🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca998a90c13ef236377b6582ce6c43a2f964cf0d9198afee45d2cb0ed0484b5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca998a90c13ef236377b6582ce6c43a2f964cf0d9198afee45d2cb0ed0484b5f
SHA3-384 hash: 4649074a086e3837dcb11d24589b0c02a2cb967179bae07be43611d54330534371a46d85ca355ba8a3960625f97ed832
SHA1 hash: 8906a57bfc418e925832b44ffd3b75be6fc3be7d
MD5 hash: 516638914b7ceb8142483a41bc2e9d47
humanhash: king-uranus-blossom-thirteen
File name:cat.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'903 bytes
First seen:2026-10-21 18:14:37 UTC
Last seen:2026-10-22 10:14:12 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:sCMbcX2GGLiASEmyBocEEmqpCF2uITy8bS0+FD:I2XD
TLSH T16C41048910B0E173C6DACE41B0E5C698D246F58A76D62FBEDCC92DA9CCD9D40B025B37
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.231/iran.x86_644cad92324efb2059559603ecb12b209ba7398e985cbea691a668649c74fd4acf Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.aarch646e97bcc4e00a402a5b0fae8fc979e4589e040b19a10ca089b8e41721bf265be9 Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.m68kb76146d4423f0b09c29a2662a15fb2fe420a4dee5f4c3bf47e4285cba07eb76d Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.mips0396b39bbb67135712d2b058e3ed7bd77054865c655cfcf810c6b4981d157111 Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.mipsel0b65862f541e107c401881d6c064b526bc7206915fdaa739e914101a771292e8 Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.powerpcdb2bb794f68e2f6994ff0d5892b341d8684ae743eb9a7462f30c4596828a13d6 Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.sparcd268af016438746b43c6ae4d226c80fec85e74563128bf10406d44748384e76d Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.sh43a1265165f281628e3a21cf566ea97e9e87e7bbb098ea0f031c469f2538584fe Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.arc0b363625c8bcc65552bde9e9c721b16f0f67b126ec92bdd2680d6b3791c841c2 Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.i4867aa2703a28b3894d74194a19397bef50eb5e7c32f0602bdb518d63d6e7c00e2a Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.armv4l5bf0f4254e12c89c169de36452645aef1bc8faf57c5fe3bca0c1e541aeeef579 Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.armv5lae15f86b545f844b49be7b684e48c72acaddad20b94a2dac2d2e709a5d9d6836 Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.armv6ld5a4582002db9af61e1978c97461771034288f373805166a5cc294a48cd3a8b8 Mirai176-65-139-231 elf mirai ua-wget
http://176.65.139.231/iran.armv7lcb0ec371a599291187e64f2e5f35c61f8423a30efe7af9e7831d612612ee3cd0 Mirai176-65-139-231 elf mirai ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
63
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-21T16:27:00Z UTC
Last seen:
2026-10-22T03:59:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ca998a90c13ef236377b6582ce6c43a2f964cf0d9198afee45d2cb0ed0484b5f/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ea677dc4-dcb4-48ef-ad02-95d685aee813
Behavior Graph:
Download SVG
%3 guuid=7968c474-1a00-0000-c0eb-7579280c0000 pid=3112 /usr/bin/sudo guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114 /tmp/sample.bin guuid=7968c474-1a00-0000-c0eb-7579280c0000 pid=3112->guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114 execve guuid=0837d278-1a00-0000-c0eb-75792b0c0000 pid=3115 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=0837d278-1a00-0000-c0eb-75792b0c0000 pid=3115 execve guuid=828a2f82-1a00-0000-c0eb-7579390c0000 pid=3129 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=828a2f82-1a00-0000-c0eb-7579390c0000 pid=3129 execve guuid=eb298c82-1a00-0000-c0eb-75793a0c0000 pid=3130 /home/sandbox/x86_64 guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=eb298c82-1a00-0000-c0eb-75793a0c0000 pid=3130 execve guuid=f1a3ef82-1a00-0000-c0eb-75793c0c0000 pid=3132 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=f1a3ef82-1a00-0000-c0eb-75793c0c0000 pid=3132 execve guuid=0b3f2d8a-1a00-0000-c0eb-75793f0c0000 pid=3135 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=0b3f2d8a-1a00-0000-c0eb-75793f0c0000 pid=3135 execve guuid=1523b08a-1a00-0000-c0eb-7579400c0000 pid=3136 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=1523b08a-1a00-0000-c0eb-7579400c0000 pid=3136 clone guuid=a33ac08a-1a00-0000-c0eb-7579410c0000 pid=3137 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=a33ac08a-1a00-0000-c0eb-7579410c0000 pid=3137 execve guuid=fc27e512-1b00-0000-c0eb-7579470c0000 pid=3143 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=fc27e512-1b00-0000-c0eb-7579470c0000 pid=3143 execve guuid=6e663c13-1b00-0000-c0eb-7579490c0000 pid=3145 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=6e663c13-1b00-0000-c0eb-7579490c0000 pid=3145 clone guuid=5ded1a14-1b00-0000-c0eb-75794c0c0000 pid=3148 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=5ded1a14-1b00-0000-c0eb-75794c0c0000 pid=3148 execve guuid=37ea3d1b-1b00-0000-c0eb-75794e0c0000 pid=3150 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=37ea3d1b-1b00-0000-c0eb-75794e0c0000 pid=3150 execve guuid=3fe1c01b-1b00-0000-c0eb-75794f0c0000 pid=3151 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=3fe1c01b-1b00-0000-c0eb-75794f0c0000 pid=3151 clone guuid=87b9dc1d-1b00-0000-c0eb-7579570c0000 pid=3159 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=87b9dc1d-1b00-0000-c0eb-7579570c0000 pid=3159 execve guuid=0eb4c924-1b00-0000-c0eb-7579660c0000 pid=3174 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=0eb4c924-1b00-0000-c0eb-7579660c0000 pid=3174 execve guuid=27a3ff24-1b00-0000-c0eb-7579680c0000 pid=3176 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=27a3ff24-1b00-0000-c0eb-7579680c0000 pid=3176 clone guuid=ed7fd725-1b00-0000-c0eb-75796b0c0000 pid=3179 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=ed7fd725-1b00-0000-c0eb-75796b0c0000 pid=3179 execve guuid=f0ae7830-1b00-0000-c0eb-7579730c0000 pid=3187 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=f0ae7830-1b00-0000-c0eb-7579730c0000 pid=3187 execve guuid=d9e2ec30-1b00-0000-c0eb-7579750c0000 pid=3189 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=d9e2ec30-1b00-0000-c0eb-7579750c0000 pid=3189 clone guuid=d60bcf31-1b00-0000-c0eb-75797a0c0000 pid=3194 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=d60bcf31-1b00-0000-c0eb-75797a0c0000 pid=3194 execve guuid=f4cb3937-1b00-0000-c0eb-7579830c0000 pid=3203 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=f4cb3937-1b00-0000-c0eb-7579830c0000 pid=3203 execve guuid=b8067837-1b00-0000-c0eb-7579850c0000 pid=3205 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=b8067837-1b00-0000-c0eb-7579850c0000 pid=3205 clone guuid=95e14c38-1b00-0000-c0eb-7579890c0000 pid=3209 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=95e14c38-1b00-0000-c0eb-7579890c0000 pid=3209 execve guuid=e76ecb3e-1b00-0000-c0eb-7579950c0000 pid=3221 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=e76ecb3e-1b00-0000-c0eb-7579950c0000 pid=3221 execve guuid=20e8093f-1b00-0000-c0eb-7579970c0000 pid=3223 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=20e8093f-1b00-0000-c0eb-7579970c0000 pid=3223 clone guuid=7acc8b3f-1b00-0000-c0eb-75799a0c0000 pid=3226 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=7acc8b3f-1b00-0000-c0eb-75799a0c0000 pid=3226 execve guuid=1cc36e44-1b00-0000-c0eb-7579a30c0000 pid=3235 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=1cc36e44-1b00-0000-c0eb-7579a30c0000 pid=3235 execve guuid=17acf444-1b00-0000-c0eb-7579a50c0000 pid=3237 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=17acf444-1b00-0000-c0eb-7579a50c0000 pid=3237 clone guuid=253a2846-1b00-0000-c0eb-7579a80c0000 pid=3240 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=253a2846-1b00-0000-c0eb-7579a80c0000 pid=3240 execve guuid=8533024c-1b00-0000-c0eb-7579ac0c0000 pid=3244 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=8533024c-1b00-0000-c0eb-7579ac0c0000 pid=3244 execve guuid=e1d2524d-1b00-0000-c0eb-7579ad0c0000 pid=3245 /home/sandbox/i486 guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=e1d2524d-1b00-0000-c0eb-7579ad0c0000 pid=3245 execve guuid=7b2e8952-1b00-0000-c0eb-7579af0c0000 pid=3247 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=7b2e8952-1b00-0000-c0eb-7579af0c0000 pid=3247 execve guuid=f075ad59-1b00-0000-c0eb-7579b40c0000 pid=3252 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=f075ad59-1b00-0000-c0eb-7579b40c0000 pid=3252 execve guuid=a3995f5a-1b00-0000-c0eb-7579b60c0000 pid=3254 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=a3995f5a-1b00-0000-c0eb-7579b60c0000 pid=3254 clone guuid=b482245b-1b00-0000-c0eb-7579b90c0000 pid=3257 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=b482245b-1b00-0000-c0eb-7579b90c0000 pid=3257 execve guuid=7ab72e60-1b00-0000-c0eb-7579c60c0000 pid=3270 /usr/bin/curl net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=7ab72e60-1b00-0000-c0eb-7579c60c0000 pid=3270 execve guuid=04c93b70-1b00-0000-c0eb-7579df0c0000 pid=3295 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=04c93b70-1b00-0000-c0eb-7579df0c0000 pid=3295 execve guuid=ae82ab70-1b00-0000-c0eb-7579e10c0000 pid=3297 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=ae82ab70-1b00-0000-c0eb-7579e10c0000 pid=3297 clone guuid=f0935671-1b00-0000-c0eb-7579e60c0000 pid=3302 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=f0935671-1b00-0000-c0eb-7579e60c0000 pid=3302 execve guuid=eab14e77-1b00-0000-c0eb-7579f50c0000 pid=3317 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=eab14e77-1b00-0000-c0eb-7579f50c0000 pid=3317 execve guuid=23b7c577-1b00-0000-c0eb-7579f80c0000 pid=3320 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=23b7c577-1b00-0000-c0eb-7579f80c0000 pid=3320 clone guuid=99628278-1b00-0000-c0eb-7579fd0c0000 pid=3325 /usr/bin/wget net send-data write-file guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=99628278-1b00-0000-c0eb-7579fd0c0000 pid=3325 execve guuid=01197e7f-1b00-0000-c0eb-7579090d0000 pid=3337 /usr/bin/chmod guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=01197e7f-1b00-0000-c0eb-7579090d0000 pid=3337 execve guuid=00953e80-1b00-0000-c0eb-75790c0d0000 pid=3340 /usr/bin/dash guuid=2fdf9078-1a00-0000-c0eb-75792a0c0000 pid=3114->guuid=00953e80-1b00-0000-c0eb-75790c0d0000 pid=3340 clone 31430302-b3da-520e-a1e1-a3a5c65557d1 176.65.139.231:80 guuid=0837d278-1a00-0000-c0eb-75792b0c0000 pid=3115->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 140B guuid=4063e582-1a00-0000-c0eb-75793b0c0000 pid=3131 /home/sandbox/x86_64 zombie guuid=eb298c82-1a00-0000-c0eb-75793a0c0000 pid=3130->guuid=4063e582-1a00-0000-c0eb-75793b0c0000 pid=3131 clone guuid=0b790d83-1a00-0000-c0eb-75793d0c0000 pid=3133 /home/sandbox/x86_64 write-config zombie guuid=4063e582-1a00-0000-c0eb-75793b0c0000 pid=3131->guuid=0b790d83-1a00-0000-c0eb-75793d0c0000 pid=3133 clone guuid=f1a3ef82-1a00-0000-c0eb-75793c0c0000 pid=3132->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 141B guuid=4c3df083-1a00-0000-c0eb-75793e0c0000 pid=3134 /home/sandbox/x86_64 net send-data guuid=0b790d83-1a00-0000-c0eb-75793d0c0000 pid=3133->guuid=4c3df083-1a00-0000-c0eb-75793e0c0000 pid=3134 clone 716a6bba-8962-5c8c-a979-15c02084bdc8 176.65.139.231:8060 guuid=4c3df083-1a00-0000-c0eb-75793e0c0000 pid=3134->716a6bba-8962-5c8c-a979-15c02084bdc8 send: 38B guuid=a33ac08a-1a00-0000-c0eb-7579410c0000 pid=3137->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 138B guuid=5ded1a14-1b00-0000-c0eb-75794c0c0000 pid=3148->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 138B guuid=87b9dc1d-1b00-0000-c0eb-7579570c0000 pid=3159->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 140B guuid=ed7fd725-1b00-0000-c0eb-75796b0c0000 pid=3179->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 141B guuid=d60bcf31-1b00-0000-c0eb-75797a0c0000 pid=3194->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 139B guuid=95e14c38-1b00-0000-c0eb-7579890c0000 pid=3209->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 137B guuid=7acc8b3f-1b00-0000-c0eb-75799a0c0000 pid=3226->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 137B guuid=253a2846-1b00-0000-c0eb-7579a80c0000 pid=3240->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 138B guuid=7a8a7152-1b00-0000-c0eb-7579ae0c0000 pid=3246 /home/sandbox/i486 guuid=e1d2524d-1b00-0000-c0eb-7579ad0c0000 pid=3245->guuid=7a8a7152-1b00-0000-c0eb-7579ae0c0000 pid=3246 clone guuid=d0e2ee53-1b00-0000-c0eb-7579b00c0000 pid=3248 /home/sandbox/i486 write-config zombie guuid=7a8a7152-1b00-0000-c0eb-7579ae0c0000 pid=3246->guuid=d0e2ee53-1b00-0000-c0eb-7579b00c0000 pid=3248 clone guuid=7b2e8952-1b00-0000-c0eb-7579af0c0000 pid=3247->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 140B guuid=4fe15954-1b00-0000-c0eb-7579b10c0000 pid=3249 /home/sandbox/i486 net send-data guuid=d0e2ee53-1b00-0000-c0eb-7579b00c0000 pid=3248->guuid=4fe15954-1b00-0000-c0eb-7579b10c0000 pid=3249 clone guuid=4fe15954-1b00-0000-c0eb-7579b10c0000 pid=3249->716a6bba-8962-5c8c-a979-15c02084bdc8 send: 194B guuid=4fe15954-1b00-0000-c0eb-7579b10c0000 pid=3250 /home/sandbox/i486 guuid=4fe15954-1b00-0000-c0eb-7579b10c0000 pid=3249->guuid=4fe15954-1b00-0000-c0eb-7579b10c0000 pid=3250 clone guuid=b482245b-1b00-0000-c0eb-7579b90c0000 pid=3257->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 140B guuid=7ab72e60-1b00-0000-c0eb-7579c60c0000 pid=3270->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 89B guuid=f0935671-1b00-0000-c0eb-7579e60c0000 pid=3302->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 140B guuid=99628278-1b00-0000-c0eb-7579fd0c0000 pid=3325->31430302-b3da-520e-a1e1-a3a5c65557d1 send: 140B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ca998a90c13ef236377b6582ce6c43a2f964cf0d9198afee45d2cb0ed0484b5f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca998a90c13ef236377b6582ce6c43a2f964cf0d9198afee45d2cb0ed0484b5f/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-10-21 18:14:20 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zkmyvegbh3zdmn33mwbm43cdul4wjtynsgmk73sf2lfq5ucijnpq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/261021-wwbk5avtfx/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Enumerates running processes
Modifies init.d
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
Gafgyt
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ca998a90c13e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/ca998a90c13ef236377b6582ce6c43a2f964cf0d9198afee45d2cb0ed0484b5f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh ca998a90c13ef236377b6582ce6c43a2f964cf0d9198afee45d2cb0ed0484b5f

(this sample)

Mirai

elf 4cad92324efb2059559603ecb12b209ba7398e985cbea691a668649c74fd4acf

  
URLhaus
https://urlhaus.abuse.ch/url/3955112/
  
Delivery method
Distributed via web download
  
Dropping
MD5 69ae780abe178856cb775f333c0f783e
  
Dropping
SHA256 4cad92324efb2059559603ecb12b209ba7398e985cbea691a668649c74fd4acf

Comments