MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dde415acf74c14da073b4b23e0e7af8f36ce2ea147dc29e7b848e0209b9d5d6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dde415acf74c14da073b4b23e0e7af8f36ce2ea147dc29e7b848e0209b9d5d6b
SHA3-384 hash: c4766312c09fec96771dbc3fa3596f09802337ae1ae3bbd6110c29a95c1be30529afd327b57d78a35ace1325edbad944
SHA1 hash: 0d0aa021f523d5d2431a2d4a8d62ced18caed68e
MD5 hash: 74923703fbd36d83ebeb6123e2a77246
humanhash: william-kitten-carpet-ack
File name:w.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'793 bytes
First seen:2026-08-06 19:48:53 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:TX+GBYAz0FMpMdkmgpTy5LgSbq8f8qm94P:6WdYFMpMd3gpTy5cfhx9M
TLSH T1B03182F4B3615D71394D8F2CBA6421E1C6873DD5A4EB34B4D4439CC82A6D21CBA1AB32
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
Tags:mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
48
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Detection(s):
URLhaus.3898163.UNOFFICIAL
Create hunting rule

URLhaus.3898168.UNOFFICIAL
Create hunting rule

URLhaus.3898165.UNOFFICIAL
Create hunting rule

URLhaus.3898162.UNOFFICIAL
Create hunting rule

URLhaus.3898170.UNOFFICIAL
Create hunting rule

URLhaus.3898161.UNOFFICIAL
Create hunting rule

URLhaus.3898164.UNOFFICIAL
Create hunting rule

URLhaus.3898166.UNOFFICIAL
Create hunting rule

URLhaus.3898169.UNOFFICIAL
Create hunting rule

URLhaus.3898172.UNOFFICIAL
Create hunting rule

URLhaus.3898171.UNOFFICIAL
Create hunting rule

URLhaus.3898173.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a74e63e7a4479870f7b8ed6/reports/0e83a986-24f1-4975-8224-908c3338949a/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/286f6379-5b46-4a77-a61b-be6fa5eb8052
Behavior Graph:
Download SVG
%3 guuid=977fb17b-1c00-0000-08c8-fd29160c0000 pid=3094 /usr/bin/sudo guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095 /tmp/sample.bin guuid=977fb17b-1c00-0000-08c8-fd29160c0000 pid=3094->guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095 execve guuid=07ffa37f-1c00-0000-08c8-fd29180c0000 pid=3096 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=07ffa37f-1c00-0000-08c8-fd29180c0000 pid=3096 execve guuid=73203287-1c00-0000-08c8-fd29190c0000 pid=3097 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=73203287-1c00-0000-08c8-fd29190c0000 pid=3097 execve guuid=d5dd8e8c-1c00-0000-08c8-fd291b0c0000 pid=3099 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=d5dd8e8c-1c00-0000-08c8-fd291b0c0000 pid=3099 execve guuid=ca6d4092-1c00-0000-08c8-fd29240c0000 pid=3108 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=ca6d4092-1c00-0000-08c8-fd29240c0000 pid=3108 execve guuid=78e0bb96-1c00-0000-08c8-fd292b0c0000 pid=3115 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=78e0bb96-1c00-0000-08c8-fd292b0c0000 pid=3115 execve guuid=3150909a-1c00-0000-08c8-fd29320c0000 pid=3122 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=3150909a-1c00-0000-08c8-fd29320c0000 pid=3122 execve guuid=f5e67e9f-1c00-0000-08c8-fd29330c0000 pid=3123 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=f5e67e9f-1c00-0000-08c8-fd29330c0000 pid=3123 execve guuid=64b0a3a5-1c00-0000-08c8-fd293f0c0000 pid=3135 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=64b0a3a5-1c00-0000-08c8-fd293f0c0000 pid=3135 execve guuid=a15d92ab-1c00-0000-08c8-fd29470c0000 pid=3143 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=a15d92ab-1c00-0000-08c8-fd29470c0000 pid=3143 execve guuid=9c7ad4b0-1c00-0000-08c8-fd294b0c0000 pid=3147 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=9c7ad4b0-1c00-0000-08c8-fd294b0c0000 pid=3147 execve guuid=bd0f4bb7-1c00-0000-08c8-fd294d0c0000 pid=3149 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=bd0f4bb7-1c00-0000-08c8-fd294d0c0000 pid=3149 execve guuid=42188abc-1c00-0000-08c8-fd29560c0000 pid=3158 /usr/bin/wget net send-data write-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=42188abc-1c00-0000-08c8-fd29560c0000 pid=3158 execve guuid=fc7e07c2-1c00-0000-08c8-fd29620c0000 pid=3170 /usr/bin/chmod guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=fc7e07c2-1c00-0000-08c8-fd29620c0000 pid=3170 execve guuid=636e02c3-1c00-0000-08c8-fd29650c0000 pid=3173 /tmp/x86 net zombie guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=636e02c3-1c00-0000-08c8-fd29650c0000 pid=3173 execve guuid=e62726c3-1c00-0000-08c8-fd29660c0000 pid=3174 /usr/bin/bash guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=e62726c3-1c00-0000-08c8-fd29660c0000 pid=3174 clone guuid=61a645c3-1c00-0000-08c8-fd29670c0000 pid=3175 /usr/bin/bash guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=61a645c3-1c00-0000-08c8-fd29670c0000 pid=3175 clone guuid=b39b61c3-1c00-0000-08c8-fd29680c0000 pid=3176 /usr/bin/bash guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=b39b61c3-1c00-0000-08c8-fd29680c0000 pid=3176 clone guuid=15b66dc3-1c00-0000-08c8-fd296a0c0000 pid=3178 /usr/bin/bash guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=15b66dc3-1c00-0000-08c8-fd296a0c0000 pid=3178 clone guuid=754d78c3-1c00-0000-08c8-fd296b0c0000 pid=3179 /usr/bin/bash guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=754d78c3-1c00-0000-08c8-fd296b0c0000 pid=3179 clone guuid=2de08cc3-1c00-0000-08c8-fd296e0c0000 pid=3182 /usr/bin/bash guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=2de08cc3-1c00-0000-08c8-fd296e0c0000 pid=3182 clone guuid=7e6310c4-1c00-0000-08c8-fd29710c0000 pid=3185 /usr/bin/bash guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=7e6310c4-1c00-0000-08c8-fd29710c0000 pid=3185 clone guuid=e0853fc7-1c00-0000-08c8-fd297a0c0000 pid=3194 /usr/bin/bash zombie guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=e0853fc7-1c00-0000-08c8-fd297a0c0000 pid=3194 clone guuid=6b6547c7-1c00-0000-08c8-fd297b0c0000 pid=3195 /usr/bin/bash guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=6b6547c7-1c00-0000-08c8-fd297b0c0000 pid=3195 clone guuid=385350c7-1c00-0000-08c8-fd297c0c0000 pid=3196 /usr/bin/bash zombie guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=385350c7-1c00-0000-08c8-fd297c0c0000 pid=3196 clone guuid=8bf259c7-1c00-0000-08c8-fd297d0c0000 pid=3197 /tmp/x86_64 net zombie guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=8bf259c7-1c00-0000-08c8-fd297d0c0000 pid=3197 execve guuid=4a776bc7-1c00-0000-08c8-fd297f0c0000 pid=3199 /usr/bin/rm delete-file guuid=248b2d7f-1c00-0000-08c8-fd29170c0000 pid=3095->guuid=4a776bc7-1c00-0000-08c8-fd297f0c0000 pid=3199 execve bafe16b7-ede9-55a6-97f9-102a0140a7e1 94.154.43.37:80 guuid=07ffa37f-1c00-0000-08c8-fd29180c0000 pid=3096->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 135B guuid=73203287-1c00-0000-08c8-fd29190c0000 pid=3097->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 136B guuid=d5dd8e8c-1c00-0000-08c8-fd291b0c0000 pid=3099->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 138B guuid=ca6d4092-1c00-0000-08c8-fd29240c0000 pid=3108->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 135B guuid=78e0bb96-1c00-0000-08c8-fd292b0c0000 pid=3115->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 136B guuid=3150909a-1c00-0000-08c8-fd29320c0000 pid=3122->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 136B guuid=f5e67e9f-1c00-0000-08c8-fd29330c0000 pid=3123->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 136B guuid=64b0a3a5-1c00-0000-08c8-fd293f0c0000 pid=3135->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 135B guuid=a15d92ab-1c00-0000-08c8-fd29470c0000 pid=3143->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 135B guuid=9c7ad4b0-1c00-0000-08c8-fd294b0c0000 pid=3147->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 136B guuid=bd0f4bb7-1c00-0000-08c8-fd294d0c0000 pid=3149->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 135B guuid=42188abc-1c00-0000-08c8-fd29560c0000 pid=3158->bafe16b7-ede9-55a6-97f9-102a0140a7e1 send: 138B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=636e02c3-1c00-0000-08c8-fd29650c0000 pid=3173->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9bb67ec3-1c00-0000-08c8-fd296c0c0000 pid=3180 /tmp/x86 guuid=636e02c3-1c00-0000-08c8-fd29650c0000 pid=3173->guuid=9bb67ec3-1c00-0000-08c8-fd296c0c0000 pid=3180 clone guuid=690929ff-1c00-0000-08c8-fd29cf0c0000 pid=3279 /tmp/x86 guuid=636e02c3-1c00-0000-08c8-fd29650c0000 pid=3173->guuid=690929ff-1c00-0000-08c8-fd29cf0c0000 pid=3279 clone guuid=4df5d43a-1d00-0000-08c8-fd29410d0000 pid=3393 /tmp/x86 guuid=636e02c3-1c00-0000-08c8-fd29650c0000 pid=3173->guuid=4df5d43a-1d00-0000-08c8-fd29410d0000 pid=3393 clone guuid=2e18d83a-1d00-0000-08c8-fd29420d0000 pid=3394 /tmp/x86 net send-data zombie guuid=636e02c3-1c00-0000-08c8-fd29650c0000 pid=3173->guuid=2e18d83a-1d00-0000-08c8-fd29420d0000 pid=3394 clone guuid=8bf259c7-1c00-0000-08c8-fd297d0c0000 pid=3197->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9479f4c8-1c00-0000-08c8-fd29840c0000 pid=3204 /tmp/x86_64 guuid=8bf259c7-1c00-0000-08c8-fd297d0c0000 pid=3197->guuid=9479f4c8-1c00-0000-08c8-fd29840c0000 pid=3204 clone guuid=3168bb04-1d00-0000-08c8-fd29dc0c0000 pid=3292 /tmp/x86_64 guuid=8bf259c7-1c00-0000-08c8-fd297d0c0000 pid=3197->guuid=3168bb04-1d00-0000-08c8-fd29dc0c0000 pid=3292 clone guuid=8e8f6640-1d00-0000-08c8-fd29560d0000 pid=3414 /tmp/x86_64 guuid=8bf259c7-1c00-0000-08c8-fd297d0c0000 pid=3197->guuid=8e8f6640-1d00-0000-08c8-fd29560d0000 pid=3414 clone guuid=82e06b40-1d00-0000-08c8-fd29570d0000 pid=3415 /tmp/x86_64 net send-data zombie guuid=8bf259c7-1c00-0000-08c8-fd297d0c0000 pid=3197->guuid=82e06b40-1d00-0000-08c8-fd29570d0000 pid=3415 clone guuid=2e18d83a-1d00-0000-08c8-fd29420d0000 pid=3394->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 9f974101-87d8-5666-a4b6-7919b6dc79d1 94.154.43.37:1999 guuid=2e18d83a-1d00-0000-08c8-fd29420d0000 pid=3394->9f974101-87d8-5666-a4b6-7919b6dc79d1 send: 135B guuid=2687ff3a-1d00-0000-08c8-fd29430d0000 pid=3395 /tmp/x86 guuid=2e18d83a-1d00-0000-08c8-fd29420d0000 pid=3394->guuid=2687ff3a-1d00-0000-08c8-fd29430d0000 pid=3395 clone guuid=ef4fa876-1d00-0000-08c8-fd29ae0d0000 pid=3502 /tmp/x86 guuid=2e18d83a-1d00-0000-08c8-fd29420d0000 pid=3394->guuid=ef4fa876-1d00-0000-08c8-fd29ae0d0000 pid=3502 clone guuid=aba365b2-1d00-0000-08c8-fd29110e0000 pid=3601 /tmp/x86 guuid=2e18d83a-1d00-0000-08c8-fd29420d0000 pid=3394->guuid=aba365b2-1d00-0000-08c8-fd29110e0000 pid=3601 clone guuid=82e06b40-1d00-0000-08c8-fd29570d0000 pid=3415->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=82e06b40-1d00-0000-08c8-fd29570d0000 pid=3415->9f974101-87d8-5666-a4b6-7919b6dc79d1 send: 145B guuid=571a7a40-1d00-0000-08c8-fd29580d0000 pid=3416 /tmp/x86_64 guuid=82e06b40-1d00-0000-08c8-fd29570d0000 pid=3415->guuid=571a7a40-1d00-0000-08c8-fd29580d0000 pid=3416 clone guuid=ee7c237c-1d00-0000-08c8-fd29b90d0000 pid=3513 /tmp/x86_64 guuid=82e06b40-1d00-0000-08c8-fd29570d0000 pid=3415->guuid=ee7c237c-1d00-0000-08c8-fd29b90d0000 pid=3513 clone guuid=2c69d6b7-1d00-0000-08c8-fd29130e0000 pid=3603 /tmp/x86_64 guuid=82e06b40-1d00-0000-08c8-fd29570d0000 pid=3415->guuid=2c69d6b7-1d00-0000-08c8-fd29130e0000 pid=3603 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dde415acf74c14da073b4b23e0e7af8f36ce2ea147dc29e7b848e0209b9d5d6b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dde415acf74c14da073b4b23e0e7af8f36ce2ea147dc29e7b848e0209b9d5d6b/
Threat name:
Script-Shell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-06 19:48:18 UTC
File Type:
Text (Shell)
AV detection:
6 of 36 (16.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3xsbllhxjqknubz3jmr6bz5pr43m4lvbi7octz5yjdqcbg45lvvq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:owari botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260806-yj1etszbnd/
Behaviour
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Reads system network configuration
Enumerates active TCP sockets
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
tuxbot.cc
94.154.43.37
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/dde415acf74c14da073b4b23e0e7af8f36ce2ea147dc29e7b848e0209b9d5d6b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh dde415acf74c14da073b4b23e0e7af8f36ce2ea147dc29e7b848e0209b9d5d6b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3898167/
  
Delivery method
Distributed via web download

Comments