MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4b15ac50d03460b5cc4d2fe64c12bbffa068b1a583ecb4330198fc933a63578. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	b4b15ac50d03460b5cc4d2fe64c12bbffa068b1a583ecb4330198fc933a63578
SHA3-384 hash:	36fb7c03f5bc2f77d38cda25eb0f2c4a4cd4f80d0f30c0a55d8565def5d8db42ce27617061019e380b9d51146b7600a3
SHA1 hash:	bf960f674e6fbdcfe9a36fb096df1e74b4c9ec2c
MD5 hash:	086fb30181d1efd4020809a183f6f372
humanhash:	tango-maryland-march-quiet
File name:	newreaxe.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'169 bytes
First seen:	2026-02-04 00:04:35 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:i+/RjQbx7+ukIVYhANnLDJbuUqOTJ364M:idbx7bBNnL9bnJ39M
TLSH	T1BE5175F6A3C247305EA95637A3789904BC45E1F3B1862E649CFB29BEF84CE047405E97
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.x86	a032e7a7053822b6d37f8dc47c093ee0ba09ca5b95ad8413f8511fb0cf9c8abd	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.mips	50fb71af4bd1a64094411511e589a57204996c4d710205183077c33bd519a691	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arc	d76564ccae6da46add86edce0bb04f496cd1314627037762b9af384f8b559d98	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.i686	b5d446d3991fb2adbb7e31a3ecb733973183363f9efb07f32ec27272e835953f	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.x86_64	c032550cc344c3f14b7c564ea58a3c5159ed4e8edb4266f59bfc3e7e8a13ea9e	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.mpsl	eb3418495b5dfb16051c2de9bb8b5bc66e9b41e1d3d99e3ea99ff6a6d6259331	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arm	a438ffb10ea3becb4c73479c32cbbbbd4bc10d9fb0b6b7b9f098a10ae0edc325	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arm5	4a9c10ff6a733c2d5b6f36efe6bc90eeec03d8a02c3cfbb176ba3c6e8959281d	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arm6	e71d81bf192f040d0ea8745ee49be356c84ab886538fc96f2cae915e31b019c3	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arm7	888a0bbfc855fdd57b1ffc7959b837e1f75fb344b6a871eb3a96865ebf4938d8	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.ppc	a4f605c2274bb2aabae86e5b5fb0bfe540353981dcb49b4f3a57ae4fbfb64c8c	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.spc	70187d1faf0c941e42fabedcc9b769bda9090d5e90c4f9585c57b5d0bcca27b8	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.m68k	76c85b80fb3f7aac818f1d79d98750e665275d4060b5ba81c0366b9fe84ca948	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.sh4	17e065d59586f2fc634de3340309c609b8ed11c7606df41e6583cba42571169f	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Result

Gathering data

Verdict:

Malicious

File Type:

Script

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/b4b15ac50d03460b5cc4d2fe64c12bbffa068b1a583ecb4330198fc933a63578/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4d0a0e5c-7214-4339-962d-08594d01d156

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b4b15ac50d03460b5cc4d2fe64c12bbffa068b1a583ecb4330198fc933a63578

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b4b15ac50d03460b5cc4d2fe64c12bbffa068b1a583ecb4330198fc933a63578/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/b4b15ac50d03460b5cc4d2fe64c12bbffa068b1a583ecb4330198fc933a63578

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-02-04 00:05:46 UTC

File Type:

Text (Shell)

AV detection:

20 of 36 (55.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wsyvvrinandawxge2l7gjqjlx75ancy2la7mwqzqdgh4sm5ggv4a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260204-adedeaev4b/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b4b15ac50d03/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/b4b15ac50d03460b5cc4d2fe64c12bbffa068b1a583ecb4330198fc933a63578

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh