MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33bd46c5f00b789cc31bc21ba95d2e9fd9f2f22fb065cb9dc41b463ebc96013f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	33bd46c5f00b789cc31bc21ba95d2e9fd9f2f22fb065cb9dc41b463ebc96013f
SHA3-384 hash:	f5d0e1ae646867ab93b382dc009a5e05a84a6a7634cd0a0ef8b0dfe300eac8baa518b64a0f12ca329e674cfb76bd3310
SHA1 hash:	906d12148f8c9c818a571e308be078462b7c8b1b
MD5 hash:	c3e760eb72c362d165617f6ff87bdd0e
humanhash:	batman-fillet-lake-princess
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'344 bytes
First seen:	2025-12-05 12:43:39 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ItXZslbhrkRlfdms9TQRGgJH69nLGfNIpKkspMEDhrsgNcGgJsQApk:iC3YzVVQR1axLKJDdggNBgJsVk
TLSH	T12661B3FB23428B3B6DAB89D3B3A846497541449FA4CF4F755BEC38B61C8CEC86C41642
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.77.241.135/00101010101001/morte.x86	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.mips	412dcec02119e2c26865b969786717379024e2d98c1ab261949b85c55a365eda	Mirai	elf mirai ua-wget
http://103.77.241.135/00101010101001/morte.arc	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.i468	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.i686	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.x86_64	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.mpsl	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.arm	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.arm5	65f88bcdf622dc4d768771fb825af1fb3e2f566c9b6d0d3df4525db6bea00041	Mirai	elf mirai ua-wget
http://103.77.241.135/00101010101001/morte.arm6	e6e53a4fdba4d1e01fff4c9ef401cae7264d7f0bd0a6e771fcaa4165ef363bdc	Mirai	elf mirai ua-wget
http://103.77.241.135/00101010101001/morte.arm7	bf228521a22296c2f6b4d5b090c0661cd31a93417d51f9b95e8b71a19127ba6a	Mirai	elf mirai ua-wget
http://103.77.241.135/00101010101001/morte.ppc	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.spc	n/a	n/a	elf ua-wget
http://103.77.241.135/00101010101001/morte.m68k	49cc2f75c5b42d600d0e6ee0199b02ef0e1853cc3c2fadcaef9ec4e0ba89d1ef	Mirai	elf mirai ua-wget
http://103.77.241.135/00101010101001/morte.sh4	04527947c92a2df86e59aac8375b3ac545b2abfb69158eb07cf27ab260342563	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive medusa mirai

Link:

https://www.filescan.io/uploads/6932d39dff25e40750d4b854/reports/6c5ed61d-076e-4e5e-b58a-19f8348cb084/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-04T08:52:00Z UTC

Last seen:

2025-12-07T09:29:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/33bd46c5f00b789cc31bc21ba95d2e9fd9f2f22fb065cb9dc41b463ebc96013f/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/33bd46c5f00b789cc31bc21ba95d2e9fd9f2f22fb065cb9dc41b463ebc96013f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/33bd46c5f00b789cc31bc21ba95d2e9fd9f2f22fb065cb9dc41b463ebc96013f/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-12-04 16:06:00 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=go6unrpqbn4jzqy3yin2sxjot7m7f4rpwbs4xhoedndd5pewae7q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251205-pykhgszpcz/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware Config

C2 Extraction:

draft22.redirectme.net

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/33bd46c5f00b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/33bd46c5f00b789cc31bc21ba95d2e9fd9f2f22fb065cb9dc41b463ebc96013f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.