MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cd3075a18181fec2e6ad5692b40dc9376d6e43dbd764f7fca54bc85d36967a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	7cd3075a18181fec2e6ad5692b40dc9376d6e43dbd764f7fca54bc85d36967a4
SHA3-384 hash:	bddac59584f54067f92e0d7705ba69b703232b64af87c9209ce8d7f0a26e2e30b3d66808060abe9db24e050185a70db7
SHA1 hash:	517119d1b35e05823891ee5cb4e035adcfe18b5f
MD5 hash:	2514a0dc22544f9f5a810441ed3c1dc4
humanhash:	alabama-tennis-mango-thirteen
File name:	2.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'330 bytes
First seen:	2025-11-25 06:53:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:xjlSbCXSGTbuS5wNSWDlASA9YSYlUS9n9GxJSfu/SQtMSLnLNIpJSqvMtSWDuS9/:/vK9+Y0u9QJ30p6Ql2ZBgJVba
TLSH	T1F46180FB034406735CB689D632BD0444B190819B1DCEAF72ABEC28E88D8DECC7C43666
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://41.216.189.88/00101010101001/morte.x86	c55ee5fec74bdb5352c26bb534882ad6036a46b85041bc9e287a2fa6b1bf0333	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.mips	0504c1d19f4a6c87638bc8947f2119dd105bdf219aa725acc298ebdf13e920db	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.arc	516008d52f068d99c6da5daca184e8f9cda817315edbeec1f7d2620b74e0c253	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.i468	n/a	n/a	elf ua-wget
http://41.216.189.88/00101010101001/morte.i686	119c7b0dce311181efe54f32bbb20e540a236987474cc7c709b016e057fa8a9b	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.x86_64	326d58959cf1dd14d8ccc66fc9bc4ad350951480522c3dba258c2a3df58aa57b	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.mpsl	ce940118a23cb340ee5498494c241f25d8254b610135c18aa2ffa889f5f685b6	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.arm	3f5dc3dbd08d5e45b06044e78fdb6f0ba3fcf5bb914463f53dbaaef706be0dc3	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.arm5	1dee276376977a4d9fc974b31bd79771333e03c53e1001803245691fb53ce533	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.arm6	e6303809e66e047611d6043c3bbf4459648e17a0eb09e4a1d74479d934bd6d8d	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.arm7	802f7f2c5adeb565137aa94763e0953b5f9a534a961fab8884443e4ebd013364	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.ppc	e2997b7d24200f5f941dfc5db065f7755a895ddb97c3ba48587bb63e202d3b7a	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.spc	5893032cbf7e5b9c035cdf2a4624bedfe91bcdac00a11b38d333d61406a79b7c	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.m68k	5ee083843525bf947c5c59b1ea303a8e32511623d0a8bb1437bde11475d03135	Mirai	elf mirai ua-wget
http://41.216.189.88/00101010101001/morte.sh4	c7bdb154068f113a84cc7d7668b8b728f52b16c9310945ba79670b7fbae045ac	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive medusa mirai

Link:

https://www.filescan.io/uploads/692552a5f6a4ba1793b00f7c/reports/12591bd1-68c2-4c19-8eb0-0c9951cf3376/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-25T05:28:00Z UTC

Last seen:

2025-11-25T06:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7cd3075a18181fec2e6ad5692b40dc9376d6e43dbd764f7fca54bc85d36967a4/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6c75a959-d080-4b80-9d0c-6d9817b17030

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7cd3075a18181fec2e6ad5692b40dc9376d6e43dbd764f7fca54bc85d36967a4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7cd3075a18181fec2e6ad5692b40dc9376d6e43dbd764f7fca54bc85d36967a4/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-11-25 06:53:23 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ptjqowqydap6yltk2vuswqg4sn3nnzb5xv3e676kks6ilu3jm6sa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251125-hntj3sxrfz/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7cd3075a18181fec2e6ad5692b40dc9376d6e43dbd764f7fca54bc85d36967a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.