MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9
SHA3-384 hash: 470f4bc80217298bc9847ce90c3764dce7eacc6c0760bdc947b58c48239b232de7f1ce721d23142e671abc873d8663ce
SHA1 hash: 2d60b1f965e11029c2c8d2f05f7f02143bb4d6eb
MD5 hash: 11f70e88de06f1e198c2a98119fd16af
humanhash: thirteen-beryllium-mississippi-victor
File name:XKcNhY4G8rcYpb.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'982 bytes
First seen:2026-04-15 18:28:28 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:ItxCGbxBH2ikx8csyxpPQxH56xvBixJKibtxOi3xH56xnKujxVrcxI0IUIhxAdA9:inEJ0SSfHPKR0Od9hRTf
TLSH T1278192D939A24179D8BA149F31BA7448B0969BC173C57F5C59CC39F2828CE072F61A2F
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.x86865612726362f9134dfb9def80fa6adf79e1ab123e033ad3ce91d103c2b93dae MiraiBoatnet botnet mirai qbot x86
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.mips718670c5321b57dc37c5df9ecf1adb771d8b7bd7fcae36d9b65ffa7e22bb9d9b MiraiBoatnet botnet mips. mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.arc3683db3261e884f2b7cf7622c1ba519a6bf1d71527a1cdc53b4214102cfd5665 Miraiarc botnet ddos mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.i468n/an/abotnet ddos i468 mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.i686a90d8a5e0a902201adb3acb34e7e6efc9df68edcda58a824892ba3ba34406e54 Miraiddos i686 mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.x86_6433f87d33a21d54fec8f71afdb953d7304f70b8cb5083a494e3235d661535f1a5 Miraibotnet mirai qbot x86_64
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.mpsl7222ab2e8a0bd799919644f318a078686ee3e447524add479626c20425b6a809 Miraiddos mirai mpsl qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.arm03a87400ee5bb9777560b965d9337d1c0c727634e0f1248c725e378559482cf5 Miraiarm bot ddos mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.arm55ba1a20fe6849666cf833244c9bc34c1882b3c9879a6f63949e990c10eb7a176 Miraiarm5 botnet ddos mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.arm64a7d72ef1717b586826ab439e5aa4bfe568ff9eac7513e051bc95503ad0617b9 Miraiarm6 ddos mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.arm700a7036fecd5c4b42887ce28b961573c1e0449ce233e7b3f70c3ab0801fce089 Miraiarm7 botnet ddos mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.ppc09eefc7212485cf37ffdc1b8e5663015feb435ee78ffcbcdb5009afa8cc74d63 Miraiddos mirai ppc qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.spc5ee10c1171820fb8c0945ad17f018724e55b87c36ef84b1d0e7fad05fd402251 Miraiddos mirai qbot spc
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.m68kf97471ccab2827c00dd55db72c93ad97a1c01f9794e033180ea84e63d573ae44 Miraiddos m68k mirai qbot
http://196.199.55.11/Vye32GsS2g38eKHmaKrLdDjgrnf2YBT4/FGx8SNCa4txePA.sh4d7cc3955a69e3b15acf8198c4b02e12d1394bd7cb41ffa7da30137c64efa56dc Miraiddos mirai qbot sh4

Intelligence

File Origin
# of uploads :
1
# of downloads :
45
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-04-15T15:42:00Z UTC
Last seen:
2026-04-15T16:51:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0359bca9-e6b1-4af7-bf6f-4c7d0aaab95e
Behavior Graph:
Download SVG
%3 guuid=233176ae-1b00-0000-e29d-0b6404090000 pid=2308 /usr/bin/sudo guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313 /tmp/sample.bin guuid=233176ae-1b00-0000-e29d-0b6404090000 pid=2308->guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313 execve guuid=7519b9b2-1b00-0000-e29d-0b640d090000 pid=2317 /usr/bin/cp guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=7519b9b2-1b00-0000-e29d-0b640d090000 pid=2317 execve guuid=47d982b9-1b00-0000-e29d-0b6418090000 pid=2328 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=47d982b9-1b00-0000-e29d-0b6418090000 pid=2328 execve guuid=6c1f03cb-1b00-0000-e29d-0b6431090000 pid=2353 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=6c1f03cb-1b00-0000-e29d-0b6431090000 pid=2353 execve guuid=38aa40e2-1b00-0000-e29d-0b644a090000 pid=2378 /usr/bin/cat guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=38aa40e2-1b00-0000-e29d-0b644a090000 pid=2378 execve guuid=639df3e2-1b00-0000-e29d-0b644d090000 pid=2381 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=639df3e2-1b00-0000-e29d-0b644d090000 pid=2381 execve guuid=1c5795e3-1b00-0000-e29d-0b644f090000 pid=2383 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=1c5795e3-1b00-0000-e29d-0b644f090000 pid=2383 execve guuid=1b1443e4-1b00-0000-e29d-0b6454090000 pid=2388 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=1b1443e4-1b00-0000-e29d-0b6454090000 pid=2388 execve guuid=fdb7f2f8-1b00-0000-e29d-0b6478090000 pid=2424 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=fdb7f2f8-1b00-0000-e29d-0b6478090000 pid=2424 execve guuid=758dbd09-1c00-0000-e29d-0b649a090000 pid=2458 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=758dbd09-1c00-0000-e29d-0b649a090000 pid=2458 clone guuid=1177e709-1c00-0000-e29d-0b649c090000 pid=2460 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=1177e709-1c00-0000-e29d-0b649c090000 pid=2460 execve guuid=96db410a-1c00-0000-e29d-0b649d090000 pid=2461 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=96db410a-1c00-0000-e29d-0b649d090000 pid=2461 execve guuid=8a9faa0a-1c00-0000-e29d-0b64a2090000 pid=2466 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=8a9faa0a-1c00-0000-e29d-0b64a2090000 pid=2466 execve guuid=1d0f9423-1c00-0000-e29d-0b64df090000 pid=2527 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=1d0f9423-1c00-0000-e29d-0b64df090000 pid=2527 execve guuid=07226d4d-1c00-0000-e29d-0b64400a0000 pid=2624 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=07226d4d-1c00-0000-e29d-0b64400a0000 pid=2624 clone guuid=38a9934d-1c00-0000-e29d-0b64420a0000 pid=2626 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=38a9934d-1c00-0000-e29d-0b64420a0000 pid=2626 execve guuid=3f9ae54d-1c00-0000-e29d-0b64430a0000 pid=2627 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=3f9ae54d-1c00-0000-e29d-0b64430a0000 pid=2627 execve guuid=8084594e-1c00-0000-e29d-0b64480a0000 pid=2632 /usr/bin/wget net send-data guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=8084594e-1c00-0000-e29d-0b64480a0000 pid=2632 execve guuid=0bdf2659-1c00-0000-e29d-0b64630a0000 pid=2659 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=0bdf2659-1c00-0000-e29d-0b64630a0000 pid=2659 execve guuid=e02ee876-1c00-0000-e29d-0b64aa0a0000 pid=2730 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=e02ee876-1c00-0000-e29d-0b64aa0a0000 pid=2730 clone guuid=b6901a77-1c00-0000-e29d-0b64ab0a0000 pid=2731 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=b6901a77-1c00-0000-e29d-0b64ab0a0000 pid=2731 execve guuid=87557e77-1c00-0000-e29d-0b64ad0a0000 pid=2733 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=87557e77-1c00-0000-e29d-0b64ad0a0000 pid=2733 execve guuid=924fe777-1c00-0000-e29d-0b64b20a0000 pid=2738 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=924fe777-1c00-0000-e29d-0b64b20a0000 pid=2738 execve guuid=0d5b3988-1c00-0000-e29d-0b64ce0a0000 pid=2766 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=0d5b3988-1c00-0000-e29d-0b64ce0a0000 pid=2766 execve guuid=54bf3198-1c00-0000-e29d-0b64ee0a0000 pid=2798 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=54bf3198-1c00-0000-e29d-0b64ee0a0000 pid=2798 clone guuid=f1f74b98-1c00-0000-e29d-0b64ef0a0000 pid=2799 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=f1f74b98-1c00-0000-e29d-0b64ef0a0000 pid=2799 execve guuid=4e8f9c98-1c00-0000-e29d-0b64f10a0000 pid=2801 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=4e8f9c98-1c00-0000-e29d-0b64f10a0000 pid=2801 execve guuid=fa1ded98-1c00-0000-e29d-0b64f60a0000 pid=2806 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=fa1ded98-1c00-0000-e29d-0b64f60a0000 pid=2806 execve guuid=9a3dddaa-1c00-0000-e29d-0b64100b0000 pid=2832 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=9a3dddaa-1c00-0000-e29d-0b64100b0000 pid=2832 execve guuid=dfef19bd-1c00-0000-e29d-0b64290b0000 pid=2857 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=dfef19bd-1c00-0000-e29d-0b64290b0000 pid=2857 clone guuid=21ba3dbd-1c00-0000-e29d-0b642b0b0000 pid=2859 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=21ba3dbd-1c00-0000-e29d-0b642b0b0000 pid=2859 execve