MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d
SHA3-384 hash: eb0231ca8ba479a936aa107f43c36b4706e79581b1eceb159c2ccced8cafbede325327d72b7b99f0cdb36fee65347f4f
SHA1 hash: 91eead808bdd29b83ebb2cce4213ec304a722e77
MD5 hash: e75c7490f9d9b2cfd9653d6876bb4806
humanhash: mirror-kilo-floor-robin
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'584 bytes
First seen:2026-06-21 14:39:34 UTC
Last seen:2026-06-22 11:11:42 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:sLPGr0o0ogZmC3GgG5wJ5+kI3niFEEyjx5mhPP:sLPGrppmGgG5wJ5+h3ni6x4hPP
TLSH T12931929F90151A391203CADD73B3355CB20C85EB284BD798EC485EAE93892DCB1A9FC4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/9d37f3n/an/aelf ua-wget
http://5.182.210.61/1bcdc8n/an/aelf ua-wget
http://5.182.210.61/aff262n/an/aelf ua-wget
http://5.182.210.61/d8adden/an/aelf ua-wget
http://5.182.210.61/7955fcn/an/aelf ua-wget
http://5.182.210.61/0c5c16n/an/aelf ua-wget
http://5.182.210.61/d56300n/an/aelf ua-wget
http://5.182.210.61/863e7cn/an/aelf ua-wget
http://5.182.210.61/981ea2n/an/aelf ua-wget
http://5.182.210.61/9bab4bn/an/aelf ua-wget
http://5.182.210.61/351328n/an/aelf ua-wget
http://5.182.210.61/85ef0dn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a37f7e64dca8c24a595b447/reports/dd964d2f-e0d2-4720-b4d2-a506e056f862/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-21T11:46:00Z UTC
Last seen:
2026-06-22T23:48:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6a553cd5-eb15-46a3-a29e-05624a634702
Behavior Graph:
Download SVG
%3 guuid=f0adc17c-1900-0000-accb-14486d110000 pid=4461 /usr/bin/sudo guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471 /tmp/sample.bin guuid=f0adc17c-1900-0000-accb-14486d110000 pid=4461->guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471 execve guuid=7a91017f-1900-0000-accb-14487b110000 pid=4475 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=7a91017f-1900-0000-accb-14487b110000 pid=4475 execve guuid=e17a6482-1900-0000-accb-14488c110000 pid=4492 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=e17a6482-1900-0000-accb-14488c110000 pid=4492 execve guuid=9303428b-1900-0000-accb-1448ad110000 pid=4525 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=9303428b-1900-0000-accb-1448ad110000 pid=4525 execve guuid=b6728c8b-1900-0000-accb-1448ae110000 pid=4526 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=b6728c8b-1900-0000-accb-1448ae110000 pid=4526 clone guuid=df59e28b-1900-0000-accb-1448b3110000 pid=4531 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=df59e28b-1900-0000-accb-1448b3110000 pid=4531 execve guuid=e950368c-1900-0000-accb-1448b5110000 pid=4533 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=e950368c-1900-0000-accb-1448b5110000 pid=4533 execve guuid=a74a8d8c-1900-0000-accb-1448b7110000 pid=4535 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=a74a8d8c-1900-0000-accb-1448b7110000 pid=4535 execve guuid=8544238f-1900-0000-accb-1448c3110000 pid=4547 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=8544238f-1900-0000-accb-1448c3110000 pid=4547 execve guuid=6a58ee94-1900-0000-accb-1448d4110000 pid=4564 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=6a58ee94-1900-0000-accb-1448d4110000 pid=4564 execve guuid=da2d8295-1900-0000-accb-1448d6110000 pid=4566 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=da2d8295-1900-0000-accb-1448d6110000 pid=4566 clone guuid=f758d595-1900-0000-accb-1448d8110000 pid=4568 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=f758d595-1900-0000-accb-1448d8110000 pid=4568 execve guuid=ad753a96-1900-0000-accb-1448da110000 pid=4570 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=ad753a96-1900-0000-accb-1448da110000 pid=4570 execve guuid=784d9896-1900-0000-accb-1448dc110000 pid=4572 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=784d9896-1900-0000-accb-1448dc110000 pid=4572 execve guuid=f7da3e99-1900-0000-accb-1448e1110000 pid=4577 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=f7da3e99-1900-0000-accb-1448e1110000 pid=4577 execve guuid=5b7e699d-1900-0000-accb-1448f1110000 pid=4593 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=5b7e699d-1900-0000-accb-1448f1110000 pid=4593 execve guuid=a4a0e19d-1900-0000-accb-1448f5110000 pid=4597 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=a4a0e19d-1900-0000-accb-1448f5110000 pid=4597 clone guuid=987f2b9e-1900-0000-accb-1448f8110000 pid=4600 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=987f2b9e-1900-0000-accb-1448f8110000 pid=4600 execve guuid=a0a5879e-1900-0000-accb-1448fb110000 pid=4603 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=a0a5879e-1900-0000-accb-1448fb110000 pid=4603 execve guuid=5b37df9e-1900-0000-accb-1448fd110000 pid=4605 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=5b37df9e-1900-0000-accb-1448fd110000 pid=4605 execve guuid=cc2062a1-1900-0000-accb-144809120000 pid=4617 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=cc2062a1-1900-0000-accb-144809120000 pid=4617 execve guuid=6aebdaa4-1900-0000-accb-144815120000 pid=4629 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=6aebdaa4-1900-0000-accb-144815120000 pid=4629 execve guuid=887b24a5-1900-0000-accb-144818120000 pid=4632 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=887b24a5-1900-0000-accb-144818120000 pid=4632 clone guuid=d5a05fa5-1900-0000-accb-14481a120000 pid=4634 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=d5a05fa5-1900-0000-accb-14481a120000 pid=4634 execve guuid=c0bda8a5-1900-0000-accb-14481b120000 pid=4635 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=c0bda8a5-1900-0000-accb-14481b120000 pid=4635 execve guuid=6aa9e9a5-1900-0000-accb-14481f120000 pid=4639 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=6aa9e9a5-1900-0000-accb-14481f120000 pid=4639 execve guuid=9bf38ea8-1900-0000-accb-14482b120000 pid=4651 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=9bf38ea8-1900-0000-accb-14482b120000 pid=4651 execve guuid=112d87ad-1900-0000-accb-144840120000 pid=4672 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=112d87ad-1900-0000-accb-144840120000 pid=4672 execve guuid=f674cfad-1900-0000-accb-144841120000 pid=4673 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=f674cfad-1900-0000-accb-144841120000 pid=4673 clone guuid=fc430fae-1900-0000-accb-144843120000 pid=4675 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=fc430fae-1900-0000-accb-144843120000 pid=4675 execve guuid=71515fae-1900-0000-accb-144847120000 pid=4679 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=71515fae-1900-0000-accb-144847120000 pid=4679 execve guuid=e4009aae-1900-0000-accb-144848120000 pid=4680 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=e4009aae-1900-0000-accb-144848120000 pid=4680 execve guuid=510a2bb1-1900-0000-accb-144853120000 pid=4691 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=510a2bb1-1900-0000-accb-144853120000 pid=4691 execve guuid=01e768b4-1900-0000-accb-144863120000 pid=4707 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=01e768b4-1900-0000-accb-144863120000 pid=4707 execve guuid=3abacfb4-1900-0000-accb-144865120000 pid=4709 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=3abacfb4-1900-0000-accb-144865120000 pid=4709 clone guuid=e5be1db5-1900-0000-accb-144867120000 pid=4711 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=e5be1db5-1900-0000-accb-144867120000 pid=4711 execve guuid=aea179b5-1900-0000-accb-144868120000 pid=4712 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=aea179b5-1900-0000-accb-144868120000 pid=4712 execve guuid=4d00c8b5-1900-0000-accb-144869120000 pid=4713 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=4d00c8b5-1900-0000-accb-144869120000 pid=4713 execve guuid=75901db9-1900-0000-accb-144872120000 pid=4722 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=75901db9-1900-0000-accb-144872120000 pid=4722 execve guuid=315ee0bd-1900-0000-accb-144884120000 pid=4740 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=315ee0bd-1900-0000-accb-144884120000 pid=4740 execve guuid=dd0e24be-1900-0000-accb-144886120000 pid=4742 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=dd0e24be-1900-0000-accb-144886120000 pid=4742 clone guuid=98ee54be-1900-0000-accb-144888120000 pid=4744 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=98ee54be-1900-0000-accb-144888120000 pid=4744 execve guuid=d36398be-1900-0000-accb-14488b120000 pid=4747 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=d36398be-1900-0000-accb-14488b120000 pid=4747 execve guuid=eacad9be-1900-0000-accb-14488d120000 pid=4749 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=eacad9be-1900-0000-accb-14488d120000 pid=4749 execve guuid=dcb939c1-1900-0000-accb-144895120000 pid=4757 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=dcb939c1-1900-0000-accb-144895120000 pid=4757 execve guuid=f28e99c4-1900-0000-accb-1448a2120000 pid=4770 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=f28e99c4-1900-0000-accb-1448a2120000 pid=4770 execve guuid=ededd8c4-1900-0000-accb-1448a4120000 pid=4772 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=ededd8c4-1900-0000-accb-1448a4120000 pid=4772 clone guuid=ec6e17c5-1900-0000-accb-1448a7120000 pid=4775 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=ec6e17c5-1900-0000-accb-1448a7120000 pid=4775 execve guuid=e5d17fc5-1900-0000-accb-1448aa120000 pid=4778 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=e5d17fc5-1900-0000-accb-1448aa120000 pid=4778 execve guuid=4fb7ccc5-1900-0000-accb-1448ac120000 pid=4780 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=4fb7ccc5-1900-0000-accb-1448ac120000 pid=4780 execve guuid=055860c9-1900-0000-accb-1448bb120000 pid=4795 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=055860c9-1900-0000-accb-1448bb120000 pid=4795 execve guuid=fe9027cf-1900-0000-accb-1448d0120000 pid=4816 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=fe9027cf-1900-0000-accb-1448d0120000 pid=4816 execve guuid=1c5695cf-1900-0000-accb-1448d2120000 pid=4818 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=1c5695cf-1900-0000-accb-1448d2120000 pid=4818 clone guuid=3e8cdecf-1900-0000-accb-1448d5120000 pid=4821 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=3e8cdecf-1900-0000-accb-1448d5120000 pid=4821 execve guuid=cf7749d0-1900-0000-accb-1448d7120000 pid=4823 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=cf7749d0-1900-0000-accb-1448d7120000 pid=4823 execve guuid=1cefb7d0-1900-0000-accb-1448d9120000 pid=4825 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=1cefb7d0-1900-0000-accb-1448d9120000 pid=4825 execve guuid=07bca4d3-1900-0000-accb-1448e3120000 pid=4835 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=07bca4d3-1900-0000-accb-1448e3120000 pid=4835 execve guuid=264bb1d7-1900-0000-accb-1448f3120000 pid=4851 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=264bb1d7-1900-0000-accb-1448f3120000 pid=4851 execve guuid=fb361cd8-1900-0000-accb-1448f5120000 pid=4853 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=fb361cd8-1900-0000-accb-1448f5120000 pid=4853 clone guuid=386c94d8-1900-0000-accb-1448f9120000 pid=4857 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=386c94d8-1900-0000-accb-1448f9120000 pid=4857 execve guuid=482deed8-1900-0000-accb-1448fb120000 pid=4859 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=482deed8-1900-0000-accb-1448fb120000 pid=4859 execve guuid=163359d9-1900-0000-accb-1448fd120000 pid=4861 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=163359d9-1900-0000-accb-1448fd120000 pid=4861 execve guuid=4b0ecedc-1900-0000-accb-14480b130000 pid=4875 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=4b0ecedc-1900-0000-accb-14480b130000 pid=4875 execve guuid=6dbbedeb-1900-0000-accb-14481b130000 pid=4891 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=6dbbedeb-1900-0000-accb-14481b130000 pid=4891 execve guuid=8fd88fec-1900-0000-accb-14481d130000 pid=4893 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=8fd88fec-1900-0000-accb-14481d130000 pid=4893 clone guuid=6d6314ed-1900-0000-accb-144820130000 pid=4896 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=6d6314ed-1900-0000-accb-144820130000 pid=4896 execve guuid=95d4b2ed-1900-0000-accb-144823130000 pid=4899 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=95d4b2ed-1900-0000-accb-144823130000 pid=4899 execve guuid=27cf23ee-1900-0000-accb-144825130000 pid=4901 /usr/bin/wget net send-data guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=27cf23ee-1900-0000-accb-144825130000 pid=4901 execve guuid=12dc62f1-1900-0000-accb-144832130000 pid=4914 /usr/bin/curl net send-data write-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=12dc62f1-1900-0000-accb-144832130000 pid=4914 execve guuid=9b85d2f6-1900-0000-accb-144846130000 pid=4934 /usr/bin/chmod guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=9b85d2f6-1900-0000-accb-144846130000 pid=4934 execve guuid=966d19f7-1900-0000-accb-144848130000 pid=4936 /usr/bin/bash guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=966d19f7-1900-0000-accb-144848130000 pid=4936 clone guuid=8e8c60f7-1900-0000-accb-14484b130000 pid=4939 /usr/bin/rm delete-file guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=8e8c60f7-1900-0000-accb-14484b130000 pid=4939 execve guuid=4849abf7-1900-0000-accb-14484d130000 pid=4941 /usr/bin/rm guuid=a31ab07e-1900-0000-accb-144877110000 pid=4471->guuid=4849abf7-1900-0000-accb-14484d130000 pid=4941 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=7a91017f-1900-0000-accb-14487b110000 pid=4475->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=e17a6482-1900-0000-accb-14488c110000 pid=4492->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=3330ac8b-1900-0000-accb-1448af110000 pid=4527 /usr/bin/bash guuid=b6728c8b-1900-0000-accb-1448ae110000 pid=4526->guuid=3330ac8b-1900-0000-accb-1448af110000 pid=4527 clone guuid=a74a8d8c-1900-0000-accb-1448b7110000 pid=4535->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8544238f-1900-0000-accb-1448c3110000 pid=4547->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=19b0a195-1900-0000-accb-1448d7110000 pid=4567 /usr/bin/bash guuid=da2d8295-1900-0000-accb-1448d6110000 pid=4566->guuid=19b0a195-1900-0000-accb-1448d7110000 pid=4567 clone guuid=784d9896-1900-0000-accb-1448dc110000 pid=4572->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=f7da3e99-1900-0000-accb-1448e1110000 pid=4577->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=6394009e-1900-0000-accb-1448f6110000 pid=4598 /usr/bin/bash guuid=a4a0e19d-1900-0000-accb-1448f5110000 pid=4597->guuid=6394009e-1900-0000-accb-1448f6110000 pid=4598 clone guuid=5b37df9e-1900-0000-accb-1448fd110000 pid=4605->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=cc2062a1-1900-0000-accb-144809120000 pid=4617->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=345037a5-1900-0000-accb-144819120000 pid=4633 /usr/bin/bash guuid=887b24a5-1900-0000-accb-144818120000 pid=4632->guuid=345037a5-1900-0000-accb-144819120000 pid=4633 clone guuid=6aa9e9a5-1900-0000-accb-14481f120000 pid=4639->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9bf38ea8-1900-0000-accb-14482b120000 pid=4651->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=dfa5eaad-1900-0000-accb-144842120000 pid=4674 /usr/bin/bash guuid=f674cfad-1900-0000-accb-144841120000 pid=4673->guuid=dfa5eaad-1900-0000-accb-144842120000 pid=4674 clone guuid=e4009aae-1900-0000-accb-144848120000 pid=4680->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=510a2bb1-1900-0000-accb-144853120000 pid=4691->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=2f1af3b4-1900-0000-accb-144866120000 pid=4710 /usr/bin/bash guuid=3abacfb4-1900-0000-accb-144865120000 pid=4709->guuid=2f1af3b4-1900-0000-accb-144866120000 pid=4710 clone guuid=4d00c8b5-1900-0000-accb-144869120000 pid=4713->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=75901db9-1900-0000-accb-144872120000 pid=4722->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=476239be-1900-0000-accb-144887120000 pid=4743 /usr/bin/bash guuid=dd0e24be-1900-0000-accb-144886120000 pid=4742->guuid=476239be-1900-0000-accb-144887120000 pid=4743 clone guuid=eacad9be-1900-0000-accb-14488d120000 pid=4749->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=dcb939c1-1900-0000-accb-144895120000 pid=4757->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=4e41eec4-1900-0000-accb-1448a6120000 pid=4774 /usr/bin/bash guuid=ededd8c4-1900-0000-accb-1448a4120000 pid=4772->guuid=4e41eec4-1900-0000-accb-1448a6120000 pid=4774 clone guuid=4fb7ccc5-1900-0000-accb-1448ac120000 pid=4780->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=055860c9-1900-0000-accb-1448bb120000 pid=4795->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=63f8b4cf-1900-0000-accb-1448d4120000 pid=4820 /usr/bin/bash guuid=1c5695cf-1900-0000-accb-1448d2120000 pid=4818->guuid=63f8b4cf-1900-0000-accb-1448d4120000 pid=4820 clone guuid=1cefb7d0-1900-0000-accb-1448d9120000 pid=4825->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=07bca4d3-1900-0000-accb-1448e3120000 pid=4835->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=366245d8-1900-0000-accb-1448f7120000 pid=4855 /usr/bin/bash guuid=fb361cd8-1900-0000-accb-1448f5120000 pid=4853->guuid=366245d8-1900-0000-accb-1448f7120000 pid=4855 clone guuid=163359d9-1900-0000-accb-1448fd120000 pid=4861->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=4b0ecedc-1900-0000-accb-14480b130000 pid=4875->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=1f74e2ec-1900-0000-accb-14481f130000 pid=4895 /usr/bin/bash guuid=8fd88fec-1900-0000-accb-14481d130000 pid=4893->guuid=1f74e2ec-1900-0000-accb-14481f130000 pid=4895 clone guuid=27cf23ee-1900-0000-accb-144825130000 pid=4901->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=12dc62f1-1900-0000-accb-144832130000 pid=4914->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=ad8733f7-1900-0000-accb-144849130000 pid=4937 /usr/bin/bash guuid=966d19f7-1900-0000-accb-144848130000 pid=4936->guuid=ad8733f7-1900-0000-accb-144849130000 pid=4937 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d
Threat name:
Linux.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-21 14:43:20 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ewlkyxgiaor2j7nb6eayzm6zp5nqs6htukorbtmvdmy75qbwnwq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260621-r166dadx3j/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh d12cb562e6401d1d27ed0f880c659ecbfad84bc79d14e8866ca8d98ff601b36d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments