MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dee75b1f9f5bf18f8ae1d2a1d2cf1c825f2b11110ce0169892b00923675c116c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dee75b1f9f5bf18f8ae1d2a1d2cf1c825f2b11110ce0169892b00923675c116c
SHA3-384 hash: 20536f0f64bd905f9f5d2787158b8eb1175c5f8fcabca2a0c5cd51c44c1c00e363f19996d28d345ff118f4d049b1b541
SHA1 hash: abc5cffdf666b56e18be8245eacbf4fdf8dc7528
MD5 hash: 00a7c96d7616b228caaa5dd0183065e1
humanhash: sink-nine-black-foxtrot
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-25 09:56:48 UTC
Last seen:2026-08-25 23:22:01 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:0WGWaWpH64HiOjXNP5w+9jXFJAx85bfa6at/lp:0/7E64x7NP55PA8Ta6at/lp
TLSH T14431729A50241A321103DA9E3362350CB15DA5FB2CDFD7D8CD481EEA82887CDF2A1F59
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/60ade1n/an/an/a
http://5.182.210.174/c52547n/an/an/a
http://5.182.210.174/1ee71bn/an/an/a
http://5.182.210.174/ab0fd4n/an/an/a
http://5.182.210.174/276dedn/an/an/a
http://5.182.210.174/85e471n/an/an/a
http://5.182.210.174/03f5b6n/an/an/a
http://5.182.210.174/e2d132n/an/an/a
http://5.182.210.174/c04cc8n/an/an/a
http://5.182.210.174/d691c4n/an/an/a
http://5.182.210.174/16b7d1n/an/an/a
http://5.182.210.174/ab42b8n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
30
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c5eed377-087a-4078-838f-f109593e2c6f
Behavior Graph:
Download SVG
%3 guuid=835a3cae-1600-0000-6ae4-ce3b360b0000 pid=2870 /usr/bin/sudo guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874 /tmp/sample.bin guuid=835a3cae-1600-0000-6ae4-ce3b360b0000 pid=2870->guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874 execve guuid=028b75b0-1600-0000-6ae4-ce3b3c0b0000 pid=2876 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=028b75b0-1600-0000-6ae4-ce3b3c0b0000 pid=2876 execve guuid=2709feb4-1600-0000-6ae4-ce3b430b0000 pid=2883 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=2709feb4-1600-0000-6ae4-ce3b430b0000 pid=2883 execve guuid=460ea4bb-1600-0000-6ae4-ce3b520b0000 pid=2898 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=460ea4bb-1600-0000-6ae4-ce3b520b0000 pid=2898 execve guuid=ce75f8bb-1600-0000-6ae4-ce3b540b0000 pid=2900 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=ce75f8bb-1600-0000-6ae4-ce3b540b0000 pid=2900 clone guuid=7ed565bc-1600-0000-6ae4-ce3b570b0000 pid=2903 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=7ed565bc-1600-0000-6ae4-ce3b570b0000 pid=2903 execve guuid=86b4b4bc-1600-0000-6ae4-ce3b590b0000 pid=2905 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=86b4b4bc-1600-0000-6ae4-ce3b590b0000 pid=2905 execve guuid=84ce07bd-1600-0000-6ae4-ce3b5b0b0000 pid=2907 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=84ce07bd-1600-0000-6ae4-ce3b5b0b0000 pid=2907 execve guuid=f33ef0bf-1600-0000-6ae4-ce3b650b0000 pid=2917 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=f33ef0bf-1600-0000-6ae4-ce3b650b0000 pid=2917 execve guuid=1dce64c3-1600-0000-6ae4-ce3b6f0b0000 pid=2927 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=1dce64c3-1600-0000-6ae4-ce3b6f0b0000 pid=2927 execve guuid=80c9ddc3-1600-0000-6ae4-ce3b710b0000 pid=2929 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=80c9ddc3-1600-0000-6ae4-ce3b710b0000 pid=2929 clone guuid=df761ec4-1600-0000-6ae4-ce3b740b0000 pid=2932 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=df761ec4-1600-0000-6ae4-ce3b740b0000 pid=2932 execve guuid=3cb178c4-1600-0000-6ae4-ce3b760b0000 pid=2934 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=3cb178c4-1600-0000-6ae4-ce3b760b0000 pid=2934 execve guuid=fc6ac5c4-1600-0000-6ae4-ce3b770b0000 pid=2935 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=fc6ac5c4-1600-0000-6ae4-ce3b770b0000 pid=2935 execve guuid=d8c94dc8-1600-0000-6ae4-ce3b840b0000 pid=2948 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=d8c94dc8-1600-0000-6ae4-ce3b840b0000 pid=2948 execve guuid=007dd5cd-1600-0000-6ae4-ce3b990b0000 pid=2969 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=007dd5cd-1600-0000-6ae4-ce3b990b0000 pid=2969 execve guuid=e97a20ce-1600-0000-6ae4-ce3b9b0b0000 pid=2971 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=e97a20ce-1600-0000-6ae4-ce3b9b0b0000 pid=2971 clone guuid=8dfd68ce-1600-0000-6ae4-ce3b9d0b0000 pid=2973 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=8dfd68ce-1600-0000-6ae4-ce3b9d0b0000 pid=2973 execve guuid=5e56aace-1600-0000-6ae4-ce3b9f0b0000 pid=2975 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=5e56aace-1600-0000-6ae4-ce3b9f0b0000 pid=2975 execve guuid=43ebf4ce-1600-0000-6ae4-ce3ba10b0000 pid=2977 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=43ebf4ce-1600-0000-6ae4-ce3ba10b0000 pid=2977 execve guuid=c8c969d1-1600-0000-6ae4-ce3baa0b0000 pid=2986 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=c8c969d1-1600-0000-6ae4-ce3baa0b0000 pid=2986 execve guuid=c2cc33d5-1600-0000-6ae4-ce3bb60b0000 pid=2998 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=c2cc33d5-1600-0000-6ae4-ce3bb60b0000 pid=2998 execve guuid=b2d8a2d5-1600-0000-6ae4-ce3bb70b0000 pid=2999 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=b2d8a2d5-1600-0000-6ae4-ce3bb70b0000 pid=2999 clone guuid=f1e1fcd5-1600-0000-6ae4-ce3bb90b0000 pid=3001 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=f1e1fcd5-1600-0000-6ae4-ce3bb90b0000 pid=3001 execve guuid=2c386dd6-1600-0000-6ae4-ce3bba0b0000 pid=3002 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=2c386dd6-1600-0000-6ae4-ce3bba0b0000 pid=3002 execve guuid=504d32d7-1600-0000-6ae4-ce3bbc0b0000 pid=3004 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=504d32d7-1600-0000-6ae4-ce3bbc0b0000 pid=3004 execve guuid=ec26c6db-1600-0000-6ae4-ce3bc70b0000 pid=3015 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=ec26c6db-1600-0000-6ae4-ce3bc70b0000 pid=3015 execve guuid=0b3592e0-1600-0000-6ae4-ce3bca0b0000 pid=3018 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=0b3592e0-1600-0000-6ae4-ce3bca0b0000 pid=3018 execve guuid=5d31ede0-1600-0000-6ae4-ce3bcb0b0000 pid=3019 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=5d31ede0-1600-0000-6ae4-ce3bcb0b0000 pid=3019 clone guuid=00092ce1-1600-0000-6ae4-ce3bcd0b0000 pid=3021 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=00092ce1-1600-0000-6ae4-ce3bcd0b0000 pid=3021 execve guuid=209073e1-1600-0000-6ae4-ce3bcf0b0000 pid=3023 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=209073e1-1600-0000-6ae4-ce3bcf0b0000 pid=3023 execve guuid=110dbee1-1600-0000-6ae4-ce3bd00b0000 pid=3024 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=110dbee1-1600-0000-6ae4-ce3bd00b0000 pid=3024 execve guuid=17754ae4-1600-0000-6ae4-ce3bd60b0000 pid=3030 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=17754ae4-1600-0000-6ae4-ce3bd60b0000 pid=3030 execve guuid=81c2b8e8-1600-0000-6ae4-ce3bdf0b0000 pid=3039 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=81c2b8e8-1600-0000-6ae4-ce3bdf0b0000 pid=3039 execve guuid=31dd5be9-1600-0000-6ae4-ce3be30b0000 pid=3043 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=31dd5be9-1600-0000-6ae4-ce3be30b0000 pid=3043 clone guuid=9fb4dbe9-1600-0000-6ae4-ce3be60b0000 pid=3046 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=9fb4dbe9-1600-0000-6ae4-ce3be60b0000 pid=3046 execve guuid=de37a1ea-1600-0000-6ae4-ce3bea0b0000 pid=3050 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=de37a1ea-1600-0000-6ae4-ce3bea0b0000 pid=3050 execve guuid=58d91aeb-1600-0000-6ae4-ce3bed0b0000 pid=3053 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=58d91aeb-1600-0000-6ae4-ce3bed0b0000 pid=3053 execve guuid=03ed7eed-1600-0000-6ae4-ce3bf60b0000 pid=3062 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=03ed7eed-1600-0000-6ae4-ce3bf60b0000 pid=3062 execve guuid=62f9eef0-1600-0000-6ae4-ce3b010c0000 pid=3073 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=62f9eef0-1600-0000-6ae4-ce3b010c0000 pid=3073 execve guuid=ff592ef1-1600-0000-6ae4-ce3b030c0000 pid=3075 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=ff592ef1-1600-0000-6ae4-ce3b030c0000 pid=3075 clone guuid=47ad61f1-1600-0000-6ae4-ce3b060c0000 pid=3078 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=47ad61f1-1600-0000-6ae4-ce3b060c0000 pid=3078 execve guuid=7a91b3f1-1600-0000-6ae4-ce3b080c0000 pid=3080 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=7a91b3f1-1600-0000-6ae4-ce3b080c0000 pid=3080 execve guuid=89c2f3f1-1600-0000-6ae4-ce3b090c0000 pid=3081 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=89c2f3f1-1600-0000-6ae4-ce3b090c0000 pid=3081 execve guuid=add597f4-1600-0000-6ae4-ce3b110c0000 pid=3089 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=add597f4-1600-0000-6ae4-ce3b110c0000 pid=3089 execve guuid=31a0eff9-1600-0000-6ae4-ce3b220c0000 pid=3106 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=31a0eff9-1600-0000-6ae4-ce3b220c0000 pid=3106 execve guuid=318d31fa-1600-0000-6ae4-ce3b240c0000 pid=3108 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=318d31fa-1600-0000-6ae4-ce3b240c0000 pid=3108 clone guuid=f8765efa-1600-0000-6ae4-ce3b260c0000 pid=3110 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=f8765efa-1600-0000-6ae4-ce3b260c0000 pid=3110 execve guuid=789f96fa-1600-0000-6ae4-ce3b270c0000 pid=3111 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=789f96fa-1600-0000-6ae4-ce3b270c0000 pid=3111 execve guuid=7362ccfa-1600-0000-6ae4-ce3b290c0000 pid=3113 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=7362ccfa-1600-0000-6ae4-ce3b290c0000 pid=3113 execve guuid=4ec924fd-1600-0000-6ae4-ce3b2b0c0000 pid=3115 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=4ec924fd-1600-0000-6ae4-ce3b2b0c0000 pid=3115 execve guuid=c4909902-1700-0000-6ae4-ce3b2c0c0000 pid=3116 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=c4909902-1700-0000-6ae4-ce3b2c0c0000 pid=3116 execve guuid=d856ff07-1700-0000-6ae4-ce3b2d0c0000 pid=3117 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=d856ff07-1700-0000-6ae4-ce3b2d0c0000 pid=3117 clone guuid=e00e4c08-1700-0000-6ae4-ce3b2f0c0000 pid=3119 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=e00e4c08-1700-0000-6ae4-ce3b2f0c0000 pid=3119 execve guuid=9abfaf08-1700-0000-6ae4-ce3b300c0000 pid=3120 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=9abfaf08-1700-0000-6ae4-ce3b300c0000 pid=3120 execve guuid=d4f11409-1700-0000-6ae4-ce3b310c0000 pid=3121 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=d4f11409-1700-0000-6ae4-ce3b310c0000 pid=3121 execve guuid=de33d60c-1700-0000-6ae4-ce3b320c0000 pid=3122 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=de33d60c-1700-0000-6ae4-ce3b320c0000 pid=3122 execve guuid=41a24f12-1700-0000-6ae4-ce3b3e0c0000 pid=3134 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=41a24f12-1700-0000-6ae4-ce3b3e0c0000 pid=3134 execve guuid=5581ab12-1700-0000-6ae4-ce3b400c0000 pid=3136 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=5581ab12-1700-0000-6ae4-ce3b400c0000 pid=3136 clone guuid=c0def812-1700-0000-6ae4-ce3b430c0000 pid=3139 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=c0def812-1700-0000-6ae4-ce3b430c0000 pid=3139 execve guuid=d03e5c13-1700-0000-6ae4-ce3b450c0000 pid=3141 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=d03e5c13-1700-0000-6ae4-ce3b450c0000 pid=3141 execve guuid=5223b813-1700-0000-6ae4-ce3b470c0000 pid=3143 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=5223b813-1700-0000-6ae4-ce3b470c0000 pid=3143 execve guuid=71488316-1700-0000-6ae4-ce3b4f0c0000 pid=3151 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=71488316-1700-0000-6ae4-ce3b4f0c0000 pid=3151 execve guuid=82d1b81a-1700-0000-6ae4-ce3b5c0c0000 pid=3164 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=82d1b81a-1700-0000-6ae4-ce3b5c0c0000 pid=3164 execve guuid=ce102a1b-1700-0000-6ae4-ce3b5f0c0000 pid=3167 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=ce102a1b-1700-0000-6ae4-ce3b5f0c0000 pid=3167 clone guuid=f3a2771b-1700-0000-6ae4-ce3b610c0000 pid=3169 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=f3a2771b-1700-0000-6ae4-ce3b610c0000 pid=3169 execve guuid=5827bf1b-1700-0000-6ae4-ce3b620c0000 pid=3170 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=5827bf1b-1700-0000-6ae4-ce3b620c0000 pid=3170 execve guuid=15d4081c-1700-0000-6ae4-ce3b630c0000 pid=3171 /usr/bin/wget net send-data guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=15d4081c-1700-0000-6ae4-ce3b630c0000 pid=3171 execve guuid=20a5b21e-1700-0000-6ae4-ce3b640c0000 pid=3172 /usr/bin/curl net send-data write-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=20a5b21e-1700-0000-6ae4-ce3b640c0000 pid=3172 execve guuid=51320423-1700-0000-6ae4-ce3b690c0000 pid=3177 /usr/bin/chmod guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=51320423-1700-0000-6ae4-ce3b690c0000 pid=3177 execve guuid=a6953c23-1700-0000-6ae4-ce3b6a0c0000 pid=3178 /usr/bin/bash guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=a6953c23-1700-0000-6ae4-ce3b6a0c0000 pid=3178 clone guuid=221f6623-1700-0000-6ae4-ce3b6d0c0000 pid=3181 /usr/bin/rm delete-file guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=221f6623-1700-0000-6ae4-ce3b6d0c0000 pid=3181 execve guuid=153d9f23-1700-0000-6ae4-ce3b6f0c0000 pid=3183 /usr/bin/rm guuid=83d412b0-1600-0000-6ae4-ce3b3a0b0000 pid=2874->guuid=153d9f23-1700-0000-6ae4-ce3b6f0c0000 pid=3183 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=028b75b0-1600-0000-6ae4-ce3b3c0b0000 pid=2876->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2709feb4-1600-0000-6ae4-ce3b430b0000 pid=2883->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=15b318bc-1600-0000-6ae4-ce3b550b0000 pid=2901 /usr/bin/bash guuid=ce75f8bb-1600-0000-6ae4-ce3b540b0000 pid=2900->guuid=15b318bc-1600-0000-6ae4-ce3b550b0000 pid=2901 clone guuid=84ce07bd-1600-0000-6ae4-ce3b5b0b0000 pid=2907->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f33ef0bf-1600-0000-6ae4-ce3b650b0000 pid=2917->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9f3ef7c3-1600-0000-6ae4-ce3b730b0000 pid=2931 /usr/bin/bash guuid=80c9ddc3-1600-0000-6ae4-ce3b710b0000 pid=2929->guuid=9f3ef7c3-1600-0000-6ae4-ce3b730b0000 pid=2931 clone guuid=fc6ac5c4-1600-0000-6ae4-ce3b770b0000 pid=2935->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d8c94dc8-1600-0000-6ae4-ce3b840b0000 pid=2948->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ac183dce-1600-0000-6ae4-ce3b9c0b0000 pid=2972 /usr/bin/bash guuid=e97a20ce-1600-0000-6ae4-ce3b9b0b0000 pid=2971->guuid=ac183dce-1600-0000-6ae4-ce3b9c0b0000 pid=2972 clone guuid=43ebf4ce-1600-0000-6ae4-ce3ba10b0000 pid=2977->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c8c969d1-1600-0000-6ae4-ce3baa0b0000 pid=2986->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8ec5ced5-1600-0000-6ae4-ce3bb80b0000 pid=3000 /usr/bin/bash guuid=b2d8a2d5-1600-0000-6ae4-ce3bb70b0000 pid=2999->guuid=8ec5ced5-1600-0000-6ae4-ce3bb80b0000 pid=3000 clone guuid=504d32d7-1600-0000-6ae4-ce3bbc0b0000 pid=3004->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ec26c6db-1600-0000-6ae4-ce3bc70b0000 pid=3015->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=02450ce1-1600-0000-6ae4-ce3bcc0b0000 pid=3020 /usr/bin/bash guuid=5d31ede0-1600-0000-6ae4-ce3bcb0b0000 pid=3019->guuid=02450ce1-1600-0000-6ae4-ce3bcc0b0000 pid=3020 clone guuid=110dbee1-1600-0000-6ae4-ce3bd00b0000 pid=3024->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=17754ae4-1600-0000-6ae4-ce3bd60b0000 pid=3030->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1bca7ce9-1600-0000-6ae4-ce3be40b0000 pid=3044 /usr/bin/bash guuid=31dd5be9-1600-0000-6ae4-ce3be30b0000 pid=3043->guuid=1bca7ce9-1600-0000-6ae4-ce3be40b0000 pid=3044 clone guuid=58d91aeb-1600-0000-6ae4-ce3bed0b0000 pid=3053->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=03ed7eed-1600-0000-6ae4-ce3bf60b0000 pid=3062->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=577f44f1-1600-0000-6ae4-ce3b040c0000 pid=3076 /usr/bin/bash guuid=ff592ef1-1600-0000-6ae4-ce3b030c0000 pid=3075->guuid=577f44f1-1600-0000-6ae4-ce3b040c0000 pid=3076 clone guuid=89c2f3f1-1600-0000-6ae4-ce3b090c0000 pid=3081->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=add597f4-1600-0000-6ae4-ce3b110c0000 pid=3089->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=009546fa-1600-0000-6ae4-ce3b250c0000 pid=3109 /usr/bin/bash guuid=318d31fa-1600-0000-6ae4-ce3b240c0000 pid=3108->guuid=009546fa-1600-0000-6ae4-ce3b250c0000 pid=3109 clone guuid=7362ccfa-1600-0000-6ae4-ce3b290c0000 pid=3113->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4ec924fd-1600-0000-6ae4-ce3b2b0c0000 pid=3115->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1baa2108-1700-0000-6ae4-ce3b2e0c0000 pid=3118 /usr/bin/bash guuid=d856ff07-1700-0000-6ae4-ce3b2d0c0000 pid=3117->guuid=1baa2108-1700-0000-6ae4-ce3b2e0c0000 pid=3118 clone guuid=d4f11409-1700-0000-6ae4-ce3b310c0000 pid=3121->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=de33d60c-1700-0000-6ae4-ce3b320c0000 pid=3122->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3bc4c912-1700-0000-6ae4-ce3b410c0000 pid=3137 /usr/bin/bash guuid=5581ab12-1700-0000-6ae4-ce3b400c0000 pid=3136->guuid=3bc4c912-1700-0000-6ae4-ce3b410c0000 pid=3137 clone guuid=5223b813-1700-0000-6ae4-ce3b470c0000 pid=3143->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=71488316-1700-0000-6ae4-ce3b4f0c0000 pid=3151->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6a31531b-1700-0000-6ae4-ce3b600c0000 pid=3168 /usr/bin/bash guuid=ce102a1b-1700-0000-6ae4-ce3b5f0c0000 pid=3167->guuid=6a31531b-1700-0000-6ae4-ce3b600c0000 pid=3168 clone guuid=15d4081c-1700-0000-6ae4-ce3b630c0000 pid=3171->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=20a5b21e-1700-0000-6ae4-ce3b640c0000 pid=3172->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b2715123-1700-0000-6ae4-ce3b6c0c0000 pid=3180 /usr/bin/bash guuid=a6953c23-1700-0000-6ae4-ce3b6a0c0000 pid=3178->guuid=b2715123-1700-0000-6ae4-ce3b6c0c0000 pid=3180 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dee75b1f9f5bf18f8ae1d2a1d2cf1c825f2b11110ce0169892b00923675c116c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dee75b1f9f5bf18f8ae1d2a1d2cf1c825f2b11110ce0169892b00923675c116c/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-25 09:57:15 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=33tvwh47lpyy7cxb2kq5fty4qjpsweirbtqbngeswaesgz24cfwa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260825-lyz2dswxe1/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/dee75b1f9f5bf18f8ae1d2a1d2cf1c825f2b11110ce0169892b00923675c116c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh dee75b1f9f5bf18f8ae1d2a1d2cf1c825f2b11110ce0169892b00923675c116c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments