MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88f866570b6d393287a7fd8261aabb61a5962372196362b44d96fa6b5c2dd9d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	88f866570b6d393287a7fd8261aabb61a5962372196362b44d96fa6b5c2dd9d3
SHA3-384 hash:	4445a19b4c72080d3bb7ccd86854e576677c9654c62adee93cedf160d2d6298125b8a1e65998c91a2c9272e79ab1eb92
SHA1 hash:	0db404fed24dbe9b21263b94da2e24c55d89091e
MD5 hash:	95ef8d539286c12a92b86a696e7d6a26
humanhash:	connecticut-foxtrot-solar-delaware
File name:	giga.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'808 bytes
First seen:	2025-07-19 17:39:45 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:S1dyd81dAdK1dYudY3df1dFd01deMdexL1deRdeUu1dvcvdvgj1dvBdvp+1dvqd4:Sr28rkKrvArb0re4exLre/eUurvcVvgQ
TLSH	T19E51A78408D78276AC759F37F9AB8268349E90DB79C1AEB244FD3CF1444DE045896E93
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://196.251.66.32/HBTs/top1miku.arc	a6ead5ecc5a093af2dd8f9cd7b44db97a3077e888ed6fed6598a68ecad756df0	Mirai	elf mirai
http://196.251.66.32/HBTs/top1miku.i586	ebac11af23f5d447139124bffa1c56429adf2132ea21eba3aed21ecad2423720	Mirai	elf mirai ua-wget x86
http://196.251.66.32/HBTs/top1miku.x86_64	d98f7aaa9e2aa30f86d5f7c88bc2e895bee6adeebc6d87a904bd28e6f9e01810	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.i686	386ed38648148fb805047a802ac6c25485bee146667b0a7f0940b388630a0285	Mirai	elf mirai
http://196.251.66.32/HBTs/top1miku.mips	a77e7186ad2e7b858f23a9f1d3d5d6365481fcf8bf212a6d49b50ba9f9ae046f	Gafgyt	elf gafgyt mirai ua-wget
http://196.251.66.32/HBTs/top1miku.mipsel	2278610b46274d256bef90a582804de656311472aedbb00c1e61a7ce801468f9	Gafgyt	elf gafgyt mips ua-wget
http://196.251.66.32/HBTs/top1miku.armv4l	61074be715c8549eedb1ff4e8f61f3b2ba72918f588b81f33cf285ce1cee3034	Mirai	arm elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.armv5l	cff95b9961ac1757bcba78d775bf142fb4c9134327f823d63a6f26704be7805e	Mirai	arm elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.armv6l	2b4fed8258475b2cb9a33688c0755df646c6473ddac66e7f2d27998f367778e6	Mirai	arm elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.armv7l	4764a1efb1dda2cc50f294de2884f1a67b68acbcf6d3fdb168c26ae59b599028	Mirai	arm elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.powerpc	beaa0f74467ee44b441389fb674657e93bdb4080452567fb4f7874de7a3b783a	Gafgyt	elf gafgyt PowerPC ua-wget
http://196.251.66.32/HBTs/top1miku.sparc	n/a	n/a	elf
http://196.251.66.32/HBTs/top1miku.m68k	eb6913d816c810b0846bc7bf8dd6a19152cf078b0e4ddac040eda89ae0de8ac1	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.sh4	b3f1e7014dfba66c06190cfa803ea2dc947f59a0b6f437f3ec6f9263b34cb4a0	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/e51ba5c0-595d-4f46-b005-7e6e3f6feabf

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/88f866570b6d393287a7fd8261aabb61a5962372196362b44d96fa6b5c2dd9d3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/88f866570b6d393287a7fd8261aabb61a5962372196362b44d96fa6b5c2dd9d3/

Verdict:

Malicious

Threat:

Downloader.Medusa/Shell

Link:

https://tip.neiki.dev/file/88f866570b6d393287a7fd8261aabb61a5962372196362b44d96fa6b5c2dd9d3

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-07-19 17:40:35 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rd4gmvylnu4tfb5h7wbgdkv3mgszmi3sdfrwfncns35gwxbn3hjq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/250719-v848jaxzf1/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Enumerates running processes

Modifies init.d

Modifies rc script

File and Directory Permissions Modification

Executes dropped EXE

Contacts a large (1900489) amount of remote hosts

Creates a large amount of network flows

Mirai

Mirai family

Malware Config

C2 Extraction:

top1miku.duckdns.org

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.