MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983
SHA3-384 hash: 28080ab20aaa39b03422d2b55cc132a556b2687415a44a670202d0862050f3ea7c6f2cbd30340c66310aa9c56beb6d34
SHA1 hash: ed2c6b9c931b66f525c7711113dead048f1fa7c7
MD5 hash: 4d90c00e1663532a65f9490f22577d5c
humanhash: item-fruit-violet-florida
File name:sora.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'779 bytes
First seen:2026-01-25 01:25:56 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vnRoRqRYRCRkarg2Rb3RCR5RYRsR1URTjRwe:vRq8aUkOgw9UjaG1OZF
TLSH T12C5193C6B2144130AEE2DD5639B8D484F2C5A9D36DFAAB2544D5BCEDC64CF4C3C60A63
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://87.121.79.186/bins/cosmic.x86627cc17bb1eaf7a33c33e94a3637606d40b0c75f0e059b9384d5f5a47d8c1ece Miraielf geofenced mirai ua-wget USA x86
http://87.121.79.186/bins/cosmic.mips89bfe8dd59bd141f8ab28958806c2e30503af4d740a7c2de139b516d4bdc54ba Miraielf geofenced mips mirai ua-wget USA
http://87.121.79.186/bins/cosmic.x86_64fb9192c081c86d098cde51ab9a29ce0e859ffc093c491281cbc223172b69c8bc Miraielf geofenced mirai ua-wget USA x86
http://87.121.79.186/bins/cosmic.i468n/an/aelf ua-wget
http://87.121.79.186/bins/cosmic.i6860221e5cf99e2b0ec07ba30f1ccb321b6c44ee03812711d65df53ddbf4cf4d93f Miraielf geofenced mirai ua-wget USA x86
http://87.121.79.186/bins/cosmic.mpsl14146d836cfc09f3dc65648a4fd3a99b5e0913a5f14b625aa0a15bfe0cc9385b Miraielf geofenced mips mirai ua-wget USA
http://87.121.79.186/bins/cosmic.arm4n/an/aelf ua-wget
http://87.121.79.186/bins/cosmic.arm5n/an/aarm elf geofenced ua-wget USA
http://87.121.79.186/bins/cosmic.arm6n/an/aarm elf geofenced ua-wget USA
http://87.121.79.186/bins/cosmic.arm7n/an/aarm elf geofenced ua-wget USA
http://87.121.79.186/bins/cosmic.ppcb6df21436b4f21f9a19fe39c34557086cc3454c4a832cc181d8f6d15d6fb93f0 Miraielf geofenced mirai PowerPC ua-wget USA
http://87.121.79.186/bins/cosmic.ppc440fpn/an/aelf ua-wget
http://87.121.79.186/bins/cosmic.m68k34d22d6992022fbfcf4a3674bed61559297920cc9f336578dfe14dc9d7e41ff1 Miraielf geofenced m68k mirai ua-wget USA
http://87.121.79.186/bins/cosmic.sh44c55943b7d11335547cc20c16ef43839d09b473fbe968fed3222990307847c9c Miraielf geofenced mirai SuperH ua-wget USA

Intelligence

File Origin
# of uploads :
1
# of downloads :
40
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Result
Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-01-24T18:58:00Z UTC
Last seen:
2026-01-24T22:28:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/36d66c41-23ee-44b3-8fe3-7a5965d8b62d
Behavior Graph:
Download SVG
%3 guuid=b821f447-1a00-0000-81b7-3d85330a0000 pid=2611 /usr/bin/sudo guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619 /tmp/sample.bin guuid=b821f447-1a00-0000-81b7-3d85330a0000 pid=2611->guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619 execve guuid=bbee2a4b-1a00-0000-81b7-3d853f0a0000 pid=2623 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=bbee2a4b-1a00-0000-81b7-3d853f0a0000 pid=2623 execve guuid=b7f00650-1a00-0000-81b7-3d854f0a0000 pid=2639 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=b7f00650-1a00-0000-81b7-3d854f0a0000 pid=2639 execve guuid=a92b8259-1a00-0000-81b7-3d85680a0000 pid=2664 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=a92b8259-1a00-0000-81b7-3d85680a0000 pid=2664 execve guuid=6984f059-1a00-0000-81b7-3d856a0a0000 pid=2666 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=6984f059-1a00-0000-81b7-3d856a0a0000 pid=2666 execve guuid=07753b5a-1a00-0000-81b7-3d856c0a0000 pid=2668 /tmp/robben net guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=07753b5a-1a00-0000-81b7-3d856c0a0000 pid=2668 execve guuid=a25a275e-1a00-0000-81b7-3d857c0a0000 pid=2684 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=a25a275e-1a00-0000-81b7-3d857c0a0000 pid=2684 execve guuid=9bbb5d61-1a00-0000-81b7-3d85860a0000 pid=2694 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=9bbb5d61-1a00-0000-81b7-3d85860a0000 pid=2694 execve guuid=0a537c66-1a00-0000-81b7-3d85960a0000 pid=2710 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=0a537c66-1a00-0000-81b7-3d85960a0000 pid=2710 execve guuid=6e99d966-1a00-0000-81b7-3d85970a0000 pid=2711 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=6e99d966-1a00-0000-81b7-3d85970a0000 pid=2711 execve guuid=12ac4367-1a00-0000-81b7-3d85990a0000 pid=2713 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=12ac4367-1a00-0000-81b7-3d85990a0000 pid=2713 clone guuid=da1cd367-1a00-0000-81b7-3d859d0a0000 pid=2717 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=da1cd367-1a00-0000-81b7-3d859d0a0000 pid=2717 execve guuid=c0d72d6b-1a00-0000-81b7-3d85a60a0000 pid=2726 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=c0d72d6b-1a00-0000-81b7-3d85a60a0000 pid=2726 execve guuid=856fde72-1a00-0000-81b7-3d85bc0a0000 pid=2748 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=856fde72-1a00-0000-81b7-3d85bc0a0000 pid=2748 execve guuid=27813a73-1a00-0000-81b7-3d85bd0a0000 pid=2749 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=27813a73-1a00-0000-81b7-3d85bd0a0000 pid=2749 execve guuid=5b548a73-1a00-0000-81b7-3d85be0a0000 pid=2750 /tmp/robben mprotect-exec net guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=5b548a73-1a00-0000-81b7-3d85be0a0000 pid=2750 execve guuid=e00d7d77-1a00-0000-81b7-3d85c50a0000 pid=2757 /usr/bin/wget net send-data guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=e00d7d77-1a00-0000-81b7-3d85c50a0000 pid=2757 execve guuid=0aec2a7a-1a00-0000-81b7-3d85cd0a0000 pid=2765 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=0aec2a7a-1a00-0000-81b7-3d85cd0a0000 pid=2765 execve guuid=fbc8737f-1a00-0000-81b7-3d85da0a0000 pid=2778 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=fbc8737f-1a00-0000-81b7-3d85da0a0000 pid=2778 execve guuid=4953cc7f-1a00-0000-81b7-3d85db0a0000 pid=2779 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=4953cc7f-1a00-0000-81b7-3d85db0a0000 pid=2779 execve guuid=66052280-1a00-0000-81b7-3d85dd0a0000 pid=2781 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=66052280-1a00-0000-81b7-3d85dd0a0000 pid=2781 clone guuid=05744580-1a00-0000-81b7-3d85de0a0000 pid=2782 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=05744580-1a00-0000-81b7-3d85de0a0000 pid=2782 execve guuid=61555783-1a00-0000-81b7-3d85e40a0000 pid=2788 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=61555783-1a00-0000-81b7-3d85e40a0000 pid=2788 execve guuid=3a5fb087-1a00-0000-81b7-3d85e90a0000 pid=2793 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=3a5fb087-1a00-0000-81b7-3d85e90a0000 pid=2793 execve guuid=c4af0388-1a00-0000-81b7-3d85eb0a0000 pid=2795 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=c4af0388-1a00-0000-81b7-3d85eb0a0000 pid=2795 execve guuid=2b994e88-1a00-0000-81b7-3d85ed0a0000 pid=2797 /tmp/robben net guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=2b994e88-1a00-0000-81b7-3d85ed0a0000 pid=2797 execve guuid=9919e08a-1a00-0000-81b7-3d85ef0a0000 pid=2799 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=9919e08a-1a00-0000-81b7-3d85ef0a0000 pid=2799 execve guuid=8ca6e58d-1a00-0000-81b7-3d85f00a0000 pid=2800 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=8ca6e58d-1a00-0000-81b7-3d85f00a0000 pid=2800 execve guuid=a158d895-1a00-0000-81b7-3d85ff0a0000 pid=2815 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=a158d895-1a00-0000-81b7-3d85ff0a0000 pid=2815 execve guuid=d2637196-1a00-0000-81b7-3d85000b0000 pid=2816 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=d2637196-1a00-0000-81b7-3d85000b0000 pid=2816 execve guuid=82c8e796-1a00-0000-81b7-3d85010b0000 pid=2817 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=82c8e796-1a00-0000-81b7-3d85010b0000 pid=2817 clone guuid=545dd997-1a00-0000-81b7-3d85030b0000 pid=2819 /usr/bin/wget net send-data guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=545dd997-1a00-0000-81b7-3d85030b0000 pid=2819 execve guuid=726b1d9a-1a00-0000-81b7-3d85040b0000 pid=2820 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=726b1d9a-1a00-0000-81b7-3d85040b0000 pid=2820 execve guuid=9897f99e-1a00-0000-81b7-3d850b0b0000 pid=2827 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=9897f99e-1a00-0000-81b7-3d850b0b0000 pid=2827 execve guuid=c0e1539f-1a00-0000-81b7-3d850d0b0000 pid=2829 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=c0e1539f-1a00-0000-81b7-3d850d0b0000 pid=2829 execve guuid=b88b9e9f-1a00-0000-81b7-3d850f0b0000 pid=2831 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=b88b9e9f-1a00-0000-81b7-3d850f0b0000 pid=2831 clone guuid=f9933ba0-1a00-0000-81b7-3d85110b0000 pid=2833 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=f9933ba0-1a00-0000-81b7-3d85110b0000 pid=2833 execve guuid=e48836a3-1a00-0000-81b7-3d85150b0000 pid=2837 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=e48836a3-1a00-0000-81b7-3d85150b0000 pid=2837 execve guuid=60f571a7-1a00-0000-81b7-3d851c0b0000 pid=2844 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=60f571a7-1a00-0000-81b7-3d851c0b0000 pid=2844 execve guuid=1f00eaa7-1a00-0000-81b7-3d851d0b0000 pid=2845 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=1f00eaa7-1a00-0000-81b7-3d851d0b0000 pid=2845 execve guuid=d61081a8-1a00-0000-81b7-3d851f0b0000 pid=2847 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=d61081a8-1a00-0000-81b7-3d851f0b0000 pid=2847 clone guuid=9ade49a9-1a00-0000-81b7-3d85210b0000 pid=2849 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=9ade49a9-1a00-0000-81b7-3d85210b0000 pid=2849 execve guuid=71dce8ad-1a00-0000-81b7-3d852c0b0000 pid=2860 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=71dce8ad-1a00-0000-81b7-3d852c0b0000 pid=2860 execve guuid=bd8f00b2-1a00-0000-81b7-3d85330b0000 pid=2867 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=bd8f00b2-1a00-0000-81b7-3d85330b0000 pid=2867 execve guuid=cf366db2-1a00-0000-81b7-3d85340b0000 pid=2868 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=cf366db2-1a00-0000-81b7-3d85340b0000 pid=2868 execve guuid=09f5c8b2-1a00-0000-81b7-3d85350b0000 pid=2869 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=09f5c8b2-1a00-0000-81b7-3d85350b0000 pid=2869 clone guuid=2dd764b3-1a00-0000-81b7-3d85380b0000 pid=2872 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=2dd764b3-1a00-0000-81b7-3d85380b0000 pid=2872 execve guuid=d0ef19b8-1a00-0000-81b7-3d85450b0000 