🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399
SHA3-384 hash: ec99a2d47113ea183f1d244b2be965f2df0e5ca117c7c04aa021a6089007e2e5734d0d97bcd0a44539562b388d3c60b5
SHA1 hash: 9ba15194373b3296374817a9adcfed2ca9ed60c5
MD5 hash: 0450ad0d94496e174831df51723ccc29
humanhash: football-fix-seven-steak
File name:ok
Download: download sample
Signature Mirai
Create hunting rule
File size:1'608 bytes
First seen:2026-08-20 21:34:18 UTC
Last seen:2026-08-21 13:04:04 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:+mRmg9bKOyDFXZkxsaRprUq6XdWIOixH4EhH:+mRmgxEF07OVxHjH
TLSH T1FF31609F14146B322002DA8D73663448B6CD95EB6D5FD7D4EC480EAA86883CCF266F5D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/5a848fn/an/aua-wget
http://5.182.210.174/1294b8n/an/aua-wget
http://5.182.210.174/597d4bn/an/aua-wget
http://5.182.210.174/b4af73n/an/aua-wget
http://5.182.210.174/85a4f4n/an/aua-wget
http://5.182.210.174/797dffn/an/aua-wget
http://5.182.210.174/7202b4n/an/aua-wget
http://5.182.210.174/370ef8n/an/aua-wget
http://5.182.210.174/c060bdn/an/aua-wget
http://5.182.210.174/8a90f5n/an/aua-wget
http://5.182.210.174/e04f45n/an/aua-wget
http://5.182.210.174/74d9f9n/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
74
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8773140dfb99c1ceb0903e/reports/171b0c02-ed7e-435f-a68e-5f8398a5ff9e/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0dd2d819-6640-4760-84ba-3ffe9268d241
Behavior Graph:
Download SVG
%3 guuid=6a514a03-1700-0000-a8fe-be59960d0000 pid=3478 /usr/bin/sudo guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482 /tmp/sample.bin guuid=6a514a03-1700-0000-a8fe-be59960d0000 pid=3478->guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482 execve guuid=f5ac9005-1700-0000-a8fe-be599c0d0000 pid=3484 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=f5ac9005-1700-0000-a8fe-be599c0d0000 pid=3484 execve guuid=ed123f0c-1700-0000-a8fe-be59b60d0000 pid=3510 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=ed123f0c-1700-0000-a8fe-be59b60d0000 pid=3510 execve guuid=0b513929-1700-0000-a8fe-be59e50d0000 pid=3557 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=0b513929-1700-0000-a8fe-be59e50d0000 pid=3557 execve guuid=6d9cfd29-1700-0000-a8fe-be59e60d0000 pid=3558 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=6d9cfd29-1700-0000-a8fe-be59e60d0000 pid=3558 clone guuid=c9afb02a-1700-0000-a8fe-be59e80d0000 pid=3560 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=c9afb02a-1700-0000-a8fe-be59e80d0000 pid=3560 execve guuid=54d4092b-1700-0000-a8fe-be59e90d0000 pid=3561 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=54d4092b-1700-0000-a8fe-be59e90d0000 pid=3561 execve guuid=b487562b-1700-0000-a8fe-be59ed0d0000 pid=3565 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=b487562b-1700-0000-a8fe-be59ed0d0000 pid=3565 execve guuid=5d04672f-1700-0000-a8fe-be59f80d0000 pid=3576 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=5d04672f-1700-0000-a8fe-be59f80d0000 pid=3576 execve guuid=a3c16834-1700-0000-a8fe-be59030e0000 pid=3587 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=a3c16834-1700-0000-a8fe-be59030e0000 pid=3587 execve guuid=5e44c034-1700-0000-a8fe-be59040e0000 pid=3588 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=5e44c034-1700-0000-a8fe-be59040e0000 pid=3588 clone guuid=6c4b8736-1700-0000-a8fe-be590f0e0000 pid=3599 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=6c4b8736-1700-0000-a8fe-be590f0e0000 pid=3599 execve guuid=81b3ca36-1700-0000-a8fe-be59130e0000 pid=3603 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=81b3ca36-1700-0000-a8fe-be59130e0000 pid=3603 execve guuid=2ac10437-1700-0000-a8fe-be59140e0000 pid=3604 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=2ac10437-1700-0000-a8fe-be59140e0000 pid=3604 execve guuid=53ba0f3b-1700-0000-a8fe-be59270e0000 pid=3623 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=53ba0f3b-1700-0000-a8fe-be59270e0000 pid=3623 execve guuid=be835340-1700-0000-a8fe-be593e0e0000 pid=3646 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=be835340-1700-0000-a8fe-be593e0e0000 pid=3646 execve guuid=90ced840-1700-0000-a8fe-be59400e0000 pid=3648 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=90ced840-1700-0000-a8fe-be59400e0000 pid=3648 clone guuid=8482ae42-1700-0000-a8fe-be59470e0000 pid=3655 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=8482ae42-1700-0000-a8fe-be59470e0000 pid=3655 execve guuid=19b7564d-1700-0000-a8fe-be594e0e0000 pid=3662 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=19b7564d-1700-0000-a8fe-be594e0e0000 pid=3662 execve guuid=c9edb54d-1700-0000-a8fe-be59500e0000 pid=3664 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=c9edb54d-1700-0000-a8fe-be59500e0000 pid=3664 execve guuid=af35ba53-1700-0000-a8fe-be59610e0000 pid=3681 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=af35ba53-1700-0000-a8fe-be59610e0000 pid=3681 execve guuid=1a75a159-1700-0000-a8fe-be59830e0000 pid=3715 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=1a75a159-1700-0000-a8fe-be59830e0000 pid=3715 execve guuid=dfeff959-1700-0000-a8fe-be59890e0000 pid=3721 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=dfeff959-1700-0000-a8fe-be59890e0000 pid=3721 clone guuid=9007fd5a-1700-0000-a8fe-be598d0e0000 pid=3725 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=9007fd5a-1700-0000-a8fe-be598d0e0000 pid=3725 execve guuid=7fa7055f-1700-0000-a8fe-be59900e0000 pid=3728 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=7fa7055f-1700-0000-a8fe-be59900e0000 pid=3728 execve guuid=3bb7c95f-1700-0000-a8fe-be59920e0000 pid=3730 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=3bb7c95f-1700-0000-a8fe-be59920e0000 pid=3730 execve guuid=83c78e66-1700-0000-a8fe-be59a50e0000 pid=3749 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=83c78e66-1700-0000-a8fe-be59a50e0000 pid=3749 execve guuid=58be9271-1700-0000-a8fe-be59bc0e0000 pid=3772 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=58be9271-1700-0000-a8fe-be59bc0e0000 pid=3772 execve guuid=4e3fd871-1700-0000-a8fe-be59bd0e0000 pid=3773 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=4e3fd871-1700-0000-a8fe-be59bd0e0000 pid=3773 clone guuid=d7c36272-1700-0000-a8fe-be59c00e0000 pid=3776 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=d7c36272-1700-0000-a8fe-be59c00e0000 pid=3776 execve guuid=d2bfc774-1700-0000-a8fe-be59c30e0000 pid=3779 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=d2bfc774-1700-0000-a8fe-be59c30e0000 pid=3779 execve guuid=23ab2575-1700-0000-a8fe-be59c40e0000 pid=3780 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=23ab2575-1700-0000-a8fe-be59c40e0000 pid=3780 execve guuid=332c8879-1700-0000-a8fe-be59cd0e0000 pid=3789 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=332c8879-1700-0000-a8fe-be59cd0e0000 pid=3789 execve guuid=35f7b27f-1700-0000-a8fe-be59e50e0000 pid=3813 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=35f7b27f-1700-0000-a8fe-be59e50e0000 pid=3813 execve guuid=a59af27f-1700-0000-a8fe-be59e60e0000 pid=3814 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=a59af27f-1700-0000-a8fe-be59e60e0000 pid=3814 clone guuid=a13a8480-1700-0000-a8fe-be59ec0e0000 pid=3820 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=a13a8480-1700-0000-a8fe-be59ec0e0000 pid=3820 execve guuid=ec70d580-1700-0000-a8fe-be59ee0e0000 pid=3822 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=ec70d580-1700-0000-a8fe-be59ee0e0000 pid=3822 execve guuid=7b851b81-1700-0000-a8fe-be59f00e0000 pid=3824 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=7b851b81-1700-0000-a8fe-be59f00e0000 pid=3824 execve guuid=10d87789-1700-0000-a8fe-be59fb0e0000 pid=3835 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=10d87789-1700-0000-a8fe-be59fb0e0000 pid=3835 execve guuid=bc9ec094-1700-0000-a8fe-be59fd0e0000 pid=3837 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=bc9ec094-1700-0000-a8fe-be59fd0e0000 pid=3837 execve guuid=f45cb696-1700-0000-a8fe-be59070f0000 pid=3847 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=f45cb696-1700-0000-a8fe-be59070f0000 pid=3847 clone guuid=78c2e897-1700-0000-a8fe-be590f0f0000 pid=3855 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=78c2e897-1700-0000-a8fe-be590f0f0000 pid=3855 execve guuid=bbfe3598-1700-0000-a8fe-be59110f0000 pid=3857 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=bbfe3598-1700-0000-a8fe-be59110f0000 pid=3857 execve guuid=578d9f98-1700-0000-a8fe-be59130f0000 pid=3859 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=578d9f98-1700-0000-a8fe-be59130f0000 pid=3859 execve guuid=f33be79f-1700-0000-a8fe-be591a0f0000 pid=3866 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=f33be79f-1700-0000-a8fe-be591a0f0000 pid=3866 execve guuid=3a2388a5-1700-0000-a8fe-be59290f0000 pid=3881 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=3a2388a5-1700-0000-a8fe-be59290f0000 pid=3881 execve guuid=f69fe5a5-1700-0000-a8fe-be592b0f0000 pid=3883 /home/sandbox/370ef8 net guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=f69fe5a5-1700-0000-a8fe-be592b0f0000 pid=3883 execve guuid=bb1d2da6-1700-0000-a8fe-be592e0f0000 pid=3886 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=bb1d2da6-1700-0000-a8fe-be592e0f0000 pid=3886 execve guuid=acf798a6-1700-0000-a8fe-be59330f0000 pid=3891 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=acf798a6-1700-0000-a8fe-be59330f0000 pid=3891 execve guuid=035c2da7-1700-0000-a8fe-be59360f0000 pid=3894 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=035c2da7-1700-0000-a8fe-be59360f0000 pid=3894 execve guuid=c3c727ae-1700-0000-a8fe-be59450f0000 pid=3909 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=c3c727ae-1700-0000-a8fe-be59450f0000 pid=3909 execve guuid=cd74d0b5-1700-0000-a8fe-be595b0f0000 pid=3931 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=cd74d0b5-1700-0000-a8fe-be595b0f0000 pid=3931 execve guuid=450339b6-1700-0000-a8fe-be595d0f0000 pid=3933 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=450339b6-1700-0000-a8fe-be595d0f0000 pid=3933 clone guuid=0c880bb7-1700-0000-a8fe-be59630f0000 pid=3939 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=0c880bb7-1700-0000-a8fe-be59630f0000 pid=3939 execve guuid=f6a791bb-1700-0000-a8fe-be59750f0000 pid=3957 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=f6a791bb-1700-0000-a8fe-be59750f0000 pid=3957 execve guuid=8376f0bb-1700-0000-a8fe-be59770f0000 pid=3959 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=8376f0bb-1700-0000-a8fe-be59770f0000 pid=3959 execve guuid=f5582cc0-1700-0000-a8fe-be59840f0000 pid=3972 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=f5582cc0-1700-0000-a8fe-be59840f0000 pid=3972 execve guuid=0328bec7-1700-0000-a8fe-be59960f0000 pid=3990 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=0328bec7-1700-0000-a8fe-be59960f0000 pid=3990 execve guuid=d0ad12c8-1700-0000-a8fe-be59970f0000 pid=3991 /home/sandbox/8a90f5 net guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=d0ad12c8-1700-0000-a8fe-be59970f0000 pid=3991 execve guuid=23693fc8-1700-0000-a8fe-be59990f0000 pid=3993 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=23693fc8-1700-0000-a8fe-be59990f0000 pid=3993 execve guuid=1778a1c8-1700-0000-a8fe-be599d0f0000 pid=3997 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=1778a1c8-1700-0000-a8fe-be599d0f0000 pid=3997 execve guuid=7dbd04c9-1700-0000-a8fe-be59a00f0000 pid=4000 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=7dbd04c9-1700-0000-a8fe-be59a00f0000 pid=4000 execve guuid=082a12cd-1700-0000-a8fe-be59ad0f0000 pid=4013 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=082a12cd-1700-0000-a8fe-be59ad0f0000 pid=4013 execve guuid=5bbf29d3-1700-0000-a8fe-be59bf0f0000 pid=4031 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=5bbf29d3-1700-0000-a8fe-be59bf0f0000 pid=4031 execve guuid=480674d3-1700-0000-a8fe-be59c10f0000 pid=4033 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=480674d3-1700-0000-a8fe-be59c10f0000 pid=4033 clone guuid=cfd712d4-1700-0000-a8fe-be59c50f0000 pid=4037 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=cfd712d4-1700-0000-a8fe-be59c50f0000 pid=4037 execve guuid=13f7fdd8-1700-0000-a8fe-be59dc0f0000 pid=4060 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=13f7fdd8-1700-0000-a8fe-be59dc0f0000 pid=4060 execve guuid=f8a93ad9-1700-0000-a8fe-be59dd0f0000 pid=4061 /usr/bin/wget net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=f8a93ad9-1700-0000-a8fe-be59dd0f0000 pid=4061 execve guuid=246a77dd-1700-0000-a8fe-be59f10f0000 pid=4081 /usr/bin/curl net send-data write-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=246a77dd-1700-0000-a8fe-be59f10f0000 pid=4081 execve guuid=760ca9e4-1700-0000-a8fe-be5907100000 pid=4103 /usr/bin/chmod guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=760ca9e4-1700-0000-a8fe-be5907100000 pid=4103 execve guuid=a71f19e5-1700-0000-a8fe-be5909100000 pid=4105 /usr/bin/bash guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=a71f19e5-1700-0000-a8fe-be5909100000 pid=4105 clone guuid=6cb60ce6-1700-0000-a8fe-be590d100000 pid=4109 /usr/bin/rm delete-file guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=6cb60ce6-1700-0000-a8fe-be590d100000 pid=4109 execve guuid=7c8072e6-1700-0000-a8fe-be590f100000 pid=4111 /usr/bin/rm guuid=630f3205-1700-0000-a8fe-be599a0d0000 pid=3482->guuid=7c8072e6-1700-0000-a8fe-be590f100000 pid=4111 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=f5ac9005-1700-0000-a8fe-be599c0d0000 pid=3484->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ed123f0c-1700-0000-a8fe-be59b60d0000 pid=3510->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b487562b-1700-0000-a8fe-be59ed0d0000 pid=3565->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5d04672f-1700-0000-a8fe-be59f80d0000 pid=3576->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2ac10437-1700-0000-a8fe-be59140e0000 pid=3604->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=53ba0f3b-1700-0000-a8fe-be59270e0000 pid=3623->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c9edb54d-1700-0000-a8fe-be59500e0000 pid=3664->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=af35ba53-1700-0000-a8fe-be59610e0000 pid=3681->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3bb7c95f-1700-0000-a8fe-be59920e0000 pid=3730->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=83c78e66-1700-0000-a8fe-be59a50e0000 pid=3749->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=23ab2575-1700-0000-a8fe-be59c40e0000 pid=3780->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=332c8879-1700-0000-a8fe-be59cd0e0000 pid=3789->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7b851b81-1700-0000-a8fe-be59f00e0000 pid=3824->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=10d87789-1700-0000-a8fe-be59fb0e0000 pid=3835->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=578d9f98-1700-0000-a8fe-be59130f0000 pid=3859->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f33be79f-1700-0000-a8fe-be591a0f0000 pid=3866->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=f69fe5a5-1700-0000-a8fe-be592b0f0000 pid=3883->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=97021ba6-1700-0000-a8fe-be592d0f0000 pid=3885 /home/sandbox/370ef8 dns net send-data zombie guuid=f69fe5a5-1700-0000-a8fe-be592b0f0000 pid=3883->guuid=97021ba6-1700-0000-a8fe-be592d0f0000 pid=3885 clone guuid=97021ba6-1700-0000-a8fe-be592d0f0000 pid=3885->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=97021ba6-1700-0000-a8fe-be592d0f0000 pid=3885->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 32B 6f4c0fc8-2b4b-5812-8240-30664dda3fb0 kappadocia.net:8080 guuid=97021ba6-1700-0000-a8fe-be592d0f0000 pid=3885->6f4c0fc8-2b4b-5812-8240-30664dda3fb0 send: 9B guuid=a28231a6-1700-0000-a8fe-be592f0f0000 pid=3887 /home/sandbox/370ef8 guuid=97021ba6-1700-0000-a8fe-be592d0f0000 pid=3885->guuid=a28231a6-1700-0000-a8fe-be592f0f0000 pid=3887 clone guuid=e32841a6-1700-0000-a8fe-be59300f0000 pid=3888 /home/sandbox/370ef8 guuid=97021ba6-1700-0000-a8fe-be592d0f0000 pid=3885->guuid=e32841a6-1700-0000-a8fe-be59300f0000 pid=3888 clone guuid=035c2da7-1700-0000-a8fe-be59360f0000 pid=3894->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c3c727ae-1700-0000-a8fe-be59450f0000 pid=3909->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8376f0bb-1700-0000-a8fe-be59770f0000 pid=3959->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f5582cc0-1700-0000-a8fe-be59840f0000 pid=3972->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d0ad12c8-1700-0000-a8fe-be59970f0000 pid=3991->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5b7e37c8-1700-0000-a8fe-be59980f0000 pid=3992 /home/sandbox/8a90f5 dns net send-data zombie guuid=d0ad12c8-1700-0000-a8fe-be59970f0000 pid=3991->guuid=5b7e37c8-1700-0000-a8fe-be59980f0000 pid=3992 clone guuid=5b7e37c8-1700-0000-a8fe-be59980f0000 pid=3992->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=5b7e37c8-1700-0000-a8fe-be59980f0000 pid=3992->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 32B guuid=5b7e37c8-1700-0000-a8fe-be59980f0000 pid=3992->6f4c0fc8-2b4b-5812-8240-30664dda3fb0 send: 9B guuid=166fa8c8-1700-0000-a8fe-be599e0f0000 pid=3998 /home/sandbox/8a90f5 guuid=5b7e37c8-1700-0000-a8fe-be59980f0000 pid=3992->guuid=166fa8c8-1700-0000-a8fe-be599e0f0000 pid=3998 clone guuid=34ecaac8-1700-0000-a8fe-be599f0f0000 pid=3999 /home/sandbox/8a90f5 guuid=5b7e37c8-1700-0000-a8fe-be59980f0000 pid=3992->guuid=34ecaac8-1700-0000-a8fe-be599f0f0000 pid=3999 clone guuid=7dbd04c9-1700-0000-a8fe-be59a00f0000 pid=4000->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=082a12cd-1700-0000-a8fe-be59ad0f0000 pid=4013->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f8a93ad9-1700-0000-a8fe-be59dd0f0000 pid=4061->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=246a77dd-1700-0000-a8fe-be59f10f0000 pid=4081->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-20 21:35:22 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=64rdulowuhrr2n2n7aazj4kb54zufdlvpiz3zpwmnmcdgxmdaomq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260820-1ffx5ayzby/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
kappadocia.net
141.98.10.50
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh f7223a2dd6a1e31d374df80194f141ef33428d757a33bcbecc6b04335d830399

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments