MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8346ac3b9e7b30b788c583be8d16a776c8383972a31fc8b04fac4a7b6f3d6b31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments

SHA256 hash: 8346ac3b9e7b30b788c583be8d16a776c8383972a31fc8b04fac4a7b6f3d6b31
SHA3-384 hash: fa0a7125af004f4d762e772c1382c8b54eb3e84a974c643b38cf9becb3229d64d335f6a730925fd27723017546a76945
SHA1 hash: d1863a725e7be00b64b11bcf502d362c9fd6f6d5
MD5 hash: 6644bc1e306e65689f79353d5018caa8
humanhash: december-edward-magazine-ten
File name:w
Download: download sample
Signature Mirai
File size:873 bytes
First seen:2025-12-09 11:58:15 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:tgvVZffVZWVZFVZsRpVZZVZ5SVZ4SVZDVZyvVZQJVL:6VdV4VvVevVvVOVpVFV4vV2VL
TLSH T14C11A1BD42096578408EE816B1A2C70878BB8BDF34B7AA506D65723860F05DE3032F5B
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://213.209.143.64/zerarmb3327565abb469b5e72ec0a7507534510ccc60acb002cb2b283735323a112420 Miraielf mirai ua-wget
http://213.209.143.64/zerarm511be9259843c96c79c4fc470a75225739fe43edec7d8fe2fccaa26d52851aa92 Miraielf mirai ua-wget
http://213.209.143.64/zerarm61fe3d648a158c45350edc95a2b176a625df955c2e96e4deba7e51e647c827191 Miraielf gafgyt mirai ua-wget
http://213.209.143.64/zerarm785e820c56acd10a63589c956ac80b187e1519a5ce248684656763150c044a27e Miraicensys elf mirai ua-wget
http://213.209.143.64/zerm68k278ac054a48a876da96c72b249d39cb04e7955efbe847126cec66cc00c2cbfe5 Miraielf gafgyt mirai ua-wget
http://213.209.143.64/zermips3ec3f406ab6e32b212258e9dff737042afab96d29b78ae795512b58952ba89b9 Miraielf mirai ua-wget
http://213.209.143.64/zermpslb1ee0fe9064f62c1674ed8afbeb6d175feec0ce7bb61213e3cc5e66059e7b88c Miraielf mirai ua-wget
http://213.209.143.64/zerppccd10a5b32764ecda7837bb9641b02a7549b15556e2ca17c76e676ae0bc7b4310 Miraielf mirai ua-wget
http://213.209.143.64/zersh4e26b89d66f151074758de67da0e319991ab99abca8e192d7cc72212b7a5c3af5 Miraielf gafgyt mirai ua-wget
http://213.209.143.64/zerspcdbd0a83fd9c02f87e38f320be9fe7c80a71dc3cbfab365e016356cec6649d78a Miraielf mirai ua-wget
http://213.209.143.64/zerx868084d2a98a8a09aa1cc54171abd670623687ce3263160668cf54a606cc5f7e8c Miraicensys elf gafgyt mirai ua-wget

Intelligence


File Origin
# of uploads :
1
# of downloads :
62
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-12-09T14:38:00Z UTC
Last seen:
2025-12-09T15:18:00Z UTC
Hits:
~10
Threat name:
Linux.Worm.Mirai
Status:
Malicious
First seen:
2025-12-09 12:10:41 UTC
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 8346ac3b9e7b30b788c583be8d16a776c8383972a31fc8b04fac4a7b6f3d6b31

(this sample)

  
Delivery method
Distributed via web download

Comments