid=3053 execve guuid=bcfccf8b-1c00-0000-ed09-d767fc0b0000 pid=3068 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=bcfccf8b-1c00-0000-ed09-d767fc0b0000 pid=3068 execve guuid=71689899-1c00-0000-ed09-d7671e0c0000 pid=3102 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=71689899-1c00-0000-ed09-d7671e0c0000 pid=3102 execve guuid=d01ce799-1c00-0000-ed09-d767200c0000 pid=3104 /home/sandbox/i486 guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=d01ce799-1c00-0000-ed09-d767200c0000 pid=3104 execve guuid=ba51469c-1c00-0000-ed09-d767240c0000 pid=3108 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=ba51469c-1c00-0000-ed09-d767240c0000 pid=3108 execve guuid=b93d59a3-1c00-0000-ed09-d7672e0c0000 pid=3118 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=b93d59a3-1c00-0000-ed09-d7672e0c0000 pid=3118 execve guuid=371601b1-1c00-0000-ed09-d7673e0c0000 pid=3134 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=371601b1-1c00-0000-ed09-d7673e0c0000 pid=3134 execve guuid=6dfb5eb1-1c00-0000-ed09-d7673f0c0000 pid=3135 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=6dfb5eb1-1c00-0000-ed09-d7673f0c0000 pid=3135 clone guuid=05be3ab3-1c00-0000-ed09-d767410c0000 pid=3137 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=05be3ab3-1c00-0000-ed09-d767410c0000 pid=3137 execve guuid=c093bcbe-1c00-0000-ed09-d767430c0000 pid=3139 /usr/bin/curl net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=c093bcbe-1c00-0000-ed09-d767430c0000 pid=3139 execve guuid=c13012d5-1c00-0000-ed09-d767620c0000 pid=3170 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=c13012d5-1c00-0000-ed09-d767620c0000 pid=3170 execve guuid=c6615ad5-1c00-0000-ed09-d767640c0000 pid=3172 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=c6615ad5-1c00-0000-ed09-d767640c0000 pid=3172 clone guuid=b6be32d6-1c00-0000-ed09-d767670c0000 pid=3175 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=b6be32d6-1c00-0000-ed09-d767670c0000 pid=3175 execve guuid=f15543e2-1c00-0000-ed09-d7676f0c0000 pid=3183 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=f15543e2-1c00-0000-ed09-d7676f0c0000 pid=3183 execve guuid=43e8e9e2-1c00-0000-ed09-d767700c0000 pid=3184 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=43e8e9e2-1c00-0000-ed09-d767700c0000 pid=3184 clone guuid=4ee828e4-1c00-0000-ed09-d767720c0000 pid=3186 /usr/bin/wget net send-data write-file guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=4ee828e4-1c00-0000-ed09-d767720c0000 pid=3186 execve guuid=91ecb1f0-1c00-0000-ed09-d7677c0c0000 pid=3196 /usr/bin/chmod guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=91ecb1f0-1c00-0000-ed09-d7677c0c0000 pid=3196 execve guuid=141a2cf1-1c00-0000-ed09-d7677d0c0000 pid=3197 /usr/bin/dash guuid=fc88c2b2-1b00-0000-ed09-d7674f0a0000 pid=2639->guuid=141a2cf1-1c00-0000-ed09-d7677d0c0000 pid=3197 clone f6650f07-f33d-53cb-8531-29aa6c7d8252 195.201.123.9:80 guuid=df0a14b3-1b00-0000-ed09-d767500a0000 pid=2640->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 139B guuid=8c3dddd2-1b00-0000-ed09-d767610a0000 pid=2657 /home/sandbox/x86_64 zombie guuid=44ae34d1-1b00-0000-ed09-d767600a0000 pid=2656->guuid=8c3dddd2-1b00-0000-ed09-d767610a0000 pid=2657 clone guuid=990af9d2-1b00-0000-ed09-d767630a0000 pid=2659 /home/sandbox/x86_64 write-config zombie guuid=8c3dddd2-1b00-0000-ed09-d767610a0000 pid=2657->guuid=990af9d2-1b00-0000-ed09-d767630a0000 pid=2659 clone guuid=0c8f2dd3-1b00-0000-ed09-d767650a0000 pid=2661 /home/sandbox/x86_64 net send-data guuid=990af9d2-1b00-0000-ed09-d767630a0000 pid=2659->guuid=0c8f2dd3-1b00-0000-ed09-d767650a0000 pid=2661 clone guuid=342c0ed3-1b00-0000-ed09-d767640a0000 pid=2660->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 140B 5110592f-54f8-5523-999a-55a85e15f1f8 195.201.123.9:8060 guuid=0c8f2dd3-1b00-0000-ed09-d767650a0000 pid=2661->5110592f-54f8-5523-999a-55a85e15f1f8 send: 37B guuid=5d803ed3-1b00-0000-ed09-d767660a0000 pid=2662 /home/sandbox/x86_64 guuid=0c8f2dd3-1b00-0000-ed09-d767650a0000 pid=2661->guuid=5d803ed3-1b00-0000-ed09-d767660a0000 pid=2662 clone guuid=5061fcd3-1b00-0000-ed09-d767670a0000 pid=2663 /home/sandbox/x86_64 guuid=5d803ed3-1b00-0000-ed09-d767660a0000 pid=2662->guuid=5061fcd3-1b00-0000-ed09-d767670a0000 pid=2663 clone guuid=76aaf2dd-1b00-0000-ed09-d7677b0a0000 pid=2683->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 89B guuid=b940e1f1-1b00-0000-ed09-d767a00a0000 pid=2720->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 137B guuid=26f50802-1c00-0000-ed09-d767b80a0000 pid=2744->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 137B guuid=bd0f5606-1c00-0000-ed09-d767c30a0000 pid=2755->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 86B guuid=029b6619-1c00-0000-ed09-d767fc0a0000 pid=2812->f6650f07-f33d-53cb-8531-29aa6c7d8252 con guuid=089dab1d-1c00-0000-ed09-d767070b0000 pid=2823->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 88B guuid=6ee00c35-1c00-0000-ed09-d7672e0b0000 pid=2862->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 140B guuid=7ecdaa43-1c00-0000-ed09-d7674a0b0000 pid=2890->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 138B guuid=8a52dd49-1c00-0000-ed09-d7675c0b0000 pid=2908->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 87B guuid=bbb78957-1c00-0000-ed09-d7677f0b0000 pid=2943->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 136B guuid=44c3715e-1c00-0000-ed09-d7678d0b0000 pid=2957->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 85B guuid=bc1c6b6d-1c00-0000-ed09-d767b20b0000 pid=2994->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 136B guuid=d0a97c74-1c00-0000-ed09-d767c60b0000 pid=3014->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 85B guuid=0050a085-1c00-0000-ed09-d767ed0b0000 pid=3053->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 137B guuid=bcfccf8b-1c00-0000-ed09-d767fc0b0000 pid=3068->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 86B guuid=a9e1279c-1c00-0000-ed09-d767220c0000 pid=3106 /home/sandbox/i486 guuid=d01ce799-1c00-0000-ed09-d767200c0000 pid=3104->guuid=a9e1279c-1c00-0000-ed09-d767220c0000 pid=3106 clone guuid=98b4329c-1c00-0000-ed09-d767230c0000 pid=3107 /home/sandbox/i486 write-config zombie guuid=a9e1279c-1c00-0000-ed09-d767220c0000 pid=3106->guuid=98b4329c-1c00-0000-ed09-d767230c0000 pid=3107 clone guuid=19a8489c-1c00-0000-ed09-d767250c0000 pid=3109 /home/sandbox/i486 net send-data guuid=98b4329c-1c00-0000-ed09-d767230c0000 pid=3107->guuid=19a8489c-1c00-0000-ed09-d767250c0000 pid=3109 clone guuid=ba51469c-1c00-0000-ed09-d767240c0000 pid=3108->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 139B guuid=19a8489c-1c00-0000-ed09-d767250c0000 pid=3109->5110592f-54f8-5523-999a-55a85e15f1f8 send: 352B guuid=19a8489c-1c00-0000-ed09-d767250c0000 pid=3110 /home/sandbox/i486 guuid=19a8489c-1c00-0000-ed09-d767250c0000 pid=3109->guuid=19a8489c-1c00-0000-ed09-d767250c0000 pid=3110 clone guuid=b93d59a3-1c00-0000-ed09-d7672e0c0000 pid=3118->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 88B guuid=05be3ab3-1c00-0000-ed09-d767410c0000 pid=3137->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 139B guuid=c093bcbe-1c00-0000-ed09-d767430c0000 pid=3139->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 88B guuid=b6be32d6-1c00-0000-ed09-d767670c0000 pid=3175->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 139B guuid=4ee828e4-1c00-0000-ed09-d767720c0000 pid=3186->f6650f07-f33d-53cb-8531-29aa6c7d8252 send: 139B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzyofgt42mvkjo7uqwqz24jdht23r2s23eynah3kzf6cs6oc4vaa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/260723-f3e9ws1fqe/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Enumerates running processes
Modifies init.d
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540

(this sample)

Mirai

elf 5345bd744accf98558645413cf859bc512d178ad80511e1e026055c00bf7357b

  
Link
http://195.201.123.9/telnet.sh
  
URLhaus
https://urlhaus.abuse.ch/url/3890415/
  
Delivery method
Distributed via web download
  
Dropping
MD5 560867e75724d1900b86ab855094f8b1
  
Dropping
SHA256 5345bd744accf98558645413cf859bc512d178ad80511e1e026055c00bf7357b

Comments