MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58a0341aa81ab84ff56586b37e3ad57689947f3d31009fa80bce147c519c79ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	58a0341aa81ab84ff56586b37e3ad57689947f3d31009fa80bce147c519c79ea
SHA3-384 hash:	0a7c6b07321f4c681896446428943038f268c2a6fa3443686e477e7df2238345695a90b13b5ec2ea2fe2fc5e86fcd4e5
SHA1 hash:	31fece6a2ff0099849c9e7aa559bc09053ac47b2
MD5 hash:	b831b6fb6d4bcf04c5fc6b8076e15300
humanhash:	moon-fanta-happy-whiskey
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'989 bytes
First seen:	2025-08-26 16:22:45 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:i90hml9SnEl9FCXl9BePl9aeazvZl9aoaFvjl99Ng9z4gel9ujcl91Svl9jejzqi:iEmlAEluXlSPlMfzvZlM1Fvjl3oz4Zlb
TLSH	T1715162C7036246396DA77AA3FEB98E5C318268D328D3BF4459DC34E5528CE88B544F47
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://193.23.220.229/hiddenbin/Space.arc	58560dda8f521e3ddfb6947ed1afd8660de74bd37ffa674da02bda7619d3b636	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.x86	0f4205ba2401a5a4c2e99cdfb69fb954ad8eaac9b174f28479b3b14547884ffd	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.x86_64	a696fd93b338281165ebe731a918835a6464845d5aa2273f0ffb28520e84acdc	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.i686	047281af59198f74ba0a4896e84e189607b9e89b8a3e878d1c09b946fe73f9bc	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.mips	25990b8c3eaed042e66125cdeaf51cafcfeccf4aa123fc4e064467ed44417313	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.mips64	n/a	n/a	elf ua-wget
http://193.23.220.229/hiddenbin/Space.mpsl	cd7af2c6a978c053e816eb8a3dfb9d8044095f84c726d08391cf1acc8eea0d8c	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.arm	1601f67bee5735940a7b83fb10b13b7068d89ba6a1d816d3ded70283f1a09005	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.arm5	f318ca4d4b41f72d567c690a5f85e83a956d44c4120c937496a505f8b17c11ce	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.arm6	bd2907190568f1d5f0673d55459aade7b0ee658a503b1bdd609aeb5dad8b369f	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.arm7	116c3653d80ae416889ab6cf582547ac61084ebe547cc33b77599b8ff028e25e	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.ppc	89d50d073a4483a8c2659c6cee5f56b04ba556072cb15df5e9b56e4461df9e67	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.sparc	n/a	n/a	elf ua-wget
http://193.23.220.229/hiddenbin/Space.m68k	8e43699b442b6719872b12224cffc3a8bdefce2f581777f91778f04d672453f2	Mirai	mirai opendir
http://193.23.220.229/hiddenbin/Space.sh4	ea586c8cfa1fd42bbfc8f8a2eb918d10716b94f9c442b54d8923b60651478708	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/58a0341aa81ab84ff56586b37e3ad57689947f3d31009fa80bce147c519c79ea/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ab07d720-ff85-4093-84b1-37a8b41e12da

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/58a0341aa81ab84ff56586b37e3ad57689947f3d31009fa80bce147c519c79ea

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/58a0341aa81ab84ff56586b37e3ad57689947f3d31009fa80bce147c519c79ea/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-26 16:25:51 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lcqdigvidk4e75lfq2zx4owvo2ezi7z5geaj7kalzykhyum4phva._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250826-t244hshq5w/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/58a0341aa81a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/58a0341aa81ab84ff56586b37e3ad57689947f3d31009fa80bce147c519c79ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.