Local reference
Suspicious dependency
Inferred
Mirai SORA SPARC bot with VSE flood: lkxstress.sh4:0x12328
Mirai SORA watchdog-backed VSE bot: lkxstress.sh4:0x12328
Mirai SORA credential bot with reflection DDoS: lkxstress.sh4:0x11934
| 0x0 | 7f454c46010101000000000000000000 | .ELF............ |
| 0x10 | 02002a0001000000a001400034000000 | ..*.......@.4... |
| 0x20 | 44440100090000003400200003002800 | DD......4. ...(. |
| 0x30 | 0d000c00010000000000000000004000 | ..............@. |
| 0x40 | 000040003c3e01003c3e010005000000 | ..@.<>..<>...... |
| 0x50 | 00000100010000000040010000404200 | .........@...@B. |
| 0x60 | 00404200f0030000683b000006000000 | .@B.....h;...... |
| 0x70 | 0000010051e574640000000000000000 | ....Q.td........ |
| 0x80 | 00000000000000000000000007000000 | ................ |
| 0x90 | 04000000c62fe62f224ff36e00a00900 | ....././"O.n.... |
| 0xa0 | 01d102c723012a409800000001d102c7 | ....#.*@........ |
| 0xb0 | 23012a40cc170100e36f264ff66e0b00 | #.*@.....o&O.n.. |
| 0xc0 | f66c0900000000000000000000000000 | .l.............. |
| 0xd0 | 00000000000000000000000000000000 | ................ |
| 0xe0 | 862f962f11d9e62f9061224f1821168f | ././.../.a"O.!.. |
| 0xf0 | f36e0fd8826112622822088d04711228 | .n...a.b("...q.( |
| 0x100 | 0b420900826112622822f88f047109d1 | .B...a.b("...q.. |
| 0x118b4 | 090009000900090009000900c62fe62f | ............././ |
| 0x118c4 | 224ff36e00a0090001d102c723012a40 | "O.n........#.*@ |
| 0x118d4 | 0ce8feffe36f264ff66e0b00f66c0900 | .....o&O.n...l.. |
| 0x118e4 | 5b7564706279706173735f666c6f6f64 | [udpbypass_flood |
| 0x118f4 | 5d20737461727465643a202827256427 | ] started: ('%d' |
| 0x11904 | 290a00000d0a0d0a00000000534e5155 | )...........SNQU |
| 0x11914 | 4552593a203132372e302e302e313a41 | ERY: 127.0.0.1:A |
| 0x11924 | 41414141413a78737672000002000000 | AAAAA:xsvr...... |
| 0x11934 | 4d2d534541524348202a20485454502f | M-SEARCH * HTTP/Mirai SORA credential bot with reflection DDoS |
| 0x11944 | 312e310d0a484f53543a203235352e32 | 1.1..HOST: 255.2IoT reflection bot with static uClibc tables |
| 0x11954 | 35352e3235352e3235353a313930300d | 55.255.255:1900. |
| 0x11964 | 0a4d414e3a2022737364703a64697363 | .MAN: "ssdp:disc |
| 0x11974 | 6f766572220d0a4d583a20310d0a5354 | over"..MX: 1..ST |
| 0x11984 | 3a2075726e3a6469616c2d6d756c7469 | : urn:dial-multi |
| 0x11994 | 73637265656e2d6f72673a7365727669 | screen-org:servi |
| 0x119a4 | 63653a6469616c3a310d0a555345522d | ce:dial:1..USER- |
| 0x119b4 | 4147454e543a20476f6f676c65204368 | AGENT: Google Ch |
| 0x119c4 | 726f6d652f36302e302e333131322e39 | rome/60.0.3112.9 |
| 0x119d4 | 302057696e646f77730d0a0d0a000000 | 0 Windows....... |
| 0x119e4 | 253268687800000072616e646f6d0000 | %2hhx...random.. |
| 0x119f4 | 646e73006e7470007374756e00000000 | dns.ntp.stun.... |
