MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abdc8e3e53c5c9b33da7d0bc1c25ca005802e39c86b88fcf18f4524d76e54c72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	abdc8e3e53c5c9b33da7d0bc1c25ca005802e39c86b88fcf18f4524d76e54c72
SHA3-384 hash:	b10fa9bd80647c89dc48111cf6fee3c34f48b9ccda0ba203ae42a5776ae1d9823cba4e9779e1095719680fedb9b5c64f
SHA1 hash:	60971cc4f9a57c3b6d6e64c5fe38624f55c72786
MD5 hash:	e7305ad2ae2e8337c8481a97996bfb57
humanhash:	comet-angel-hawaii-hot
File name:	cache
Download:	download sample
Signature	Mirai Create hunting rule
File size:	4'230 bytes
First seen:	2026-09-02 17:59:53 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vIUnUGTlUUUKEU8UnUZU2UFU+UyU9UNUTn:vIUnUOUUUKEU8UnUZU2UFU+UyU9UNUTn
TLSH	T1179161852B431BA53E3D9A2279DDC72C724685D9C8866FC5F0DFFAB04E88DCA6C44152
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec
Tags:	mirai

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86	f6436608095cd0d25dde490e6ce7b23c9bad762f278efae6aa0201a9a68b3cba	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips	0bbece3dc42199a2cc3db4e7685e5e6078084203e51e9ef6df657038cf79b306	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl	b689280b4f803b16c44dfec32d1090db70bafb18e35555d118519b79a5b7db4a	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm	a69adca11b2ae199c00bd0d3d74535bb5aa3680b7e0de357f3d3c1428fb29aaa	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5	4d80e50e552afd5bbf41ab84d845af4f3c341f70cac63e00aa37dbca91d2dd49	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6	691a464914194f0afc7524c2b1e4b555c28acbbc8ac8ce7c33d461f3806084ec	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7	cda83543753c272fe863864f34ac08d58683728775e23e012e95c6444330cb27	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc	f76b038b85f69142fe80b5a143b9f491cf0761988056d5b3eb3537b675c2f90f	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k	af3ef8ab9299f332e26daa23770cd35182fc4df18344121b3987f4ad7f9685da	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4	2d25f6667a62114c9baf23023b73ae11e82b970c092db36f8914cc3f0b26e835	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc	09710f936607bd3d1a1bc98f2117da196c55f6aed502f956eb0d915e960dacd5	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arc	e103ac29edb9ccc98a0e98c70b7de87c88eae785ad02f6749eb8b56847bb138a	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64	824a99f86dfe040a4df41bbc5af8b48070e8926d405d078dca8f54a03de73659	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i686	0de0aa09779fc1dc5339d362dcfc40453a0b8747d52913487088f54b45798af9	Mirai	94-154-43-118 elf mirai ua-wget
http://94.154.43.118/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i486	2df5084ae76cb1ed6ad44febbc7dee9e3dc77afe4299e4013c9c4a38fc8cac0c	Mirai	94-154-43-118 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

downloader mirai

Link:

https://www.filescan.io/uploads/6a986558747afbeb2afb82eb/reports/6dddb32e-63a8-4873-92d0-55c84c2fe492/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/0b286628-072f-48ab-81ad-c281108910f5

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/abdc8e3e53c5c9b33da7d0bc1c25ca005802e39c86b88fcf18f4524d76e54c72

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/abdc8e3e53c5c9b33da7d0bc1c25ca005802e39c86b88fcf18f4524d76e54c72/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-09-02 17:59:18 UTC

File Type:

Text (Shell)

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vpoi4pstyxe3gpnh2c6byjokabmafy44q24i7tyy6rje25xfjrza._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/260902-wlqx3ack3t/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (52548) amount of remote hosts

Creates a large amount of network flows

Family: Mirai

Malware Config

C2 Extraction:

hey.stresser.fan

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/abdc8e3e53c5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/abdc8e3e53c5c9b33da7d0bc1c25ca005802e39c86b88fcf18f4524d76e54c72

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh