MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 688108741b94f40ad6ce703d98b87cda9ee180213b0229b6a80d9d07ea425aa3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	688108741b94f40ad6ce703d98b87cda9ee180213b0229b6a80d9d07ea425aa3
SHA3-384 hash:	808b80375c909ac8121b7223833eff2e3232ca9d60b5abc09f2d750d0e80ac28ec7760d2be5a6946314c9ee3fd4dbd3f
SHA1 hash:	7d6118b946f8a1db23070d42dea8e03c320ee37e
MD5 hash:	d2ce4b644f82497cd4dd4148e88c529a
humanhash:	two-stairway-leopard-jupiter
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'959 bytes
First seen:	2025-09-23 04:32:45 UTC
Last seen:	2025-09-24 03:49:11 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:iVahmlVUnElVdCXlVRePlVaoazvZlVaGaFvjlV9N+9z4gelV4jclVNSvlVjojzqU:iemlyElaXlePlE1zvZlEnFvjlPWz4ZlV
TLSH	T179512ADB56E145313876BA23FEB9CE9C71C250E298E13F08D5DD34E55A8CD893058B87
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://172.86.66.203/hiddenbin/Space.arc	4dcbd84fe7b18c1f360a1fb322b4c98e202923557ba1c023c8d80c1d448227d6	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.x86	6aad8b5d1f17c344589d05a6d0b3a726daed59fc08edf78f1a3b3e34841a42cb	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.x86_64	28ba5c617da45bdfd256776fa8865b1173e0a339610c36bcc3010cbf852619b1	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.i686	e170b09ce1d40abfe737da41de77c4e3e9e1a9352f113ede58d4dd6112cdb279	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.mips	f244de67315806bd4c72db6e71af2c0652df8e0f56f2d6e70aaf1d4443026aa7	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.mips64	n/a	n/a	DEU elf geofenced ua-wget
http://172.86.66.203/hiddenbin/Space.mpsl	eb770c9d7c884900b255313994a6a1571ff1d3383066de91cd337481b8e0db7f	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.arm	ad07585e2c300e544eb0bcbef5b3650d75f847dbe9c1412bf8cc3dfc8959f3b4	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.arm5	d2aa892c1139864d74850233d4056d900d21d05dcfeacfbc4dac0421e5735042	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.arm6	9ed570105c7ea17e10ac24e2ed5325fa38f452858d364a1a1677a22864b817d1	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.arm7	ca46ab79e168c1de77afcf6ea7ac4bb3330e6ee5603ef1d94d5b4b174ce8595d	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.ppc	edc3307f9b339c9f8fc6f02066d457c4554926d766886c35eae5b722611dc48d	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.sparc	n/a	n/a	DEU elf geofenced ua-wget
http://172.86.66.203/hiddenbin/Space.m68k	e8f87777bd0dd9f3c931c52db87eeed38c3be164f68c3c07b07af6931afbe6b7	Mirai	DEU elf geofenced mirai ua-wget
http://172.86.66.203/hiddenbin/Space.sh4	ea8e507ea07647154348ef25417fc22f6093a99445838428957a5e4cf1f9103c	Mirai	DEU elf geofenced mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-22T22:14:00Z UTC

Last seen:

2025-09-22T22:14:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/688108741b94f40ad6ce703d98b87cda9ee180213b0229b6a80d9d07ea425aa3/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7ccb5fe8-64b4-4af1-b452-e8cbdb6387f8

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/688108741b94f40ad6ce703d98b87cda9ee180213b0229b6a80d9d07ea425aa3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/688108741b94f40ad6ce703d98b87cda9ee180213b0229b6a80d9d07ea425aa3/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-09-23 03:09:01 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ncaqq5a3st2avvwooa6zrod43kpodabbhmbctnvibwoqp2sclkrq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250923-e6qpcsfl8v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/688108741b94/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/688108741b94f40ad6ce703d98b87cda9ee180213b0229b6a80d9d07ea425aa3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.