| 0x11a04 | 2f7833382f78464a2f7839332f784944 | /x38/xFJ/x93/xID |
| 0x11a14 | 2f7839412f7833382f78464a2f783933 | /x9A/x38/xFJ/x93 |
| 0x11a24 | 2f7849442f7839412f7833382f78464a | /xID/x9A/x38/xFJ |
| 0x11a34 | 2f7839332f7849442f7839412f783338 | /x93/xID/x9A/x38 |
| 0x11a44 | 2f78464a2f7839332f7849442f783941 | /xFJ/x93/xID/x9A |
| 0x11a54 | 2f7833382f78464a2f7839332f784944 | /x38/xFJ/x93/xID |
| 0x11a64 | 2f7839412f7833382f78464a2f783933 | /x9A/x38/xFJ/x93 |
| 0x11a74 | 2f7849442f7839412f7833382f78464a | /xID/x9A/x38/xFJ |
| 0x11a84 | 2f7839332f7849442f7839412f783338 | /x93/xID/x9A/x38 |
| 0x11a94 | 2f78464a2f7839332f7849442f783941 | /xFJ/x93/xID/x9A |
| 0x11aa4 | 2f7833382f78464a2f | /x38/xFJ/ |
| 0x12204 | 02100108200000000210010820000000 | .... ....... ... |
| 0x12214 | 560000000e0f8c8d8e8f11129392a9aa | V............... |
| 0x12224 | 0e7d7e7f808182838485868788969798 | .}~............. |
| 0x12234 | 999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8 | ................ |
| 0x12244 | 7e7f8081828384969798999a9b9fa0a1 | ~............... |
| 0x12254 | a20000006d616c6c6f630000c006ce30 | ....malloc.....0 |
| 0x12264 | 00000000539b000044520000414e4d57 | ....S...DR..ANMW |
| 0x12274 | 4646585b5543514a4750472200000000 | FFX[UCQJGPG".... |
| 0x12284 | 273c313838540000313a353638315400 | '<188T..1:5681T.Mirai SORA credential bot with reflection DDoS |
| 0x12294 | 272d272031395400273c54007b363d3a | '-' 19T.'<T.{6=: |
| 0x122a4 | 7b3621272d363b2c741b0315061d5400 | {6!'-6;,t.....T. |
| 0x122b4 | 1b0315061d6e74352424383120743a3b | .....nt5$$81 t:; |
| 0x122c4 | 2074323b213a3054000000003a373b26 | t2;!:0T....:7;&Mirai SORA credential brute force with VSE flood |
| 0x122d4 | 26313720540000007b363d3a7b362127 | &17 T...{6=:{6!' |
| 0x122e4 | 2d363b2c74242754000000007b363d3a | -6;,t$'T....{6=: |
| 0x122f4 | 7b3621272d363b2c743f3d383874796d | {6!'-6;,t?=88tym |
| 0x12304 | 745400002d62602d414d0000c2e80528 | tT..-b`-AM.....( |
| 0x12314 | 000000007b323054000000007b393524 | ....{20T....{95$ |
| 0x12324 | 275400007b24263b377b3a31207b2037 | 'T..{$&;7{:1 { 7Mirai SORA SPARC bot with VSE flood |
| 0x12334 | 245400007b2720352021275400000000 | $T..{' 5 !'T.... |
| 0x12344 | 7a353a3d393154007b24263b377b3a31 | z5:=91T.{$&;7{:1Mirai SORA watchdog-backed VSE bot |
| 0x12354 | 207b263b212031540000000035272723 | {&;! 1T....5''# |
| 0x12364 | 3b263054000000007b373930383d3a31 | ;&0T....{7908=:1 |
| 0x12374 | 540000002039247b5400000030352035 | T... 9${T...05 5 |
| 0x12384 | 7b383b373538540025202c363b205400 | {8;758T.% ,6; T. |
| 0x12394 | 7a5400003526395400000000363b2054 | zT..5&9T....6; T |
| 0x123a4 | 000000002c6c625400000000273c6054 | ....,lbT....'<`T |
| 0x123b4 | 00000000393d24275400000039242738 | ....9=$'T...9$'8 |