pid=2885 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=d0ef19b8-1a00-0000-81b7-3d85450b0000 pid=2885 execve guuid=88e4a2bf-1a00-0000-81b7-3d85540b0000 pid=2900 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=88e4a2bf-1a00-0000-81b7-3d85540b0000 pid=2900 execve guuid=7f270ec0-1a00-0000-81b7-3d85550b0000 pid=2901 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=7f270ec0-1a00-0000-81b7-3d85550b0000 pid=2901 execve guuid=0be359c0-1a00-0000-81b7-3d85560b0000 pid=2902 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=0be359c0-1a00-0000-81b7-3d85560b0000 pid=2902 clone guuid=8b9175c1-1a00-0000-81b7-3d85590b0000 pid=2905 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=8b9175c1-1a00-0000-81b7-3d85590b0000 pid=2905 execve guuid=fa1f21c5-1a00-0000-81b7-3d85610b0000 pid=2913 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=fa1f21c5-1a00-0000-81b7-3d85610b0000 pid=2913 execve guuid=ad5478ca-1a00-0000-81b7-3d85740b0000 pid=2932 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=ad5478ca-1a00-0000-81b7-3d85740b0000 pid=2932 execve guuid=f876c4ca-1a00-0000-81b7-3d85760b0000 pid=2934 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=f876c4ca-1a00-0000-81b7-3d85760b0000 pid=2934 execve guuid=4a820ecb-1a00-0000-81b7-3d85780b0000 pid=2936 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=4a820ecb-1a00-0000-81b7-3d85780b0000 pid=2936 clone guuid=6fe9a8cb-1a00-0000-81b7-3d857c0b0000 pid=2940 /usr/bin/wget net send-data guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=6fe9a8cb-1a00-0000-81b7-3d857c0b0000 pid=2940 execve guuid=719dc4cd-1a00-0000-81b7-3d85850b0000 pid=2949 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=719dc4cd-1a00-0000-81b7-3d85850b0000 pid=2949 execve guuid=5864cfd0-1a00-0000-81b7-3d85910b0000 pid=2961 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=5864cfd0-1a00-0000-81b7-3d85910b0000 pid=2961 execve guuid=7c5340d9-1a00-0000-81b7-3d85970b0000 pid=2967 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=7c5340d9-1a00-0000-81b7-3d85970b0000 pid=2967 execve guuid=21b4d7d9-1a00-0000-81b7-3d85980b0000 pid=2968 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=21b4d7d9-1a00-0000-81b7-3d85980b0000 pid=2968 clone guuid=4d6d2bda-1a00-0000-81b7-3d859b0b0000 pid=2971 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=4d6d2bda-1a00-0000-81b7-3d859b0b0000 pid=2971 execve guuid=11732dde-1a00-0000-81b7-3d85a20b0000 pid=2978 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=11732dde-1a00-0000-81b7-3d85a20b0000 pid=2978 execve guuid=141822e3-1a00-0000-81b7-3d85b00b0000 pid=2992 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=141822e3-1a00-0000-81b7-3d85b00b0000 pid=2992 execve guuid=191f75e3-1a00-0000-81b7-3d85b10b0000 pid=2993 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=191f75e3-1a00-0000-81b7-3d85b10b0000 pid=2993 execve guuid=5c24bee3-1a00-0000-81b7-3d85b30b0000 pid=2995 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=5c24bee3-1a00-0000-81b7-3d85b30b0000 pid=2995 clone guuid=e2ee86e4-1a00-0000-81b7-3d85b70b0000 pid=2999 /usr/bin/wget net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=e2ee86e4-1a00-0000-81b7-3d85b70b0000 pid=2999 execve guuid=35306de8-1a00-0000-81b7-3d85b80b0000 pid=3000 /usr/bin/curl net send-data write-file guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=35306de8-1a00-0000-81b7-3d85b80b0000 pid=3000 execve guuid=db2421ee-1a00-0000-81b7-3d85be0b0000 pid=3006 /usr/bin/cat guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=db2421ee-1a00-0000-81b7-3d85be0b0000 pid=3006 execve guuid=5bfd75ee-1a00-0000-81b7-3d85c00b0000 pid=3008 /usr/bin/chmod guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=5bfd75ee-1a00-0000-81b7-3d85c00b0000 pid=3008 execve guuid=c5e6d1ee-1a00-0000-81b7-3d85c20b0000 pid=3010 /usr/bin/bash guuid=0ded2d4a-1a00-0000-81b7-3d853b0a0000 pid=2619->guuid=c5e6d1ee-1a00-0000-81b7-3d85c20b0000 pid=3010 clone 07b42b1e-be8d-512b-943f-0b36565b2205 87.121.79.186:80 guuid=bbee2a4b-1a00-0000-81b7-3d853f0a0000 pid=2623->07b42b1e-be8d-512b-943f-0b36565b2205 