MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c5ea30fcde6df915cd4409e643eff7347e7e14f9583fc826e885e4b3cc4ee2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	0c5ea30fcde6df915cd4409e643eff7347e7e14f9583fc826e885e4b3cc4ee2f
SHA3-384 hash:	dc871925702fd6309ce55a428b6e18b8ca783ae5f40d9573a2db5ac19b0eadff24ce077e9a5cc743967f8227825d56a8
SHA1 hash:	00de760509c0d12927fd1fb1e81c4031838de819
MD5 hash:	9157fc2fa78d4d89620236286b9c6f83
humanhash:	nine-magnesium-iowa-skylark
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'959 bytes
First seen:	2025-09-08 14:25:27 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:iqPXlPXhmlqPX/PXnElqPXiPXCXlqPXePXePlqPXa7PXazvZlqPXa5PXaFvjlqPM:iWNxmlW33ElWeSXlWKOPlWKTKzvZlWKE
TLSH	T189514DC7135905B96CA3BEF3FDB99E1C31A194D29CE52F0497DC38A5538ED883240A97
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.181.187.146/hiddenbin/Space.arc	706b379019ed7c587ff710ad71631ab34c98d5a940eb3b3e9763f81fc4e75d3d	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.x86	86caef81261bb32ab576ee45160a66053bdfcd8b99a1ee7f455188fd1cc50103	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.x86_64	f9a405ff657c86772a4045393eb390348abdca8070776142c558a4eb02a4e9ca	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.i686	6c8790ff9cb950c2d21f5489caa4819257b2304e73705ac09c7b543efe28692e	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.mips	b23d2d50414db6bc2e16771394709444bd147c4ce499a29cf7f3b50d805d2f40	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.mips64	n/a	n/a	elf ua-wget
http://5.181.187.146/hiddenbin/Space.mpsl	04a1c271d0d4540e47996c858b834a122073472432b8f2bc02e00d6bb9737d4d	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.arm	66272c6e15b69fc04030c45eae8a1cb5e8a4c7fe7051c833390241df4e40c475	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.arm5	53829847624c705a08ffded19e471986484b680c30668c0d27e60dfce384b105	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.arm6	982121ce05d2d24c02f2125f9176bb35582c7abea5431d91f526d5202f926666	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.arm7	43f413167771b2e8f00826e5b67c56018693e33cf157e667026accb61ee49de3	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.ppc	c82679d4ff50aa569fa001661c989ce77241f229825b2dc572d5a0c087f6aa81	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.sparc	n/a	n/a	elf ua-wget
http://5.181.187.146/hiddenbin/Space.m68k	563b8b1e39418368a26b24d84676cd307d56b9be8c7768455b34130e802c253a	Mirai	elf mirai ua-wget
http://5.181.187.146/hiddenbin/Space.sh4	0bd99a672cb125db5a7174ea91ee72a19a78c4070d650f72f03211f2169fec02	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-08T11:53:00Z UTC

Last seen:

2025-09-08T11:53:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen

Link:

https://opentip.kaspersky.com/0c5ea30fcde6df915cd4409e643eff7347e7e14f9583fc826e885e4b3cc4ee2f/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6fd836be-53a5-4aa3-9205-31bfe8fd7b11

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0c5ea30fcde6df915cd4409e643eff7347e7e14f9583fc826e885e4b3cc4ee2f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c5ea30fcde6df915cd4409e643eff7347e7e14f9583fc826e885e4b3cc4ee2f/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/0c5ea30fcde6df915cd4409e643eff7347e7e14f9583fc826e885e4b3cc4ee2f

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-09-08 14:26:28 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=brpkgd6n43pzcxguicpgipx7ond6pykpswb7zatorbpewpge5yxq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250908-rsplcsxxgx/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0c5ea30fcde6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0c5ea30fcde6df915cd4409e643eff7347e7e14f9583fc826e885e4b3cc4ee2f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.