guuid=459bb5bd-1c00-0000-e29d-0b642d0b0000 pid=2861 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=459bb5bd-1c00-0000-e29d-0b642d0b0000 pid=2861 execve guuid=4ccc1cbe-1c00-0000-e29d-0b64320b0000 pid=2866 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=4ccc1cbe-1c00-0000-e29d-0b64320b0000 pid=2866 execve guuid=a6949acd-1c00-0000-e29d-0b64510b0000 pid=2897 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=a6949acd-1c00-0000-e29d-0b64510b0000 pid=2897 execve guuid=48c94ddf-1c00-0000-e29d-0b647b0b0000 pid=2939 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=48c94ddf-1c00-0000-e29d-0b647b0b0000 pid=2939 clone guuid=1f5864df-1c00-0000-e29d-0b647c0b0000 pid=2940 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=1f5864df-1c00-0000-e29d-0b647c0b0000 pid=2940 execve guuid=ea57b8df-1c00-0000-e29d-0b647e0b0000 pid=2942 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=ea57b8df-1c00-0000-e29d-0b647e0b0000 pid=2942 execve guuid=54cb07e0-1c00-0000-e29d-0b64830b0000 pid=2947 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=54cb07e0-1c00-0000-e29d-0b64830b0000 pid=2947 execve guuid=8bc764ef-1c00-0000-e29d-0b64a90b0000 pid=2985 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=8bc764ef-1c00-0000-e29d-0b64a90b0000 pid=2985 execve guuid=e3d22701-1d00-0000-e29d-0b64c00b0000 pid=3008 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=e3d22701-1d00-0000-e29d-0b64c00b0000 pid=3008 clone guuid=355f5501-1d00-0000-e29d-0b64c10b0000 pid=3009 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=355f5501-1d00-0000-e29d-0b64c10b0000 pid=3009 execve guuid=1a9ce401-1d00-0000-e29d-0b64c40b0000 pid=3012 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=1a9ce401-1d00-0000-e29d-0b64c40b0000 pid=3012 execve guuid=a68d4c02-1d00-0000-e29d-0b64c80b0000 pid=3016 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=a68d4c02-1d00-0000-e29d-0b64c80b0000 pid=3016 execve guuid=ff244611-1d00-0000-e29d-0b64e80b0000 pid=3048 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=ff244611-1d00-0000-e29d-0b64e80b0000 pid=3048 execve guuid=0b2d5c23-1d00-0000-e29d-0b64100c0000 pid=3088 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=0b2d5c23-1d00-0000-e29d-0b64100c0000 pid=3088 clone guuid=1fd77e23-1d00-0000-e29d-0b64110c0000 pid=3089 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=1fd77e23-1d00-0000-e29d-0b64110c0000 pid=3089 execve guuid=eb1e2224-1d00-0000-e29d-0b64130c0000 pid=3091 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=eb1e2224-1d00-0000-e29d-0b64130c0000 pid=3091 execve guuid=47009124-1d00-0000-e29d-0b64180c0000 pid=3096 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=47009124-1d00-0000-e29d-0b64180c0000 pid=3096 execve guuid=95af8834-1d00-0000-e29d-0b64430c0000 pid=3139 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=95af8834-1d00-0000-e29d-0b64430c0000 pid=3139 execve guuid=07d0d149-1d00-0000-e29d-0b64740c0000 pid=3188 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=07d0d149-1d00-0000-e29d-0b64740c0000 pid=3188 clone guuid=e252f849-1d00-0000-e29d-0b64750c0000 pid=3189 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=e252f849-1d00-0000-e29d-0b64750c0000 pid=3189 execve guuid=04a67b4a-1d00-0000-e29d-0b64760c0000 pid=3190 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=04a67b4a-1d00-0000-e29d-0b64760c0000 pid=3190 execve guuid=3b5fe04a-1d00-0000-e29d-0b647a0c0000 pid=3194 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=3b5fe04a-1d00-0000-e29d-0b647a0c0000 pid=3194 execve guuid=4df4f25e-1d00-0000-e29d-0b64a60c0000 pid=3238 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=4df4f25e-1d00-0000-e29d-0b64a60c0000 pid=3238 execve guuid=d4616877-1d00-0000-e29d-0b64c30c0000 pid=3267 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=d4616877-1d00-0000-e29d-0b64c30c0000 pid=3267 clone guuid=50d70978-1d00-0000-e29d-0b64c40c0000 pid=3268 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=50d70978-1d00-0000-e29d-0b64c40c0000 pid=3268 execve guuid=7bb59279-1d00-0000-e29d-0b64c50c0000 pid=3269 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=7bb59279-1d00-0000-e29d-0b64c50c0000 pid=3269 execve guuid=87206b7a-1d00-0000-e29d-0b64c90c0000 pid=3273 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=87206b7a-1d00-0000-e29d-0b64c90c0000 pid=3273 execve guuid=30f8538b-1d00-0000-e29d-0b64ca0c0000 pid=3274 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=30f8538b-1d00-0000-e29d-0b64ca0c0000 pid=3274 execve guuid=fc5fcf9e-1d00-0000-e29d-0b64e60c0000 pid=3302 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=fc5fcf9e-1d00-0000-e29d-0b64e60c0000 pid=3302 clone guuid=cc46f09e-1d00-0000-e29d-0b64e70c0000 pid=3303 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=cc46f09e-1d00-0000-e29d-0b64e70c0000 pid=3303 execve guuid=96d3539f-1d00-0000-e29d-0b64e90c0000 pid=3305 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=96d3539f-1d00-0000-e29d-0b64e90c0000 pid=3305 execve guuid=2e2fa49f-1d00-0000-e29d-0b64ee0c0000 pid=3310 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=2e2fa49f-1d00-0000-e29d-0b64ee0c0000 pid=3310 execve guuid=9a04c3b4-1d00-0000-e29d-0b64f60c0000 pid=3318 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=9a04c3b4-1d00-0000-e29d-0b64f60c0000 pid=3318 execve guuid=02050bcd-1d00-0000-e29d-0b640e0d0000 pid=3342 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=02050bcd-1d00-0000-e29d-0b640e0d0000 pid=3342 clone guuid=2ed635cd-1d00-0000-e29d-0b64100d0000 pid=3344 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=2ed635cd-1d00-0000-e29d-0b64100d0000 pid=3344 execve guuid=1fbc89cd-1d00-0000-e29d-0b64110d0000 pid=3345 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=1fbc89cd-1d00-0000-e29d-0b64110d0000 pid=3345 execve guuid=f917f1cd-1d00-0000-e29d-0b64160d0000 pid=3350 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=f917f1cd-1d00-0000-e29d-0b64160d0000 pid=3350 execve guuid=657f77e3-1d00-0000-e29d-0b643b0d0000 pid=3387 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=657f77e3-1d00-0000-e29d-0b643b0d0000 pid=3387 execve guuid=bee70ffc-1d00-0000-e29d-0b646a0d0000 pid=3434 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=bee70ffc-1d00-0000-e29d-0b646a0d0000 pid=3434 clone guuid=00813cfc-1d00-0000-e29d-0b646b0d0000 pid=3435 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=00813cfc-1d00-0000-e29d-0b646b0d0000 pid=3435 execve guuid=5491c8fc-1d00-0000-e29d-0b646d0d0000 pid=3437 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=5491c8fc-1d00-0000-e29d-0b646d0d0000 pid=3437 execve guuid=0c4f21fd-1d00-0000-e29d-0b64710d0000 pid=3441 /usr/bin/wget net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=0c4f21fd-1d00-0000-e29d-0b64710d0000 pid=3441 execve guuid=25d66611-1e00-0000-e29d-0b64830d0000 pid=3459 /usr/bin/curl net send-data write-file guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=25d66611-1e00-0000-e29d-0b64830d0000 pid=3459 execve guuid=dfad6f29-1e00-0000-e29d-0b64b30d0000 pid=3507 /usr/bin/bash guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=dfad6f29-1e00-0000-e29d-0b64b30d0000 pid=3507 clone guuid=84b18e29-1e00-0000-e29d-0b64b40d0000 pid=3508 /usr/bin/chmod guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=84b18e29-1e00-0000-e29d-0b64b40d0000 pid=3508 execve guuid=846f022a-1e00-0000-e29d-0b64b70d0000 pid=3511 /tmp/WTF net guuid=800782b1-1b00-0000-e29d-0b6409090000 pid=2313->guuid=846f022a-1e00-0000-e29d-0b64b70d0000 pid=3511 execve f2add9a9-1fc1-56d8-b60b-1755ee85c4bf 196.199.55.11:80 guuid=47d982b9-1b00-0000-e29d-0b6418090000 pid=2328->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 179B guuid=6c1f03cb-1b00-0000-e29d-0b6431090000 pid=2353->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 128B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=1c5795e3-1b00-0000-e29d-0b644f090000 pid=2383->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=dd581ae4-1b00-0000-e29d-0b6451090000 pid=2385 /tmp/WTF guuid=1c5795e3-1b00-0000-e29d-0b644f090000 pid=2383->guuid=dd581ae4-1b00-0000-e29d-0b6451090000 pid=2385 clone guuid=053a21e4-1b00-0000-e29d-0b6452090000 pid=2386 /tmp/WTF guuid=1c5795e3-1b00-0000-e29d-0b644f090000 pid=2383->guuid=053a21e4-1b00-0000-e29d-0b6452090000 pid=2386 clone guuid=33d128e4-1b00-0000-e29d-0b6453090000 pid=2387 /tmp/WTF net send-data zombie guuid=1c5795e3-1b00-0000-e29d-0b644f090000 pid=2383->guuid=33d128e4-1b00-0000-e29d-0b6453090000 pid=2387 clone guuid=33d128e4-1b00-0000-e29d-0b6453090000 pid=2387->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con d602e6f0-ea16-5600-8e9c-999e8e2ff99e 196.199.55.11:22 guuid=33d128e4-1b00-0000-e29d-0b6453090000 pid=2387->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 12B guuid=1b1443e4-1b00-0000-e29d-0b6454090000 pid=2388->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 180B guuid=fdb7f2f8-1b00-0000-e29d-0b6478090000 pid=2424->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 129B guuid=96db410a-1c00-0000-e29d-0b649d090000 pid=2461->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=21768a0a-1c00-0000-e29d-0b649f090000 pid=2463 /tmp/WTF guuid=96db410a-1c00-0000-e29d-0b649d090000 pid=2461->guuid=21768a0a-1c00-0000-e29d-0b649f090000 pid=2463 clone guuid=3970950a-1c00-0000-e29d-0b64a0090000 pid=2464 /tmp/WTF guuid=96db410a-1c00-0000-e29d-0b649d090000 pid=2461->guuid=3970950a-1c00-0000-e29d-0b64a0090000 pid=2464 clone guuid=07779b0a-1c00-0000-e29d-0b64a1090000 pid=2465 /tmp/WTF net send-data zombie guuid=96db410a-1c00-0000-e29d-0b649d090000 pid=2461->guuid=07779b0a-1c00-0000-e29d-0b64a1090000 pid=2465 clone guuid=07779b0a-1c00-0000-e29d-0b64a1090000 pid=2465->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=07779b0a-1c00-0000-e29d-0b64a1090000 pid=2465->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 12B guuid=8a9faa0a-1c00-0000-e29d-0b64a2090000 pid=2466->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 179B guuid=1d0f9423-1c00-0000-e29d-0b64df090000 pid=2527->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 128B guuid=3f9ae54d-1c00-0000-e29d-0b64430a0000 pid=2627->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=dcc9304e-1c00-0000-e29d-0b64450a0000 pid=2629 /tmp/WTF guuid=3f9ae54d-1c00-0000-e29d-0b64430a0000 pid=2627->guuid=dcc9304e-1c00-0000-e29d-0b64450a0000 pid=2629 clone guuid=8d43354e-1c00-0000-e29d-0b64460a0000 pid=2630 /tmp/WTF guuid=3f9ae54d-1c00-0000-e29d-0b64430a0000 pid=2627->guuid=8d43354e-1c00-0000-e29d-0b64460a0000 pid=2630 clone guuid=88d63a4e-1c00-0000-e29d-0b64470a0000 pid=2631 /tmp/WTF net send-data zombie guuid=3f9ae54d-1c00-0000-e29d-0b64430a0000 pid=2627->guuid=88d63a4e-1c00-0000-e29d-0b64470a0000 pid=2631 clone guuid=88d63a4e-1c00-0000-e29d-0b64470a0000 pid=2631->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=88d63a4e-1c00-0000-e29d-0b64470a0000 pid=2631->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B guuid=8084594e-1c00-0000-e29d-0b64480a0000 pid=2632->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 180B guuid=0bdf2659-1c00-0000-e29d-0b64630a0000 pid=2659->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 129B guuid=87557e77-1c00-0000-e29d-0b64ad0a0000 pid=2733->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=bb00cb77-1c00-0000-e29d-0b64af0a0000 pid=2735 /tmp/WTF guuid=87557e77-1c00-0000-e29d-0b64ad0a0000 pid=2733->guuid=bb00cb77-1c00-0000-e29d-0b64af0a0000 pid=2735 clone guuid=ddd8cf77-1c00-0000-e29d-0b64b00a0000 pid=2736 /tmp/WTF guuid=87557e77-1c00-0000-e29d-0b64ad0a0000 pid=2733->guuid=ddd8cf77-1c00-0000-e29d-0b64b00a0000 pid=2736 clone guuid=6840d577-1c00-0000-e29d-0b64b10a0000 pid=2737 /tmp/WTF net send-data zombie guuid=87557e77-1c00-0000-e29d-0b64ad0a0000 pid=2733->guuid=6840d577-1c00-0000-e29d-0b64b10a0000 pid=2737 clone guuid=6840d577-1c00-0000-e29d-0b64b10a0000 pid=2737->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6840d577-1c00-0000-e29d-0b64b10a0000 pid=2737->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B guuid=924fe777-1c00-0000-e29d-0b64b20a0000 pid=2738->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 180B guuid=0d5b3988-1c00-0000-e29d-0b64ce0a0000 pid=2766->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 129B guuid=4e8f9c98-1c00-0000-e29d-0b64f10a0000 pid=2801->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ae36d498-1c00-0000-e29d-0b64f20a0000 pid=2802 /tmp/WTF guuid=4e8f9c98-1c00-0000-e29d-0b64f10a0000 pid=2801->guuid=ae36d498-1c00-0000-e29d-0b64f20a0000 pid=2802 clone guuid=9629d998-1c00-0000-e29d-0b64f30a0000 pid=2803 /tmp/WTF guuid=4e8f9c98-1c00-0000-e29d-0b64f10a0000 pid=2801->guuid=9629d998-1c00-0000-e29d-0b64f30a0000 pid=2803 clone guuid=c35adc98-1c00-0000-e29d-0b64f40a0000 pid=2804 /tmp/WTF net send-data zombie guuid=4e8f9c98-1c00-0000-e29d-0b64f10a0000 pid=2801->guuid=c35adc98-1c00-0000-e29d-0b64f40a0000 pid=2804 clone guuid=c35adc98-1c00-0000-e29d-0b64f40a0000 pid=2804->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c35adc98-1c00-0000-e29d-0b64f40a0000 pid=2804->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B guuid=fa1ded98-1c00-0000-e29d-0b64f60a0000 pid=2806->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 182B guuid=9a3dddaa-1c00-0000-e29d-0b64100b0000 pid=2832->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 131B guuid=459bb5bd-1c00-0000-e29d-0b642d0b0000 pid=2861->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f2a3ffbd-1c00-0000-e29d-0b642e0b0000 pid=2862 /tmp/WTF guuid=459bb5bd-1c00-0000-e29d-0b642d0b0000 pid=2861->guuid=f2a3ffbd-1c00-0000-e29d-0b642e0b0000 pid=2862 clone guuid=390f03be-1c00-0000-e29d-0b642f0b0000 pid=2863 /tmp/WTF guuid=459bb5bd-1c00-0000-e29d-0b642d0b0000 pid=2861->guuid=390f03be-1c00-0000-e29d-0b642f0b0000 pid=2863 clone guuid=790007be-1c00-0000-e29d-0b64300b0000 pid=2864 /tmp/WTF net send-data zombie guuid=459bb5bd-1c00-0000-e29d-0b642d0b0000 pid=2861->guuid=790007be-1c00-0000-e29d-0b64300b0000 pid=2864 clone guuid=790007be-1c00-0000-e29d-0b64300b0000 pid=2864->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=790007be-1c00-0000-e29d-0b64300b0000 pid=2864->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B guuid=4ccc1cbe-1c00-0000-e29d-0b64320b0000 pid=2866->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 180B guuid=a6949acd-1c00-0000-e29d-0b64510b0000 pid=2897->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 129B guuid=ea57b8df-1c00-0000-e29d-0b647e0b0000 pid=2942->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ed4af3df-1c00-0000-e29d-0b64800b0000 pid=2944 /tmp/WTF guuid=ea57b8df-1c00-0000-e29d-0b647e0b0000 pid=2942->guuid=ed4af3df-1c00-0000-e29d-0b64800b0000 pid=2944 clone guuid=4361f6df-1c00-0000-e29d-0b64810b0000 pid=2945 /tmp/WTF guuid=ea57b8df-1c00-0000-e29d-0b647e0b0000 pid=2942->guuid=4361f6df-1c00-0000-e29d-0b64810b0000 pid=2945 clone guuid=8c4afcdf-1c00-0000-e29d-0b64820b0000 pid=2946 /tmp/WTF net send-data zombie guuid=ea57b8df-1c00-0000-e29d-0b647e0b0000 pid=2942->guuid=8c4afcdf-1c00-0000-e29d-0b64820b0000 pid=2946 clone guuid=8c4afcdf-1c00-0000-e29d-0b64820b0000 pid=2946->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8c4afcdf-1c00-0000-e29d-0b64820b0000 pid=2946->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B guuid=54cb07e0-1c00-0000-e29d-0b64830b0000 pid=2947->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 179B guuid=8bc764ef-1c00-0000-e29d-0b64a90b0000 pid=2985->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 128B guuid=1a9ce401-1d00-0000-e29d-0b64c40b0000 pid=3012->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0ff72902-1d00-0000-e29d-0b64c50b0000 pid=3013 /tmp/WTF guuid=1a9ce401-1d00-0000-e29d-0b64c40b0000 pid=3012->guuid=0ff72902-1d00-0000-e29d-0b64c50b0000 pid=3013 clone guuid=3dad3202-1d00-0000-e29d-0b64c60b0000 pid=3014 /tmp/WTF guuid=1a9ce401-1d00-0000-e29d-0b64c40b0000 pid=3012->guuid=3dad3202-1d00-0000-e29d-0b64c60b0000 pid=3014 clone guuid=1a303d02-1d00-0000-e29d-0b64c70b0000 pid=3015 /tmp/WTF net send-data zombie guuid=1a9ce401-1d00-0000-e29d-0b64c40b0000 pid=3012->guuid=1a303d02-1d00-0000-e29d-0b64c70b0000 pid=3015 clone guuid=1a303d02-1d00-0000-e29d-0b64c70b0000 pid=3015->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1a303d02-1d00-0000-e29d-0b64c70b0000 pid=3015->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 12B guuid=a68d4c02-1d00-0000-e29d-0b64c80b0000 pid=3016->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 180B guuid=ff244611-1d00-0000-e29d-0b64e80b0000 pid=3048->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 129B guuid=eb1e2224-1d00-0000-e29d-0b64130c0000 pid=3091->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4c176c24-1d00-0000-e29d-0b64150c0000 pid=3093 /tmp/WTF guuid=eb1e2224-1d00-0000-e29d-0b64130c0000 pid=3091->guuid=4c176c24-1d00-0000-e29d-0b64150c0000 pid=3093 clone guuid=5c287324-1d00-0000-e29d-0b64160c0000 pid=3094 /tmp/WTF guuid=eb1e2224-1d00-0000-e29d-0b64130c0000 pid=3091->guuid=5c287324-1d00-0000-e29d-0b64160c0000 pid=3094 clone guuid=36477d24-1d00-0000-e29d-0b64170c0000 pid=3095 /tmp/WTF net send-data zombie guuid=eb1e2224-1d00-0000-e29d-0b64130c0000 pid=3091->guuid=36477d24-1d00-0000-e29d-0b64170c0000 pid=3095 clone guuid=36477d24-1d00-0000-e29d-0b64170c0000 pid=3095->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=36477d24-1d00-0000-e29d-0b64170c0000 pid=3095->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 12B guuid=47009124-1d00-0000-e29d-0b64180c0000 pid=3096->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 180B guuid=95af8834-1d00-0000-e29d-0b64430c0000 pid=3139->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 129B guuid=04a67b4a-1d00-0000-e29d-0b64760c0000 pid=3190->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=bf15be4a-1d00-0000-e29d-0b64770c0000 pid=3191 /tmp/WTF guuid=04a67b4a-1d00-0000-e29d-0b64760c0000 pid=3190->guuid=bf15be4a-1d00-0000-e29d-0b64770c0000 pid=3191 clone guuid=169dc74a-1d00-0000-e29d-0b64780c0000 pid=3192 /tmp/WTF guuid=04a67b4a-1d00-0000-e29d-0b64760c0000 pid=3190->guuid=169dc74a-1d00-0000-e29d-0b64780c0000 pid=3192 clone guuid=3774cd4a-1d00-0000-e29d-0b64790c0000 pid=3193 /tmp/WTF net send-data zombie guuid=04a67b4a-1d00-0000-e29d-0b64760c0000 pid=3190->guuid=3774cd4a-1d00-0000-e29d-0b64790c0000 pid=3193 clone guuid=3774cd4a-1d00-0000-e29d-0b64790c0000 pid=3193->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3774cd4a-1d00-0000-e29d-0b64790c0000 pid=3193->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B guuid=3b5fe04a-1d00-0000-e29d-0b647a0c0000 pid=3194->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 180B guuid=4df4f25e-1d00-0000-e29d-0b64a60c0000 pid=3238->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 129B guuid=7bb59279-1d00-0000-e29d-0b64c50c0000 pid=3269->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ba68257a-1d00-0000-e29d-0b64c60c0000 pid=3270 /tmp/WTF guuid=7bb59279-1d00-0000-e29d-0b64c50c0000 pid=3269->guuid=ba68257a-1d00-0000-e29d-0b64c60c0000 pid=3270 clone guuid=b1d84b7a-1d00-0000-e29d-0b64c70c0000 pid=3271 /tmp/WTF guuid=7bb59279-1d00-0000-e29d-0b64c50c0000 pid=3269->guuid=b1d84b7a-1d00-0000-e29d-0b64c70c0000 pid=3271 clone guuid=9e11537a-1d00-0000-e29d-0b64c80c0000 pid=3272 /tmp/WTF net send-data zombie guuid=7bb59279-1d00-0000-e29d-0b64c50c0000 pid=3269->guuid=9e11537a-1d00-0000-e29d-0b64c80c0000 pid=3272 clone guuid=9e11537a-1d00-0000-e29d-0b64c80c0000 pid=3272->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9e11537a-1d00-0000-e29d-0b64c80c0000 pid=3272->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 12B guuid=87206b7a-1d00-0000-e29d-0b64c90c0000 pid=3273->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 179B guuid=30f8538b-1d00-0000-e29d-0b64ca0c0000 pid=3274->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 128B guuid=96d3539f-1d00-0000-e29d-0b64e90c0000 pid=3305->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3554869f-1d00-0000-e29d-0b64ea0c0000 pid=3306 /tmp/WTF guuid=96d3539f-1d00-0000-e29d-0b64e90c0000 pid=3305->guuid=3554869f-1d00-0000-e29d-0b64ea0c0000 pid=3306 clone guuid=94b38b9f-1d00-0000-e29d-0b64ec0c0000 pid=3308 /tmp/WTF guuid=96d3539f-1d00-0000-e29d-0b64e90c0000 pid=3305->guuid=94b38b9f-1d00-0000-e29d-0b64ec0c0000 pid=3308 clone guuid=7bde929f-1d00-0000-e29d-0b64ed0c0000 pid=3309 /tmp/WTF net send-data zombie guuid=96d3539f-1d00-0000-e29d-0b64e90c0000 pid=3305->guuid=7bde929f-1d00-0000-e29d-0b64ed0c0000 pid=3309 clone guuid=7bde929f-1d00-0000-e29d-0b64ed0c0000 pid=3309->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7bde929f-1d00-0000-e29d-0b64ed0c0000 pid=3309->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B guuid=2e2fa49f-1d00-0000-e29d-0b64ee0c0000 pid=3310->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 179B guuid=9a04c3b4-1d00-0000-e29d-0b64f60c0000 pid=3318->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 128B guuid=1fbc89cd-1d00-0000-e29d-0b64110d0000 pid=3345->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5d41cccd-1d00-0000-e29d-0b64130d0000 pid=3347 /tmp/WTF guuid=1fbc89cd-1d00-0000-e29d-0b64110d0000 pid=3345->guuid=5d41cccd-1d00-0000-e29d-0b64130d0000 pid=3347 clone guuid=335ed1cd-1d00-0000-e29d-0b64140d0000 pid=3348 /tmp/WTF guuid=1fbc89cd-1d00-0000-e29d-0b64110d0000 pid=3345->guuid=335ed1cd-1d00-0000-e29d-0b64140d0000 pid=3348 clone guuid=4945d6cd-1d00-0000-e29d-0b64150d0000 pid=3349 /tmp/WTF net send-data zombie guuid=1fbc89cd-1d00-0000-e29d-0b64110d0000 pid=3345->guuid=4945d6cd-1d00-0000-e29d-0b64150d0000 pid=3349 clone guuid=4945d6cd-1d00-0000-e29d-0b64150d0000 pid=3349->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4945d6cd-1d00-0000-e29d-0b64150d0000 pid=3349->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 12B guuid=f917f1cd-1d00-0000-e29d-0b64160d0000 pid=3350->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 180B guuid=657f77e3-1d00-0000-e29d-0b643b0d0000 pid=3387->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 129B guuid=5491c8fc-1d00-0000-e29d-0b646d0d0000 pid=3437->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=33df06fd-1d00-0000-e29d-0b646e0d0000 pid=3438 /tmp/WTF guuid=5491c8fc-1d00-0000-e29d-0b646d0d0000 pid=3437->guuid=33df06fd-1d00-0000-e29d-0b646e0d0000 pid=3438 clone guuid=7df309fd-1d00-0000-e29d-0b646f0d0000 pid=3439 /tmp/WTF guuid=5491c8fc-1d00-0000-e29d-0b646d0d0000 pid=3437->guuid=7df309fd-1d00-0000-e29d-0b646f0d0000 pid=3439 clone guuid=e82b0efd-1d00-0000-e29d-0b64700d0000 pid=3440 /tmp/WTF net send-data zombie guuid=5491c8fc-1d00-0000-e29d-0b646d0d0000 pid=3437->guuid=e82b0efd-1d00-0000-e29d-0b64700d0000 pid=3440 clone guuid=e82b0efd-1d00-0000-e29d-0b64700d0000 pid=3440->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e82b0efd-1d00-0000-e29d-0b64700d0000 pid=3440->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B guuid=0c4f21fd-1d00-0000-e29d-0b64710d0000 pid=3441->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 179B guuid=25d66611-1e00-0000-e29d-0b64830d0000 pid=3459->f2add9a9-1fc1-56d8-b60b-1755ee85c4bf send: 128B guuid=846f022a-1e00-0000-e29d-0b64b70d0000 pid=3511->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4030432a-1e00-0000-e29d-0b64b80d0000 pid=3512 /tmp/WTF guuid=846f022a-1e00-0000-e29d-0b64b70d0000 pid=3511->guuid=4030432a-1e00-0000-e29d-0b64b80d0000 pid=3512 clone guuid=3e55482a-1e00-0000-e29d-0b64ba0d0000 pid=3514 /tmp/WTF guuid=846f022a-1e00-0000-e29d-0b64b70d0000 pid=3511->guuid=3e55482a-1e00-0000-e29d-0b64ba0d0000 pid=3514 clone guuid=939e4d2a-1e00-0000-e29d-0b64bb0d0000 pid=3515 /tmp/WTF net send-data zombie guuid=846f022a-1e00-0000-e29d-0b64b70d0000 pid=3511->guuid=939e4d2a-1e00-0000-e29d-0b64bb0d0000 pid=3515 clone guuid=939e4d2a-1e00-0000-e29d-0b64bb0d0000 pid=3515->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=939e4d2a-1e00-0000-e29d-0b64bb0d0000 pid=3515->d602e6f0-ea16-5600-8e9c-999e8e2ff99e send: 7B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2026-04-15 18:29:41 UTC
File Type:
Text (Shell)
AV detection:
15 of 24 (62.50%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zr2ag5tlvshvwsaog55npbxsxwxrqlgkqrige2qbjnbyk7snxpuq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260415-w4nknagt9k/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cc7403766bac/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh cc7403766bac8f5b480e377ad786f2bdaf182cca8450626a014b43857e4dbbe9

(this sample)

Mirai

elf 534e81666f4359a64a26ec9580d8d81afaf480cc1963d393a6126fc8e87d38fb

Mirai

elf 865612726362f9134dfb9def80fa6adf79e1ab123e033ad3ce91d103c2b93dae

  
URLhaus
https://urlhaus.abuse.ch/url/3822593/
  
Delivery method
Distributed via web download
  
Dropping
MD5 6c943d7c0b118fb1b1884541d43e32a4
  
Dropping
SHA256 865612726362f9134dfb9def80fa6adf79e1ab123e033ad3ce91d103c2b93dae

Comments