MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bdba7a223775f6263e5df609095d4340e8e6e2eeec616f4175ecdf281076a68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bdba7a223775f6263e5df609095d4340e8e6e2eeec616f4175ecdf281076a68
SHA3-384 hash: b710788658ff86d63a3d62ad756955bcc481642352d1ccbb731917a7af89ae35fcded6db0e55228eff901c4435ff4502
SHA1 hash: 51d31cf568d67a673fff4433fece5e4060f8eb25
MD5 hash: 0825c98d7f07289fb5de62fc5a53b9e7
humanhash: eighteen-tennis-artist-west
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:6'359 bytes
First seen:2026-02-22 14:49:42 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 192:+j3mBp+OBq6Vp83rSC12mMk7sAIgnAEbPOZRbPOZRwofI85NwDHWGpii8Ur8w9xO:+j3mBp+OBq6Vp83rSC12mMk7sAIgnAEH
TLSH T161D12EF6B486127CDD9FC83A915129BD1189B98B26871D688BBE30757C89FCC2C45DC3
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x867d623e46695300ccb07b19e5d9835518737251483ec1dac12fbab8c57d1dfe11 Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mipsf78c72f80214a258dc7e69c06bc84f3175f69d7b5e49abdbcae67a9c225ca386 Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arc5d21226b83aa3cde424e129e75386d594dd43a08ed628dbd41c3135dcf0c128f Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i468n/an/an/a
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i6869fbd9afe9593e557a71687a9509da9b90788f7a95e0eff7ff79691e3d6bf4673 Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x86_64f382191265fb58efbdf592a740f280003d932bf3b647b033dea29d1f27c21937 Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mpsl6af9813c79842fe9e490f043d7eeceb1bcc35adec81d8dcfae947911ed146a7c Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm4e2a2a63f6d4206ea52688df473548e19b360ce9170a7aabea227a2a5d05d0f0 Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm592c7b4ef6daea605603fe3525305f7cc1af6d3338da514940877a92395f122b6 Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm67445d99bf22ba85941422f08ed5d00411b34366cb97188c2ba0f08d07242634f Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm7234e296e7f319dba55ea49467e8c3be28425a1ddd7d4343498e76ee684e5d0af Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.ppc4561aedbfca0aed412e8529f61dbe69f3d6896410d4c20c82794349a792c0838 Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.spc5bbc4a44267775d5268c97ae7a036d330cab86e85908b942ae1feefa7bc4dd09 Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.m68ke0aa2740d72df4bf227c0e5313225a116918c57e9b031cc2391fb042384f9fcd Miraimirai opendir
http://88.151.195.33/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.sh4ac8252ed014d64351f428943cd9a31ef7a716b2438d8aba8d84983ec0c23c7bc Miraimirai opendir

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive
Link:
https://www.filescan.io/uploads/699b17d397feb4afd651f27d/reports/d4ab81f3-0209-42e0-bd8a-0f7192f75cd2/overview
Result
Gathering data
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8bdba7a223775f6263e5df609095d4340e8e6e2eeec616f4175ecdf281076a68
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bdba7a223775f6263e5df609095d4340e8e6e2eeec616f4175ecdf281076a68/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-02-22 15:16:46 UTC
AV detection:
16 of 38 (42.11%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rpn2pirdo5pwey7f35qjbfougqhi43ro53dbn5axl3g7faihnjua._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260222-r7vqxsat7a/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes journal logs
Deletes system logs
Executes dropped EXE
Mirai
Mirai family
Malware Config
C2 Extraction:
9103843.duckdns.org
0837234.duckdns.org
dndn3829.duckdns.org
84920433.duckdns.org
92031819.duckdns.org
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8bdba7a22377/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8bdba7a223775f6263e5df609095d4340e8e6e2eeec616f4175ecdf281076a68

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 8bdba7a223775f6263e5df609095d4340e8e6e2eeec616f4175ecdf281076a68

(this sample)

Mirai

elf 8b0e43b3d141e2a934a6ec118b92b4b41cd1a6315f515360a3173e93c4d0b27e

Mirai

elf 7d623e46695300ccb07b19e5d9835518737251483ec1dac12fbab8c57d1dfe11

  
URLhaus
https://urlhaus.abuse.ch/url/3783560/
  
Delivery method
Distributed via web download
  
Dropping
MD5 b6a4435a2557242f548ae8bfc86305e7
  
Dropping
SHA256 7d623e46695300ccb07b19e5d9835518737251483ec1dac12fbab8c57d1dfe11

Comments