🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4
SHA3-384 hash: ea6cfb282228da1a420829e8f98b6177d3c3ab6a5a378a9c3d33350b033d23a86cba50fbc664d3cfa7cb66efce3b7477
SHA1 hash: 958fa831ea4f5188b6773a5ba3e34ed48f232308
MD5 hash: 595674be8b007f86765a564bd0825c28
humanhash: august-bluebird-uranus-fruit
File name:huawei.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'997 bytes
First seen:2026-10-27 10:26:15 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vW8h9INKS9IP4F97sgg9Ssic9IsJc9UgSb9vYkjNt9gq89g4br9qrz1w5ip9aknK:vW6IlM8Q7SSIVUFJvYmgDg4tg3az
TLSH T1375151C50373CA387A69FC4F3DE79714B580A5915CC2AA98B6EC79EC05CFE29684C147
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://45.66.228.20/bins/mewww.arme46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.arm5e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.arm6e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.arm706044efe3f19c9e3635689c7d817deb6ba4f7ad390fa742d8be17148a59dfa9b Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.x868d681fcd69fb1fbe04ef49e05a8e9f4e3c4505092229313e145879b8435eab4d Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.x86_64375f130b77f559a0e17715bd55d92f60baa0e3122a4d2fdf247e6f2e9755f8b0 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.mips09847bb71dec9bb2b313841cf66ed9ec4908c7352ec9af0c46701378ff5a864c Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.mpsl5f653af0ceb544277300b3e397d4ff706e1a646d6ce488fe9da59914dd714d24 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.ppc0bbdda72a34ad768c003df63b94257dbb9c3a04851524fa7fe47a3e32b296ca4 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.m68kf26b1ca0a3713260c713e1bf8e30b4143f20fd46677170f4fe50495b99d84bc4 Mirai45-66-228-20 elf mirai ua-wget
http://45.66.228.20/bins/mewww.sh4n/an/aelf ua-wget
http://45.66.228.20/bins/mewww.arcn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-27T09:21:00Z UTC
Last seen:
2026-10-27T10:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0f2f5b79-f09b-4902-bd21-8c6cdc83df7d
Behavior Graph:
Download SVG
%3 guuid=ed5a9240-1c00-0000-912b-ed49130c0000 pid=3091 /usr/bin/sudo guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092 /tmp/sample.bin guuid=ed5a9240-1c00-0000-912b-ed49130c0000 pid=3091->guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092 execve guuid=2575fd47-1c00-0000-912b-ed49150c0000 pid=3093 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=2575fd47-1c00-0000-912b-ed49150c0000 pid=3093 execve guuid=569e954f-1c00-0000-912b-ed49220c0000 pid=3106 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=569e954f-1c00-0000-912b-ed49220c0000 pid=3106 execve guuid=402d3f50-1c00-0000-912b-ed49250c0000 pid=3109 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=402d3f50-1c00-0000-912b-ed49250c0000 pid=3109 execve guuid=a3209150-1c00-0000-912b-ed49260c0000 pid=3110 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=a3209150-1c00-0000-912b-ed49260c0000 pid=3110 clone guuid=cdd06f51-1c00-0000-912b-ed49280c0000 pid=3112 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=cdd06f51-1c00-0000-912b-ed49280c0000 pid=3112 execve guuid=6a77a955-1c00-0000-912b-ed492d0c0000 pid=3117 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=6a77a955-1c00-0000-912b-ed492d0c0000 pid=3117 execve guuid=e32a0e56-1c00-0000-912b-ed492f0c0000 pid=3119 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=e32a0e56-1c00-0000-912b-ed492f0c0000 pid=3119 execve guuid=a17a5056-1c00-0000-912b-ed49300c0000 pid=3120 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=a17a5056-1c00-0000-912b-ed49300c0000 pid=3120 clone guuid=82f2e456-1c00-0000-912b-ed49340c0000 pid=3124 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=82f2e456-1c00-0000-912b-ed49340c0000 pid=3124 execve guuid=db194a5b-1c00-0000-912b-ed49350c0000 pid=3125 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=db194a5b-1c00-0000-912b-ed49350c0000 pid=3125 execve guuid=f0ffd45b-1c00-0000-912b-ed49360c0000 pid=3126 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=f0ffd45b-1c00-0000-912b-ed49360c0000 pid=3126 execve guuid=18f1505c-1c00-0000-912b-ed49370c0000 pid=3127 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=18f1505c-1c00-0000-912b-ed49370c0000 pid=3127 clone guuid=1ad1d15e-1c00-0000-912b-ed49390c0000 pid=3129 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=1ad1d15e-1c00-0000-912b-ed49390c0000 pid=3129 execve guuid=d3e62b65-1c00-0000-912b-ed49410c0000 pid=3137 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=d3e62b65-1c00-0000-912b-ed49410c0000 pid=3137 execve guuid=dacaaf65-1c00-0000-912b-ed49420c0000 pid=3138 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=dacaaf65-1c00-0000-912b-ed49420c0000 pid=3138 execve guuid=82712a66-1c00-0000-912b-ed49440c0000 pid=3140 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=82712a66-1c00-0000-912b-ed49440c0000 pid=3140 clone guuid=387eaf66-1c00-0000-912b-ed49460c0000 pid=3142 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=387eaf66-1c00-0000-912b-ed49460c0000 pid=3142 execve guuid=e4e2886a-1c00-0000-912b-ed494a0c0000 pid=3146 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=e4e2886a-1c00-0000-912b-ed494a0c0000 pid=3146 execve guuid=4b6ad26a-1c00-0000-912b-ed494b0c0000 pid=3147 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=4b6ad26a-1c00-0000-912b-ed494b0c0000 pid=3147 execve guuid=b32d226b-1c00-0000-912b-ed494d0c0000 pid=3149 /tmp/ssh-updater guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=b32d226b-1c00-0000-912b-ed494d0c0000 pid=3149 execve guuid=5bb72f6c-1c00-0000-912b-ed49500c0000 pid=3152 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=5bb72f6c-1c00-0000-912b-ed49500c0000 pid=3152 execve guuid=712ae56f-1c00-0000-912b-ed49530c0000 pid=3155 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=712ae56f-1c00-0000-912b-ed49530c0000 pid=3155 execve guuid=a6e64670-1c00-0000-912b-ed49560c0000 pid=3158 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=a6e64670-1c00-0000-912b-ed49560c0000 pid=3158 execve guuid=e6c2b370-1c00-0000-912b-ed49580c0000 pid=3160 /tmp/ssh-updater mprotect-exec guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=e6c2b370-1c00-0000-912b-ed49580c0000 pid=3160 execve guuid=87aee171-1c00-0000-912b-ed495b0c0000 pid=3163 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=87aee171-1c00-0000-912b-ed495b0c0000 pid=3163 execve guuid=82e85678-1c00-0000-912b-ed495c0c0000 pid=3164 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=82e85678-1c00-0000-912b-ed495c0c0000 pid=3164 execve guuid=6563b079-1c00-0000-912b-ed495d0c0000 pid=3165 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=6563b079-1c00-0000-912b-ed495d0c0000 pid=3165 execve guuid=5ef7957a-1c00-0000-912b-ed495f0c0000 pid=3167 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=5ef7957a-1c00-0000-912b-ed495f0c0000 pid=3167 clone guuid=20dead7c-1c00-0000-912b-ed49640c0000 pid=3172 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=20dead7c-1c00-0000-912b-ed49640c0000 pid=3172 execve guuid=814d4281-1c00-0000-912b-ed49710c0000 pid=3185 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=814d4281-1c00-0000-912b-ed49710c0000 pid=3185 execve guuid=58899481-1c00-0000-912b-ed49720c0000 pid=3186 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=58899481-1c00-0000-912b-ed49720c0000 pid=3186 execve guuid=c8fcdd81-1c00-0000-912b-ed49740c0000 pid=3188 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=c8fcdd81-1c00-0000-912b-ed49740c0000 pid=3188 clone guuid=0791b082-1c00-0000-912b-ed49780c0000 pid=3192 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=0791b082-1c00-0000-912b-ed49780c0000 pid=3192 execve guuid=b4d72887-1c00-0000-912b-ed49800c0000 pid=3200 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=b4d72887-1c00-0000-912b-ed49800c0000 pid=3200 execve guuid=d760a387-1c00-0000-912b-ed49810c0000 pid=3201 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=d760a387-1c00-0000-912b-ed49810c0000 pid=3201 execve guuid=38fd1088-1c00-0000-912b-ed49830c0000 pid=3203 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=38fd1088-1c00-0000-912b-ed49830c0000 pid=3203 clone guuid=bc27e288-1c00-0000-912b-ed49860c0000 pid=3206 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=bc27e288-1c00-0000-912b-ed49860c0000 pid=3206 execve guuid=cef8e08d-1c00-0000-912b-ed49900c0000 pid=3216 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=cef8e08d-1c00-0000-912b-ed49900c0000 pid=3216 execve guuid=6a536e8e-1c00-0000-912b-ed49920c0000 pid=3218 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=6a536e8e-1c00-0000-912b-ed49920c0000 pid=3218 execve guuid=3f12de8e-1c00-0000-912b-ed49940c0000 pid=3220 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=3f12de8e-1c00-0000-912b-ed49940c0000 pid=3220 clone guuid=fa6f2490-1c00-0000-912b-ed49960c0000 pid=3222 /usr/bin/wget net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=fa6f2490-1c00-0000-912b-ed49960c0000 pid=3222 execve guuid=ea68cc96-1c00-0000-912b-ed49a30c0000 pid=3235 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=ea68cc96-1c00-0000-912b-ed49a30c0000 pid=3235 execve guuid=57ca1c97-1c00-0000-912b-ed49a50c0000 pid=3237 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=57ca1c97-1c00-0000-912b-ed49a50c0000 pid=3237 execve guuid=749c6697-1c00-0000-912b-ed49a60c0000 pid=3238 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=749c6697-1c00-0000-912b-ed49a60c0000 pid=3238 clone guuid=69a50899-1c00-0000-912b-ed49ac0c0000 pid=3244 /usr/bin/wget net send-data guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=69a50899-1c00-0000-912b-ed49ac0c0000 pid=3244 execve guuid=78b5709c-1c00-0000-912b-ed49b50c0000 pid=3253 /usr/bin/curl net send-data write-file guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=78b5709c-1c00-0000-912b-ed49b50c0000 pid=3253 execve guuid=288d6ba1-1c00-0000-912b-ed49bd0c0000 pid=3261 /usr/bin/cat guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=288d6ba1-1c00-0000-912b-ed49bd0c0000 pid=3261 execve guuid=84d9e9a1-1c00-0000-912b-ed49be0c0000 pid=3262 /usr/bin/chmod guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=84d9e9a1-1c00-0000-912b-ed49be0c0000 pid=3262 execve guuid=c10560a2-1c00-0000-912b-ed49bf0c0000 pid=3263 /usr/bin/bash guuid=cce7f546-1c00-0000-912b-ed49140c0000 pid=3092->guuid=c10560a2-1c00-0000-912b-ed49bf0c0000 pid=3263 clone 34f3fc5f-5353-5421-bf3d-44e89693cc6d 45.66.228.20:80 guuid=2575fd47-1c00-0000-912b-ed49150c0000 pid=3093->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=cdd06f51-1c00-0000-912b-ed49280c0000 pid=3112->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=82f2e456-1c00-0000-912b-ed49340c0000 pid=3124->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=1ad1d15e-1c00-0000-912b-ed49390c0000 pid=3129->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=387eaf66-1c00-0000-912b-ed49460c0000 pid=3142->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=5bb72f6c-1c00-0000-912b-ed49500c0000 pid=3152->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 144B guuid=87aee171-1c00-0000-912b-ed495b0c0000 pid=3163->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=20dead7c-1c00-0000-912b-ed49640c0000 pid=3172->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=0791b082-1c00-0000-912b-ed49780c0000 pid=3192->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=bc27e288-1c00-0000-912b-ed49860c0000 pid=3206->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 142B guuid=fa6f2490-1c00-0000-912b-ed49960c0000 pid=3222->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=69a50899-1c00-0000-912b-ed49ac0c0000 pid=3244->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 141B guuid=78b5709c-1c00-0000-912b-ed49b50c0000 pid=3253->34f3fc5f-5353-5421-bf3d-44e89693cc6d send: 90B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2026-10-27 10:26:57 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6cxty6odcjetjs4aian3nybrkc3aiatmzqbx46hh7jlfpxklhca._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux upx
Link:
https://tria.ge/reports/261027-mgql3adc34/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
File and Directory Permissions Modification
Executes dropped EXE
Traces itself
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1f8579e3ce18/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4

(this sample)

Mirai

elf 9ac4306572c720216db8f375c1226002e240033d5e33669192819886d36579a7

Mirai

elf e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720

  
URLhaus
https://urlhaus.abuse.ch/url/4035861/
  
Delivery method
Distributed via web download
  
Dropping
MD5 f5166fac7bed1ea81796ccd223a1ceb2
  
Dropping
SHA256 e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720

Comments