MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e57509531ccf9d33a996908a1230c0f9552cbb3a307279aab1df6b5acf88b34f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e57509531ccf9d33a996908a1230c0f9552cbb3a307279aab1df6b5acf88b34f
SHA3-384 hash: dad3fcc94c7bae42c39b8df13f554ae7154393c5b3ae83a8fc536f2249c57cdb9a2bbc8c9add5f5eac7a670c438574a1
SHA1 hash: 9e6ae2e2865eb827bb8e28bfdb5dbd0281b6d5cb
MD5 hash: 8b2ca9c032b69fbda1550b8268535cf5
humanhash: quiet-emma-jersey-two
File name:zyxel
Download: download sample
Signature Mirai
Create hunting rule
File size:4'830 bytes
First seen:2025-10-12 11:30:51 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:v8ZMV4kuo8C1V4Ko8rXrWV4jo8NoV49o8EhEEV4Eho8BkV4Bo8C1V4Ko8eZV4GoZ:vDppW39TBL2EpObLJKrszNbT1c7YbbJX
TLSH T1E9A129F97474A3AE6DB1ED7321C6C602B28270A6E4D64D0AE3E1F0E5044EF61F4D4AC2
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86924b4daa3d183fc7d1312a17b68aa952c8d0136918478730cd95623bb1890ed9 Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips4e06ece7ae576417a8dc0e419b8782ce0860cd9e90bc947b4c118e2a52786304 Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mpsl6294a0eb4ee65e6ba006a024522658107ec8753f6d3df2dc7309776199da65e7 Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm236fa5092bd06813996532ef793834e31a69ed1e576599eaa97bcf8fb7db9b61 Miraielf mirai
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm5dc06d5d4daab1b23eef11b6eac8da75bafa7e75a7e44d60fb14c9db8199c7553 Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm641e5adc3527479d2bee1a3bb4c590899d40713df8fd20e0871a8f2e46a7afedd Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arm76d65317a9d29fdfee8ff125c78705186155fdb0162f3d13890c43b971bdf6586 Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.ppccd58c26a61496c5f2091a6e51f6d2764a61073bf619bdd2322be5379b519c71d Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.m68kfa94633bd1d61a6bfaad5d6308f4020013ccc11c9c9fa463e9795485b84ddaf5 Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.spc9c08e0232337e3288d21e5f278f98d2a7d514763b85aa5d79c3588e81037ec5d Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.i6864bd20d49002299fd230f3eeddddcf6bf9e81033d15c8519cdfc296723a57b9d3 Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.sh48ac733a14bdcdf3b2543a8e420d2fa224bc067e425ac38ea9d99fbe389f48c44 Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.arc248b6599aebc4e053a68ae502bafc1fec19cc1edcc455a8358e2d3dbe46f0e5e Miraielf mirai ua-wget
http://158.94.209.95/596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.x86_64e1872b44f151615dd30c9120e8d8bd8d477212b7188a79478af49ff7df6610a9 Miraielf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
39
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-12T09:01:00Z UTC
Last seen:
2025-10-13T13:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e57509531ccf9d33a996908a1230c0f9552cbb3a307279aab1df6b5acf88b34f/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0a116ce3-3284-4b31-a2fa-efb1a1d57366
Behavior Graph:
Download SVG
%3 guuid=a76fca48-1800-0000-152d-22a0630c0000 pid=3171 /usr/bin/sudo guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173 /tmp/sample.bin guuid=a76fca48-1800-0000-152d-22a0630c0000 pid=3171->guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173 execve guuid=2640b24c-1800-0000-152d-22a0670c0000 pid=3175 /usr/bin/wget net send-data write-file guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=2640b24c-1800-0000-152d-22a0670c0000 pid=3175 execve guuid=777c135a-1800-0000-152d-22a08a0c0000 pid=3210 /usr/bin/curl net send-data write-file guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=777c135a-1800-0000-152d-22a08a0c0000 pid=3210 execve guuid=124e1c6a-1800-0000-152d-22a08b0c0000 pid=3211 /usr/bin/cat guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=124e1c6a-1800-0000-152d-22a08b0c0000 pid=3211 execve guuid=cfdc8d6a-1800-0000-152d-22a08c0c0000 pid=3212 /usr/bin/chmod guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=cfdc8d6a-1800-0000-152d-22a08c0c0000 pid=3212 execve guuid=e65ee66a-1800-0000-152d-22a08d0c0000 pid=3213 /tmp/76d32be0 net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=e65ee66a-1800-0000-152d-22a08d0c0000 pid=3213 execve guuid=49cd606b-1800-0000-152d-22a0920c0000 pid=3218 /usr/bin/wget net send-data write-file guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=49cd606b-1800-0000-152d-22a0920c0000 pid=3218 execve guuid=3c8e8078-1800-0000-152d-22a09c0c0000 pid=3228 /usr/bin/curl net send-data write-file guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=3c8e8078-1800-0000-152d-22a09c0c0000 pid=3228 execve guuid=8367f083-1800-0000-152d-22a0aa0c0000 pid=3242 /usr/bin/bash guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=8367f083-1800-0000-152d-22a0aa0c0000 pid=3242 clone guuid=a28b2684-1800-0000-152d-22a0ab0c0000 pid=3243 /usr/bin/chmod guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=a28b2684-1800-0000-152d-22a0ab0c0000 pid=3243 execve guuid=96edb784-1800-0000-152d-22a0ac0c0000 pid=3244 /tmp/76d32be0 net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=96edb784-1800-0000-152d-22a0ac0c0000 pid=3244 execve guuid=e9b201c9-1c00-0000-152d-22a07c140000 pid=5244 /usr/bin/wget net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=e9b201c9-1c00-0000-152d-22a07c140000 pid=5244 execve guuid=51d043cb-1c00-0000-152d-22a07f140000 pid=5247 /usr/bin/curl net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=51d043cb-1c00-0000-152d-22a07f140000 pid=5247 execve guuid=805e5ed2-1c00-0000-152d-22a080140000 pid=5248 /usr/bin/bash guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=805e5ed2-1c00-0000-152d-22a080140000 pid=5248 clone guuid=9fa59ad2-1c00-0000-152d-22a081140000 pid=5249 /usr/bin/chmod guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=9fa59ad2-1c00-0000-152d-22a081140000 pid=5249 execve guuid=7b964ad3-1c00-0000-152d-22a082140000 pid=5250 /tmp/76d32be0 net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=7b964ad3-1c00-0000-152d-22a082140000 pid=5250 execve guuid=9bd8ca15-2100-0000-152d-22a0d8140000 pid=5336 /usr/bin/wget net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=9bd8ca15-2100-0000-152d-22a0d8140000 pid=5336 execve guuid=119ff916-2100-0000-152d-22a0db140000 pid=5339 /usr/bin/curl net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=119ff916-2100-0000-152d-22a0db140000 pid=5339 execve guuid=9d445e19-2100-0000-152d-22a0dc140000 pid=5340 /usr/bin/bash guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=9d445e19-2100-0000-152d-22a0dc140000 pid=5340 clone guuid=c7938019-2100-0000-152d-22a0dd140000 pid=5341 /usr/bin/chmod guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=c7938019-2100-0000-152d-22a0dd140000 pid=5341 execve guuid=22cbde19-2100-0000-152d-22a0de140000 pid=5342 /tmp/76d32be0 net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=22cbde19-2100-0000-152d-22a0de140000 pid=5342 execve guuid=53172c58-2500-0000-152d-22a0e1140000 pid=5345 /usr/bin/wget net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=53172c58-2500-0000-152d-22a0e1140000 pid=5345 execve guuid=08580e59-2500-0000-152d-22a0e4140000 pid=5348 /usr/bin/curl net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=08580e59-2500-0000-152d-22a0e4140000 pid=5348 execve guuid=c3a0a45a-2500-0000-152d-22a0e5140000 pid=5349 /usr/bin/bash guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=c3a0a45a-2500-0000-152d-22a0e5140000 pid=5349 clone guuid=f557ec5a-2500-0000-152d-22a0e6140000 pid=5350 /usr/bin/chmod guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=f557ec5a-2500-0000-152d-22a0e6140000 pid=5350 execve guuid=b861c85b-2500-0000-152d-22a0e7140000 pid=5351 /tmp/76d32be0 net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=b861c85b-2500-0000-152d-22a0e7140000 pid=5351 execve guuid=3b23939a-2900-0000-152d-22a0ea140000 pid=5354 /usr/bin/wget net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=3b23939a-2900-0000-152d-22a0ea140000 pid=5354 execve guuid=72dcb39b-2900-0000-152d-22a0ed140000 pid=5357 /usr/bin/curl net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=72dcb39b-2900-0000-152d-22a0ed140000 pid=5357 execve guuid=3480999e-2900-0000-152d-22a0ee140000 pid=5358 /usr/bin/bash guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=3480999e-2900-0000-152d-22a0ee140000 pid=5358 clone guuid=2e5bca9e-2900-0000-152d-22a0ef140000 pid=5359 /usr/bin/chmod guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=2e5bca9e-2900-0000-152d-22a0ef140000 pid=5359 execve guuid=23263e9f-2900-0000-152d-22a0f0140000 pid=5360 /tmp/76d32be0 net guuid=f0126e4b-1800-0000-152d-22a0650c0000 pid=3173->guuid=23263e9f-2900-0000-152d-22a0f0140000 pid=5360 execve ca4cc0d7-5486-5710-a0a1-75a555a3b3a4 158.94.209.95:80 guuid=2640b24c-1800-0000-152d-22a0670c0000 pid=3175->ca4cc0d7-5486-5710-a0a1-75a555a3b3a4 send: 197B guuid=777c135a-1800-0000-152d-22a08a0c0000 pid=3210->ca4cc0d7-5486-5710-a0a1-75a555a3b3a4 send: 146B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=e65ee66a-1800-0000-152d-22a08d0c0000 pid=3213->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=545e386b-1800-0000-152d-22a08e0c0000 pid=3214 /tmp/76d32be0 dns net send-data zombie guuid=e65ee66a-1800-0000-152d-22a08d0c0000 pid=3213->guuid=545e386b-1800-0000-152d-22a08e0c0000 pid=3214 clone guuid=545e386b-1800-0000-152d-22a08e0c0000 pid=3214->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B 2ac2249c-25bc-5019-a88f-33a6c2731b07 cnc.504.su:56999 guuid=545e386b-1800-0000-152d-22a08e0c0000 pid=3214->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=3f11496b-1800-0000-152d-22a08f0c0000 pid=3215 /tmp/76d32be0 guuid=545e386b-1800-0000-152d-22a08e0c0000 pid=3214->guuid=3f11496b-1800-0000-152d-22a08f0c0000 pid=3215 clone guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216 /tmp/76d32be0 net net-scan send-data zombie guuid=545e386b-1800-0000-152d-22a08e0c0000 pid=3214->guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216 clone guuid=eac2546b-1800-0000-152d-22a0910c0000 pid=3217 /tmp/76d32be0 guuid=545e386b-1800-0000-152d-22a08e0c0000 pid=3214->guuid=eac2546b-1800-0000-152d-22a0910c0000 pid=3217 clone guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 93ca08a9-baee-53d1-bbf0-f22df186a9b9 185.18.7.253:23 guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216->93ca08a9-baee-53d1-bbf0-f22df186a9b9 send: 52B b84a2c8b-f468-5be3-89b1-842ac7b95762 94.121.134.98:23 guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216->b84a2c8b-f468-5be3-89b1-842ac7b95762 send: 40B f7f8c601-1616-5c5c-b017-0d09ffbf160d 151.102.130.163:23 guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216->f7f8c601-1616-5c5c-b017-0d09ffbf160d send: 40B guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216|send-data send-data to 4093 IP addresses review logs to see them all guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216->guuid=d96d4e6b-1800-0000-152d-22a0900c0000 pid=3216|send-data send 4bcd05e0-7ebf-53bb-9cc8-c008d3256770 cnc.504.su:80 guuid=49cd606b-1800-0000-152d-22a0920c0000 pid=3218->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 198B guuid=3c8e8078-1800-0000-152d-22a09c0c0000 pid=3228->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 send: 147B guuid=96edb784-1800-0000-152d-22a0ac0c0000 pid=3244->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 5fbefa0b-74db-5ddb-909f-7c8f89ca1384 0.0.0.0:46157 guuid=96edb784-1800-0000-152d-22a0ac0c0000 pid=3244->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=8f43f0c8-1c00-0000-152d-22a07a140000 pid=5242 /tmp/76d32be0 dns net send-data zombie guuid=96edb784-1800-0000-152d-22a0ac0c0000 pid=3244->guuid=8f43f0c8-1c00-0000-152d-22a07a140000 pid=5242 clone guuid=8f43f0c8-1c00-0000-152d-22a07a140000 pid=5242->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 28B guuid=8f43f0c8-1c00-0000-152d-22a07a140000 pid=5242->2ac2249c-25bc-5019-a88f-33a6c2731b07 con guuid=699cfdc8-1c00-0000-152d-22a07b140000 pid=5243 /tmp/76d32be0 guuid=8f43f0c8-1c00-0000-152d-22a07a140000 pid=5242->guuid=699cfdc8-1c00-0000-152d-22a07b140000 pid=5243 clone guuid=173802c9-1c00-0000-152d-22a07d140000 pid=5245 /tmp/76d32be0 net net-scan send-data zombie guuid=8f43f0c8-1c00-0000-152d-22a07a140000 pid=5242->guuid=173802c9-1c00-0000-152d-22a07d140000 pid=5245 clone guuid=1eab0dc9-1c00-0000-152d-22a07e140000 pid=5246 /tmp/76d32be0 guuid=8f43f0c8-1c00-0000-152d-22a07a140000 pid=5242->guuid=1eab0dc9-1c00-0000-152d-22a07e140000 pid=5246 clone guuid=e9b201c9-1c00-0000-152d-22a07c140000 pid=5244->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=173802c9-1c00-0000-152d-22a07d140000 pid=5245->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=173802c9-1c00-0000-152d-22a07d140000 pid=5245|send-data send-data to 4097 IP addresses review logs to see them all guuid=173802c9-1c00-0000-152d-22a07d140000 pid=5245->guuid=173802c9-1c00-0000-152d-22a07d140000 pid=5245|send-data send guuid=51d043cb-1c00-0000-152d-22a07f140000 pid=5247->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=7b964ad3-1c00-0000-152d-22a082140000 pid=5250->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7b964ad3-1c00-0000-152d-22a082140000 pid=5250->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=e857bc15-2100-0000-152d-22a0d6140000 pid=5334 /tmp/76d32be0 net send-data zombie guuid=7b964ad3-1c00-0000-152d-22a082140000 pid=5250->guuid=e857bc15-2100-0000-152d-22a0d6140000 pid=5334 clone guuid=e857bc15-2100-0000-152d-22a0d6140000 pid=5334->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=4f2dc915-2100-0000-152d-22a0d7140000 pid=5335 /tmp/76d32be0 guuid=e857bc15-2100-0000-152d-22a0d6140000 pid=5334->guuid=4f2dc915-2100-0000-152d-22a0d7140000 pid=5335 clone guuid=6f73cd15-2100-0000-152d-22a0d9140000 pid=5337 /tmp/76d32be0 net net-scan send-data zombie guuid=e857bc15-2100-0000-152d-22a0d6140000 pid=5334->guuid=6f73cd15-2100-0000-152d-22a0d9140000 pid=5337 clone guuid=09c2d115-2100-0000-152d-22a0da140000 pid=5338 /tmp/76d32be0 guuid=e857bc15-2100-0000-152d-22a0d6140000 pid=5334->guuid=09c2d115-2100-0000-152d-22a0da140000 pid=5338 clone guuid=9bd8ca15-2100-0000-152d-22a0d8140000 pid=5336->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=6f73cd15-2100-0000-152d-22a0d9140000 pid=5337->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6f73cd15-2100-0000-152d-22a0d9140000 pid=5337|send-data send-data to 4097 IP addresses review logs to see them all guuid=6f73cd15-2100-0000-152d-22a0d9140000 pid=5337->guuid=6f73cd15-2100-0000-152d-22a0d9140000 pid=5337|send-data send guuid=119ff916-2100-0000-152d-22a0db140000 pid=5339->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=22cbde19-2100-0000-152d-22a0de140000 pid=5342->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=22cbde19-2100-0000-152d-22a0de140000 pid=5342->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=26901758-2500-0000-152d-22a0df140000 pid=5343 /tmp/76d32be0 net send-data zombie guuid=22cbde19-2100-0000-152d-22a0de140000 pid=5342->guuid=26901758-2500-0000-152d-22a0df140000 pid=5343 clone guuid=26901758-2500-0000-152d-22a0df140000 pid=5343->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=11112958-2500-0000-152d-22a0e0140000 pid=5344 /tmp/76d32be0 guuid=26901758-2500-0000-152d-22a0df140000 pid=5343->guuid=11112958-2500-0000-152d-22a0e0140000 pid=5344 clone guuid=8e123058-2500-0000-152d-22a0e2140000 pid=5346 /tmp/76d32be0 net net-scan send-data zombie guuid=26901758-2500-0000-152d-22a0df140000 pid=5343->guuid=8e123058-2500-0000-152d-22a0e2140000 pid=5346 clone guuid=5ebf3a58-2500-0000-152d-22a0e3140000 pid=5347 /tmp/76d32be0 guuid=26901758-2500-0000-152d-22a0df140000 pid=5343->guuid=5ebf3a58-2500-0000-152d-22a0e3140000 pid=5347 clone guuid=53172c58-2500-0000-152d-22a0e1140000 pid=5345->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=8e123058-2500-0000-152d-22a0e2140000 pid=5346->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8e123058-2500-0000-152d-22a0e2140000 pid=5346|send-data send-data to 4097 IP addresses review logs to see them all guuid=8e123058-2500-0000-152d-22a0e2140000 pid=5346->guuid=8e123058-2500-0000-152d-22a0e2140000 pid=5346|send-data send guuid=08580e59-2500-0000-152d-22a0e4140000 pid=5348->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=b861c85b-2500-0000-152d-22a0e7140000 pid=5351->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=b861c85b-2500-0000-152d-22a0e7140000 pid=5351->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con guuid=d807859a-2900-0000-152d-22a0e8140000 pid=5352 /tmp/76d32be0 net send-data zombie guuid=b861c85b-2500-0000-152d-22a0e7140000 pid=5351->guuid=d807859a-2900-0000-152d-22a0e8140000 pid=5352 clone guuid=d807859a-2900-0000-152d-22a0e8140000 pid=5352->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 56B guuid=eda9919a-2900-0000-152d-22a0e9140000 pid=5353 /tmp/76d32be0 guuid=d807859a-2900-0000-152d-22a0e8140000 pid=5352->guuid=eda9919a-2900-0000-152d-22a0e9140000 pid=5353 clone guuid=589f969a-2900-0000-152d-22a0eb140000 pid=5355 /tmp/76d32be0 net net-scan send-data zombie guuid=d807859a-2900-0000-152d-22a0e8140000 pid=5352->guuid=589f969a-2900-0000-152d-22a0eb140000 pid=5355 clone guuid=de129c9a-2900-0000-152d-22a0ec140000 pid=5356 /tmp/76d32be0 guuid=d807859a-2900-0000-152d-22a0e8140000 pid=5352->guuid=de129c9a-2900-0000-152d-22a0ec140000 pid=5356 clone guuid=3b23939a-2900-0000-152d-22a0ea140000 pid=5354->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=589f969a-2900-0000-152d-22a0eb140000 pid=5355->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=589f969a-2900-0000-152d-22a0eb140000 pid=5355|send-data send-data to 3072 IP addresses review logs to see them all guuid=589f969a-2900-0000-152d-22a0eb140000 pid=5355->guuid=589f969a-2900-0000-152d-22a0eb140000 pid=5355|send-data send guuid=72dcb39b-2900-0000-152d-22a0ed140000 pid=5357->4bcd05e0-7ebf-53bb-9cc8-c008d3256770 con guuid=23263e9f-2900-0000-152d-22a0f0140000 pid=5360->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=23263e9f-2900-0000-152d-22a0f0140000 pid=5360->5fbefa0b-74db-5ddb-909f-7c8f89ca1384 con
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e57509531ccf9d33a996908a1230c0f9552cbb3a307279aab1df6b5acf88b34f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e57509531ccf9d33a996908a1230c0f9552cbb3a307279aab1df6b5acf88b34f/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-10-12 11:23:05 UTC
File Type:
Text (Shell)
AV detection:
18 of 24 (75.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4v2qsuy4z6othkmwscfbemga7fkszoz2gbzhtkvr35vvvt4iwnhq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:unstable antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251012-nnwbkatmv5/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
UPX packed file
Enumerates active TCP sockets
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (55023) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware Config
C2 Extraction:
cnc.504.su
scan.504.su
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e57509531ccf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e57509531ccf9d33a996908a1230c0f9552cbb3a307279aab1df6b5acf88b34f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh e57509531ccf9d33a996908a1230c0f9552cbb3a307279aab1df6b5acf88b34f

(this sample)

Mirai

elf 924b4daa3d183fc7d1312a17b68aa952c8d0136918478730cd95623bb1890ed9

  
URLhaus
https://urlhaus.abuse.ch/url/3669657/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3669690/
  
URLhaus
https://urlhaus.abuse.ch/url/3669717/
  
Dropping
MD5 e4e48028a8e278bd6b7a9296154dcb51
  
Dropping
SHA256 924b4daa3d183fc7d1312a17b68aa952c8d0136918478730cd95623bb1890ed9

Comments