MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fde80d47bd425ed2d0f6249b78e2222e6476d6dc47d0d74106ea92c771666d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fde80d47bd425ed2d0f6249b78e2222e6476d6dc47d0d74106ea92c771666d7
SHA3-384 hash: 8e046289720112fc555016ff135b1d46af8dcb8ed01400d2a463084eea8852c93d48f38eab6373b633c8b95f9f126a12
SHA1 hash: ec49a8b7c3fa8530b1f5f660d67403af6cabd0d0
MD5 hash: 671703e05e95963f5ce7c224d4bac6f4
humanhash: twelve-december-idaho-comet
File name:x
Download: download sample
Signature Mirai
Create hunting rule
File size:600 bytes
First seen:2026-05-20 16:41:06 UTC
Last seen:2026-05-21 04:52:04 UTC
File type: sh
MIME type:text/plain
ssdeep 12:5Imi+30LK2XYmi+SOmi+KNIl5+mi+YjmiyUJM/miyoqZjYmiJFmiTIt:BKKqq9yNI7NdD25DoGzGwXt
TLSH T117F0DCBFB42019A34D68DE0FB1F70ACC9114E3C89162DBDCBC58447BA0A9E08B454F9A
Magika txt
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://cdn-assets.xyz/arm7n/an/abotnetdomain mirai opendir
http://cdn-assets.xyz/arm5n/an/abotnetdomain mirai opendir
http://cdn-assets.xyz/arm6444dded915bc90218c3920b71f289b23aaf6e26c078dd44ab09561d707ac6161 Miraibotnetdomain mirai opendir
http://cdn-assets.xyz/armn/an/abotnetdomain mirai opendir
http://cdn-assets.xyz/mipsn/an/abotnetdomain mirai opendir
http://cdn-assets.xyz/mpsln/an/abotnetdomain mirai opendir
http://cdn-assets.xyz/x86ad5321bf0b55b159b503001e39150f3b14529a217321fa5b1c96d9d442444b64 Miraibotnetdomain mirai opendir
http://cdn-assets.xyz/x86_64n/an/abotnetdomain mirai opendir

