MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e0bd5206319d496d982b1cd36c8e181bc99986156fc529d24e47eb913d6ed18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	2e0bd5206319d496d982b1cd36c8e181bc99986156fc529d24e47eb913d6ed18
SHA3-384 hash:	de30ae657890a6ea512ec3ed074c123e760a51a46a55e1c5d187fb11442a8f0d899afd44db4405190fcecc0bf6d9cd53
SHA1 hash:	aae98581c60c603a2aa477db1a5833d4dc367e7a
MD5 hash:	0a53d9fcd16b547366cd8ee9007e858e
humanhash:	uranus-river-river-earth
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'374 bytes
First seen:	2025-06-24 10:04:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ItBLJZsBW+bhBZvkBySlfBw4msBsMTBKuKGgJBzh6BEUnLBEuENIpKksBW+MEBo7:i69Up3PoX1i7LuJRfco/BgJsDk
TLSH	T162613DF6134247339DEA8EA376A884046185809B94CE5FB99BFC74B68C4CEC9FC46653
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://196.251.117.162/00101010101001/morte.x86	5ed1b9ac972a32ccd8e338e37d34e0d8dda1470054c8e65ae8973d5676e67e05	Mirai	elf mirai ua-wget
http://196.251.117.162/00101010101001/morte.mips	ad0014f7c3e604337ddc19ef434b8026e712d03400cec2b7c10c9c5617d16a81	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.arc	7b6bba4e96e466269dd67e803f36e9902228e565d19ff96697c9a9591f6f1d45	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.i468	n/a	n/a	n/a
http://196.251.117.162/00101010101001/morte.i686	4c429ba34ce795e5f6d7cf151889caa9221c8fe6910b52312fe612addda6498b	Mirai	CoinMiner mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.x86_64	e577e2fba99280a6bfb5abd75048d8371d2ab9637d1c2a74b95155e906677817	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.mpsl	5df2b5357b42bbaf21309d1695ee1ff5e67b29a99682e63671e466d24d9e04e2	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.arm	e1cb2eee5c69a0c80198336de508ca901a9e70678f9b2ae291d7781a6bdee794	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.arm5	e28b4a608313570071e74495580493ec59567e4971c44e8e44c11b6b4f49dc06	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.arm6	61b7c859316ea98f83307d221ebb0200002399cc6ec182371e49829133d12bf4	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.arm7	1d7c1cf868a753537c94c6f3f8fc374311b370ad42c8efcab33703d2a1408fc1	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.ppc	856e9cb5636752694313199f4c80a7a0577a50420e2bd7b3f6ee2252ab08345e	Mirai	CoinMiner mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.spc	858ac66c2df8bc22074efffe1e278e4af1f8a50421aa6b3549cb8fb58479d53e	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.m68k	fed25a810ff084957f4cf11384b377862414c27e0496244862a51e408db0c342	Mirai	mirai opendir ua-wget
http://196.251.117.162/00101010101001/morte.sh4	8a5139d6dc5ffb22c4142d8c7699e99574cd9360537a0aaa73e87828fe8bc567	Mirai	mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685a782a32ed47a3a8d6aef7linux22vpnfull_triage

Tags:

n/a

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/41f1c656-3517-4f54-94e9-5509b3c9bca6

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2e0bd5206319d496d982b1cd36c8e181bc99986156fc529d24e47eb913d6ed18

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e0bd5206319d496d982b1cd36c8e181bc99986156fc529d24e47eb913d6ed18/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-06-24 10:04:23 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fyf5kidddhkjnwmcwhgtnshbqg6jtgdbk36ffhje4r7lse6w5uma._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250624-l35sfazpx8/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2e0bd5206319/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/2e0bd5206319d496d982b1cd36c8e181bc99986156fc529d24e47eb913d6ed18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.