MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 841650f051565d262f72c66ba29408fba38e0e6e771a110a4e9509cdad5b75ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	841650f051565d262f72c66ba29408fba38e0e6e771a110a4e9509cdad5b75ad
SHA3-384 hash:	fbd6f871c25409e2729a159ddb27a32471fba54bf3beb38af761e7d0e88ab217d66a3c5ab46d93d1ea7068e02ed7e8b2
SHA1 hash:	6e9564d12187bbd20fd730af90f8670175e322b6
MD5 hash:	f62fb7683b734db9c71f4e981afd68af
humanhash:	foxtrot-double-eight-delaware
File name:	mq.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'796 bytes
First seen:	2025-04-15 12:17:54 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:15Of505M5VtBy5I5Xs5HU5t+5q6Ha5U5w5k5MW:15g505M5PBy5I5c5HU5w5q6Ha5U5w5kl
TLSH	T1DC317EDA21F516B02FA0A577F6688C017DE8E2CE09CE2F196EDC38FB40DDE446508687
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://pirati.privatedns.org/mqms	646e22539c017087ee8c76af0e3e9a1d9fdd16f9f3dcb60697e1440eabf23596	Mirai	elf mirai
http://pirati.privatedns.org/mqml	af9ffeb5447b6d7982a82fca7122fe9310e1d2d2966f60efcad6641214e36023	Mirai	elf mirai
http://pirati.privatedns.org/mqsh	7419328518ce5180c4bd0fae15f950d61218eb00403d1f61991cb0fb4583aa87	Mirai	elf mirai
http://pirati.privatedns.org/mq86	959caba248cbae06b4c76a4508003bd9d652bbd9867702a80645a7910d356320	Mirai	elf mirai
http://pirati.privatedns.org/mqar6	1e613f3f1bfd5ccbf190aa43b152eba8cdfb61c0a81b1dd6ab753b100ffefeec	Mirai	elf mirai
http://pirati.privatedns.org/mqi686	696a6982fde964537da8553c138cd575a4de65b225b5d37c73bc974a583306bd	Mirai	elf mirai
http://pirati.privatedns.org/mqppc	904077235a9d94979a1eaaa011f9fd6a1bf40620dd6b95b4e9387fcc1fc82e46	Mirai	elf mirai
http://pirati.privatedns.org/mqi586	4c1632ab85b2392ffd53012575887c6787221e041a926d50b24fc4a1854fc5e0	Mirai	elf mirai
http://pirati.privatedns.org/mqm68k	4cce7ffe9eb4be605c6119be3df62c8caee9ccf0737bc2b824317f79bb54e777	Mirai	elf mirai
http://pirati.privatedns.org/mqar4	fd8890a2ccf009d7531cb7e6beaff7160dc27342752abfdfc46af54f756118b6	Mirai	elf mirai
http://pirati.privatedns.org/mqar5	09aeb79d5573cacc33892805983522c6358505d379db4d8240572579ee212760	Mirai	elf mirai
http://pirati.privatedns.org/mqar7	5b735289f2cb3a772aade1d19cc53ac822497a6adeeed13f32f65e321af732fe	Mirai	elf mirai
http://pirati.privatedns.org/mqspcr	0b2459db45b900b80bc56a95a66877810fafde3623962177d605648ff6237cd6	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67fe580bd6e7c3effad3762elinux22vpnfull_triage

Tags:

medusa virus shell

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67fe4e8f89fec6b88b9d311b/reports/ecb07c98-27ce-49d2-8e48-b0e9e1bee1b5/overview

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/841650f051565d262f72c66ba29408fba38e0e6e771a110a4e9509cdad5b75ad

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/841650f051565d262f72c66ba29408fba38e0e6e771a110a4e9509cdad5b75ad/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-04-15 12:18:21 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qqlfb4crkzosml3syzv2ffai7ory4dtoo4nbccsosue43lk3owwq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250415-pgr61atnx8/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/841650f051565d262f72c66ba29408fba38e0e6e771a110a4e9509cdad5b75ad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.