MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74198ca689c46dfe80dc0dd177af8886fcae25896aa0a397189e8939d67d3ec0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74198ca689c46dfe80dc0dd177af8886fcae25896aa0a397189e8939d67d3ec0
SHA3-384 hash: 421fef86a8e058f7de1cef697dcdb1b37d0610302403b2753ce126f6a0ee59cd9348d70bb265acc547b09e186954d51d
SHA1 hash: f4d9c6b09d3cbbc83a1a75fb9166bc6599f62e87
MD5 hash: db160e18a457a512d731d0e5c4a7a6f9
humanhash: network-green-ack-india
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'044 bytes
First seen:2025-09-15 02:50:23 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:i+O7+TuM+gr+Pt+5F+Bp+c5cE+WQg+JVL+4BJ+/R+xN+oKs+iz+lkB:i+O7+TuM+gr+Pt+5F+Bp+yr+WQg+JVLP
TLSH T1CA51508910678235AD95EFD3E2AB8818338BA09E77CE6FC754F96CB4494CF44A540B73
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://196.251.84.55/renji/renji.x869c56f9aec59697a9c7834032e480e1c8be43218c912b57c818b457dd417bb6d1 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.mipsb4020cab0a431addf1854ce352f4e87580db3762ddbd5062090ed874c8c3480a Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.arc32d84ec7a5f4c8c081fac153b98d3ad0855360e17b1ee505bc431544f71f2f65 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.i468n/an/aelf ua-wget
http://196.251.84.55/renji/renji.i68699229a86edfbca412a9e9cc20ec1c76dff595b7cbccd7719848ecdae36f142fa Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.x86_64c4b7dbf2dbd59126e3ffaa0fd5baf1800fb8a140005506e38025524f2f78cbc8 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.mpsldd23caa67b7a5a0f811dcad50f3d2ce0ff72d472810c1871ef5fbe243fc530f8 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.armb5c6eb898b6158357616cbdf56790f9aa61ccfe391e311f52df9d97ee7265d3a Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.arm5a89f36b53e621b01342bed5b96bf001ff17f179003fdf1a6315211532a885a68 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.arm652c66a00a2ba15039ab043ac874b908b0c24b793c28442439d6476cb5d57ec47 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.arm7d2ecab8ce321bf41f8a954aefe157093b6fdac17ee72fddd07e4c904be4a63bd Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.ppca7f411886349db308c3eaacc78dda73ad746cf8ac9656bc4065b8c6a096bb673 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.spcf25f8be191753e7c2c2f692ecac5504588b20a307e1aa7c23fbdfd0eeffa4505 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.m68kf6b54458fc39b77bec5ff4aa62675500be17141a934a6eae674d39675f747541 Miraielf mirai ua-wget
http://196.251.84.55/renji/renji.sh43807a288db8989920d148451c3835f0b7575c901dff9bd5fa9fd0ba96c26356c Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-14T23:55:00Z UTC
Last seen:
2025-09-14T23:55:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen
Link:
https://opentip.kaspersky.com/74198ca689c46dfe80dc0dd177af8886fcae25896aa0a397189e8939d67d3ec0/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/74198ca689c46dfe80dc0dd177af8886fcae25896aa0a397189e8939d67d3ec0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74198ca689c46dfe80dc0dd177af8886fcae25896aa0a397189e8939d67d3ec0/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/74198ca689c46dfe80dc0dd177af8886fcae25896aa0a397189e8939d67d3ec0
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-09-15 02:50:53 UTC
File Type:
Text (Shell)
AV detection:
16 of 24 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oqmyzjujyrw75ag4bxixpl4iq36k4jmjnkqkhfyyt2ettvt5h3aa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/250915-dbz4wa1p14/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes journal logs
Deletes system logs
Executes dropped EXE
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/74198ca689c4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/74198ca689c46dfe80dc0dd177af8886fcae25896aa0a397189e8939d67d3ec0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts
Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 74198ca689c46dfe80dc0dd177af8886fcae25896aa0a397189e8939d67d3ec0

(this sample)

Mirai

elf 87f8bfb586997f7e3c22b30326424f27ba43a78dcb4a3344918455fe7e2b07aa

  
URLhaus
https://urlhaus.abuse.ch/url/3620232/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3620221/
  
URLhaus
https://urlhaus.abuse.ch/url/3620243/
  
URLhaus
https://urlhaus.abuse.ch/url/3624347/
  
Dropping
MD5 e412d047e2cff17d19d2ce4160681ebe
  
Dropping
SHA256 87f8bfb586997f7e3c22b30326424f27ba43a78dcb4a3344918455fe7e2b07aa

Comments