MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90f334965ba865614e629c4b6b02aeee9aa40adc45f81f5e80b0f1fcf2f674b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90f334965ba865614e629c4b6b02aeee9aa40adc45f81f5e80b0f1fcf2f674b6
SHA3-384 hash: 27c40ad5cd08312e4f486ec8d936784113bcf8ccbb008a9d11fc23840ed6d715a6f93a3c0dc2085b1a7c27fd893c573e
SHA1 hash: 61547932a8cc50ae3867978b494a4429a3bf05e4
MD5 hash: fa54c33a1e440c158089996723af3f3b
humanhash: early-spring-berlin-xray
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'407 bytes
First seen:2025-10-02 05:36:54 UTC
Last seen:2025-10-07 10:40:34 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:YymsngFhG/s9hTmTfc/UJuxLjENIeksrLW3Mn1fC:Yy3ngXG09lK3uxLIJrLE81C
TLSH T154618F8E12D2833798D967BE71B7C424F0C1D1C2A1EF9F0FE8D929E9914DEC52641963
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.94.31.127/MyFuckingBins/Labello.x86ccc6687d55dfeadf98b084e5793ea4d701bbaba59a7486532b1f548f6360112b Miraielf geofenced mirai opendir ua-wget USA x86
http://45.94.31.127/MyFuckingBins/Labello.mipse5418d13a80d3d12aa6defc35ee83d93548730d86ff298739a33b2e5be0a2356 Miraielf geofenced mips mirai opendir ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.arc36f916270f34cdf9dca6eca1839f453dbc72ec09c5e5b183e0f2be662b901cf0 Miraiarc elf geofenced mirai opendir ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.i468n/an/aelf ua-wget
http://45.94.31.127/MyFuckingBins/Labello.i6865d125863cda9a3413fb4fafb9663b9f7af06d2df1e403939b424aeed7f7fe3ac Miraielf geofenced mirai opendir ua-wget USA x86
http://45.94.31.127/MyFuckingBins/Labello.x86_64181772d1375e7c40c29e78937c2d8baa04810db808adf2814a4295e60810efaa Miraielf geofenced mirai opendir ua-wget USA x86
http://45.94.31.127/MyFuckingBins/Labello.mpsl3710c2270c07a02df0c2a8e2582b2142ca5384d7cf102474bedd9137b00362d1 Miraielf geofenced mips mirai opendir ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.armc8295c8b5be86dbda4da6c0df624eeb7190ef156e5a3b6264923d02a53d7a3c2 Miraiarm elf geofenced mirai opendir ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.arm587b2e84ad84e8bc204b6be5483d78855af000e999f0b63c47c86566963c55dcc Miraiarm elf geofenced mirai opendir ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.arm69db960ba3c7049755dba3ad900f4f4709795cc090cf1ed2e6be1cfb1db713ede Miraiarm elf geofenced mirai opendir ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.arm798177fbf9d8537b709dd37dbc170f97085bd809fc400298fee0dd8f489375cd9 Miraiarm elf geofenced mirai opendir ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.ppcd4372744acf13969afac12150781b853ebd19f0a01447816763fe3949e351b74 Miraielf geofenced mirai opendir PowerPC ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.spc3850533162a9a2790f751d0ffdec398b8329237663bf5463ecf9f695d09a7c7c Miraielf geofenced mirai opendir sparc ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.m68k934fe47ae1664567345559c342eba464aa377c1bdd50d728ba070f9343c7fc30 Miraielf geofenced m68k mirai opendir ua-wget USA
http://45.94.31.127/MyFuckingBins/Labello.sh4ef33efbfbe671d27b31f2df01219e68f2e3bfcd66956a9fd8b9a8151a9b75d50 Miraielf geofenced mirai opendir SuperH ua-wget USA

Intelligence

File Origin
# of uploads :
3
# of downloads :
48
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-01T04:37:00Z UTC
Last seen:
2025-10-02T10:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/90f334965ba865614e629c4b6b02aeee9aa40adc45f81f5e80b0f1fcf2f674b6/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/90f334965ba865614e629c4b6b02aeee9aa40adc45f81f5e80b0f1fcf2f674b6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90f334965ba865614e629c4b6b02aeee9aa40adc45f81f5e80b0f1fcf2f674b6/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-10-01 09:35:32 UTC
File Type:
Text (Shell)
AV detection:
16 of 24 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sdztjfs3vbswcttctrfwwavo52nkicw4ix4b6xuawdy7z4xwos3a._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251002-gcfy6shn6t/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes journal logs
Deletes system logs
Executes dropped EXE
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/90f334965ba8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.42
Link:
https://yomi.yoroi.company/submissions/90f334965ba865614e629c4b6b02aeee9aa40adc45f81f5e80b0f1fcf2f674b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 90f334965ba865614e629c4b6b02aeee9aa40adc45f81f5e80b0f1fcf2f674b6

(this sample)

Mirai

elf ccc6687d55dfeadf98b084e5793ea4d701bbaba59a7486532b1f548f6360112b

  
URLhaus
https://urlhaus.abuse.ch/url/3639112/
  
Delivery method
Distributed via web download
  
Dropping
MD5 8e6f0112ce912d4c8535cf803f762e62
  
Dropping
SHA256 ccc6687d55dfeadf98b084e5793ea4d701bbaba59a7486532b1f548f6360112b

Comments