MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46de421734f272934e7f6b69db826d4f74db727e89d15a7884420bb625b6679f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	46de421734f272934e7f6b69db826d4f74db727e89d15a7884420bb625b6679f
SHA3-384 hash:	ba4df8291d6cdce78ef6bb76a851b6fe7053b12680c6651f3306e793abefd094616adea00e21c0a9092cfd89a38158ab
SHA1 hash:	d21890717b5d34310114e00e7cbb7ecd1e2e2c24
MD5 hash:	443c92484e4f5903d9cf693549b10e90
humanhash:	vegan-fix-tango-bacon
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'344 bytes
First seen:	2026-02-23 07:20:17 UTC
Last seen:	2026-02-23 19:40:45 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:i1qZ1r31s91bf1xL1tL1/g/11eR1dvL1SDJ1zf1XD1Q11dudBgJs1bjk:iGtwt/3oyjLeBpMTiBgJs5k
TLSH	T19D615DF7034147335CEB89D632AA4425664C84DBA8DF0F7A9BECA8E68C4EEC87C41651
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.91.127.182/00101010101001/morte.x86	1fbe6cb0e6ba20afc340df967e6ff7e7862b3d010ee5626ac73e6db4852c8eef	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.mips	c7b2a2b4b4644f6c66dca72290d7f44fb6337b019124d6dcfeb6aad79cbe0c6e	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.arc	8f2e2be996b6a5700859ec8cafc2455637fca6a3f5702e3674e2bb1a34907612	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.i468	n/a	n/a	elf ua-wget
http://185.91.127.182/00101010101001/morte.i686	315c34efa6fbbbbaa61ec83f02a3ab80df64b58e30df9b40fe9926eb89727822	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.x86_64	0b3217709d2927ba08c7559f54485084f6ddb21f5dd4806e0f4ae31510286e9f	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.mpsl	9305e8c59a66507f47230f6cc2008ad305751a84692c5d1ce02f8f00ab1ab0d8	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.arm	95131e989ffcf20fac261e4ac9cdf89698a54a8689718dedc8fa20e53d61802a	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.arm5	eeec163a3cfa424ac7a3c2d70dfc1da7c13200ab4aa6ac4185eb31df4bbfd7ad	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.arm6	92fb174b9020ae360d4bf9422b0b14b6e480b2d29f825740017f5430856ff048	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.arm7	8023e6c8e78879d50b058d851f30c8ba72abf545b87d917b8a9ab4ffa7907c8b	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.ppc	9ade06515009c61fc82215074fbe0c7af07aeb434c8cc3994a42f59ed8856641	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.spc	69a084828958de9978a95b462b9ca83db8bcd1f12fa07c27665d196d0edd41b5	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.m68k	27932c15c6c21ef787ec5275f35c1ad751d9a80c623a9a44d1582f72dbd9dbe5	Mirai	elf mirai ua-wget
http://185.91.127.182/00101010101001/morte.sh4	f1fb52f8792ff45b86cfe050b2a0957e0f07d801fd9cd5e972a5eb580beba6e8	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive medusa mirai virus

Link:

https://www.filescan.io/uploads/699bffb510e80629d4eded7c/reports/72e5c7b0-41c3-4e33-ac22-efeb53f47ebd/overview

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/46de421734f272934e7f6b69db826d4f74db727e89d15a7884420bb625b6679f/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/88f6be2f-0817-440b-b531-5870125cbebb

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/46de421734f272934e7f6b69db826d4f74db727e89d15a7884420bb625b6679f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/46de421734f272934e7f6b69db826d4f74db727e89d15a7884420bb625b6679f/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-02-23 00:37:22 UTC

File Type:

Text (Shell)

AV detection:

22 of 36 (61.11%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i3peefzu6jzjgtt7nnu5xatnj52nw4t6rhivu6eeiif3mjnwm6pq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery execution linux persistence upx

Link:

https://tria.ge/reports/260223-h5814agt2a/

Behaviour

Command and Scripting Interpreter: Unix Shell

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

UPX packed file

Enumerates active TCP sockets

Enumerates running processes

Modifies init.d

Modifies rc script

File and Directory Permissions Modification

Executes dropped EXE

Mirai

Mirai family

Malware Config

C2 Extraction:

last.galaxias.cc

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/46de421734f2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/46de421734f272934e7f6b69db826d4f74db727e89d15a7884420bb625b6679f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh