MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 923716f12912cf36d08e6ed72589d88e5cb58a815722b74816a0583b09d9e6eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 923716f12912cf36d08e6ed72589d88e5cb58a815722b74816a0583b09d9e6eb
SHA3-384 hash: e8e082d55ea61df068602782dcb75295b5c9efe8c5bf6ec35fd8fd7932d53224892012809f51589909a059065a24a0ad
SHA1 hash: 2048c8da026f6d3e242439f7d1a5e6aed3931744
MD5 hash: 0bac8b5b10909c5fd2134ba3c3d110f6
humanhash: magnesium-butter-item-arizona
File name:Oblivion121.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'930 bytes
First seen:2025-11-24 07:36:41 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vbUubb9bZ8XGbOKtbhHLbM+Jbfpbbdb2WbXO:vn1MGb1LTtF/6
TLSH T17D41C7C8231214772C595B2ABDFB9E14BDD04D8158CCEE8859DC34F844DEE4CA8F5AE6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://103.130.215.101/bins/jade420.x86n/an/aelf ua-wget
http://103.130.215.101/bins/jade420.mipsn/an/aelf ua-wget
http://103.130.215.101/bins/jade420.mpsln/an/aelf ua-wget
http://103.130.215.101/bins/jade420.arm4n/an/aelf ua-wget
http://103.130.215.101/bins/jade420.arm5fe953772e21b648e0639f17f412227249d83b3b39580c722041ba3fbe4ee7c8b Miraielf mirai ua-wget
http://103.130.215.101/bins/jade420.arm6c4bf4bf75729b88d993ceeaad8c04e1b6e2bc152446c4c2c989ae2617324e9c1 Miraielf mirai ua-wget
http://103.130.215.101/bins/jade420.arm7n/an/aelf ua-wget
http://103.130.215.101/bins/jade420.ppc978873a2bebb5a4c6bf0ff2a7e65c1edcd5e131f5812c8e370d535e68d7b0157 Miraielf mirai ua-wget
http://103.130.215.101/bins/jade420.m68kn/an/aelf ua-wget
http://103.130.215.101/bins/jade420.sh4n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
medusa mirai
Link:
https://www.filescan.io/uploads/69240b2d4e80e19848448bc9/reports/5c3f8645-6b0c-4896-8620-e7dcc62607f3/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-24T05:04:00Z UTC
Last seen:
2025-11-24T10:56:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/923716f12912cf36d08e6ed72589d88e5cb58a815722b74816a0583b09d9e6eb/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/923716f12912cf36d08e6ed72589d88e5cb58a815722b74816a0583b09d9e6eb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/923716f12912cf36d08e6ed72589d88e5cb58a815722b74816a0583b09d9e6eb/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2025-11-24 07:37:19 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=si3rn4jjclhtnueon3lslcoyrzollcubk4rlosawubmdwcoz43vq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:echobot family:mirai antivm botnet defense_evasion discovery linux trojan
Link:
https://tria.ge/reports/251124-jfza2avpbn/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (160961) amount of remote hosts
Creates a large amount of network flows
Detected Echobot
Echobot
Echobot family
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/923716f12912/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Mirai
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/923716f12912cf36d08e6ed72589d88e5cb58a815722b74816a0583b09d9e6eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 923716f12912cf36d08e6ed72589d88e5cb58a815722b74816a0583b09d9e6eb

(this sample)

Mirai

elf fe953772e21b648e0639f17f412227249d83b3b39580c722041ba3fbe4ee7c8b

  
URLhaus
https://urlhaus.abuse.ch/url/3715635/
  
Delivery method
Distributed via web download
  
Dropping
MD5 1b10e406e9bee083c2473e6c058013ad
  
Dropping
SHA256 fe953772e21b648e0639f17f412227249d83b3b39580c722041ba3fbe4ee7c8b

Comments