MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f1fec694ff75ebb60f8607e5ff85441398cbbfdd304dfeb43a6b250f6ae33ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	6f1fec694ff75ebb60f8607e5ff85441398cbbfdd304dfeb43a6b250f6ae33ee
SHA3-384 hash:	6fcd7306bbd30a6f7b1a27693adc3337a23d9d9387b9c8c10e6ffac9451c022174d7c40b31f91ccf43b95aaec8a8e55a
SHA1 hash:	c11876badf089c5b787d046f7e4bc3bc3c05f895
MD5 hash:	20e6e7fa363b9ea77a4c2432cc5c34d2
humanhash:	oscar-don-bacon-mango
File name:	nullnet_bash.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'825 bytes
First seen:	2026-08-19 10:06:54 UTC
Last seen:	2026-08-19 20:13:45 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:vozBo4XoVlo3BoCTnobho0joY5oZNocBoNtoGkGOoKzoCDokk:EG
TLSH	T150815FCC2321C7337CA6552271B959D433C1A4E756E5CEE1B0BA7FE28889E4C39A47D1
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://132.243.200.43/nullnet_bin_dir/nullnet_load.x86	8e7006793b831e33326fea744861e592f9815032d92e0f3fa8866cd48156614f	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.mips	07b2f7df0f0f3c0e49b8a41b0ef39378deb95457adad564bb177b6f5c14eb0a5	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.mpsl	394a184fccd33144c8916c99cc9fb4992cf9db5cb1b40317ff38b34e5a241c06	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.arm	b78851a867a3438bf847dabd817f966222bf7ccc742e97e3187bec81208e42a4	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.arm5	ccab0ec1753714357c97db2d0ae3e27fd6e43b1d1cf45fcf5f4ab6f944a4f672	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.arm6	c48a8fd580df07df4f24e4983f87f02eb12c50deda3f833325073aaedb390b1d	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.arm7	7df437c77e314c8e5d2f9c0d3f686aeb656aaf877ac0d5f906e0e8d806bb2d09	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.ppc	c1804f28ef75a9f92a1c8fc6644bfdd6daedb62918bc0ef847c459edb8399a5c	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.m68k	be2b4b00f7f6cc381f6f33f18409baee016e103256bdaf4177c609d3245cea7c	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.sh4	51cdf1524335797a08e246245947cb7039b659f88d72cf7bfe2a7e50f41c7639	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.spc	328e0e31f802cc35318b1a5e844aa9708c6d985a629b042257ef59a037aa1def	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.arc	d4513aaa95e7d1ff0779d7deba3fdaa2ec4d54ca450ca097d7b9faa137bc9b74	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.x86_64	1bbb938e24f865c0270ba68c7f892151066fdd755d3c1d2215e9abe461b7f1e1	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.i686	93991708c741b6f73ecc5b0245702e07f42fbc71ee5ac0d8c39085574eb4b6a8	Mirai	mirai
http://132.243.200.43/nullnet_bin_dir/nullnet_load.i486	53ed214fd5f899b5d3e54e41b22dab4340dae96a241e7032504515a5cc65cd48	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8b972983-8f72-4405-b66c-471e4d77ada6

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6f1fec694ff75ebb60f8607e5ff85441398cbbfdd304dfeb43a6b250f6ae33ee

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6f1fec694ff75ebb60f8607e5ff85441398cbbfdd304dfeb43a6b250f6ae33ee/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-08-18 19:02:54 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n4p6y2kp65plwyhymb7f76cuie4yzo752mcn722du2zfb5vogpxa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:ecchi antivm botnet credential_access defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260819-l5x6daec68/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

UPX packed file

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (37606) amount of remote hosts

Creates a large amount of network flows

Family: Mirai

Malware Config

C2 Extraction:

132.243.200.43

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6f1fec694ff7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.59

Link:

https://yomi.yoroi.company/submissions/6f1fec694ff75ebb60f8607e5ff85441398cbbfdd304dfeb43a6b250f6ae33ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh