MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 955ad87811b51a67c7fa377b6939ee2c65577f346ead2988119289f5fdaa90e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	955ad87811b51a67c7fa377b6939ee2c65577f346ead2988119289f5fdaa90e0
SHA3-384 hash:	404e22ff4bbc9acb42c6ca90925b126cefb39c5da7774e00aa91f6a94f992acdc586f7c6ea69389147800a6e85ae950d
SHA1 hash:	28b8ddd3405e90b2385fe5c1718acfabb897bf7f
MD5 hash:	b4da03d74eb692925e426ae97deba843
humanhash:	queen-twenty-bulldog-table
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'929 bytes
First seen:	2025-08-17 07:39:47 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:izqhmlzAnElzLCXlz/ePlzakazvZlzaWaFvjlz9Ne9z4gelz0jclz7Svlzjkjzqi:iomlAElaXlqPlOpzvZlO3FvjlJyz4Zlv
TLSH	T1F85175CB03920A31AC63FA13FEBD8E9CB18190E518D67F46A5DD35E5638CD997044E87
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.156.87.56/hiddenbin/Space.arc	8c4df2d353f57c488fa39bacf52c40643bfb9c6df48f8d295f10f96159967542	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.x86	578f29fb877231efd438b58e7bb6f3bd2008c7e8df36691e300adb167d3cd675	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.x86_64	n/a	n/a	elf ua-wget
http://45.156.87.56/hiddenbin/Space.i686	n/a	n/a	elf ua-wget
http://45.156.87.56/hiddenbin/Space.mips	d7b6c9cf78a33b8a35a1c869de8dfeac33f01487e04e4cd22a92bed17238aa7f	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.mips64	n/a	n/a	elf ua-wget
http://45.156.87.56/hiddenbin/Space.mpsl	22226fde746b51eabf7ceac67564089ade41ae94b1ca73be6a486961ba90c408	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.arm	d3d69c391cb9d143aad7da984e4f48e0cb9f65b60e40fc8b2a878c5a2a446c12	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.arm5	3f6519894b6985cd7cdf755e9278408c97f6c319bdd9b00969f11087345011ad	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.arm6	09db7f6cbbb8eccff93c4269d335ca2c2d5a1d1862aeb044b56cf6a486bb5b1f	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.arm7	c45d553b1b2f9f197253bc4d9f587a2c751002c53d1ea2eb0bbdc9bb833fa034	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.ppc	fd7546f73ecf27be23606cd4bd3cddcd6c0ce8541bae9ce90fedcb844627047a	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.sparc	n/a	n/a	elf ua-wget
http://45.156.87.56/hiddenbin/Space.m68k	21d14c6eb2867424e9ab7a30ee3e7d21583ccf1799e54393a618a6ea3e7dcc63	Mirai	elf mirai ua-wget
http://45.156.87.56/hiddenbin/Space.sh4	ffcd255f7fec98622828de1a98db9f7b0ce9af13592cf2dbcff86db274e9170d	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/10cac7a2-562e-4db3-b25d-a48a05c0384c

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/955ad87811b51a67c7fa377b6939ee2c65577f346ead2988119289f5fdaa90e0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/955ad87811b51a67c7fa377b6939ee2c65577f346ead2988119289f5fdaa90e0/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/955ad87811b51a67c7fa377b6939ee2c65577f346ead2988119289f5fdaa90e0

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-17 05:39:42 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=svnnq6arwungpr72g55wsopofrsvo7zun2wstcarske7l7nksdqa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250817-jhsk9ssr19/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/955ad87811b5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/955ad87811b51a67c7fa377b6939ee2c65577f346ead2988119289f5fdaa90e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.