MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ecff67913822cba865d3f69777425e16c8eee250e13cc88fd2c21add4d785d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	8ecff67913822cba865d3f69777425e16c8eee250e13cc88fd2c21add4d785d0
SHA3-384 hash:	7d2c98acdef4a270aa9ee638e44bb0643c1399e220cc4bcbad05902d9f80fb2cdea9073451abc0001b6f1e81f47c5138
SHA1 hash:	62436518e1e3437322e2d8aa556f83c0cd2aaa74
MD5 hash:	81951bd4758d495ca424ac721e97b184
humanhash:	sixteen-florida-kentucky-asparagus
File name:	nullnet_bash.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'795 bytes
First seen:	2026-03-03 12:47:31 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:v4BB4IX4vl41B4GTn45h40j4o54zN4sB43t4GkGO4ez4GD4kk:UW
TLSH	T1B37182D42370C3377CA2463614B95ED863C5AEE791D58EE0B0BA3F61C88DE4C2E947A1
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.142.209.47/nullnet_bin_dir/nullnet_load.x86	f89d25a12a3642fc6493fdb10967afb4d7ff12dcec9ddd4b5c4343e03aed97c1	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.mips	92a65e4fa18cd21fac7a1b63d19793de325807f2b75781ac56feda3b90d2b54d	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.mpsl	cc82b3051e31143956d3e04c3de9bd03f5a9c3f452fa7e6596ae5741a9e3bec7	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.arm	5a883f181447faaf82ebfcbfd91e49a979e3e6db9c41e954f9af79f5a1b691f5	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.arm5	2581dc4fa78b2561596d4cbe7e62c0fa3f8881c2af5b5ff14a77f80334b69173	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.arm6	c726e56fcb2693456279ba27fe9267832d65d39e656e681190833f01e7dca83c	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.arm7	3669ac19d7ca04e7de7fee18b07ae0ff08ba9c9f1f1ee4b44ba85c79769eaa92	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.ppc	d07b76ec268a4cebf4718c40037a6a855dd75385e6841e5788f899cedcb1d4d1	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.m68k	6b727573a20e52183dd2921068626f205bf9abef811aa17f1493ef0634a6ac97	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.sh4	a9df931f5322690419c8a1e01007f64b42258283a64757fb2023590ee517c27b	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.spc	9c42c8d446d50efbf0c526a56ee5c55cccac24885c030bf5c1110fada30cd7fe	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.arc	952d50fbeba80966a785dc0a427b7514b7d4f0f8b13c072095bdef8dc757f66b	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.x86_64	755d0635bb1effdf27f5f828ccdae96ffbe1bef6839f445168ec3611e65c77b9	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.i686	f8eea1f5af1af4eb4f5c9ce1f38d65a99ecb1ab5915b7f9cc1c53f290d4b3e79	Mirai	mirai
http://83.142.209.47/nullnet_bin_dir/nullnet_load.i486	5eba349021e95339d69fc905707f5be3b7876fb5f74bec0a65bb520f52ebf0f6	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

medusa mirai

Link:

https://www.filescan.io/uploads/69a6d88dcd25bfe1dfdf1b09/reports/7bca976e-4cf0-4c2c-b5d2-0af18fc0bba5/overview

Verdict:

Malicious

File Type:

unix shell

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen

Link:

https://opentip.kaspersky.com/8ecff67913822cba865d3f69777425e16c8eee250e13cc88fd2c21add4d785d0/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/2f289cb9-d2fa-4795-ab3e-229c1c6de0f5

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8ecff67913822cba865d3f69777425e16c8eee250e13cc88fd2c21add4d785d0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8ecff67913822cba865d3f69777425e16c8eee250e13cc88fd2c21add4d785d0/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/8ecff67913822cba865d3f69777425e16c8eee250e13cc88fd2c21add4d785d0

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-03-01 12:11:31 UTC

File Type:

Text (Shell)

AV detection:

22 of 36 (61.11%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r3h7m6itqiwlvbs5h5uxo5bf4fwi53rfbyj4zch5fqq23vgxqxia._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:ecchi antivm botnet credential_access defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260303-p1vq8sgs9w/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

UPX packed file

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (28806) amount of remote hosts

Creates a large amount of network flows

Mirai

Mirai family

Malware Config

C2 Extraction:

83.142.209.47

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8ecff6791382/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8ecff67913822cba865d3f69777425e16c8eee250e13cc88fd2c21add4d785d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh