MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8acda67209aa36edec5b42c8d50b2a45750287838203b789f364412a049a056c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8acda67209aa36edec5b42c8d50b2a45750287838203b789f364412a049a056c
SHA3-384 hash: 6c73144c2c414a4fc9af921f7f8a1356fe45131588c06f1d095df4ad2958f0226ec2af921ba4d710008d3bd8326e710a
SHA1 hash: 189360e2c1e9c56faf97ab163c1f9786441f984b
MD5 hash: 5cb699913334582b401ff5dc3137d200
humanhash: venus-mirror-social-asparagus
File name:zeros6x.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'704 bytes
First seen:2025-03-02 16:46:38 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:xmdmscC2FAJh3chRaLQDAksf5nRPmsuo3q:xmd3D2Fih3cjaLhJf5nx3h3q
TLSH T136517CCB00C687F1ADD5552271B98C447ACAF29BE8E31E459BEC24E4CD8DE8035D4AE6
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://83.147.13.230/Yboats.x8691cc660252d715a05c0a4978049f6da9dfed222f24bc81d30fc8a692a2350510 Miraicensys elf mirai
http://83.147.13.230/Yboats.mips40243b6a611a1d3e7f9b0de8bb2411e4f6a5b773adec2208ebb830fed5201ac0 Miraicensys elf mirai
http://83.147.13.230/Yboats.mpsld54e5102bc7216dd7eabc6ed65351f4e89fe4fb5315de4ea7be8d596475ebb5b Miraicensys elf mirai
http://83.147.13.230/Yboats.armc78f6c75175a6807af694e1e7fada1752d2f75ac034bae2ca2af56de12816cdd Miraicensys elf mirai
http://83.147.13.230/Yboats.arm5725731b14e7f70481f2c1fe7aaf6a1a6451cda2e83b1253b26511bf85378207f Miraicensys elf mirai
http://83.147.13.230/Yboats.arm6840fb6b83ee9bd96ac35d42d6a7a387414078c34b8f516c105a657593e263f73 Miraicensys elf mirai
http://83.147.13.230/Yboats.arm76393da324e211907bd040b7b75a0c9975ef18edac2241ce8c09a7a92a804890e Miraicensys elf mirai
http://83.147.13.230/Yboats.ppcb2df141acf83316ddb3cc379ba670275ace58dc1205e6ce75f9d8162cb8bb342 Miraicensys elf mirai
http://83.147.13.230/Yboats.m68k991819a70325fa070e2014dbcd8a2f0091c8ef99bd08f9663c0bcdabd34bf84c Miraicensys elf mirai
http://83.147.13.230/Yboats.spceffb69893beba12497bab7f34d35e34b6b42dc7ab35cd6bd6f58b34aed3e6941 Miraicensys elf mirai
http://83.147.13.230/Yboats.i686b239971ce019997f089bb1c8c21b8ab2abafddd0b30bc9f2cd9cc882791ec425 Miraicensys elf mirai
http://83.147.13.230/Yboats.sh4743e13adb624151962e836710320c7944b87b8a2a10b2bb2f9bc1aada64c5df1 Miraicensys elf mirai
http://83.147.13.230/Yboats.arc4bd47f2ad2d89f4e034c979a2a258f8ba622d629aca35c535db455da81471a70 Miraicensys elf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67c48bebc668b65489be6868linux22vpnfull_triage
Tags:
downloader trojan agent
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bash busybox lolbin mirai remote
Link:
https://www.filescan.io/uploads/67c48b9f4a3011c802c56748/reports/ec42a29a-93b3-4fbd-a328-26021e220087/overview
Result
Verdict:
MALICIOUS
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8acda67209aa36edec5b42c8d50b2a45750287838203b789f364412a049a056c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8acda67209aa36edec5b42c8d50b2a45750287838203b789f364412a049a056c/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-03-02 16:47:21 UTC
File Type:
Text (Shell)
AV detection:
21 of 38 (55.26%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rlg2m4qjvi3o33c3ilenkczkiv2qfb4dqib3pcptmrasube2avwa._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:unstable antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/250302-vak21aywcs/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Writes file to system bin folder
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (111321) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware Config
C2 Extraction:
scan.bigboats.icu
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8acda67209aa36edec5b42c8d50b2a45750287838203b789f364412a049a056c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 8acda67209aa36edec5b42c8d50b2a45750287838203b789f364412a049a056c

(this sample)

Mirai

elf 91cc660252d715a05c0a4978049f6da9dfed222f24bc81d30fc8a692a2350510

  
URLhaus
https://urlhaus.abuse.ch/url/3463214/
  
Delivery method
Distributed via web download
  
Dropping
MD5 bfef1b45b1e2962eabed72a91c6f13a9
  
Dropping
SHA256 91cc660252d715a05c0a4978049f6da9dfed222f24bc81d30fc8a692a2350510

Comments