send: 143B guuid=b7f00650-1a00-0000-81b7-3d854f0a0000 pid=2639->07b42b1e-be8d-512b-943f-0b36565b2205 send: 92B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=07753b5a-1a00-0000-81b7-3d856c0a0000 pid=2668->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a25a275e-1a00-0000-81b7-3d857c0a0000 pid=2684->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=9bbb5d61-1a00-0000-81b7-3d85860a0000 pid=2694->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=da1cd367-1a00-0000-81b7-3d859d0a0000 pid=2717->07b42b1e-be8d-512b-943f-0b36565b2205 send: 146B guuid=c0d72d6b-1a00-0000-81b7-3d85a60a0000 pid=2726->07b42b1e-be8d-512b-943f-0b36565b2205 send: 95B guuid=5b548a73-1a00-0000-81b7-3d85be0a0000 pid=2750->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e00d7d77-1a00-0000-81b7-3d85c50a0000 pid=2757->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=0aec2a7a-1a00-0000-81b7-3d85cd0a0000 pid=2765->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=05744580-1a00-0000-81b7-3d85de0a0000 pid=2782->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=61555783-1a00-0000-81b7-3d85e40a0000 pid=2788->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=2b994e88-1a00-0000-81b7-3d85ed0a0000 pid=2797->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9919e08a-1a00-0000-81b7-3d85ef0a0000 pid=2799->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=8ca6e58d-1a00-0000-81b7-3d85f00a0000 pid=2800->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=545dd997-1a00-0000-81b7-3d85030b0000 pid=2819->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=726b1d9a-1a00-0000-81b7-3d85040b0000 pid=2820->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=f9933ba0-1a00-0000-81b7-3d85110b0000 pid=2833->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=e48836a3-1a00-0000-81b7-3d85150b0000 pid=2837->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=9ade49a9-1a00-0000-81b7-3d85210b0000 pid=2849->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=71dce8ad-1a00-0000-81b7-3d852c0b0000 pid=2860->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=2dd764b3-1a00-0000-81b7-3d85380b0000 pid=2872->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=d0ef19b8-1a00-0000-81b7-3d85450b0000 pid=2885->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=8b9175c1-1a00-0000-81b7-3d85590b0000 pid=2905->07b42b1e-be8d-512b-943f-0b36565b2205 send: 143B guuid=fa1f21c5-1a00-0000-81b7-3d85610b0000 pid=2913->07b42b1e-be8d-512b-943f-0b36565b2205 send: 92B guuid=6fe9a8cb-1a00-0000-81b7-3d857c0b0000 pid=2940->07b42b1e-be8d-512b-943f-0b36565b2205 send: 148B guuid=719dc4cd-1a00-0000-81b7-3d85850b0000 pid=2949->07b42b1e-be8d-512b-943f-0b36565b2205 send: 97B guuid=4d6d2bda-1a00-0000-81b7-3d859b0b0000 pid=2971->07b42b1e-be8d-512b-943f-0b36565b2205 send: 144B guuid=11732dde-1a00-0000-81b7-3d85a20b0000 pid=2978->07b42b1e-be8d-512b-943f-0b36565b2205 send: 93B guuid=e2ee86e4-1a00-0000-81b7-3d85b70b0000 pid=2999->07b42b1e-be8d-512b-943f-0b36565b2205 send: 143B guuid=35306de8-1a00-0000-81b7-3d85b80b0000 pid=3000->07b42b1e-be8d-512b-943f-0b36565b2205 send: 92B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-01-24 23:54:17 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z3dhajj57rf375jvulwt3m2kdk2hnbliwcrpkj7p352lg3b3ngbq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:sora antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260125-btmv6ab16d/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (28943) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cec670253dfc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh cec670253dfc4bbff535a2ed3db34a1ab4768568b0a2f527efdf74b36c3b6983

(this sample)

Mirai

elf 0862cdfccdd3ea907eee9020181560d14f45dfc25867762aa249d69251632c19

Mirai

elf 627cc17bb1eaf7a33c33e94a3637606d40b0c75f0e059b9384d5f5a47d8c1ece

  
URLhaus
https://urlhaus.abuse.ch/url/3763415/
  
Delivery method
Distributed via web download
  
Dropping
MD5 16b58f1ba2935fd6f184bda84ce8d02c
  
Dropping
SHA256 627cc17bb1eaf7a33c33e94a3637606d40b0c75f0e059b9384d5f5a47d8c1ece

Comments