MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d442b5376625db2254eac2e9dac7effe78d8b4e7c81f689a4401f754fde58017. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d442b5376625db2254eac2e9dac7effe78d8b4e7c81f689a4401f754fde58017
SHA3-384 hash: 1360e045388b1a86fb37c0651bdebdd349684c43a997914333f540268774b7a8c4bfe1ef48f92fb4dc292bcebf48d0b2
SHA1 hash: b7165a0b4b69faf3ce7610ac04fca65ba84789f6
MD5 hash: f21283d3b8ac3949c225b3b4540f24d9
humanhash: pennsylvania-network-summer-jersey
File name:d442b5376625db2254eac2e9dac7effe78d8b4e7c81f689a4401f754fde58017
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-13 22:23:28 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:G38WsrxrXRtZ/dPHB7M3lTkSNWyWVHYUyUf2:G38WsrxrhtvPHB7ZI3U2
TLSH T18831109E41214B755502C99E73B2395CB18DAAFB6C8EC7C8C9880EED924878CF251F8D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c2hunter
Tags:mirai sh wraith
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/d3a258n/an/aua-wget
http://5.182.210.174/00d054n/an/aua-wget
http://5.182.210.174/aecb15n/an/aua-wget
http://5.182.210.174/c8bc3cn/an/aua-wget
http://5.182.210.174/ff1781n/an/aua-wget
http://5.182.210.174/cd5c35n/an/aua-wget
http://5.182.210.174/174cb4n/an/aua-wget
http://5.182.210.174/8cf703n/an/aua-wget
http://5.182.210.174/171868n/an/aua-wget
http://5.182.210.174/28d4d8n/an/aua-wget
http://5.182.210.174/537b66n/an/aua-wget
http://5.182.210.174/ca6953n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7e442250f02b0ef04b2877/reports/99375cdf-4ca8-49af-87dd-206596c3242c/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-13T20:18:00Z UTC
Last seen:
2026-08-13T20:51:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d442b5376625db2254eac2e9dac7effe78d8b4e7c81f689a4401f754fde58017/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2377331c-c88c-44f2-a463-c02f47b693f0
Behavior Graph:
Download SVG
%3 guuid=1b3026e6-1600-0000-6bec-a7ac950d0000 pid=3477 /usr/bin/sudo guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481 /tmp/sample.bin guuid=1b3026e6-1600-0000-6bec-a7ac950d0000 pid=3477->guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481 execve guuid=b49b48e8-1600-0000-6bec-a7ac9b0d0000 pid=3483 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=b49b48e8-1600-0000-6bec-a7ac9b0d0000 pid=3483 execve guuid=f98b6fef-1600-0000-6bec-a7acb70d0000 pid=3511 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=f98b6fef-1600-0000-6bec-a7acb70d0000 pid=3511 execve guuid=29268efc-1600-0000-6bec-a7acd80d0000 pid=3544 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=29268efc-1600-0000-6bec-a7acd80d0000 pid=3544 execve guuid=a4d0e9fc-1600-0000-6bec-a7acd90d0000 pid=3545 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=a4d0e9fc-1600-0000-6bec-a7acd90d0000 pid=3545 clone guuid=72303c01-1700-0000-6bec-a7acdb0d0000 pid=3547 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=72303c01-1700-0000-6bec-a7acdb0d0000 pid=3547 execve guuid=676dac01-1700-0000-6bec-a7acdc0d0000 pid=3548 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=676dac01-1700-0000-6bec-a7acdc0d0000 pid=3548 execve guuid=a9ce1502-1700-0000-6bec-a7acdd0d0000 pid=3549 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=a9ce1502-1700-0000-6bec-a7acdd0d0000 pid=3549 execve guuid=35b54408-1700-0000-6bec-a7acea0d0000 pid=3562 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=35b54408-1700-0000-6bec-a7acea0d0000 pid=3562 execve guuid=6b3b910f-1700-0000-6bec-a7acfe0d0000 pid=3582 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=6b3b910f-1700-0000-6bec-a7acfe0d0000 pid=3582 execve guuid=8387e00f-1700-0000-6bec-a7ac000e0000 pid=3584 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=8387e00f-1700-0000-6bec-a7ac000e0000 pid=3584 clone guuid=e3d9c110-1700-0000-6bec-a7ac050e0000 pid=3589 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=e3d9c110-1700-0000-6bec-a7ac050e0000 pid=3589 execve guuid=4744cd11-1700-0000-6bec-a7ac080e0000 pid=3592 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=4744cd11-1700-0000-6bec-a7ac080e0000 pid=3592 execve guuid=5dc52312-1700-0000-6bec-a7ac0c0e0000 pid=3596 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=5dc52312-1700-0000-6bec-a7ac0c0e0000 pid=3596 execve guuid=c563e017-1700-0000-6bec-a7ac240e0000 pid=3620 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=c563e017-1700-0000-6bec-a7ac240e0000 pid=3620 execve guuid=8f9c2e21-1700-0000-6bec-a7ac3c0e0000 pid=3644 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=8f9c2e21-1700-0000-6bec-a7ac3c0e0000 pid=3644 execve guuid=41a5f321-1700-0000-6bec-a7ac3f0e0000 pid=3647 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=41a5f321-1700-0000-6bec-a7ac3f0e0000 pid=3647 clone guuid=0a5fe522-1700-0000-6bec-a7ac430e0000 pid=3651 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=0a5fe522-1700-0000-6bec-a7ac430e0000 pid=3651 execve guuid=55beaa23-1700-0000-6bec-a7ac470e0000 pid=3655 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=55beaa23-1700-0000-6bec-a7ac470e0000 pid=3655 execve guuid=0bc61924-1700-0000-6bec-a7ac490e0000 pid=3657 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=0bc61924-1700-0000-6bec-a7ac490e0000 pid=3657 execve guuid=59211328-1700-0000-6bec-a7ac5e0e0000 pid=3678 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=59211328-1700-0000-6bec-a7ac5e0e0000 pid=3678 execve guuid=3fe8532d-1700-0000-6bec-a7ac7d0e0000 pid=3709 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=3fe8532d-1700-0000-6bec-a7ac7d0e0000 pid=3709 execve guuid=78b8d12d-1700-0000-6bec-a7ac820e0000 pid=3714 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=78b8d12d-1700-0000-6bec-a7ac820e0000 pid=3714 clone guuid=f882502e-1700-0000-6bec-a7ac860e0000 pid=3718 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=f882502e-1700-0000-6bec-a7ac860e0000 pid=3718 execve guuid=97a6972e-1700-0000-6bec-a7ac8d0e0000 pid=3725 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=97a6972e-1700-0000-6bec-a7ac8d0e0000 pid=3725 execve guuid=5b48fc2e-1700-0000-6bec-a7ac8e0e0000 pid=3726 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=5b48fc2e-1700-0000-6bec-a7ac8e0e0000 pid=3726 execve guuid=24a40933-1700-0000-6bec-a7aca00e0000 pid=3744 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=24a40933-1700-0000-6bec-a7aca00e0000 pid=3744 execve guuid=46f52b38-1700-0000-6bec-a7acba0e0000 pid=3770 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=46f52b38-1700-0000-6bec-a7acba0e0000 pid=3770 execve guuid=d8a8a138-1700-0000-6bec-a7acbd0e0000 pid=3773 /home/sandbox/ff1781 net guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=d8a8a138-1700-0000-6bec-a7acbd0e0000 pid=3773 execve guuid=c52ee838-1700-0000-6bec-a7acc00e0000 pid=3776 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=c52ee838-1700-0000-6bec-a7acc00e0000 pid=3776 execve guuid=82775739-1700-0000-6bec-a7acc40e0000 pid=3780 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=82775739-1700-0000-6bec-a7acc40e0000 pid=3780 execve guuid=54c0ce39-1700-0000-6bec-a7accb0e0000 pid=3787 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=54c0ce39-1700-0000-6bec-a7accb0e0000 pid=3787 execve guuid=da07ce3d-1700-0000-6bec-a7acdd0e0000 pid=3805 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=da07ce3d-1700-0000-6bec-a7acdd0e0000 pid=3805 execve guuid=95930d46-1700-0000-6bec-a7acfa0e0000 pid=3834 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=95930d46-1700-0000-6bec-a7acfa0e0000 pid=3834 execve guuid=56634f46-1700-0000-6bec-a7acfb0e0000 pid=3835 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=56634f46-1700-0000-6bec-a7acfb0e0000 pid=3835 clone guuid=5ef6c647-1700-0000-6bec-a7ac060f0000 pid=3846 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=5ef6c647-1700-0000-6bec-a7ac060f0000 pid=3846 execve guuid=785ba948-1700-0000-6bec-a7ac0a0f0000 pid=3850 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=785ba948-1700-0000-6bec-a7ac0a0f0000 pid=3850 execve guuid=9dfb4749-1700-0000-6bec-a7ac0d0f0000 pid=3853 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=9dfb4749-1700-0000-6bec-a7ac0d0f0000 pid=3853 execve guuid=cf47504e-1700-0000-6bec-a7ac1c0f0000 pid=3868 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=cf47504e-1700-0000-6bec-a7ac1c0f0000 pid=3868 execve guuid=591a0654-1700-0000-6bec-a7ac290f0000 pid=3881 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=591a0654-1700-0000-6bec-a7ac290f0000 pid=3881 execve guuid=3b755154-1700-0000-6bec-a7ac2a0f0000 pid=3882 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=3b755154-1700-0000-6bec-a7ac2a0f0000 pid=3882 clone guuid=2cd1de55-1700-0000-6bec-a7ac340f0000 pid=3892 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=2cd1de55-1700-0000-6bec-a7ac340f0000 pid=3892 execve guuid=07eea356-1700-0000-6bec-a7ac370f0000 pid=3895 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=07eea356-1700-0000-6bec-a7ac370f0000 pid=3895 execve guuid=a6635257-1700-0000-6bec-a7ac3a0f0000 pid=3898 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=a6635257-1700-0000-6bec-a7ac3a0f0000 pid=3898 execve guuid=5ba0ca5b-1700-0000-6bec-a7ac4e0f0000 pid=3918 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=5ba0ca5b-1700-0000-6bec-a7ac4e0f0000 pid=3918 execve guuid=46ec9060-1700-0000-6bec-a7ac610f0000 pid=3937 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=46ec9060-1700-0000-6bec-a7ac610f0000 pid=3937 execve guuid=1e1ecc60-1700-0000-6bec-a7ac620f0000 pid=3938 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=1e1ecc60-1700-0000-6bec-a7ac620f0000 pid=3938 clone guuid=1e445c61-1700-0000-6bec-a7ac650f0000 pid=3941 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=1e445c61-1700-0000-6bec-a7ac650f0000 pid=3941 execve guuid=673f0e6a-1700-0000-6bec-a7ac660f0000 pid=3942 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=673f0e6a-1700-0000-6bec-a7ac660f0000 pid=3942 execve guuid=4eed7a6a-1700-0000-6bec-a7ac6a0f0000 pid=3946 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=4eed7a6a-1700-0000-6bec-a7ac6a0f0000 pid=3946 execve guuid=63541a6f-1700-0000-6bec-a7ac7d0f0000 pid=3965 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=63541a6f-1700-0000-6bec-a7ac7d0f0000 pid=3965 execve guuid=ad926374-1700-0000-6bec-a7ac940f0000 pid=3988 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=ad926374-1700-0000-6bec-a7ac940f0000 pid=3988 execve guuid=86a5b274-1700-0000-6bec-a7ac980f0000 pid=3992 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=86a5b274-1700-0000-6bec-a7ac980f0000 pid=3992 clone guuid=1fea3f75-1700-0000-6bec-a7ac9d0f0000 pid=3997 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=1fea3f75-1700-0000-6bec-a7ac9d0f0000 pid=3997 execve guuid=4de98375-1700-0000-6bec-a7aca10f0000 pid=4001 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=4de98375-1700-0000-6bec-a7aca10f0000 pid=4001 execve guuid=7bdfc175-1700-0000-6bec-a7aca30f0000 pid=4003 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=7bdfc175-1700-0000-6bec-a7aca30f0000 pid=4003 execve guuid=0400cf79-1700-0000-6bec-a7acb50f0000 pid=4021 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=0400cf79-1700-0000-6bec-a7acb50f0000 pid=4021 execve guuid=dcd7647f-1700-0000-6bec-a7acd10f0000 pid=4049 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=dcd7647f-1700-0000-6bec-a7acd10f0000 pid=4049 execve guuid=02979a7f-1700-0000-6bec-a7acd30f0000 pid=4051 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=02979a7f-1700-0000-6bec-a7acd30f0000 