MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a
SHA3-384 hash: 46e5592a0d872e7e20e699e5c2c59583553ee1b910343bbf19ef20280905ffc6ad2947e4aef02d9a2d2d516907856f11
SHA1 hash: 95e42ffd82b2fffeb1a35f38247b2f73646c885d
MD5 hash: 8032814a64a99e29f2d08266c53b1d8e
humanhash: pennsylvania-oklahoma-india-violet
File name:ohshit.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'940 bytes
First seen:2026-04-19 09:36:24 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vpd70d7N7hpdvd6GpdgndzPpdfdKWpd1doUpd71d7o7UpdfOd3bpdEd9RpdhdcgD:vz7+7N7hzV6GzgdzPzFKWznoUz7n7o7C
TLSH T1C251E7C546846C792CB7EA53F6B6C12C3091A4D318EE7F99DDC8BAE0868EE14F140793
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.59/hiddenbin/boatnet.x86634a5e5b8a15afea7472edf823fbb3ff6c2a68fcdf9aa664e31d949e68439936 Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.mips5570cb713f9369f4c8e32901d4d4fc7b480b869922ea70d81d61a072b570aa40 Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.arcb34a90ff104c491d1bd5239b3b9d445d78e0cf759295bbb5b1de8006e801d6c5 Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.i468n/an/aelf ua-wget
http://176.65.139.59/hiddenbin/boatnet.i686a5b0b31676cc0301e5e7b466b2b300977bc62b534a620bdb05877b99519baf5a Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.x86_6484de113f126e4d984b9380f8ec56b8e733d4f9e4415b5de2962fa9b48a3677d3 Gafgytelf gafgyt mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.mpsl0df758641eb16e734606d2a49b3da9e581410beabc90729982eafbf2ee52bf3f Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.armn/an/aelf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.arm5n/an/aelf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.arm67a9fbc2e02ef010aedae2177ab3b8fe895eb5d18776df41c834ba488e2ef5c99 Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.arm793b9de7279cdac2c417a9475861ad1f89c7ea37bd6045d52bb520f8eb2cf4501 Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.ppc3340e282b20981c45c3ceb330ec3a2ae5ed41113ad98c342726e40e951080b94 Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.spcedbfe2509023b1a4b422e69ca30e889be38d3e08765e8c3c25139e0908df1f77 Miraielf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.m68kn/an/aelf mirai ua-wget
http://176.65.139.59/hiddenbin/boatnet.sh44eb18a9b9fc84f8dea3d6ca013c188eda15a2b0a5ee2a43acfe7948ca20125b3 Miraielf gafgyt mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-04-19T06:41:00Z UTC
Last seen:
2026-04-21T06:39:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0d8af90e-3566-4ec2-817b-8d046a54ce9e
Behavior Graph:
Download SVG
%3 guuid=2e18e71e-1800-0000-0ca1-0a79f90b0000 pid=3065 /usr/bin/sudo guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073 /tmp/sample.bin guuid=2e18e71e-1800-0000-0ca1-0a79f90b0000 pid=3065->guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073 execve guuid=8bcf0421-1800-0000-0ca1-0a79040c0000 pid=3076 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=8bcf0421-1800-0000-0ca1-0a79040c0000 pid=3076 execve guuid=eb5adb26-1800-0000-0ca1-0a79120c0000 pid=3090 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=eb5adb26-1800-0000-0ca1-0a79120c0000 pid=3090 execve guuid=1733e82f-1800-0000-0ca1-0a79220c0000 pid=3106 /usr/bin/cat guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=1733e82f-1800-0000-0ca1-0a79220c0000 pid=3106 execve guuid=5be66b30-1800-0000-0ca1-0a79240c0000 pid=3108 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=5be66b30-1800-0000-0ca1-0a79240c0000 pid=3108 execve guuid=aa52b330-1800-0000-0ca1-0a79260c0000 pid=3110 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=aa52b330-1800-0000-0ca1-0a79260c0000 pid=3110 execve guuid=5e5c0231-1800-0000-0ca1-0a792b0c0000 pid=3115 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=5e5c0231-1800-0000-0ca1-0a792b0c0000 pid=3115 execve guuid=2ab7b934-1800-0000-0ca1-0a79380c0000 pid=3128 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=2ab7b934-1800-0000-0ca1-0a79380c0000 pid=3128 execve guuid=3a611a3b-1800-0000-0ca1-0a794c0c0000 pid=3148 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=3a611a3b-1800-0000-0ca1-0a794c0c0000 pid=3148 clone guuid=674a3e3b-1800-0000-0ca1-0a794d0c0000 pid=3149 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=674a3e3b-1800-0000-0ca1-0a794d0c0000 pid=3149 execve guuid=81ee8d3b-1800-0000-0ca1-0a794f0c0000 pid=3151 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=81ee8d3b-1800-0000-0ca1-0a794f0c0000 pid=3151 execve guuid=4f570e3c-1800-0000-0ca1-0a79560c0000 pid=3158 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=4f570e3c-1800-0000-0ca1-0a79560c0000 pid=3158 execve guuid=d3579942-1800-0000-0ca1-0a79590c0000 pid=3161 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=d3579942-1800-0000-0ca1-0a79590c0000 pid=3161 execve guuid=d497a24c-1800-0000-0ca1-0a796a0c0000 pid=3178 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=d497a24c-1800-0000-0ca1-0a796a0c0000 pid=3178 clone guuid=2a5fca4c-1800-0000-0ca1-0a796b0c0000 pid=3179 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=2a5fca4c-1800-0000-0ca1-0a796b0c0000 pid=3179 execve guuid=7db92d4d-1800-0000-0ca1-0a796c0c0000 pid=3180 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=7db92d4d-1800-0000-0ca1-0a796c0c0000 pid=3180 execve guuid=860e744d-1800-0000-0ca1-0a79710c0000 pid=3185 /usr/bin/wget net send-data guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=860e744d-1800-0000-0ca1-0a79710c0000 pid=3185 execve guuid=7c723650-1800-0000-0ca1-0a797a0c0000 pid=3194 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=7c723650-1800-0000-0ca1-0a797a0c0000 pid=3194 execve guuid=c5341f54-1800-0000-0ca1-0a797f0c0000 pid=3199 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=c5341f54-1800-0000-0ca1-0a797f0c0000 pid=3199 clone guuid=314d4254-1800-0000-0ca1-0a79800c0000 pid=3200 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=314d4254-1800-0000-0ca1-0a79800c0000 pid=3200 execve guuid=0b8eb954-1800-0000-0ca1-0a79810c0000 pid=3201 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=0b8eb954-1800-0000-0ca1-0a79810c0000 pid=3201 execve guuid=c6d11e55-1800-0000-0ca1-0a79850c0000 pid=3205 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=c6d11e55-1800-0000-0ca1-0a79850c0000 pid=3205 execve guuid=846ccb58-1800-0000-0ca1-0a79860c0000 pid=3206 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=846ccb58-1800-0000-0ca1-0a79860c0000 pid=3206 execve guuid=c76e905d-1800-0000-0ca1-0a79870c0000 pid=3207 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=c76e905d-1800-0000-0ca1-0a79870c0000 pid=3207 clone guuid=c141c35d-1800-0000-0ca1-0a79880c0000 pid=3208 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=c141c35d-1800-0000-0ca1-0a79880c0000 pid=3208 execve guuid=0d6d635e-1800-0000-0ca1-0a79890c0000 pid=3209 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=0d6d635e-1800-0000-0ca1-0a79890c0000 pid=3209 execve guuid=302ce25e-1800-0000-0ca1-0a798d0c0000 pid=3213 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=302ce25e-1800-0000-0ca1-0a798d0c0000 pid=3213 execve guuid=ddeaa463-1800-0000-0ca1-0a79920c0000 pid=3218 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=ddeaa463-1800-0000-0ca1-0a79920c0000 pid=3218 execve guuid=ba16006a-1800-0000-0ca1-0a79a10c0000 pid=3233 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=ba16006a-1800-0000-0ca1-0a79a10c0000 pid=3233 clone guuid=e92d1e6a-1800-0000-0ca1-0a79a20c0000 pid=3234 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=e92d1e6a-1800-0000-0ca1-0a79a20c0000 pid=3234 execve guuid=71d8916a-1800-0000-0ca1-0a79a30c0000 pid=3235 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=71d8916a-1800-0000-0ca1-0a79a30c0000 pid=3235 execve guuid=3874de6a-1800-0000-0ca1-0a79a70c0000 pid=3239 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=3874de6a-1800-0000-0ca1-0a79a70c0000 pid=3239 execve guuid=3aa9596e-1800-0000-0ca1-0a79ad0c0000 pid=3245 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=3aa9596e-1800-0000-0ca1-0a79ad0c0000 pid=3245 execve guuid=487d0d73-1800-0000-0ca1-0a79b80c0000 pid=3256 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=487d0d73-1800-0000-0ca1-0a79b80c0000 pid=3256 clone guuid=8ffa2c73-1800-0000-0ca1-0a79ba0c0000 pid=3258 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=8ffa2c73-1800-0000-0ca1-0a79ba0c0000 pid=3258 execve guuid=82faa973-1800-0000-0ca1-0a79bc0c0000 pid=3260 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=82faa973-1800-0000-0ca1-0a79bc0c0000 pid=3260 execve guuid=b0680b74-1800-0000-0ca1-0a79c10c0000 pid=3265 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=b0680b74-1800-0000-0ca1-0a79c10c0000 pid=3265 execve guuid=591b5178-1800-0000-0ca1-0a79c20c0000 pid=3266 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=591b5178-1800-0000-0ca1-0a79c20c0000 pid=3266 execve guuid=020b127f-1800-0000-0ca1-0a79c30c0000 pid=3267 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=020b127f-1800-0000-0ca1-0a79c30c0000 pid=3267 clone guuid=e7094b7f-1800-0000-0ca1-0a79c40c0000 pid=3268 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=e7094b7f-1800-0000-0ca1-0a79c40c0000 pid=3268 execve guuid=22bccb7f-1800-0000-0ca1-0a79c50c0000 pid=3269 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=22bccb7f-1800-0000-0ca1-0a79c50c0000 pid=3269 execve guuid=f1253f80-1800-0000-0ca1-0a79c90c0000 pid=3273 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=f1253f80-1800-0000-0ca1-0a79c90c0000 pid=3273 execve guuid=a26c9685-1800-0000-0ca1-0a79cb0c0000 pid=3275 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=a26c9685-1800-0000-0ca1-0a79cb0c0000 pid=3275 execve guuid=a336c28c-1800-0000-0ca1-0a79d90c0000 pid=3289 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=a336c28c-1800-0000-0ca1-0a79d90c0000 pid=3289 clone guuid=a75de68c-1800-0000-0ca1-0a79da0c0000 pid=3290 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=a75de68c-1800-0000-0ca1-0a79da0c0000 pid=3290 execve guuid=ce788d8d-1800-0000-0ca1-0a79db0c0000 pid=3291 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=ce788d8d-1800-0000-0ca1-0a79db0c0000 pid=3291 execve guuid=42d7d98d-1800-0000-0ca1-0a79df0c0000 pid=3295 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=42d7d98d-1800-0000-0ca1-0a79df0c0000 pid=3295 execve guuid=2caeeb91-1800-0000-0ca1-0a79e00c0000 pid=3296 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=2caeeb91-1800-0000-0ca1-0a79e00c0000 pid=3296 execve guuid=2fb3f196-1800-0000-0ca1-0a79e80c0000 pid=3304 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=2fb3f196-1800-0000-0ca1-0a79e80c0000 pid=3304 clone guuid=bffb1097-1800-0000-0ca1-0a79e90c0000 pid=3305 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=bffb1097-1800-0000-0ca1-0a79e90c0000 pid=3305 execve guuid=882f5d97-1800-0000-0ca1-0a79ea0c0000 pid=3306 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=882f5d97-1800-0000-0ca1-0a79ea0c0000 pid=3306 execve guuid=beb1a897-1800-0000-0ca1-0a79ee0c0000 pid=3310 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=beb1a897-1800-0000-0ca1-0a79ee0c0000 pid=3310 execve guuid=0516ec9b-1800-0000-0ca1-0a79ef0c0000 pid=3311 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=0516ec9b-1800-0000-0ca1-0a79ef0c0000 pid=3311 execve guuid=a9038fa1-1800-0000-0ca1-0a79f60c0000 pid=3318 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=a9038fa1-1800-0000-0ca1-0a79f60c0000 pid=3318 clone guuid=c9bcd4a1-1800-0000-0ca1-0a79f80c0000 pid=3320 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=c9bcd4a1-1800-0000-0ca1-0a79f80c0000 pid=3320 execve guuid=acec44a2-1800-0000-0ca1-0a79f90c0000 pid=3321 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=acec44a2-1800-0000-0ca1-0a79f90c0000 pid=3321 execve guuid=c7c98da2-1800-0000-0ca1-0a79fd0c0000 pid=3325 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=c7c98da2-1800-0000-0ca1-0a79fd0c0000 pid=3325 execve guuid=08863da6-1800-0000-0ca1-0a79050d0000 pid=3333 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=08863da6-1800-0000-0ca1-0a79050d0000 pid=3333 execve guuid=d7ef18ab-1800-0000-0ca1-0a790d0d0000 pid=3341 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=d7ef18ab-1800-0000-0ca1-0a790d0d0000 pid=3341 clone guuid=70a74fab-1800-0000-0ca1-0a790e0d0000 pid=3342 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=70a74fab-1800-0000-0ca1-0a790e0d0000 pid=3342 execve guuid=e34102ac-1800-0000-0ca1-0a790f0d0000 pid=3343 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=e34102ac-1800-0000-0ca1-0a790f0d0000 pid=3343 execve guuid=24458dac-1800-0000-0ca1-0a79130d0000 pid=3347 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=24458dac-1800-0000-0ca1-0a79130d0000 pid=3347 execve guuid=f85711b1-1800-0000-0ca1-0a791b0d0000 pid=3355 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=f85711b1-1800-0000-0ca1-0a791b0d0000 pid=3355 execve guuid=4c6d8ab6-1800-0000-0ca1-0a79290d0000 pid=3369 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=4c6d8ab6-1800-0000-0ca1-0a79290d0000 pid=3369 clone guuid=0be9b0b6-1800-0000-0ca1-0a792a0d0000 pid=3370 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=0be9b0b6-1800-0000-0ca1-0a792a0d0000 pid=3370 execve guuid=39756fb7-1800-0000-0ca1-0a792b0d0000 pid=3371 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=39756fb7-1800-0000-0ca1-0a792b0d0000 pid=3371 execve guuid=54f9cfb7-1800-0000-0ca1-0a792f0d0000 pid=3375 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=54f9cfb7-1800-0000-0ca1-0a792f0d0000 pid=3375 execve guuid=aa7a8dbd-1800-0000-0ca1-0a793e0d0000 pid=3390 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=aa7a8dbd-1800-0000-0ca1-0a793e0d0000 pid=3390 execve guuid=b15bdec2-1800-0000-0ca1-0a794a0d0000 pid=3402 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=b15bdec2-1800-0000-0ca1-0a794a0d0000 pid=3402 clone guuid=200a19c3-1800-0000-0ca1-0a794b0d0000 pid=3403 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=200a19c3-1800-0000-0ca1-0a794b0d0000 pid=3403 execve guuid=05f2ddc3-1800-0000-0ca1-0a794c0d0000 pid=3404 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=05f2ddc3-1800-0000-0ca1-0a794c0d0000 pid=3404 execve guuid=7c9c8fc4-1800-0000-0ca1-0a79500d0000 pid=3408 /usr/bin/wget net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=7c9c8fc4-1800-0000-0ca1-0a79500d0000 pid=3408 execve guuid=53d773cb-1800-0000-0ca1-0a79610d0000 pid=3425 /usr/bin/curl net send-data write-file guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=53d773cb-1800-0000-0ca1-0a79610d0000 pid=3425 execve guuid=aaa9b7d1-1800-0000-0ca1-0a796c0d0000 pid=3436 /usr/bin/bash guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=aaa9b7d1-1800-0000-0ca1-0a796c0d0000 pid=3436 clone guuid=f103ded1-1800-0000-0ca1-0a796d0d0000 pid=3437 /usr/bin/chmod guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=f103ded1-1800-0000-0ca1-0a796d0d0000 pid=3437 execve guuid=b30a99d2-1800-0000-0ca1-0a796e0d0000 pid=3438 /tmp/WTF net guuid=beb7ad20-1800-0000-0ca1-0a79010c0000 pid=3073->guuid=b30a99d2-1800-0000-0ca1-0a796e0d0000 pid=3438 execve 2518ac35-7c39-5ae3-902e-6b81291bcee9 176.65.139.59:80 guuid=8bcf0421-1800-0000-0ca1-0a79040c0000 pid=3076->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 149B guuid=eb5adb26-1800-0000-0ca1-0a79120c0000 pid=3090->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 98B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=aa52b330-1800-0000-0ca1-0a79260c0000 pid=3110->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=df26eb30-1800-0000-0ca1-0a79280c0000 pid=3112 /tmp/WTF guuid=aa52b330-1800-0000-0ca1-0a79260c0000 pid=3110->guuid=df26eb30-1800-0000-0ca1-0a79280c0000 pid=3112 clone guuid=3e04f030-1800-0000-0ca1-0a79290c0000 pid=3113 /tmp/WTF guuid=aa52b330-1800-0000-0ca1-0a79260c0000 pid=3110->guuid=3e04f030-1800-0000-0ca1-0a79290c0000 pid=3113 clone guuid=1d7ff330-1800-0000-0ca1-0a792a0c0000 pid=3114 /tmp/WTF net send-data zombie guuid=aa52b330-1800-0000-0ca1-0a79260c0000 pid=3110->guuid=1d7ff330-1800-0000-0ca1-0a792a0c0000 pid=3114 clone guuid=1d7ff330-1800-0000-0ca1-0a792a0c0000 pid=3114->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con d183a5f6-61ac-5c8a-bd44-32bf5155798d 176.65.139.59:3778 guuid=1d7ff330-1800-0000-0ca1-0a792a0c0000 pid=3114->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=5e5c0231-1800-0000-0ca1-0a792b0c0000 pid=3115->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 150B guuid=2ab7b934-1800-0000-0ca1-0a79380c0000 pid=3128->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 99B guuid=81ee8d3b-1800-0000-0ca1-0a794f0c0000 pid=3151->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8304d73b-1800-0000-0ca1-0a79530c0000 pid=3155 /tmp/WTF guuid=81ee8d3b-1800-0000-0ca1-0a794f0c0000 pid=3151->guuid=8304d73b-1800-0000-0ca1-0a79530c0000 pid=3155 clone guuid=3e18dc3b-1800-0000-0ca1-0a79540c0000 pid=3156 /tmp/WTF guuid=81ee8d3b-1800-0000-0ca1-0a794f0c0000 pid=3151->guuid=3e18dc3b-1800-0000-0ca1-0a79540c0000 pid=3156 clone guuid=311ce33b-1800-0000-0ca1-0a79550c0000 pid=3157 /tmp/WTF net send-data zombie guuid=81ee8d3b-1800-0000-0ca1-0a794f0c0000 pid=3151->guuid=311ce33b-1800-0000-0ca1-0a79550c0000 pid=3157 clone guuid=311ce33b-1800-0000-0ca1-0a79550c0000 pid=3157->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=311ce33b-1800-0000-0ca1-0a79550c0000 pid=3157->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=4f570e3c-1800-0000-0ca1-0a79560c0000 pid=3158->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 149B guuid=d3579942-1800-0000-0ca1-0a79590c0000 pid=3161->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 98B guuid=7db92d4d-1800-0000-0ca1-0a796c0c0000 pid=3180->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=102d614d-1800-0000-0ca1-0a796e0c0000 pid=3182 /tmp/WTF guuid=7db92d4d-1800-0000-0ca1-0a796c0c0000 pid=3180->guuid=102d614d-1800-0000-0ca1-0a796e0c0000 pid=3182 clone guuid=1115654d-1800-0000-0ca1-0a796f0c0000 pid=3183 /tmp/WTF guuid=7db92d4d-1800-0000-0ca1-0a796c0c0000 pid=3180->guuid=1115654d-1800-0000-0ca1-0a796f0c0000 pid=3183 clone guuid=1098694d-1800-0000-0ca1-0a79700c0000 pid=3184 /tmp/WTF net send-data zombie guuid=7db92d4d-1800-0000-0ca1-0a796c0c0000 pid=3180->guuid=1098694d-1800-0000-0ca1-0a79700c0000 pid=3184 clone guuid=1098694d-1800-0000-0ca1-0a79700c0000 pid=3184->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=1098694d-1800-0000-0ca1-0a79700c0000 pid=3184->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=860e744d-1800-0000-0ca1-0a79710c0000 pid=3185->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 150B guuid=7c723650-1800-0000-0ca1-0a797a0c0000 pid=3194->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 99B guuid=0b8eb954-1800-0000-0ca1-0a79810c0000 pid=3201->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a3960355-1800-0000-0ca1-0a79820c0000 pid=3202 /tmp/WTF guuid=0b8eb954-1800-0000-0ca1-0a79810c0000 pid=3201->guuid=a3960355-1800-0000-0ca1-0a79820c0000 pid=3202 clone guuid=24ad0955-1800-0000-0ca1-0a79830c0000 pid=3203 /tmp/WTF guuid=0b8eb954-1800-0000-0ca1-0a79810c0000 pid=3201->guuid=24ad0955-1800-0000-0ca1-0a79830c0000 pid=3203 clone guuid=86691155-1800-0000-0ca1-0a79840c0000 pid=3204 /tmp/WTF net send-data zombie guuid=0b8eb954-1800-0000-0ca1-0a79810c0000 pid=3201->guuid=86691155-1800-0000-0ca1-0a79840c0000 pid=3204 clone guuid=86691155-1800-0000-0ca1-0a79840c0000 pid=3204->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=86691155-1800-0000-0ca1-0a79840c0000 pid=3204->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=c6d11e55-1800-0000-0ca1-0a79850c0000 pid=3205->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 150B guuid=846ccb58-1800-0000-0ca1-0a79860c0000 pid=3206->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 99B guuid=0d6d635e-1800-0000-0ca1-0a79890c0000 pid=3209->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f605bb5e-1800-0000-0ca1-0a798a0c0000 pid=3210 /tmp/WTF guuid=0d6d635e-1800-0000-0ca1-0a79890c0000 pid=3209->guuid=f605bb5e-1800-0000-0ca1-0a798a0c0000 pid=3210 clone guuid=ab08c05e-1800-0000-0ca1-0a798b0c0000 pid=3211 /tmp/WTF guuid=0d6d635e-1800-0000-0ca1-0a79890c0000 pid=3209->guuid=ab08c05e-1800-0000-0ca1-0a798b0c0000 pid=3211 clone guuid=33eecb5e-1800-0000-0ca1-0a798c0c0000 pid=3212 /tmp/WTF net send-data zombie guuid=0d6d635e-1800-0000-0ca1-0a79890c0000 pid=3209->guuid=33eecb5e-1800-0000-0ca1-0a798c0c0000 pid=3212 clone guuid=33eecb5e-1800-0000-0ca1-0a798c0c0000 pid=3212->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=33eecb5e-1800-0000-0ca1-0a798c0c0000 pid=3212->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=302ce25e-1800-0000-0ca1-0a798d0c0000 pid=3213->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 152B guuid=ddeaa463-1800-0000-0ca1-0a79920c0000 pid=3218->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 101B guuid=71d8916a-1800-0000-0ca1-0a79a30c0000 pid=3235->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=eb2eca6a-1800-0000-0ca1-0a79a40c0000 pid=3236 /tmp/WTF guuid=71d8916a-1800-0000-0ca1-0a79a30c0000 pid=3235->guuid=eb2eca6a-1800-0000-0ca1-0a79a40c0000 pid=3236 clone guuid=0509cf6a-1800-0000-0ca1-0a79a50c0000 pid=3237 /tmp/WTF guuid=71d8916a-1800-0000-0ca1-0a79a30c0000 pid=3235->guuid=0509cf6a-1800-0000-0ca1-0a79a50c0000 pid=3237 clone guuid=3a20d26a-1800-0000-0ca1-0a79a60c0000 pid=3238 /tmp/WTF net send-data zombie guuid=71d8916a-1800-0000-0ca1-0a79a30c0000 pid=3235->guuid=3a20d26a-1800-0000-0ca1-0a79a60c0000 pid=3238 clone guuid=3a20d26a-1800-0000-0ca1-0a79a60c0000 pid=3238->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3a20d26a-1800-0000-0ca1-0a79a60c0000 pid=3238->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=3874de6a-1800-0000-0ca1-0a79a70c0000 pid=3239->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 150B guuid=3aa9596e-1800-0000-0ca1-0a79ad0c0000 pid=3245->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 99B guuid=82faa973-1800-0000-0ca1-0a79bc0c0000 pid=3260->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c09aee73-1800-0000-0ca1-0a79bd0c0000 pid=3261 /tmp/WTF guuid=82faa973-1800-0000-0ca1-0a79bc0c0000 pid=3260->guuid=c09aee73-1800-0000-0ca1-0a79bd0c0000 pid=3261 clone guuid=6a30f373-1800-0000-0ca1-0a79be0c0000 pid=3262 /tmp/WTF guuid=82faa973-1800-0000-0ca1-0a79bc0c0000 pid=3260->guuid=6a30f373-1800-0000-0ca1-0a79be0c0000 pid=3262 clone guuid=cb20f873-1800-0000-0ca1-0a79bf0c0000 pid=3263 /tmp/WTF net send-data zombie guuid=82faa973-1800-0000-0ca1-0a79bc0c0000 pid=3260->guuid=cb20f873-1800-0000-0ca1-0a79bf0c0000 pid=3263 clone guuid=cb20f873-1800-0000-0ca1-0a79bf0c0000 pid=3263->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cb20f873-1800-0000-0ca1-0a79bf0c0000 pid=3263->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=b0680b74-1800-0000-0ca1-0a79c10c0000 pid=3265->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 149B guuid=591b5178-1800-0000-0ca1-0a79c20c0000 pid=3266->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 98B guuid=22bccb7f-1800-0000-0ca1-0a79c50c0000 pid=3269->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=14fa2380-1800-0000-0ca1-0a79c60c0000 pid=3270 /tmp/WTF guuid=22bccb7f-1800-0000-0ca1-0a79c50c0000 pid=3269->guuid=14fa2380-1800-0000-0ca1-0a79c60c0000 pid=3270 clone guuid=8d812880-1800-0000-0ca1-0a79c70c0000 pid=3271 /tmp/WTF guuid=22bccb7f-1800-0000-0ca1-0a79c50c0000 pid=3269->guuid=8d812880-1800-0000-0ca1-0a79c70c0000 pid=3271 clone guuid=bfa82e80-1800-0000-0ca1-0a79c80c0000 pid=3272 /tmp/WTF net send-data zombie guuid=22bccb7f-1800-0000-0ca1-0a79c50c0000 pid=3269->guuid=bfa82e80-1800-0000-0ca1-0a79c80c0000 pid=3272 clone guuid=bfa82e80-1800-0000-0ca1-0a79c80c0000 pid=3272->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=bfa82e80-1800-0000-0ca1-0a79c80c0000 pid=3272->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=f1253f80-1800-0000-0ca1-0a79c90c0000 pid=3273->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 150B guuid=a26c9685-1800-0000-0ca1-0a79cb0c0000 pid=3275->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 99B guuid=ce788d8d-1800-0000-0ca1-0a79db0c0000 pid=3291->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=479cbf8d-1800-0000-0ca1-0a79dc0c0000 pid=3292 /tmp/WTF guuid=ce788d8d-1800-0000-0ca1-0a79db0c0000 pid=3291->guuid=479cbf8d-1800-0000-0ca1-0a79dc0c0000 pid=3292 clone guuid=1849c48d-1800-0000-0ca1-0a79dd0c0000 pid=3293 /tmp/WTF guuid=ce788d8d-1800-0000-0ca1-0a79db0c0000 pid=3291->guuid=1849c48d-1800-0000-0ca1-0a79dd0c0000 pid=3293 clone guuid=22f1c98d-1800-0000-0ca1-0a79de0c0000 pid=3294 /tmp/WTF net send-data zombie guuid=ce788d8d-1800-0000-0ca1-0a79db0c0000 pid=3291->guuid=22f1c98d-1800-0000-0ca1-0a79de0c0000 pid=3294 clone guuid=22f1c98d-1800-0000-0ca1-0a79de0c0000 pid=3294->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=22f1c98d-1800-0000-0ca1-0a79de0c0000 pid=3294->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=42d7d98d-1800-0000-0ca1-0a79df0c0000 pid=3295->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 150B guuid=2caeeb91-1800-0000-0ca1-0a79e00c0000 pid=3296->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 99B guuid=882f5d97-1800-0000-0ca1-0a79ea0c0000 pid=3306->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=44ee9097-1800-0000-0ca1-0a79eb0c0000 pid=3307 /tmp/WTF guuid=882f5d97-1800-0000-0ca1-0a79ea0c0000 pid=3306->guuid=44ee9097-1800-0000-0ca1-0a79eb0c0000 pid=3307 clone guuid=32ca9497-1800-0000-0ca1-0a79ec0c0000 pid=3308 /tmp/WTF guuid=882f5d97-1800-0000-0ca1-0a79ea0c0000 pid=3306->guuid=32ca9497-1800-0000-0ca1-0a79ec0c0000 pid=3308 clone guuid=a05f9a97-1800-0000-0ca1-0a79ed0c0000 pid=3309 /tmp/WTF net send-data zombie guuid=882f5d97-1800-0000-0ca1-0a79ea0c0000 pid=3306->guuid=a05f9a97-1800-0000-0ca1-0a79ed0c0000 pid=3309 clone guuid=a05f9a97-1800-0000-0ca1-0a79ed0c0000 pid=3309->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a05f9a97-1800-0000-0ca1-0a79ed0c0000 pid=3309->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=beb1a897-1800-0000-0ca1-0a79ee0c0000 pid=3310->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 150B guuid=0516ec9b-1800-0000-0ca1-0a79ef0c0000 pid=3311->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 99B guuid=acec44a2-1800-0000-0ca1-0a79f90c0000 pid=3321->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5ec374a2-1800-0000-0ca1-0a79fa0c0000 pid=3322 /tmp/WTF guuid=acec44a2-1800-0000-0ca1-0a79f90c0000 pid=3321->guuid=5ec374a2-1800-0000-0ca1-0a79fa0c0000 pid=3322 clone guuid=1baa79a2-1800-0000-0ca1-0a79fb0c0000 pid=3323 /tmp/WTF guuid=acec44a2-1800-0000-0ca1-0a79f90c0000 pid=3321->guuid=1baa79a2-1800-0000-0ca1-0a79fb0c0000 pid=3323 clone guuid=faf17ea2-1800-0000-0ca1-0a79fc0c0000 pid=3324 /tmp/WTF net send-data zombie guuid=acec44a2-1800-0000-0ca1-0a79f90c0000 pid=3321->guuid=faf17ea2-1800-0000-0ca1-0a79fc0c0000 pid=3324 clone guuid=faf17ea2-1800-0000-0ca1-0a79fc0c0000 pid=3324->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=faf17ea2-1800-0000-0ca1-0a79fc0c0000 pid=3324->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=c7c98da2-1800-0000-0ca1-0a79fd0c0000 pid=3325->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 149B guuid=08863da6-1800-0000-0ca1-0a79050d0000 pid=3333->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 98B guuid=e34102ac-1800-0000-0ca1-0a790f0d0000 pid=3343->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7be664ac-1800-0000-0ca1-0a79100d0000 pid=3344 /tmp/WTF guuid=e34102ac-1800-0000-0ca1-0a790f0d0000 pid=3343->guuid=7be664ac-1800-0000-0ca1-0a79100d0000 pid=3344 clone guuid=430c74ac-1800-0000-0ca1-0a79110d0000 pid=3345 /tmp/WTF guuid=e34102ac-1800-0000-0ca1-0a790f0d0000 pid=3343->guuid=430c74ac-1800-0000-0ca1-0a79110d0000 pid=3345 clone guuid=cd727cac-1800-0000-0ca1-0a79120d0000 pid=3346 /tmp/WTF net send-data zombie guuid=e34102ac-1800-0000-0ca1-0a790f0d0000 pid=3343->guuid=cd727cac-1800-0000-0ca1-0a79120d0000 pid=3346 clone guuid=cd727cac-1800-0000-0ca1-0a79120d0000 pid=3346->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cd727cac-1800-0000-0ca1-0a79120d0000 pid=3346->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=24458dac-1800-0000-0ca1-0a79130d0000 pid=3347->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 149B guuid=f85711b1-1800-0000-0ca1-0a791b0d0000 pid=3355->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 98B guuid=39756fb7-1800-0000-0ca1-0a792b0d0000 pid=3371->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=b27fb3b7-1800-0000-0ca1-0a792c0d0000 pid=3372 /tmp/WTF guuid=39756fb7-1800-0000-0ca1-0a792b0d0000 pid=3371->guuid=b27fb3b7-1800-0000-0ca1-0a792c0d0000 pid=3372 clone guuid=2589bab7-1800-0000-0ca1-0a792d0d0000 pid=3373 /tmp/WTF guuid=39756fb7-1800-0000-0ca1-0a792b0d0000 pid=3371->guuid=2589bab7-1800-0000-0ca1-0a792d0d0000 pid=3373 clone guuid=919cc1b7-1800-0000-0ca1-0a792e0d0000 pid=3374 /tmp/WTF net send-data zombie guuid=39756fb7-1800-0000-0ca1-0a792b0d0000 pid=3371->guuid=919cc1b7-1800-0000-0ca1-0a792e0d0000 pid=3374 clone guuid=919cc1b7-1800-0000-0ca1-0a792e0d0000 pid=3374->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=919cc1b7-1800-0000-0ca1-0a792e0d0000 pid=3374->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=54f9cfb7-1800-0000-0ca1-0a792f0d0000 pid=3375->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 150B guuid=aa7a8dbd-1800-0000-0ca1-0a793e0d0000 pid=3390->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 99B guuid=05f2ddc3-1800-0000-0ca1-0a794c0d0000 pid=3404->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=3f774fc4-1800-0000-0ca1-0a794d0d0000 pid=3405 /tmp/WTF guuid=05f2ddc3-1800-0000-0ca1-0a794c0d0000 pid=3404->guuid=3f774fc4-1800-0000-0ca1-0a794d0d0000 pid=3405 clone guuid=b4705ac4-1800-0000-0ca1-0a794e0d0000 pid=3406 /tmp/WTF guuid=05f2ddc3-1800-0000-0ca1-0a794c0d0000 pid=3404->guuid=b4705ac4-1800-0000-0ca1-0a794e0d0000 pid=3406 clone guuid=0e5368c4-1800-0000-0ca1-0a794f0d0000 pid=3407 /tmp/WTF net send-data zombie guuid=05f2ddc3-1800-0000-0ca1-0a794c0d0000 pid=3404->guuid=0e5368c4-1800-0000-0ca1-0a794f0d0000 pid=3407 clone guuid=0e5368c4-1800-0000-0ca1-0a794f0d0000 pid=3407->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0e5368c4-1800-0000-0ca1-0a794f0d0000 pid=3407->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B guuid=7c9c8fc4-1800-0000-0ca1-0a79500d0000 pid=3408->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 149B guuid=53d773cb-1800-0000-0ca1-0a79610d0000 pid=3425->2518ac35-7c39-5ae3-902e-6b81291bcee9 send: 98B guuid=b30a99d2-1800-0000-0ca1-0a796e0d0000 pid=3438->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=846bd1d2-1800-0000-0ca1-0a796f0d0000 pid=3439 /tmp/WTF guuid=b30a99d2-1800-0000-0ca1-0a796e0d0000 pid=3438->guuid=846bd1d2-1800-0000-0ca1-0a796f0d0000 pid=3439 clone guuid=0b6cd6d2-1800-0000-0ca1-0a79700d0000 pid=3440 /tmp/WTF guuid=b30a99d2-1800-0000-0ca1-0a796e0d0000 pid=3438->guuid=0b6cd6d2-1800-0000-0ca1-0a79700d0000 pid=3440 clone guuid=9c8fdad2-1800-0000-0ca1-0a79710d0000 pid=3441 /tmp/WTF net send-data zombie guuid=b30a99d2-1800-0000-0ca1-0a796e0d0000 pid=3438->guuid=9c8fdad2-1800-0000-0ca1-0a79710d0000 pid=3441 clone guuid=9c8fdad2-1800-0000-0ca1-0a79710d0000 pid=3441->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=9c8fdad2-1800-0000-0ca1-0a79710d0000 pid=3441->d183a5f6-61ac-5c8a-bd44-32bf5155798d send: 7B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2026-04-19 09:37:38 UTC
File Type:
Text (Shell)
AV detection:
18 of 24 (75.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32ri3m3hcfnmayfqa7rvjmh7rtkvjl3q6wmvcahabpsk5i5fejva._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260419-lk6l1sct5t/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dea28db36711/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh dea28db367115ac060b007e354b0ff8cd554af70f5995100e00be4aea3a5226a

(this sample)

Mirai

elf 93e4e5006079c7668fd7e8e7f90e000421c72147719681c3a65b2675789a06d3

Mirai

elf 6411d990948b96e8347a053611e6d4d178f995e913d973404ea7fd8d07b442d0

  
URLhaus
https://urlhaus.abuse.ch/url/3809122/
  
Delivery method
Distributed via web download
  
Dropping
MD5 7805caaf65bcb21b637274e2cf4b1c9b
  
Dropping
SHA256 6411d990948b96e8347a053611e6d4d178f995e913d973404ea7fd8d07b442d0

Comments