MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4648fe36ec5436818619692859b48bb0b48442270eed73d6d0e4db7a9564a318. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4648fe36ec5436818619692859b48bb0b48442270eed73d6d0e4db7a9564a318
SHA3-384 hash: 3e281c0bb1a84e74171349addb370f34a8941881213e0adecb8dbd8ee78f8b7a451bbb0290f7709da37e7ca4a7a4ef4c
SHA1 hash: 3efe745c15c6d8a8b1cb6e97e60475f770ee7cb7
MD5 hash: e5c767508f883181066335a239ae0e34
humanhash: sixteen-arizona-beer-three
File name:dr.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'274 bytes
First seen:2025-11-23 17:18:45 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:pIydqsSaanhYapwMZBkZhVCR27AF3OHeENnuXxwhE:pTgLleaGuBWhIADUW6
TLSH T1B541FDED02802B3A31058A25A3E755AC9C5A8FD1B14B17ACD5897C2B8C0F71C7BF9D87
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://94.154.35.154/powerpc.uhavenobotsxdbf2f4e207fff4e2c8d5c0af99fe91750e3cf7c8d8cc425116a99bfede80097a3 Miraielf geofenced mirai PowerPC ua-wget USA
http://94.154.35.154/mips.uhavenobotsxdbd01008034661874e60f933eae3f615035b399696ec81bc9b6613d6864a95082 Miraielf geofenced mips mirai ua-wget USA
http://94.154.35.154/mipsel.uhavenobotsxd1ad76c837935535dcab64e5b868e154ead29aab26fb6cb415d2a6d3574b61416 Miraielf geofenced mips mirai ua-wget USA
http://94.154.35.154/arm.uhavenobotsxdedb1379d31f273bdc49f66111b5418dce65340c5cffda5d1a25b3f61c796e9de Miraiarm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm5.uhavenobotsxd55ffc58940a68ebd8ceb420c2f76ce0c6203a70a32c7eeefbc054c60a5b547ce Miraiarm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm6.uhavenobotsxd7c784b4c8da1e633611224bf67fea2760556564e3fa200d00a6c866a39767a9a Miraiarm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm7.uhavenobotsxd5563a5a7ddfa4ed29b594e9b1f0c7c528c1d6f398caf7bc80cfb4a883700dfe4 Miraiarm elf geofenced mirai ua-wget USA
http://94.154.35.154/sparc.uhavenobotsxdn/an/aelf ua-wget
http://94.154.35.154/m68k.uhavenobotsxdn/an/aelf ua-wget
http://94.154.35.154/sh4.uhavenobotsxdn/an/aelf ua-wget
http://94.154.35.154/x86_64.uhavenobotsxd4591c54052c787376ea64aae9e4297bedf835551d9e1c7db3c2e5e3f90bff02a Miraielf geofenced mirai ua-wget USA x86
http://94.154.35.154/x86_32.uhavenobotsxd207c44dc24b64ccb863ffd5a2678512115891ec6645b18e74f3804d872f9d381 Miraielf geofenced mirai ua-wget USA x86

Intelligence

File Origin
# of uploads :
1
# of downloads :
35
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive medusa mirai
Link:
https://www.filescan.io/uploads/69234216f96b58f0dc80ee5a/reports/40c29f39-c539-453c-974b-560d7de4296e/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-23T16:32:00Z UTC
Last seen:
2025-11-23T20:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4648fe36ec5436818619692859b48bb0b48442270eed73d6d0e4db7a9564a318/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4648fe36ec5436818619692859b48bb0b48442270eed73d6d0e4db7a9564a318
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4648fe36ec5436818619692859b48bb0b48442270eed73d6d0e4db7a9564a318/
Threat name:
Linux.Trojan.Geninst
Create hunting rule
Status:
Malicious
First seen:
2025-11-23 17:19:18 UTC
File Type:
Text (Shell)
AV detection:
18 of 36 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=izep4nxmkq3idbqzneuftnelwc2iiqrhb3wxhvwq4tnxvfleumma._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/251123-vvytlavjap/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4648fe36ec54/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4648fe36ec5436818619692859b48bb0b48442270eed73d6d0e4db7a9564a318

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 4648fe36ec5436818619692859b48bb0b48442270eed73d6d0e4db7a9564a318

(this sample)

Mirai

elf a7906586bfddb6e83e11bd9e899a33a1090d7a217b64b7ad2b3261f733e85c2f

  
URLhaus
https://urlhaus.abuse.ch/url/3715229/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d627feec3d05508f7e93e145ced60faf
  
Dropping
SHA256 a7906586bfddb6e83e11bd9e899a33a1090d7a217b64b7ad2b3261f733e85c2f

Comments