MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7706b4ac0e8f740ff9184bc691dfc5b8d10415618bb21fa69b64d7c9f0dc98b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	7706b4ac0e8f740ff9184bc691dfc5b8d10415618bb21fa69b64d7c9f0dc98b6
SHA3-384 hash:	364f26bbe638d737c595cf879062249ecf040ee718f64c1ab7b6db591366626e1bcb18970a69b279c2dc4c15cd66129e
SHA1 hash:	2c80e9984208f6dc90335c7e5b7728b2aa723eeb
MD5 hash:	93bb63f54a3ffaadb699a793c055f2a5
humanhash:	moon-hotel-carolina-twenty
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'032 bytes
First seen:	2025-09-20 06:41:55 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:iZ2hmVZsnE7ZRCXcZ9ePgZaIazvZSZa6aFvjkZ9NC9z4geDZYjczZBSvaLZjIjzF:iqmVCE7mXc6PggVzvZSgTFvjkz2z4ZD6
TLSH	T1345184CB06914A316C67FBABFDFACE1CB180549138D27F4454ED36EA5A9CE88B044B43
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.46.152.89/hiddenbin/Space.arc	a376a81308501bd0e0352d64fd25820da2e3198f8418bb110dabc9ea67ba7f34	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.x86	0e1ca78920ba72087eae6b8ab3c3b24c3c97924687e2771df504d4e7172ed90d	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.x86_64	f8a4f2de2a3b640993e5d0c729313cc61cfffd19f02165fd035676bfee82567f	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.i686	f5ce49d4baf9dd3b060addacbdd9b36c1aebd1c87a117bb6ac46fba727ba3984	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.mips	336ac437257d13357860f3671be111ad3d01c238667cebd51dacc8d52a29659d	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.mips64	n/a	n/a	elf ua-wget
http://176.46.152.89/hiddenbin/Space.mpsl	e1645210fcd49a5c71aa2f7ad34560959e149294afdb540156b52bb848031e30	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.arm	87f89c02ddf707aabaaf87dc4c09ca79cbba7317432165b38b0da3b98d056d40	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.arm5	7ff5bb8cf4a9cef76b220fd026ca8ba1b04f9a5eca92aa71d3a803cb629769ed	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.arm6	b84931f7538bdd405996a4ed756b71d5f596990d45070c5321639cf9a8934e96	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.arm7	7d7479eef3320f3454b618fcdbfca5604f3dae37653358fda459dc01486b4546	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.ppc	fe6a20bfcbd86f7a2e6f1af9844da36b9fef0a2ca052b1bcb8a592b248452ec3	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.sparc	n/a	n/a	elf ua-wget
http://176.46.152.89/hiddenbin/Space.m68k	701a66df40cce9ab910dbecf72f0bf689538971703cc51ac09708c1cd7f51a94	Mirai	mirai opendir
http://176.46.152.89/hiddenbin/Space.sh4	c9e4c022c8abcf8285da22c6544972f867d94d5655bc1dbabc338d9f6e7f8bb5	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-18T18:38:00Z UTC

Last seen:

2025-09-18T18:38:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/7706b4ac0e8f740ff9184bc691dfc5b8d10415618bb21fa69b64d7c9f0dc98b6/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/65fac622-61f2-49c5-9979-48e9a00db9b7

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7706b4ac0e8f740ff9184bc691dfc5b8d10415618bb21fa69b64d7c9f0dc98b6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7706b4ac0e8f740ff9184bc691dfc5b8d10415618bb21fa69b64d7c9f0dc98b6/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-09-18 21:29:52 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o4dljlaor52a76iyjpdjdx6fxdiqiflbrozb7ju3mtl4t4g4tc3a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250920-hggxpsem5v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7706b4ac0e8f740ff9184bc691dfc5b8d10415618bb21fa69b64d7c9f0dc98b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.