MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a3de22ccb25a70e12d0b74d2e26748cd13e65c5708f3ba435dbca903c1abf5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	7a3de22ccb25a70e12d0b74d2e26748cd13e65c5708f3ba435dbca903c1abf5e
SHA3-384 hash:	f3fca41d82a88ab0cb134a924a6e8ef36c617848fea415b02773ff7bb25c102e12551375a3a117d51c220e80740ea57b
SHA1 hash:	5598a854e5414d924455a70ea0b87694dc66a88d
MD5 hash:	0c4c49f0b3529b178324374d0ad368e7
humanhash:	solar-six-dakota-kitten
File name:	mimi.x86.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	4'677 bytes
First seen:	2025-08-05 03:14:38 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:vM7h7N7hMq6GMgSzPMaKWM4oUM747o7UMz3bMx9RMUcgMVpVMSSOM2+CMLfTMz3s:q9JPuee
TLSH	T11BA1D3C592044D3029A7AE23FBB647BC348195D21CE5EF95EDC8FEE0064EE14B269763
Magika	shell
Reporter	AntiSkidding
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.67.244.57/hiddenbin/boatnet.x86	3c3e36b9c5dcac4324d16ada4ec2b0100156ee43e98d4693317e574bbb5f7d2c	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.mips	f4dfb944cb657fb586818228afb57fc4cd19c5ba05358936e4f75b8c4d51f303	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.arc	5f87d62a958e779686e29261e31c0115da8e6b03141ca1a22c49ee5de2a1be26	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://103.67.244.57/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://103.67.244.57/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://103.67.244.57/hiddenbin/boatnet.mpsl	95f761923c051f49322fbeb65da632cd807c34eb5352ca7989c6b6c79db0c7ab	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.arm	16047a48e8841e9ff0f8e37ce6d90edeaaf92d1a4f590d7b7eab5626b13e6cd4	Mirai	32-bit elf mirai Mozi
http://103.67.244.57/hiddenbin/boatnet.arm5	6af2e5eca5aa3483754a8b5ecc20264bda5fd6c8b22b1ccca82fad8e9f6f3c77	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.arm6	39c8d341b0b356020ece614010fa7ccf3e581618c4178b753980552100feceb8	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.arm7	a0dbd4d368087f425a67004ca95fc6e6c68093e44171384c10755a055e59b775	Mirai	32-bit elf mirai Mozi
http://103.67.244.57/hiddenbin/boatnet.ppc	680d6800a4a131ca2afe8e89f704aae1baaa56d26cfe9097bea007cfaf233c25	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.spc	n/a	n/a	elf ua-wget
http://103.67.244.57/hiddenbin/boatnet.m68k	553379a9048929b6a3ddf2d6c4bdd90dabc6268327e75dd6afedaef620a0c3cd	Mirai	elf mirai ua-wget
http://103.67.244.57/hiddenbin/boatnet.sh4	f64bd010a6b4de34f00ff6f5170c1deffbe3ed481192917943bc0ffe2b86dc5c	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/35bb55e4-9778-4550-b0d2-48dbd01b117d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7a3de22ccb25a70e12d0b74d2e26748cd13e65c5708f3ba435dbca903c1abf5e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a3de22ccb25a70e12d0b74d2e26748cd13e65c5708f3ba435dbca903c1abf5e/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/7a3de22ccb25a70e12d0b74d2e26748cd13e65c5708f3ba435dbca903c1abf5e

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-05 03:15:34 UTC

File Type:

Text (Shell)

AV detection:

23 of 36 (63.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pi66elglewtq4ewqw5gs4jturtit4zofochtxjbv3pfjapa2x5pa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250805-dr6xcsdq8y/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7a3de22ccb25/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/7a3de22ccb25a70e12d0b74d2e26748cd13e65c5708f3ba435dbca903c1abf5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.