MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9115fbb78cc1ce44275e44500738a04decb3f51dfc506cbeb224b69ec2876a67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	9115fbb78cc1ce44275e44500738a04decb3f51dfc506cbeb224b69ec2876a67
SHA3-384 hash:	140191220abcd2d24a99548d11d9ffe9c6076565a157b4906d7bf21d9651b4e1f1e9d055f6f0676adc3ce19cc65a3362
SHA1 hash:	a23e8c115e208c16d5ba1dadd4adc54425958853
MD5 hash:	d6b0ba27be97eeeeb1a5ea305eb180f7
humanhash:	avocado-salami-sixteen-winner
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'344 bytes
First seen:	2025-12-28 08:14:28 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:iNE3NpFNaE2NE2EGLesNzxNrBNlolxN43NTFLNshJNtlN020y56sNOzNirNFt0:iqBYZ/DcW3Lm5mly56sE8R0
TLSH	T1B56173CAB29603F39DF24BAB72764C4437E4A1E644C6AE15A5DCA4F10A4DD3C740B5D3
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://41.216.189.149/HOME/Mark90c80.x86	e2bcf189c377f8a005f152bad20c89f66f74dfd40f6c5432b5a2e01831ba014e	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.mips	271d6a0e041ad8a3fcb638d869b36abc1d358509f69a57817c561723973dd305	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.arc	64e28d40ae1b261c53dafe3ede379e4286e5cf16bec6839486df9cd96fe1cb0b	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.i468	n/a	n/a	elf ua-wget
http://41.216.189.149/HOME/Mark90c80.i686	5c3143983ed8466d1dfad3b559c5e889431ca53c41b9ea8fb523e7f8ec17d781	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.x86_64	62cebcf7aabaff4f582c281f620811e45a16ac5e5fcfdd782f8748dc01c18a17	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.mpsl	88c5165e657f1257c2968e8d7653f72128db4128741ee59a421b5456279ef0f8	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.arm	eb32c5d648cb6ac14419232cdb50f6babd4f1034b16b1bb0b7a9491b1c394a3a	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.arm5	6e04ebb5902187654c319021840c486cbc8e9202325d35fd668b5545956d6d7c	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.arm6	n/a	n/a	elf ua-wget
http://41.216.189.149/HOME/Mark90c80.arm7	n/a	n/a	elf ua-wget
http://41.216.189.149/HOME/Mark90c80.ppc	87d5d6f02f582b4ce13433f4dad7f428ea812bfdc6b3fdc5983ec5c1ecb6bc1a	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.spc	n/a	n/a	elf ua-wget
http://41.216.189.149/HOME/Mark90c80.m68k	3155e9279470b9498e8b9f70a9bf57a6351be5fb47ddc2e5dc3a57456771c271	Mirai	elf mirai ua-wget
http://41.216.189.149/HOME/Mark90c80.sh4	ed7f373864180e1c167c8bc9d45725b7d7c3df7604d7834280b0f2003d52d948	Gafgyt	elf gafgyt ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive medusa mirai

Link:

https://www.filescan.io/uploads/6950e71be126b9ff4393c6b5/reports/9c1935cb-56a3-4c1e-9d6c-c4e897e25f3b/overview

Result

Gathering data

Verdict:

Malicious

File Type:

Script

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/9115fbb78cc1ce44275e44500738a04decb3f51dfc506cbeb224b69ec2876a67/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dab74eb6-e0c3-4b6d-993a-39aef5bb72e3

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9115fbb78cc1ce44275e44500738a04decb3f51dfc506cbeb224b69ec2876a67

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9115fbb78cc1ce44275e44500738a04decb3f51dfc506cbeb224b69ec2876a67/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/9115fbb78cc1ce44275e44500738a04decb3f51dfc506cbeb224b69ec2876a67

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-12-28 08:15:25 UTC

File Type:

Text (Shell)

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sek7xn4myhheij26iriaoofajxwlh5i57rigzpvses3j5quhnjtq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251228-j5rmgsgx5b/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

UPX packed file

Deletes log files

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Deletes Audit logs

Deletes system logs

Executes dropped EXE

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9115fbb78cc1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/9115fbb78cc1ce44275e44500738a04decb3f51dfc506cbeb224b69ec2876a67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh