MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3
SHA3-384 hash: 38bb556400f2b55acc279f925a008d80396375b34209e6d743207c1e40c32811785b30dfefda9c3070955de54b8b038f
SHA1 hash: 72db1691c5ba9331e7888136589c0a38b5fd5785
MD5 hash: f47760557b427b4b95392f42b7c7b40a
humanhash: jupiter-item-mars-two
File name:w.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'345 bytes
First seen:2025-12-25 07:40:24 UTC
Last seen:2025-12-25 18:28:40 UTC
File type: sh
MIME type:text/plain
ssdeep 24:efIdXIGDNIiIptKKIIo43s7gIsRXI+GfIwZI30r4I0pn1VInuTIPedIE:efIdXIG9IptRI8HIEXI+GfIwZI30r4I6
TLSH T1B6211DFEDE61653441D449792A268535D40DADF43904CEDCB40B0ABB7F84E14FD09B4C
Magika txt
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://192.227.152.84/sdxkzX_UXA229x.arm9fc0d72deeab65f7ac00286be85411e807b0da014ff315f144e49b84c52d92d7 Miraielf mirai ua-wget
http://192.227.152.84/sdxkzX_UXA229x.arm53e5759b3871fd991fd33de411ffda09c8787a95e4918fefaa770f6e413bc5c54 Miraielf mirai ua-wget
http://192.227.152.84/sdxkzX_UXA229x.arm62b2b67121a3390a094dbf2d0871f781bd84c6265f3e1d757db164fc46f11c624 Miraielf mirai ua-wget
http://192.227.152.84/sdxkzX_UXA229x.arm7e0e20b965ef3646a3a7f217f8cbb0392378be35ecdc20fc583ce9dd4ccf815a3 Miraiarm elf geofenced mirai ua-wget USA
http://192.227.152.84/sdxkzX_UXA229x.sh4a53e2ca20864a3940269ee9c08d0a871d8d7000298fc74936fa7791fbe680dff Miraielf mirai ua-wget
http://192.227.152.84/sdxkzX_UXA229x.arcn/an/aelf ua-wget
http://192.227.152.84/sdxkzX_UXA229x.mips71135e23195033fae26b6c923d09d4120148c61d94ac6a50f45796cddd083a15 Miraielf geofenced mips mirai ua-wget USA
http://192.227.152.84/sdxkzX_UXA229x.mipseln/an/aelf ua-wget
http://192.227.152.84/sdxkzX_UXA229x.sparcn/an/aelf ua-wget
http://192.227.152.84/sdxkzX_UXA229x.x86_64n/an/aelf ua-wget
http://192.227.152.84/sdxkzX_UXA229x.i686n/an/aelf ua-wget
http://192.227.152.84/sdxkzX_UXA229x.i586n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
busybox mirai
Link:
https://www.filescan.io/uploads/694cea9a3f8fdbf8e951b8c7/reports/9ca048e6-9dcd-4ead-8e64-2b77438b0039/overview
Verdict:
Malicious
File Type:
text
First seen:
2025-12-25T04:44:00Z UTC
Last seen:
2025-12-25T04:54:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.cl
Link:
https://opentip.kaspersky.com/342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7c928101-a20d-4e60-8cfd-f438c6096f71
Behavior Graph:
Download SVG
%3 guuid=ecf78adc-1600-0000-1ceb-e5dc3c0c0000 pid=3132 /usr/bin/sudo guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137 /tmp/sample.bin guuid=ecf78adc-1600-0000-1ceb-e5dc3c0c0000 pid=3132->guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137 execve guuid=ba2378df-1600-0000-1ceb-e5dc430c0000 pid=3139 /usr/bin/busybox net send-data write-file guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=ba2378df-1600-0000-1ceb-e5dc430c0000 pid=3139 execve guuid=271ec0f7-1600-0000-1ceb-e5dc5e0c0000 pid=3166 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=271ec0f7-1600-0000-1ceb-e5dc5e0c0000 pid=3166 execve guuid=101698f8-1600-0000-1ceb-e5dc5f0c0000 pid=3167 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=101698f8-1600-0000-1ceb-e5dc5f0c0000 pid=3167 clone guuid=d77926f9-1600-0000-1ceb-e5dc610c0000 pid=3169 /usr/bin/busybox net send-data write-file guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=d77926f9-1600-0000-1ceb-e5dc610c0000 pid=3169 execve guuid=e3f56c0b-1700-0000-1ceb-e5dc7b0c0000 pid=3195 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=e3f56c0b-1700-0000-1ceb-e5dc7b0c0000 pid=3195 execve guuid=1a0af00b-1700-0000-1ceb-e5dc7d0c0000 pid=3197 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=1a0af00b-1700-0000-1ceb-e5dc7d0c0000 pid=3197 clone guuid=60a6600d-1700-0000-1ceb-e5dc830c0000 pid=3203 /usr/bin/busybox net send-data write-file guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=60a6600d-1700-0000-1ceb-e5dc830c0000 pid=3203 execve guuid=10558625-1700-0000-1ceb-e5dcad0c0000 pid=3245 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=10558625-1700-0000-1ceb-e5dcad0c0000 pid=3245 execve guuid=4abcf325-1700-0000-1ceb-e5dcae0c0000 pid=3246 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=4abcf325-1700-0000-1ceb-e5dcae0c0000 pid=3246 clone guuid=e9bbdc26-1700-0000-1ceb-e5dcb10c0000 pid=3249 /usr/bin/busybox net send-data write-file guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=e9bbdc26-1700-0000-1ceb-e5dcb10c0000 pid=3249 execve guuid=584ade45-1700-0000-1ceb-e5dceb0c0000 pid=3307 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=584ade45-1700-0000-1ceb-e5dceb0c0000 pid=3307 execve guuid=cbec3946-1700-0000-1ceb-e5dced0c0000 pid=3309 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=cbec3946-1700-0000-1ceb-e5dced0c0000 pid=3309 clone guuid=98cff446-1700-0000-1ceb-e5dcf10c0000 pid=3313 /usr/bin/busybox net send-data write-file guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=98cff446-1700-0000-1ceb-e5dcf10c0000 pid=3313 execve guuid=f69f6382-1700-0000-1ceb-e5dc670d0000 pid=3431 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=f69f6382-1700-0000-1ceb-e5dc670d0000 pid=3431 execve guuid=4203c582-1700-0000-1ceb-e5dc680d0000 pid=3432 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=4203c582-1700-0000-1ceb-e5dc680d0000 pid=3432 clone guuid=785e1184-1700-0000-1ceb-e5dc6d0d0000 pid=3437 /usr/bin/busybox net send-data guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=785e1184-1700-0000-1ceb-e5dc6d0d0000 pid=3437 execve guuid=c98b5d90-1700-0000-1ceb-e5dc860d0000 pid=3462 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=c98b5d90-1700-0000-1ceb-e5dc860d0000 pid=3462 execve guuid=3ccdd790-1700-0000-1ceb-e5dc880d0000 pid=3464 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=3ccdd790-1700-0000-1ceb-e5dc880d0000 pid=3464 clone guuid=b73ff790-1700-0000-1ceb-e5dc8a0d0000 pid=3466 /usr/bin/busybox net send-data write-file guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=b73ff790-1700-0000-1ceb-e5dc8a0d0000 pid=3466 execve guuid=56f457a9-1700-0000-1ceb-e5dcb00d0000 pid=3504 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=56f457a9-1700-0000-1ceb-e5dcb00d0000 pid=3504 execve guuid=410e9fa9-1700-0000-1ceb-e5dcb10d0000 pid=3505 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=410e9fa9-1700-0000-1ceb-e5dcb10d0000 pid=3505 clone guuid=c89a1faa-1700-0000-1ceb-e5dcb50d0000 pid=3509 /usr/bin/busybox net send-data guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=c89a1faa-1700-0000-1ceb-e5dcb50d0000 pid=3509 execve guuid=a6a733b6-1700-0000-1ceb-e5dcc50d0000 pid=3525 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=a6a733b6-1700-0000-1ceb-e5dcc50d0000 pid=3525 execve guuid=a2f1bcb6-1700-0000-1ceb-e5dcc70d0000 pid=3527 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=a2f1bcb6-1700-0000-1ceb-e5dcc70d0000 pid=3527 clone guuid=3ed9ccb6-1700-0000-1ceb-e5dcc80d0000 pid=3528 /usr/bin/busybox net send-data guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=3ed9ccb6-1700-0000-1ceb-e5dcc80d0000 pid=3528 execve guuid=e9ceefc2-1700-0000-1ceb-e5dce80d0000 pid=3560 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=e9ceefc2-1700-0000-1ceb-e5dce80d0000 pid=3560 execve guuid=06a855c3-1700-0000-1ceb-e5dceb0d0000 pid=3563 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=06a855c3-1700-0000-1ceb-e5dceb0d0000 pid=3563 clone guuid=9e6d63c3-1700-0000-1ceb-e5dcec0d0000 pid=3564 /usr/bin/busybox net send-data guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=9e6d63c3-1700-0000-1ceb-e5dcec0d0000 pid=3564 execve guuid=535392cf-1700-0000-1ceb-e5dc080e0000 pid=3592 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=535392cf-1700-0000-1ceb-e5dc080e0000 pid=3592 execve guuid=e3d4f9cf-1700-0000-1ceb-e5dc090e0000 pid=3593 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=e3d4f9cf-1700-0000-1ceb-e5dc090e0000 pid=3593 clone guuid=401409d0-1700-0000-1ceb-e5dc0b0e0000 pid=3595 /usr/bin/busybox net send-data guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=401409d0-1700-0000-1ceb-e5dc0b0e0000 pid=3595 execve guuid=738922dc-1700-0000-1ceb-e5dc1f0e0000 pid=3615 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=738922dc-1700-0000-1ceb-e5dc1f0e0000 pid=3615 execve guuid=b27a93dc-1700-0000-1ceb-e5dc210e0000 pid=3617 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=b27a93dc-1700-0000-1ceb-e5dc210e0000 pid=3617 clone guuid=73f9a6dc-1700-0000-1ceb-e5dc230e0000 pid=3619 /usr/bin/busybox net send-data guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=73f9a6dc-1700-0000-1ceb-e5dc230e0000 pid=3619 execve guuid=f58ef2e8-1700-0000-1ceb-e5dc350e0000 pid=3637 /usr/bin/chmod guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=f58ef2e8-1700-0000-1ceb-e5dc350e0000 pid=3637 execve guuid=46446be9-1700-0000-1ceb-e5dc370e0000 pid=3639 /usr/bin/dash guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=46446be9-1700-0000-1ceb-e5dc370e0000 pid=3639 clone guuid=a3ad87e9-1700-0000-1ceb-e5dc380e0000 pid=3640 /usr/bin/rm delete-file guuid=b2ba34df-1600-0000-1ceb-e5dc410c0000 pid=3137->guuid=a3ad87e9-1700-0000-1ceb-e5dc380e0000 pid=3640 execve 754c9895-f526-5c23-835d-e9aa002cfebe 192.227.152.84:80 guuid=ba2378df-1600-0000-1ceb-e5dc430c0000 pid=3139->754c9895-f526-5c23-835d-e9aa002cfebe send: 95B guuid=d77926f9-1600-0000-1ceb-e5dc610c0000 pid=3169->754c9895-f526-5c23-835d-e9aa002cfebe send: 96B guuid=60a6600d-1700-0000-1ceb-e5dc830c0000 pid=3203->754c9895-f526-5c23-835d-e9aa002cfebe send: 96B guuid=e9bbdc26-1700-0000-1ceb-e5dcb10c0000 pid=3249->754c9895-f526-5c23-835d-e9aa002cfebe send: 96B guuid=98cff446-1700-0000-1ceb-e5dcf10c0000 pid=3313->754c9895-f526-5c23-835d-e9aa002cfebe send: 95B guuid=785e1184-1700-0000-1ceb-e5dc6d0d0000 pid=3437->754c9895-f526-5c23-835d-e9aa002cfebe send: 95B guuid=b73ff790-1700-0000-1ceb-e5dc8a0d0000 pid=3466->754c9895-f526-5c23-835d-e9aa002cfebe send: 96B guuid=c89a1faa-1700-0000-1ceb-e5dcb50d0000 pid=3509->754c9895-f526-5c23-835d-e9aa002cfebe send: 98B guuid=3ed9ccb6-1700-0000-1ceb-e5dcc80d0000 pid=3528->754c9895-f526-5c23-835d-e9aa002cfebe send: 97B guuid=9e6d63c3-1700-0000-1ceb-e5dcec0d0000 pid=3564->754c9895-f526-5c23-835d-e9aa002cfebe send: 98B guuid=401409d0-1700-0000-1ceb-e5dc0b0e0000 pid=3595->754c9895-f526-5c23-835d-e9aa002cfebe send: 96B guuid=73f9a6dc-1700-0000-1ceb-e5dc230e0000 pid=3619->754c9895-f526-5c23-835d-e9aa002cfebe send: 96B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-24 13:49:25 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gqv5tbebafk7snwbsdgyfxyis64tfqyanqgft5iby4zkmtqdlcrq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251225-jhrzqs1jbj/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 342bd984810155f936c190cd82df0897b932c3006c0c59f501c732a64e0358a3

(this sample)

Mirai

elf 03102d2c210a07eb67ac99d90a57eed7f87681fa49eea3f69d36812088968ca7

  
URLhaus
https://urlhaus.abuse.ch/url/3743073/
  
Delivery method
Distributed via web download
  
Dropping
MD5 929f8271895a193b93d5ac9c442591c7
  
Dropping
SHA256 03102d2c210a07eb67ac99d90a57eed7f87681fa49eea3f69d36812088968ca7

Comments