MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b0168bc82de4474ab817f559f3450a7caaff5daa05e327800712775c059f310. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b0168bc82de4474ab817f559f3450a7caaff5daa05e327800712775c059f310
SHA3-384 hash: 69f44e38812447abc6ca95fd0e7dae072dae427e908694ebb71648b1b01db61a8deb9963cd2719e914d96f544a30dafb
SHA1 hash: 09637ba05c8126ce40116fed69bc705e495acb35
MD5 hash: 7d937a7242fb21acfa44594e458f9786
humanhash: delta-helium-zebra-happy
File name:t.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:4'807 bytes
First seen:2025-12-13 07:50:08 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:1xeveoe1beEeqceyeHXn8NkCELdwIifiki1ji4iqgiOiHXwSdm1pCq6gHXd/pnJY:mWv1KjQZHXn8NkCELdwIifiki1ji4iZs
TLSH T1ACA1A0C9BAA1323389D8DD9AF61785AEB046E08082215FF476CD70FC78EBDC4DA80245
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://178.16.52.10/z/89/mipsb8efd9fc22ee259562c41a184ae8cf9d9228efbd58a20ccd2074476f63ea3c13 Mirai32-bit elf mirai Mozi
http://178.16.52.10/z/89/mpsln/an/an/a
http://178.16.52.10/z/89/x86_64n/an/an/a
http://178.16.52.10/z/89/arm4n/an/an/a
http://178.16.52.10/z/89/arm557c4be7164bd6838fd423f289cfa9ca76f77eae52db1cadac80b0ee2628f99c8 Miraiarm elf geofenced mirai ua-wget USA
http://178.16.52.10/z/89/arm6n/an/an/a
http://178.16.52.10/z/89/arm7n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
44
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox medusa mirai
Link:
https://www.filescan.io/uploads/693d1ac2900ee247e843584b/reports/a4fdb2a7-ed80-4358-81db-4fa4a82afa1c/overview
Verdict:
Malicious
File Type:
text
First seen:
2025-12-13T06:05:00Z UTC
Last seen:
2025-12-14T07:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8b0168bc82de4474ab817f559f3450a7caaff5daa05e327800712775c059f310/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8b0168bc82de4474ab817f559f3450a7caaff5daa05e327800712775c059f310
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b0168bc82de4474ab817f559f3450a7caaff5daa05e327800712775c059f310/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-12-13 07:37:45 UTC
File Type:
Text (Shell)
AV detection:
18 of 38 (47.37%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmawrpec3zchjk4bp5kz6ncqu7fk75o2ubpde6aaoetxlqcz6mia._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251213-jpja6sdw6e/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8b0168bc82de4474ab817f559f3450a7caaff5daa05e327800712775c059f310

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 8b0168bc82de4474ab817f559f3450a7caaff5daa05e327800712775c059f310

(this sample)

Mirai

elf b8efd9fc22ee259562c41a184ae8cf9d9228efbd58a20ccd2074476f63ea3c13

  
URLhaus
https://urlhaus.abuse.ch/url/3732787/
  
Delivery method
Distributed via web download
  
Dropping
MD5 7f1f09309771a31ba2b12e132a6398e3
  
Dropping
SHA256 b8efd9fc22ee259562c41a184ae8cf9d9228efbd58a20ccd2074476f63ea3c13

Comments