pid=4051 clone guuid=d5ae0d80-1700-0000-6bec-a7acd80f0000 pid=4056 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=d5ae0d80-1700-0000-6bec-a7acd80f0000 pid=4056 execve guuid=39ba4980-1700-0000-6bec-a7acda0f0000 pid=4058 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=39ba4980-1700-0000-6bec-a7acda0f0000 pid=4058 execve guuid=c8887d80-1700-0000-6bec-a7acdb0f0000 pid=4059 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=c8887d80-1700-0000-6bec-a7acdb0f0000 pid=4059 execve guuid=e9e79084-1700-0000-6bec-a7acf30f0000 pid=4083 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=e9e79084-1700-0000-6bec-a7acf30f0000 pid=4083 execve guuid=ef0b8189-1700-0000-6bec-a7ac08100000 pid=4104 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=ef0b8189-1700-0000-6bec-a7ac08100000 pid=4104 execve guuid=2e85db89-1700-0000-6bec-a7ac0a100000 pid=4106 /home/sandbox/537b66 net guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=2e85db89-1700-0000-6bec-a7ac0a100000 pid=4106 execve guuid=a603128a-1700-0000-6bec-a7ac0f100000 pid=4111 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=a603128a-1700-0000-6bec-a7ac0f100000 pid=4111 execve guuid=512f5d8a-1700-0000-6bec-a7ac11100000 pid=4113 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=512f5d8a-1700-0000-6bec-a7ac11100000 pid=4113 execve guuid=3f369f8a-1700-0000-6bec-a7ac13100000 pid=4115 /usr/bin/wget net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=3f369f8a-1700-0000-6bec-a7ac13100000 pid=4115 execve guuid=93bcb68e-1700-0000-6bec-a7ac22100000 pid=4130 /usr/bin/curl net send-data write-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=93bcb68e-1700-0000-6bec-a7ac22100000 pid=4130 execve guuid=48bfdc95-1700-0000-6bec-a7ac3f100000 pid=4159 /usr/bin/chmod guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=48bfdc95-1700-0000-6bec-a7ac3f100000 pid=4159 execve guuid=e5aa2a96-1700-0000-6bec-a7ac40100000 pid=4160 /usr/bin/bash guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=e5aa2a96-1700-0000-6bec-a7ac40100000 pid=4160 clone guuid=931dcd96-1700-0000-6bec-a7ac45100000 pid=4165 /usr/bin/rm delete-file guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=931dcd96-1700-0000-6bec-a7ac45100000 pid=4165 execve guuid=e6f5ae98-1700-0000-6bec-a7ac4e100000 pid=4174 /usr/bin/rm guuid=c8fee5e7-1600-0000-6bec-a7ac990d0000 pid=3481->guuid=e6f5ae98-1700-0000-6bec-a7ac4e100000 pid=4174 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=b49b48e8-1600-0000-6bec-a7ac9b0d0000 pid=3483->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f98b6fef-1600-0000-6bec-a7acb70d0000 pid=3511->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a9ce1502-1700-0000-6bec-a7acdd0d0000 pid=3549->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=35b54408-1700-0000-6bec-a7acea0d0000 pid=3562->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5dc52312-1700-0000-6bec-a7ac0c0e0000 pid=3596->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c563e017-1700-0000-6bec-a7ac240e0000 pid=3620->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0bc61924-1700-0000-6bec-a7ac490e0000 pid=3657->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=59211328-1700-0000-6bec-a7ac5e0e0000 pid=3678->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5b48fc2e-1700-0000-6bec-a7ac8e0e0000 pid=3726->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=24a40933-1700-0000-6bec-a7aca00e0000 pid=3744->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=d8a8a138-1700-0000-6bec-a7acbd0e0000 pid=3773->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3a6ce238-1700-0000-6bec-a7acbf0e0000 pid=3775 /home/sandbox/ff1781 dns net send-data zombie guuid=d8a8a138-1700-0000-6bec-a7acbd0e0000 pid=3773->guuid=3a6ce238-1700-0000-6bec-a7acbf0e0000 pid=3775 clone guuid=3a6ce238-1700-0000-6bec-a7acbf0e0000 pid=3775->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=3a6ce238-1700-0000-6bec-a7acbf0e0000 pid=3775->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 32B 6f4c0fc8-2b4b-5812-8240-30664dda3fb0 kappadocia.net:8080 guuid=3a6ce238-1700-0000-6bec-a7acbf0e0000 pid=3775->6f4c0fc8-2b4b-5812-8240-30664dda3fb0 send: 9B guuid=38446e39-1700-0000-6bec-a7acc60e0000 pid=3782 /home/sandbox/ff1781 guuid=3a6ce238-1700-0000-6bec-a7acbf0e0000 pid=3775->guuid=38446e39-1700-0000-6bec-a7acc60e0000 pid=3782 clone guuid=1a617139-1700-0000-6bec-a7acc70e0000 pid=3783 /home/sandbox/ff1781 guuid=3a6ce238-1700-0000-6bec-a7acbf0e0000 pid=3775->guuid=1a617139-1700-0000-6bec-a7acc70e0000 pid=3783 clone guuid=54c0ce39-1700-0000-6bec-a7accb0e0000 pid=3787->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=da07ce3d-1700-0000-6bec-a7acdd0e0000 pid=3805->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9dfb4749-1700-0000-6bec-a7ac0d0f0000 pid=3853->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cf47504e-1700-0000-6bec-a7ac1c0f0000 pid=3868->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a6635257-1700-0000-6bec-a7ac3a0f0000 pid=3898->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5ba0ca5b-1700-0000-6bec-a7ac4e0f0000 pid=3918->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4eed7a6a-1700-0000-6bec-a7ac6a0f0000 pid=3946->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=63541a6f-1700-0000-6bec-a7ac7d0f0000 pid=3965->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7bdfc175-1700-0000-6bec-a7aca30f0000 pid=4003->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0400cf79-1700-0000-6bec-a7acb50f0000 pid=4021->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c8887d80-1700-0000-6bec-a7acdb0f0000 pid=4059->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e9e79084-1700-0000-6bec-a7acf30f0000 pid=4083->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2e85db89-1700-0000-6bec-a7ac0a100000 pid=4106->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=102efa89-1700-0000-6bec-a7ac0c100000 pid=4108 /home/sandbox/537b66 dns net send-data zombie guuid=2e85db89-1700-0000-6bec-a7ac0a100000 pid=4106->guuid=102efa89-1700-0000-6bec-a7ac0c100000 pid=4108 clone guuid=102efa89-1700-0000-6bec-a7ac0c100000 pid=4108->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=102efa89-1700-0000-6bec-a7ac0c100000 pid=4108->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 32B guuid=102efa89-1700-0000-6bec-a7ac0c100000 pid=4108->6f4c0fc8-2b4b-5812-8240-30664dda3fb0 send: 9B guuid=5d45028a-1700-0000-6bec-a7ac0d100000 pid=4109 /home/sandbox/537b66 guuid=102efa89-1700-0000-6bec-a7ac0c100000 pid=4108->guuid=5d45028a-1700-0000-6bec-a7ac0d100000 pid=4109 clone guuid=a9a2048a-1700-0000-6bec-a7ac0e100000 pid=4110 /home/sandbox/537b66 guuid=102efa89-1700-0000-6bec-a7ac0c100000 pid=4108->guuid=a9a2048a-1700-0000-6bec-a7ac0e100000 pid=4110 clone guuid=3f369f8a-1700-0000-6bec-a7ac13100000 pid=4115->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=93bcb68e-1700-0000-6bec-a7ac22100000 pid=4130->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d442b5376625db2254eac2e9dac7effe78d8b4e7c81f689a4401f754fde58017
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d442b5376625db2254eac2e9dac7effe78d8b4e7c81f689a4401f754fde58017/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-13 22:24:44 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2rblkn3gexnsevhkylu5vr7p7z4nrnhhzapwrgseah3vj7pfqalq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260813-2bmqjszcqh/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/d442b5376625db2254eac2e9dac7effe78d8b4e7c81f689a4401f754fde58017

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
http://5.182.210.174/ok

Comments