MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 478a079faeecad0d70309471f496de500e2eb20fc6ec38321e159a90873011ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	478a079faeecad0d70309471f496de500e2eb20fc6ec38321e159a90873011ba
SHA3-384 hash:	49f8494bc567697d2c85805825c107f34bd1d69dfb490878671b64d7f798b32e5cf9be98e43620e31c1a90ad49556d13
SHA1 hash:	1890ec6cb42214e17087ae55d705f35eb21df01d
MD5 hash:	9684a48c60096b20d2c01010fd9f58f5
humanhash:	quiet-floor-rugby-butter
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'269 bytes
First seen:	2025-12-02 15:55:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:i1Cq19M1s61VU1z81bQ1wK1uC1DWL16W1hZe1Nc1Ii18y1J/H:h
TLSH	T12161D7D511424B706DDB7C12E368C77D3441A9A7C8EBCF1667EC28AA2C4DEC8AC5D742
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.77.241.148/00101010101001/ecco.x86	d218e19014e272aa7becbae8c1aa94ebeca15a0b53d31acc90fee931a0cb988e	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.mips	aceaeffc6a3960bb84ec59ad8dfaa6a1f4bb6c7fba96c651c8cadd0a949dfc09	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.arc	95781432349bac13684f77b948f9e17e05a5e068107836481cedb8ed80d23b20	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.i468	n/a	n/a	n/a
http://103.77.241.148/00101010101001/ecco.i686	97816202b21f30a349af9869b4c352cb0c3848a5c707442baaa247d03b468b82	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.x86_64	4d3f001406af7b2ac599e5463d8e619ab7f6bfa1a234e12f7c1a2533aa08fb2b	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.mpsl	8ef96f4d02feb5d517c2d2ba30e1056cec54a310850058af5ec5dcd9ae484932	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.arm	5718911d55aca6a3a117104d4903bfd76cc234fc725a38729f0ee598923c7c8e	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.arm5	fdb14bd88e4d7743bebb9012b92c8ca41755a8f25912456816c6641a1a3d178d	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.arm6	ed759b194168655768454dabfa5d438a36cf85d8cd0072ce7da4e5a72c803168	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.arm7	78558e7a8f669eb6fdfc8875e7549db054ad1b0808df070cbc4a7357ed66c844	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.ppc	3410b5c3819d7bfddaaf987b93ca75c82a8ea032cc8b0cafc92c5540ae22a312	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.spc	n/a	n/a	elf ua-wget
http://103.77.241.148/00101010101001/ecco.m68k	5e8c4673ace4b163293911fe9dad7c231152f844f52e89ff565ca7ec698cef5d	Mirai	elf mirai ua-wget
http://103.77.241.148/00101010101001/ecco.sh4	2bb60370f6ae1b1e4655d04d2e64f8b444dd6be11f3db1adedab980e07e03529	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/692f0bef5ba113a32e3a3349/reports/08f8a0f3-a322-44c9-85b7-d0e37d8580f2/overview

Result

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-02T10:20:00Z UTC

Last seen:

2025-12-02T10:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/478a079faeecad0d70309471f496de500e2eb20fc6ec38321e159a90873011ba/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/478a079faeecad0d70309471f496de500e2eb20fc6ec38321e159a90873011ba

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/478a079faeecad0d70309471f496de500e2eb20fc6ec38321e159a90873011ba/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i6faph5o5swq24bqsry7jfw6kahc5mqpy3wdqmq6cwnjbbzqcg5a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux persistence upx

Link:

https://tria.ge/reports/251202-tcy6zavlbx/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

UPX packed file

Deletes log files

Enumerates running processes

Modifies init.d

Modifies rc script

Writes file to system bin folder

File and Directory Permissions Modification

Deletes Audit logs

Deletes system logs

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (49293) amount of remote hosts

Creates a large amount of network flows

Mirai

Mirai family

Malware Config

C2 Extraction:

draft21.redirectme.net

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.