| 0x123c4 | 54000000273035540000000039203054 | T...'05T....9 0T |
| 0x123d4 | 000000003c353f353d5400007b312037 | ....<5?5=T..{1 7 |
| 0x123e4 | 7b2631273b38227a373b3a3254000000 | {&1';8"z7;:2T... |
| 0x123f4 | 3a353931273126223126745400000000 | :591'1&"1&tT.... |
| 0x12404 | 7b3031227b233520373c303b33540000 | {01"{#5 7<0;3T.. |
| 0x12414 | 7b3031227b393d27377b233520373c30 | {01"{9='7{#5 7<0 |
| 0x12424 | 3b335400243636322a37214500000000 | ;3T.$662*7!E.... |
| 0x12434 | 3b333d3a54000000313a203126540000 | ;3=:T...1: 1&T.. |
| 0x12444 | 6d2165666760606c2165666035216c65 | m!efg``l!ef`5!le |
| 0x12454 | 6030602c6564540028d785f85458a600 | `0`,edT.(...TX.. |
| 0x12464 | 2b64163bf72b47a1c8320000bd914ff6 | +d.;.+G..2....O. |
| 0x12474 | 0edb8c17000000009aea183900000000 | ...........9.... |
| 0x12484 | 6260b4008ef80f210000000088ee1522 | b`.....!......." |
| 0x12494 | 0000000050628843c90000004e629e4c | ....Pb.C....Nb.L |
| 0x124a4 | c90000006a77c400777cc4006e7d752b | ....jw..w|..n}u+ |
| 0x124b4 | 4c62000028d483f64302e4004d7d9449 | Lb..(...C...M}.I |
| 0x124c4 | 8700000012659240d8000000c2e9183b | .....e.@.......; |
| 0x124d4 | 00000000c2fb1c3f00000000e35c7e43 | .......?.....\~C |
| 0x124e4 | 9f83a1132932c8ef00000000d40b59f4 | ....)2........Y. |
| 0x124f4 | f804586e37dd44de632e00002a67ab00 | ..Xn7.D.c...*g.. |
| 0x12579 | 3754003d2627273d5400003621272d36 | 7T.=&''=T..6!'-6 |
| 0x12589 | 3b2c540000000027273c540000000027 | ;,T....''<T....' |
| 0x12599 | 372454000000002031383a3120540024 | 7$T.... 18:1 T.$ |
| 0x125a9 | 31263854000000242d203c3b3a540026 | 1&8T...$- <;:T.& |
| 0x125b9 | 21362d54000000382135540000000033 | !6-T...8!5T....3 |
| 0x125c9 | 3036540000000027202635373154003d | 06T....' &571T.= |
| 0x125d9 | 2420353638312754000000242754003f | $ 5681'T...$'T.? |
| 0x125e9 | 3d383854000000323d3a305400000000 | =88T...2=:0T.... |
| 0x125f9 | 073b2126373174113a333d3a31740521 | .;!&71t.:3=:1t.!Mirai SORA watchdog-backed VSE bot |
| 0x12609 | 31262d5400000072656164646972002f | 1&-T...readdir./ |
| 0x12619 | 70726f630000006f70656e6469720077 | proc...opendir.w |
| 0x12629 | 35713668653364627273676d636c6b69 | 5q6he3dbrsgmclki |
| 0x12639 | 7534746f31386e7061766a3730326600 | u4to18npavj702f. |
| 0x12649 | 0000006162636465666768696a6b6c6d | ...abcdefghijklm |
| 0x12659 | 6e6f707172737475767778797a414243 | nopqrstuvwxyzABC |
| 0x12669 | 4445464748494a4b4c4d4e4f50515253 | DEFGHIJKLMNOPQRS |
| 0x12679 | 5455565758595a000000003230342e31 | TUVWXYZ....204.1Mirai SORA SPARC bot with VSE flood |
| 0x12689 | 302e3139342e36300000000000000100 | 0.194.60........ |
| 0x12699 | 0000004c697374206f66206c6f616465 | ...List of loade |
| 0x126a9 | 64206d6f64756c65730a000925702025 | d modules...%p % |
| 0x126b9 | 702025702025732025642025730a000a | p %p %s %d %s... |
| 0x126c9 | 4d6f64756c657320666f72206170706c | Modules for appl |
| 0x126d9 | 69636174696f6e20282570293a0a0009 | ication (%p):... |
| 0x126e9 | 25702025730a004d6f64756c65732066 | %p %s..Modules f |
| 0x126f9 | 6f722068616e646c652025700a00006d | or handle %p...m |
| 0x12709 | 6d6170206f6620612073706172652070 | map of a spare p |
| 0x12719 | 616765206661696c6564210a0000006f | age failed!....o |
| 0x12729 | 766572666c6f770a000000286e756c6c | verflow....(null |
| 0x12739 | 29000025733a25693a2063616e277420 | )..%s:%i: can't |
| 0x12749 | 6d617020272573270a000025733a2027 | map '%s'...%s: ' |
| 0x12759 | 257327206973206e6f7420616e20454c | %s' is not an EL |
| 0x12769 | 462066696c650a0000000025733a2027 | F file.....%s: ' |
| 0x12779 | 257327206973206e6f7420616e20454c | %s' is not an EL |
| 0x12789 | 4620657865637574 | F execut |
| 0x12dd0 | 3a20000025732573256d0a0000000000 | : ..%s%s%m...... |
| 0x12de0 | 00000000000000000100000000000000 | ................ |
| 0x12df0 | 00000000286e696c290000002b002d00 | ....(nil)...+.-. |
| 0x12e00 | 2000307800305800101010080a0a0a00 | .0x.0X......... |
| 0x12e10 | 686c4c6a7a74715a0002040808000008 | hlLjztqZ........IoT reflection bot with static uClibc tables |
| 0x12e20 | 00000108001f0500000f070802000400 | ................ |
| 0x12e30 | 01000300001005000000070002000400 | ................ |
| 0x12e40 | 010003000001070f1011121315000000 | ................ |
| 0x12e50 | 6e7078586f7564696646654567476141 | npxXoudifFeEgGaA |
| 0x12e60 | 4353637300000000202b302d23274900 | CScs.... +0-#'I. |
| 0x12e70 | 08000500030004000100000200000004 | ................ |
| 0x12e80 | 00080200070007080001010104020101 | ................ |
| 0x12e90 | 01010101556e6b6e6f776e206572726f | ....Unknown erro |
| 0x12ea0 | 7220000053756363657373004f706572 | r ..Success.Oper |
| 0x12eb0 | 6174696f6e206e6f74207065726d6974 | ation not permit |
| 0x12ec0 | 746564004e6f20737563682066696c65 | ted.No such file |
| 0x12ed0 | 206f72206469726563746f7279004e6f | or directory.No |
| 0x12ee0 | 20737563 | suc |
Well-known
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
build
ELF omits compiler metadata (.comment)
Third-party
Identity
| SHA-256 | 65e78491657d59311a840210a20358a1bba58665c7078486cd402aaf37003d62 |
|---|---|
| Filename | lkxstress.sh4 |
| Package | 65e78491657d59311a840210a20358a1bba58665c7078486cd402aaf37003d62 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | linux |
| Domain | abuse.ch |
Timeline
| First seen | 3 Aug 2026 22:02 UTC |
|---|---|
| First analyzed | 4 Aug 2026 10:45 UTC |
| Last analyzed | 4 Aug 2026 10:45 UTC |
| Last updated | 4 Aug 2026 10:45 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 3fe0e |
Not seeing what you expected? Let us know