MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81243c851e87fd9d49574f187c5e8d8e091cfa03d2ba8d467deb74abcb6d2df6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	81243c851e87fd9d49574f187c5e8d8e091cfa03d2ba8d467deb74abcb6d2df6
SHA3-384 hash:	07243ee8167b8eb256ea408c94fa9354a636fd79076cb36f6d4c7a950dccc94ddbba83a5671c62737c8b8c41430c529b
SHA1 hash:	36833c295e14fddc77d266348826f4c95526e4b1
MD5 hash:	54f3d1e58a7c3e9fc742eaf865ed3a69
humanhash:	uncle-item-freddie-don
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'944 bytes
First seen:	2025-07-15 15:11:37 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:i1dydal1dsdal1dYudYnXl1dFd0l1deMdelZl1deidezjl1dZNKdZGgel1dQdOlj:ir2alrYalrvclrb0lre4elZlreGezjlX
TLSH	T10151B0850ED3817A6C75AF33F9BE8A6C349D50D7B8C0AD6644ED3CF2408DE446899E93
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://196.251.66.32/HBTs/top1miku.arc	a6ead5ecc5a093af2dd8f9cd7b44db97a3077e888ed6fed6598a68ecad756df0	Mirai	elf mirai
http://196.251.66.32/HBTs/top1miku.x86	effabb0c89d67dc1deaaff5d5a7512613f0c6d6a3c86c773d05a3062890673ba	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.x86_64	d98f7aaa9e2aa30f86d5f7c88bc2e895bee6adeebc6d87a904bd28e6f9e01810	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.i686	386ed38648148fb805047a802ac6c25485bee146667b0a7f0940b388630a0285	Mirai	elf mirai
http://196.251.66.32/HBTs/top1miku.mips	a77e7186ad2e7b858f23a9f1d3d5d6365481fcf8bf212a6d49b50ba9f9ae046f	Gafgyt	elf gafgyt mirai ua-wget
http://196.251.66.32/HBTs/top1miku.mips64	n/a	n/a	elf
http://196.251.66.32/HBTs/top1miku.mpsl	425dc69ffcd048df8726f1cb3716901322750e3bfc56803135c3a803eeab6369	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.arm	92117e88e20232d0fe9f1fd7fb7d12ea5adecf19b18e227ce6ce83d9f4376a99	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.arm5	046a329591855ebf9749429465feda29ac2e8fc327fc2d4664ba4255a9cda5d4	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.arm6	0c7fa0d266b490427b6857294ee1500691ed8506884baff619f1d51049bc4c52	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.arm7	b5bce493d05031ba446080722dfb270aec7c97fc4378e639723d637adea784d2	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.ppc	4adaa8fbc175e4a169c4767bc147fe1b288888cddfa4f1b39abc3fe250806ff7	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.sparc	n/a	n/a	elf
http://196.251.66.32/HBTs/top1miku.m68k	eb6913d816c810b0846bc7bf8dd6a19152cf078b0e4ddac040eda89ae0de8ac1	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.sh4	b3f1e7014dfba66c06190cfa803ea2dc947f59a0b6f437f3ec6f9263b34cb4a0	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6ef7163f-84dc-4286-b86b-0749da7dd478

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/81243c851e87fd9d49574f187c5e8d8e091cfa03d2ba8d467deb74abcb6d2df6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/81243c851e87fd9d49574f187c5e8d8e091cfa03d2ba8d467deb74abcb6d2df6/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-07-15 14:34:46 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qesdzbi6q76z2skxj4mhyxunryerz6qd2k5i2rt55n2kxs3nfx3a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250715-slctnagr8s/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware Config

C2 Extraction:

top1miku.duckdns.org

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/81243c851e87fd9d49574f187c5e8d8e091cfa03d2ba8d467deb74abcb6d2df6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.