🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd26b24bc624eb66118107fabf7e59cbad3e313f080b15d22daaffcb5b758d23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd26b24bc624eb66118107fabf7e59cbad3e313f080b15d22daaffcb5b758d23
SHA3-384 hash: 6ffffb38826e75b7c00ad44b873ec117b2638658d8487d7106f5db9ffd44d13eefe96373acbcdf3c47d8342198a38b19
SHA1 hash: e6f8f3ace70cbc8043db7f6a8c2614121006c132
MD5 hash: f58f84f9d59db328d5d2f3d74679fdcd
humanhash: louisiana-emma-happy-diet
File name:telnet.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'862 bytes
First seen:2026-09-16 09:35:08 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:sRSPWFrSxK52ZpcjGXexF0h+N1rKRihuFf:u/4
TLSH T1BC31588D14F1B153E19CCE01B0E1C2D4A245D5A622D62F7FECC9BCA9E8C9D84B475B36
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.214/iran.x86_64fe7ec6a5dead51d20f94a53577043b952ac836b9d89584b964719b2b731edf4d Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.aarch64n/an/aelf ua-wget
http://176.65.139.214/iran.m68k2e3e8984134ce768b11c536d1cedeeb4de79a521f0056de4c6ce24584cf3b624 Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.mips1ca1e135111522058c8e415b48809fdacf2d44197609b63f7b6572f11d9e7557 Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.mipsel404ad55552ebaf8d70529ccd8fc55e8fbdeacccd1027fd4654d72d837faca38b Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.powerpcc0c2b4e34a92d77f7c94e1f1fbfba1fa5b45f47ec25f20316cbc0a0d288707b1 Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.sparc5ec82cfe6d729b0365f01be4564e04fad2ba0a76826e50ba9bfa82a54a2884a0 Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.sh414bd0c5a06aea281e8d76bb4e6985f6ba721bc0053d662c3ebf7da08d0546c7e Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.arcn/an/aelf ua-wget
http://176.65.139.214/iran.i486n/an/aelf ua-wget
http://176.65.139.214/iran.armv4l849fab72479bca1a148b2b9fb78291351459714f27ac29f31b91f45a2cbb4edc Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.armv5l0f8e640d25d90cb494c917a7e8ad8024859c18f582ee1552590d75e27c86f7a8 Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.armv6l26737f93e704f6dfa279183fa93d1da300e77e94c8deafc1e9105c9fccc9a92d Mirai176-65-139-214 elf mirai ua-wget
http://176.65.139.214/iran.armv7l8c32e78ad04be0a22f515dc5d8e183895fa6ca64034e829b38f3ffd7b0eeeb60 Mirai176-65-139-214 elf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/358efe09-d76e-4e8f-abbb-8d65f42c70c3
Behavior Graph:
Download SVG
%3 guuid=7e7d58e6-1d00-0000-11cd-302ae4080000 pid=2276 /usr/bin/sudo guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277 /tmp/sample.bin guuid=7e7d58e6-1d00-0000-11cd-302ae4080000 pid=2276->guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277 execve guuid=ce16e2f2-1d00-0000-11cd-302ae6080000 pid=2278 /usr/bin/wget net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=ce16e2f2-1d00-0000-11cd-302ae6080000 pid=2278 execve guuid=5b451b11-1e00-0000-11cd-302afb080000 pid=2299 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=5b451b11-1e00-0000-11cd-302afb080000 pid=2299 execve guuid=21fc3e12-1e00-0000-11cd-302afe080000 pid=2302 /home/sandbox/x86_64 guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=21fc3e12-1e00-0000-11cd-302afe080000 pid=2302 execve guuid=7b7fb113-1e00-0000-11cd-302a02090000 pid=2306 /usr/bin/wget net send-data guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=7b7fb113-1e00-0000-11cd-302a02090000 pid=2306 execve guuid=d224ac1f-1e00-0000-11cd-302a11090000 pid=2321 /usr/bin/curl net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=d224ac1f-1e00-0000-11cd-302a11090000 pid=2321 execve guuid=2798f43a-1e00-0000-11cd-302a2e090000 pid=2350 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=2798f43a-1e00-0000-11cd-302a2e090000 pid=2350 execve guuid=483c5a3c-1e00-0000-11cd-302a30090000 pid=2352 /home/sandbox/aarch64 guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=483c5a3c-1e00-0000-11cd-302a30090000 pid=2352 execve guuid=cfc84840-1e00-0000-11cd-302a35090000 pid=2357 /usr/bin/wget net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=cfc84840-1e00-0000-11cd-302a35090000 pid=2357 execve guuid=3199bf52-1e00-0000-11cd-302a48090000 pid=2376 /usr/bin/curl net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=3199bf52-1e00-0000-11cd-302a48090000 pid=2376 execve guuid=dfee7670-1e00-0000-11cd-302a5d090000 pid=2397 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=dfee7670-1e00-0000-11cd-302a5d090000 pid=2397 execve guuid=5c780771-1e00-0000-11cd-302a5e090000 pid=2398 /home/sandbox/m68k guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=5c780771-1e00-0000-11cd-302a5e090000 pid=2398 execve guuid=966cc673-1e00-0000-11cd-302a63090000 pid=2403 /usr/bin/wget net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=966cc673-1e00-0000-11cd-302a63090000 pid=2403 execve guuid=cd14cf8e-1e00-0000-11cd-302a75090000 pid=2421 /usr/bin/curl net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=cd14cf8e-1e00-0000-11cd-302a75090000 pid=2421 execve guuid=1613699c-1e00-0000-11cd-302a7e090000 pid=2430 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=1613699c-1e00-0000-11cd-302a7e090000 pid=2430 execve guuid=0f0ef19c-1e00-0000-11cd-302a80090000 pid=2432 /usr/bin/dash guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=0f0ef19c-1e00-0000-11cd-302a80090000 pid=2432 clone guuid=cc46fd9e-1e00-0000-11cd-302a83090000 pid=2435 /usr/bin/wget net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=cc46fd9e-1e00-0000-11cd-302a83090000 pid=2435 execve guuid=afa164a9-1e00-0000-11cd-302a8d090000 pid=2445 /usr/bin/curl net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=afa164a9-1e00-0000-11cd-302a8d090000 pid=2445 execve guuid=200934c7-1e00-0000-11cd-302aac090000 pid=2476 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=200934c7-1e00-0000-11cd-302aac090000 pid=2476 execve guuid=721bb4c7-1e00-0000-11cd-302aae090000 pid=2478 /home/sandbox/mipsel guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=721bb4c7-1e00-0000-11cd-302aae090000 pid=2478 execve guuid=737f4bca-1e00-0000-11cd-302ab6090000 pid=2486 /usr/bin/wget net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=737f4bca-1e00-0000-11cd-302ab6090000 pid=2486 execve guuid=8e0c76df-1e00-0000-11cd-302ace090000 pid=2510 /usr/bin/curl net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=8e0c76df-1e00-0000-11cd-302ace090000 pid=2510 execve guuid=2846b1f0-1e00-0000-11cd-302aeb090000 pid=2539 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=2846b1f0-1e00-0000-11cd-302aeb090000 pid=2539 execve guuid=63930ef1-1e00-0000-11cd-302aec090000 pid=2540 /usr/bin/dash guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=63930ef1-1e00-0000-11cd-302aec090000 pid=2540 clone guuid=7c3a20f2-1e00-0000-11cd-302aef090000 pid=2543 /usr/bin/wget net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=7c3a20f2-1e00-0000-11cd-302aef090000 pid=2543 execve guuid=9a4ed6f4-1e00-0000-11cd-302af5090000 pid=2549 /usr/bin/curl net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=9a4ed6f4-1e00-0000-11cd-302af5090000 pid=2549 execve guuid=c383e30c-1f00-0000-11cd-302a1b0a0000 pid=2587 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=c383e30c-1f00-0000-11cd-302a1b0a0000 pid=2587 execve guuid=b0f99e0d-1f00-0000-11cd-302a1d0a0000 pid=2589 /home/sandbox/sparc guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=b0f99e0d-1f00-0000-11cd-302a1d0a0000 pid=2589 execve guuid=a5af390f-1f00-0000-11cd-302a220a0000 pid=2594 /usr/bin/wget net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=a5af390f-1f00-0000-11cd-302a220a0000 pid=2594 execve guuid=7e499d16-1f00-0000-11cd-302a2b0a0000 pid=2603 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=7e499d16-1f00-0000-11cd-302a2b0a0000 pid=2603 execve guuid=fe8e3617-1f00-0000-11cd-302a2d0a0000 pid=2605 /usr/bin/dash guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=fe8e3617-1f00-0000-11cd-302a2d0a0000 pid=2605 clone guuid=fb40a518-1f00-0000-11cd-302a320a0000 pid=2610 /usr/bin/wget net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=fb40a518-1f00-0000-11cd-302a320a0000 pid=2610 execve guuid=89c78d29-1f00-0000-11cd-302a490a0000 pid=2633 /usr/bin/curl net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=89c78d29-1f00-0000-11cd-302a490a0000 pid=2633 execve guuid=462b5544-1f00-0000-11cd-302a680a0000 pid=2664 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=462b5544-1f00-0000-11cd-302a680a0000 pid=2664 execve guuid=aff24245-1f00-0000-11cd-302a6b0a0000 pid=2667 /home/sandbox/arc guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=aff24245-1f00-0000-11cd-302a6b0a0000 pid=2667 execve guuid=e9110849-1f00-0000-11cd-302a710a0000 pid=2673 /usr/bin/wget net send-data guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=e9110849-1f00-0000-11cd-302a710a0000 pid=2673 execve guuid=65947552-1f00-0000-11cd-302a770a0000 pid=2679 /usr/bin/curl net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=65947552-1f00-0000-11cd-302a770a0000 pid=2679 execve guuid=5acd765e-1f00-0000-11cd-302a7e0a0000 pid=2686 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=5acd765e-1f00-0000-11cd-302a7e0a0000 pid=2686 execve guuid=c1dcbb5f-1f00-0000-11cd-302a810a0000 pid=2689 /home/sandbox/i486 guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=c1dcbb5f-1f00-0000-11cd-302a810a0000 pid=2689 execve guuid=377b2660-1f00-0000-11cd-302a830a0000 pid=2691 /usr/bin/wget net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=377b2660-1f00-0000-11cd-302a830a0000 pid=2691 execve guuid=a5df39b2-1f00-0000-11cd-302a8d0a0000 pid=2701 /usr/bin/curl net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=a5df39b2-1f00-0000-11cd-302a8d0a0000 pid=2701 execve guuid=cb3917b7-1f00-0000-11cd-302a960a0000 pid=2710 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=cb3917b7-1f00-0000-11cd-302a960a0000 pid=2710 execve guuid=566c02b8-1f00-0000-11cd-302a970a0000 pid=2711 /usr/bin/dash guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=566c02b8-1f00-0000-11cd-302a970a0000 pid=2711 clone guuid=98c601ba-1f00-0000-11cd-302a9a0a0000 pid=2714 /usr/bin/wget net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=98c601ba-1f00-0000-11cd-302a9a0a0000 pid=2714 execve guuid=18171ad0-1f00-0000-11cd-302aa30a0000 pid=2723 /usr/bin/curl net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=18171ad0-1f00-0000-11cd-302aa30a0000 pid=2723 execve guuid=da8e4bdb-1f00-0000-11cd-302aa90a0000 pid=2729 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=da8e4bdb-1f00-0000-11cd-302aa90a0000 pid=2729 execve guuid=9258ffdb-1f00-0000-11cd-302aaa0a0000 pid=2730 /usr/bin/dash guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=9258ffdb-1f00-0000-11cd-302aaa0a0000 pid=2730 clone guuid=89bde6dc-1f00-0000-11cd-302aac0a0000 pid=2732 /usr/bin/wget net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=89bde6dc-1f00-0000-11cd-302aac0a0000 pid=2732 execve guuid=8a7fc3ea-1f00-0000-11cd-302ab50a0000 pid=2741 /usr/bin/curl net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=8a7fc3ea-1f00-0000-11cd-302ab50a0000 pid=2741 execve guuid=d5443cfe-1f00-0000-11cd-302ad00a0000 pid=2768 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=d5443cfe-1f00-0000-11cd-302ad00a0000 pid=2768 execve guuid=1d7bb2fe-1f00-0000-11cd-302ad20a0000 pid=2770 /usr/bin/dash guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=1d7bb2fe-1f00-0000-11cd-302ad20a0000 pid=2770 clone guuid=70b29bff-1f00-0000-11cd-302ad50a0000 pid=2773 /usr/bin/wget net guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=70b29bff-1f00-0000-11cd-302ad50a0000 pid=2773 execve guuid=96db8701-2000-0000-11cd-302ada0a0000 pid=2778 /usr/bin/curl net send-data write-file guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=96db8701-2000-0000-11cd-302ada0a0000 pid=2778 execve guuid=bcc9bb1e-2000-0000-11cd-302aee0a0000 pid=2798 /usr/bin/chmod guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=bcc9bb1e-2000-0000-11cd-302aee0a0000 pid=2798 execve guuid=08143120-2000-0000-11cd-302af20a0000 pid=2802 /usr/bin/dash guuid=e3de77f1-1d00-0000-11cd-302ae5080000 pid=2277->guuid=08143120-2000-0000-11cd-302af20a0000 pid=2802 clone da591e27-660a-5411-ac1b-6e71e29e1b31 176.65.139.214:80 guuid=ce16e2f2-1d00-0000-11cd-302ae6080000 pid=2278->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 140B guuid=f8538b13-1e00-0000-11cd-302a00090000 pid=2304 /home/sandbox/x86_64 zombie guuid=21fc3e12-1e00-0000-11cd-302afe080000 pid=2302->guuid=f8538b13-1e00-0000-11cd-302a00090000 pid=2304 clone guuid=0420bf13-1e00-0000-11cd-302a03090000 pid=2307 /home/sandbox/x86_64 write-config zombie guuid=f8538b13-1e00-0000-11cd-302a00090000 pid=2304->guuid=0420bf13-1e00-0000-11cd-302a03090000 pid=2307 clone guuid=7b7fb113-1e00-0000-11cd-302a02090000 pid=2306->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 141B guuid=e34d1d14-1e00-0000-11cd-302a04090000 pid=2308 /home/sandbox/x86_64 net guuid=0420bf13-1e00-0000-11cd-302a03090000 pid=2307->guuid=e34d1d14-1e00-0000-11cd-302a04090000 pid=2308 clone c30095f5-ad7c-5810-a56b-439f6b54e3d5 176.65.139.214:8060 guuid=e34d1d14-1e00-0000-11cd-302a04090000 pid=2308->c30095f5-ad7c-5810-a56b-439f6b54e3d5 con guuid=62e03814-1e00-0000-11cd-302a05090000 pid=2309 /home/sandbox/x86_64 guuid=e34d1d14-1e00-0000-11cd-302a04090000 pid=2308->guuid=62e03814-1e00-0000-11cd-302a05090000 pid=2309 clone guuid=6ce23e14-1e00-0000-11cd-302a06090000 pid=2310 /home/sandbox/x86_64 guuid=62e03814-1e00-0000-11cd-302a05090000 pid=2309->guuid=6ce23e14-1e00-0000-11cd-302a06090000 pid=2310 clone guuid=d224ac1f-1e00-0000-11cd-302a11090000 pid=2321->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=cfc84840-1e00-0000-11cd-302a35090000 pid=2357->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=3199bf52-1e00-0000-11cd-302a48090000 pid=2376->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=966cc673-1e00-0000-11cd-302a63090000 pid=2403->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=cd14cf8e-1e00-0000-11cd-302a75090000 pid=2421->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 87B guuid=cc46fd9e-1e00-0000-11cd-302a83090000 pid=2435->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=afa164a9-1e00-0000-11cd-302a8d090000 pid=2445->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=737f4bca-1e00-0000-11cd-302ab6090000 pid=2486->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=8e0c76df-1e00-0000-11cd-302ace090000 pid=2510->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 90B guuid=7c3a20f2-1e00-0000-11cd-302aef090000 pid=2543->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=9a4ed6f4-1e00-0000-11cd-302af5090000 pid=2549->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=a5af390f-1f00-0000-11cd-302a220a0000 pid=2594->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 137B guuid=fb40a518-1f00-0000-11cd-302a320a0000 pid=2610->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=89c78d29-1f00-0000-11cd-302a490a0000 pid=2633->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=e9110849-1f00-0000-11cd-302a710a0000 pid=2673->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 138B guuid=65947552-1f00-0000-11cd-302a770a0000 pid=2679->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 87B guuid=377b2660-1f00-0000-11cd-302a830a0000 pid=2691->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 140B guuid=a5df39b2-1f00-0000-11cd-302a8d0a0000 pid=2701->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=98c601ba-1f00-0000-11cd-302a9a0a0000 pid=2714->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 140B guuid=18171ad0-1f00-0000-11cd-302aa30a0000 pid=2723->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 89B guuid=89bde6dc-1f00-0000-11cd-302aac0a0000 pid=2732->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 140B guuid=8a7fc3ea-1f00-0000-11cd-302ab50a0000 pid=2741->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 89B guuid=70b29bff-1f00-0000-11cd-302ad50a0000 pid=2773->da591e27-660a-5411-ac1b-6e71e29e1b31 con guuid=96db8701-2000-0000-11cd-302ada0a0000 pid=2778->da591e27-660a-5411-ac1b-6e71e29e1b31 send: 89B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cd26b24bc624eb66118107fabf7e59cbad3e313f080b15d22daaffcb5b758d23
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd26b24bc624eb66118107fabf7e59cbad3e313f080b15d22daaffcb5b758d23/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-09-16 08:57:18 UTC
File Type:
Text (Shell)
AV detection:
9 of 36 (25.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zutles6getvwmemba75l67szzowt4mj7bafrlurnvl74ww3vrurq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/260916-lkjggsybpe/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Enumerates running processes
Modifies init.d
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
Gafgyt
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cd26b24bc624/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/cd26b24bc624eb66118107fabf7e59cbad3e313f080b15d22daaffcb5b758d23

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh cd26b24bc624eb66118107fabf7e59cbad3e313f080b15d22daaffcb5b758d23

(this sample)

Mirai

elf fe7ec6a5dead51d20f94a53577043b952ac836b9d89584b964719b2b731edf4d

  
URLhaus
https://urlhaus.abuse.ch/url/3917323/
  
Delivery method
Distributed via web download
  
Dropping
MD5 0dece3b9ef24c6e20507946a4276dca9
  
Dropping
SHA256 fe7ec6a5dead51d20f94a53577043b952ac836b9d89584b964719b2b731edf4d

Comments