MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 238b1095c5d04520299799099a360f63317e8e24bd95457f0f15b2a5daa172af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	238b1095c5d04520299799099a360f63317e8e24bd95457f0f15b2a5daa172af
SHA3-384 hash:	26ef38d8c8a3e80b755f1665d648e329b37fb8e80bd1bc2d27a94768c9ae3dd68652bbacf05e3c99471cda2642ebb6c8
SHA1 hash:	ecc62ec6063d9403d20672f645d33a4c4663af0a
MD5 hash:	d89c67e3820c93aa421675151d1a2bb1
humanhash:	high-video-winter-papa
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'939 bytes
First seen:	2026-01-18 14:11:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ItlsfGUsF9BQsZdY5JMQaNtLr+NI8ks/3eqXXOjUdfi:iefGUsF/1ZdYfKtLsJ/3eqHOjUxi
TLSH	T1115193D510518331BD75EAB2B3AD4C4DB9A4B49B58D6DF66ACD838FC80CFD04B580792
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://143.20.185.79/Orbt/Orbt.x86	955c8992a9f4377d52d5eaa260768bcf9219d965d69e335ba8a7bec2547116e5	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.mips	336a746f6be5c835eb03aa9805e3f5c96d4d1657a59389b1c2a9a53b112dc005	Mirai	elf gafgyt mirai ua-wget
http://143.20.185.79/Orbt/Orbt.arc	f3639e05ddc7cc0a5d0ebb36a683c1c6dec5ddcdd835fbbd4ad0da19e7495402	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.i468	n/a	n/a	elf ua-wget
http://143.20.185.79/Orbt/Orbt.i686	3aca404aad07d2f41b0572148b28433b7b752a77e1fd5fed7bbdc67824e75b12	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.x86_64	2e97b806c426ac28a8782964bfcac48e93955635b70c12ac283d3f717ef12b70	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.mpsl	505b9c302899cf898d8812c22bf1c36e9e10bc818c0e538c9f8ade3f37771e1a	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.arm	b6416c2b6acbd2208c0ee0fce606241e27a1dabfe13c2d54926b5c0e01a4ebe8	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.arm5	0b5a44d310d868e79d7ef9ead43c6080e0479684513099cec7d3deaf3c5c9676	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.arm6	0bd753010fee80888a5969498a1215139f2548a90cad6298e01bcf54c40b94c3	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.arm7	70274d5c4fb81f75f3b7aff57483e0126b79b51256227ea6fc1c0f8555406b2b	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.ppc	44dfb4a3d329e43f9c5d1963465e9ce571b9d01f95c8534798ed9155634db8d1	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.spc	2fda4a4cb3f07146a3441f3a1a78289fd29492bb8022ad13ca94af648e2f5d33	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.m68k	8559a2a4b9ebe51f096a49cce3a70536b9db169bc593351fc25853a1fa329eaf	Mirai	elf mirai ua-wget
http://143.20.185.79/Orbt/Orbt.sh4	7f602b7a2d5994fea011550a7eef299c31f21fc3134f244d5e05b127f1e24524	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive medusa mirai obfuscated

Link:

https://www.filescan.io/uploads/696cea0dfdafd7624ab02667/reports/c3952349-764a-4139-a49b-0f78a311668f/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-01-18T11:40:00Z UTC

Last seen:

2026-01-18T12:14:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/238b1095c5d04520299799099a360f63317e8e24bd95457f0f15b2a5daa172af/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dfec9993-3f70-480f-818f-75ba356cbc59

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/238b1095c5d04520299799099a360f63317e8e24bd95457f0f15b2a5daa172af

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/238b1095c5d04520299799099a360f63317e8e24bd95457f0f15b2a5daa172af/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/238b1095c5d04520299799099a360f63317e8e24bd95457f0f15b2a5daa172af

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-01-18 14:11:32 UTC

File Type:

Text (Shell)

AV detection:

22 of 38 (57.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eofrbfof2bcsakmxteezunqpmmyx5drexwkuk7ypcwzklwvbokxq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260118-rhgg1aey6c/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware Config

C2 Extraction:

mirailoversddos.duckdns.org

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/238b1095c5d0/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh