MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9164fdfbb0423dd8f7117459ec89740fc110ccf18a0015360781188a1ecccbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	a9164fdfbb0423dd8f7117459ec89740fc110ccf18a0015360781188a1ecccbf
SHA3-384 hash:	9ceff2c2a410f6940fc9c6f3c435d4297e5aa0e97daddb9dc7f0fa77c9599682619e04017a83bd5477911636dadf51fc
SHA1 hash:	342cc9ace50c4eccb8569677555ba7a8da10de14
MD5 hash:	0a2815f566a3f8bd2a4db08579aa1c1b
humanhash:	jupiter-crazy-shade-salami
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'077 bytes
First seen:	2025-08-10 00:00:46 UTC
Last seen:	2025-08-12 00:51:16 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:YQr5QCXQ5dQS/Q8rQIrQftf1QvxQYPLQTjJQq/QujQdVQ9/9BgJsQSDk:YGxEtvLaunLIJPMClBgJszk
TLSH	T11451B1EB27824A736DBA8EE736A8840875C5949FD4CF5F7555ECFCB8808CE08B442653
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://196.251.114.181/bins/morte.x86	8bc6abe5f1f3d9010949e535920ec4b8bb996c7c726c078d1c6d53b7647f814c	Mirai	elf geofenced mirai ua-wget USA x86
http://196.251.114.181/bins/morte.mips	a3ffef056a3d62d106749d489819683a30cf2db48b6e265f12dc3494e9538895	Mirai	elf geofenced mips mirai ua-wget USA
http://196.251.114.181/bins/morte.arc	1ceee7e5264174e8ecaf51b61ef423c4484beac1e2278db8a70af7d14649e84e	Mirai	elf geofenced mirai opendir ua-wget USA
http://196.251.114.181/bins/morte.i468	n/a	n/a	elf ua-wget
http://196.251.114.181/bins/morte.i686	748e12e023eaa4c1d349efa65126224a484b6bec2667c9cff34140d0b7dd23a4	Mirai	elf geofenced mirai ua-wget USA x86
http://196.251.114.181/bins/morte.x86_64	888b144a8dfa1af4ec91915e37f96f52c4589cc2f9048d6574d2f69ca24871ce	Mirai	elf geofenced mirai ua-wget USA x86
http://196.251.114.181/bins/morte.mpsl	c7107f511fae8c78ad8a796b1fd293ce236c50c92ba33640fd908cbcd69eae17	Mirai	elf geofenced mips mirai ua-wget USA
http://196.251.114.181/bins/morte.arm	68a55de8c554359d63be31102c7020843d1610a59348a064d42d2ddc84edbf4a	Mirai	elf geofenced mirai opendir ua-wget USA
http://196.251.114.181/bins/morte.arm5	d5c07001ad8a565f451d6f0ece703e68c1acc552b4ef85672c60f5f6ee0a004f	Mirai	elf geofenced mirai opendir ua-wget USA
http://196.251.114.181/bins/morte.arm6	d15d68e98575a59ef06a2822852faae0f74296c82fc565579a8999e59c8e120b	Mirai	arm elf geofenced mirai ua-wget USA
http://196.251.114.181/bins/morte.arm7	5b4f9a2dad271887e3298e1f44659a080f05f78b0bf6f5c00f12c0201f87f1d2	Mirai	elf geofenced mirai opendir ua-wget USA
http://196.251.114.181/bins/morte.ppc	abce0be6a999f8e2514fdc1aa2704e8fd767b98c03305e36c22114bdf2f7f5a4	Mirai	elf geofenced mirai opendir ua-wget USA
http://196.251.114.181/bins/morte.spc	af5843158f13539f49d831a9980f20ab9b916a8bc124d2e95e1e30be9de86d76	Mirai	elf geofenced mirai sparc ua-wget USA
http://196.251.114.181/bins/morte.m68k	8b45175fc2ac81934a449298b10b9d040c7c9645d9e744282b79535ff3892f48	Mirai	elf geofenced m68k mirai ua-wget USA
http://196.251.114.181/bins/morte.sh4	6b440abc9ffc3afc2772281adca749d6c485bd4195619ef6ea4d264f9738adf3	Mirai	elf geofenced mirai SuperH ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/ea2296d1-1b65-46e0-90be-3b4dc81098b4

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a9164fdfbb0423dd8f7117459ec89740fc110ccf18a0015360781188a1ecccbf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a9164fdfbb0423dd8f7117459ec89740fc110ccf18a0015360781188a1ecccbf/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/a9164fdfbb0423dd8f7117459ec89740fc110ccf18a0015360781188a1ecccbf

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-10 00:01:45 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vele7x53aqr53d3rc5cz5sexid6bcdgpdcqacu3apaiyripmzs7q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250810-aavwzsznw3/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

UPX packed file

Deletes log files

Enumerates running processes

File and Directory Permissions Modification

Deletes Audit logs

Deletes journal logs

Deletes system logs

Executes dropped EXE

Mirai

Mirai family

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a9164fdfbb04/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a9164fdfbb0423dd8f7117459ec89740fc110ccf18a0015360781188a1ecccbf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.