Intelligence

File Origin
# of uploads :
268
# of downloads :
8
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.37.8771.20167.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
text
First seen:
2026-05-20T15:00:00Z UTC
Last seen:
2026-05-20T15:25:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0fde80d47bd425ed2d0f6249b78e2222e6476d6dc47d0d74106ea92c771666d7/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/39b5ad89-3dbb-453d-9172-51fff075b08b
Behavior Graph:
Download SVG
%3 guuid=e3de6bdc-1b00-0000-bbae-4299d50b0000 pid=3029 /usr/bin/sudo guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039 /tmp/sample.bin guuid=e3de6bdc-1b00-0000-bbae-4299d50b0000 pid=3029->guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039 execve guuid=4112ccdf-1b00-0000-bbae-4299e10b0000 pid=3041 /usr/bin/wget dns net send-data guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=4112ccdf-1b00-0000-bbae-4299e10b0000 pid=3041 execve guuid=da0014e7-1b00-0000-bbae-4299f30b0000 pid=3059 /usr/bin/chmod guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=da0014e7-1b00-0000-bbae-4299f30b0000 pid=3059 execve guuid=796885e7-1b00-0000-bbae-4299f50b0000 pid=3061 /usr/bin/dash guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=796885e7-1b00-0000-bbae-4299f50b0000 pid=3061 clone guuid=f1749ee7-1b00-0000-bbae-4299f60b0000 pid=3062 /usr/bin/rm guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=f1749ee7-1b00-0000-bbae-4299f60b0000 pid=3062 execve guuid=2949f6e7-1b00-0000-bbae-4299f70b0000 pid=3063 /usr/bin/wget dns net send-data guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=2949f6e7-1b00-0000-bbae-4299f70b0000 pid=3063 execve guuid=d5b2dbec-1b00-0000-bbae-4299020c0000 pid=3074 /usr/bin/chmod guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=d5b2dbec-1b00-0000-bbae-4299020c0000 pid=3074 execve guuid=3cf55bed-1b00-0000-bbae-4299050c0000 pid=3077 /usr/bin/dash guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=3cf55bed-1b00-0000-bbae-4299050c0000 pid=3077 clone guuid=9d8b8aed-1b00-0000-bbae-4299060c0000 pid=3078 /usr/bin/rm guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=9d8b8aed-1b00-0000-bbae-4299060c0000 pid=3078 execve guuid=dcdad6ed-1b00-0000-bbae-4299080c0000 pid=3080 /usr/bin/wget dns net send-data guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=dcdad6ed-1b00-0000-bbae-4299080c0000 pid=3080 execve guuid=441deef2-1b00-0000-bbae-4299120c0000 pid=3090 /usr/bin/chmod guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=441deef2-1b00-0000-bbae-4299120c0000 pid=3090 execve guuid=07d77ef3-1b00-0000-bbae-4299140c0000 pid=3092 /usr/bin/dash guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=07d77ef3-1b00-0000-bbae-4299140c0000 pid=3092 clone guuid=98ccb8f3-1b00-0000-bbae-4299150c0000 pid=3093 /usr/bin/rm guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=98ccb8f3-1b00-0000-bbae-4299150c0000 pid=3093 execve guuid=ec9b05f4-1b00-0000-bbae-4299170c0000 pid=3095 /usr/bin/wget dns net send-data guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=ec9b05f4-1b00-0000-bbae-4299170c0000 pid=3095 execve guuid=6bc492f8-1b00-0000-bbae-4299240c0000 pid=3108 /usr/bin/chmod guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=6bc492f8-1b00-0000-bbae-4299240c0000 pid=3108 execve guuid=b200daf8-1b00-0000-bbae-4299260c0000 pid=3110 /usr/bin/dash guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=b200daf8-1b00-0000-bbae-4299260c0000 pid=3110 clone guuid=765ae6f8-1b00-0000-bbae-4299270c0000 pid=3111 /usr/bin/rm guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=765ae6f8-1b00-0000-bbae-4299270c0000 pid=3111 execve guuid=491127f9-1b00-0000-bbae-4299290c0000 pid=3113 /usr/bin/wget dns net send-data guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=491127f9-1b00-0000-bbae-4299290c0000 pid=3113 execve guuid=c1f194fd-1b00-0000-bbae-4299360c0000 pid=3126 /usr/bin/chmod guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=c1f194fd-1b00-0000-bbae-4299360c0000 pid=3126 execve guuid=613adcfd-1b00-0000-bbae-4299380c0000 pid=3128 /usr/bin/dash guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=613adcfd-1b00-0000-bbae-4299380c0000 pid=3128 clone guuid=0db5e2fd-1b00-0000-bbae-4299390c0000 pid=3129 /usr/bin/rm guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=0db5e2fd-1b00-0000-bbae-4299390c0000 pid=3129 execve guuid=4d5022fe-1b00-0000-bbae-42993b0c0000 pid=3131 /usr/bin/wget dns net send-data guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=4d5022fe-1b00-0000-bbae-42993b0c0000 pid=3131 execve guuid=f21a9c02-1c00-0000-bbae-4299480c0000 pid=3144 /usr/bin/chmod guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=f21a9c02-1c00-0000-bbae-4299480c0000 pid=3144 execve guuid=eb3e1503-1c00-0000-bbae-42994a0c0000 pid=3146 /usr/bin/dash guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=eb3e1503-1c00-0000-bbae-42994a0c0000 pid=3146 clone guuid=df7c3603-1c00-0000-bbae-42994c0c0000 pid=3148 /usr/bin/rm guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=df7c3603-1c00-0000-bbae-42994c0c0000 pid=3148 execve guuid=36a0b403-1c00-0000-bbae-42994e0c0000 pid=3150 /usr/bin/wget dns net send-data guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=36a0b403-1c00-0000-bbae-42994e0c0000 pid=3150 execve guuid=ce48ed08-1c00-0000-bbae-42995e0c0000 pid=3166 /usr/bin/chmod guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=ce48ed08-1c00-0000-bbae-42995e0c0000 pid=3166 execve guuid=c4832c09-1c00-0000-bbae-4299600c0000 pid=3168 /usr/bin/dash guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=c4832c09-1c00-0000-bbae-4299600c0000 pid=3168 clone guuid=73893909-1c00-0000-bbae-4299610c0000 pid=3169 /usr/bin/rm guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=73893909-1c00-0000-bbae-4299610c0000 pid=3169 execve guuid=5ba97809-1c00-0000-bbae-4299630c0000 pid=3171 /usr/bin/wget dns net send-data guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=5ba97809-1c00-0000-bbae-4299630c0000 pid=3171 execve guuid=7ca80d0e-1c00-0000-bbae-4299720c0000 pid=3186 /usr/bin/chmod guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=7ca80d0e-1c00-0000-bbae-4299720c0000 pid=3186 execve guuid=8df6680e-1c00-0000-bbae-4299740c0000 pid=3188 /usr/bin/dash guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=8df6680e-1c00-0000-bbae-4299740c0000 pid=3188 clone guuid=af36740e-1c00-0000-bbae-4299750c0000 pid=3189 /usr/bin/rm guuid=45a33edf-1b00-0000-bbae-4299df0b0000 pid=3039->guuid=af36740e-1c00-0000-bbae-4299750c0000 pid=3189 execve 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=4112ccdf-1b00-0000-bbae-4299e10b0000 pid=3041->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=2949f6e7-1b00-0000-bbae-4299f70b0000 pid=3063->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=dcdad6ed-1b00-0000-bbae-4299080c0000 pid=3080->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=ec9b05f4-1b00-0000-bbae-4299170c0000 pid=3095->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=491127f9-1b00-0000-bbae-4299290c0000 pid=3113->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=4d5022fe-1b00-0000-bbae-42993b0c0000 pid=3131->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=36a0b403-1c00-0000-bbae-42994e0c0000 pid=3150->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=5ba97809-1c00-0000-bbae-4299630c0000 pid=3171->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0fde80d47bd425ed2d0f6249b78e2222e6476d6dc47d0d74106ea92c771666d7
Gathering data
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-05-20 18:35:16 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7pibvd32qs62lipmje3pdrcelteo3lnyr6q25aqn2usy5ywm3lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 0fde80d47bd425ed2d0f6249b78e2222e6476d6dc47d0d74106ea92c771666d7

(this sample)

elf 2c3f814e49ed009187a76d448c92bd1b730817297949906a2fed73d0e2276644

  
URLhaus
https://urlhaus.abuse.ch/url/3850712/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d12ba930315cef53664e9939084cd454
  
Dropping
SHA256 2c3f814e49ed009187a76d448c92bd1b730817297949906a2fed73d0e2276644

Comments