MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 051f723955c59e0b9b3e9c2e6a905d51b7c9df96b7c48a4aaf27c36824846bf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	051f723955c59e0b9b3e9c2e6a905d51b7c9df96b7c48a4aaf27c36824846bf0
SHA3-384 hash:	291cd9866709a77b8de7a7c29892aba490cea3e909167ce77657bfdc5caa746cbf6cc863f6abb9f8f033edac99d645c0
SHA1 hash:	11a6a3f96e504638a2da5efb89e14a13ef9d7291
MD5 hash:	55109e71dc9e4d52333fbbcc5fd5c2be
humanhash:	glucose-triple-mars-blue
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'134 bytes
First seen:	2026-02-26 04:19:42 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:IttsrUykFssd08D8PlJiJL5eNIyksNh3PYonBW:iWrUyYBdX4LiJLwJD3goBW
TLSH	T13E5196CA03C516711DA74966B3A9F5C83DADD0E931821F76DFE824E2084FD18329D6E2
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://62.171.157.4/ambatukam/rizzx.x86	ec40d63ad3d3c57e9bedf02e80df74e203490ef157683c55c9dfd5a9c25cf062	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.mips	8d381277c335a4c2891890afe629066832cf0a06e7e9300eebbc4310c143d23c	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.arc	b870f5b857c3c9a5709ac92cac685c2d44a3467a8613f4f2e8a7b5e0fd81055b	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.i468	n/a	n/a	elf ua-wget
http://62.171.157.4/ambatukam/rizzx.i686	b725da3ea68c7f7f8d65a6317edbfdf87666b05cb3ddbadad7f21b53319e00d9	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.x86_64	8b74d70490a41efea42b0def29787233082d774edee77e2025a5c94ad444e144	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.mpsl	4082310165cad3e26cabb4059aca70a94f3f4d7aa74ac96bd03137b4e933dd42	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.arm	4fb1d8352fd1652e4c4e86be3f4d463bc21428ec8d72b13b9b3ba4cfa809f8fd	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.arm5	e5b5d24a655b99ec545148a571be973d18bc96baa54ade0f40d16094f07b93e4	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.arm6	64e4efd9f521b5445383789dd193014cd9ee7fc5e6b14ad18ab6336ac4af2fc5	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.arm7	00025c1f47120c77ef155e9604b428ef7b1dfb0238ecad7699880609da36d51a	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.ppc	71b3b1e14085f1319d6b6eb24fe9e3dc2ed9c09b5c183b4f4516172d92db4788	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.spc	6bd0e06ed81dce408653097d8ea3195e6bc01e4ea949dae0077d8127bad63ee9	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.m68k	0f5463db83741b388668ab6f1c43ba0daae6c81d6dde65596701ee25e8edec83	Mirai	elf mirai ua-wget
http://62.171.157.4/ambatukam/rizzx.sh4	d54bb43267fb7fe4b8200584d6c131b7f6732daf73a52df33276a0ae2ba8a1e2	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive medusa mirai obfuscated virus

Link:

https://www.filescan.io/uploads/699fca0a10e80629d4f324fb/reports/3304a079-987a-47be-8724-d73235d02b99/overview

Result

Gathering data

Verdict:

Unknown

File Type:

unix shell

Link:

https://opentip.kaspersky.com/051f723955c59e0b9b3e9c2e6a905d51b7c9df96b7c48a4aaf27c36824846bf0/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/623ee79a-9334-4687-bda7-991619525fa4

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/051f723955c59e0b9b3e9c2e6a905d51b7c9df96b7c48a4aaf27c36824846bf0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/051f723955c59e0b9b3e9c2e6a905d51b7c9df96b7c48a4aaf27c36824846bf0/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-02-23 18:18:08 UTC

File Type:

Text (Shell)

AV detection:

20 of 36 (55.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aupxeokvywpaxgz6tqxgvec5kg34tx4ww7ciusvpe7bwqjeenpya._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260226-eyaceaax8f/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/051f723955c5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/051f723955c59e0b9b3e9c2e6a905d51b7c9df96b7c48a4aaf27c36824846bf0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh