MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf1e49c7a7d5e451eb8280d36d465bc8782aef93b67606bb54982152c815aa82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	bf1e49c7a7d5e451eb8280d36d465bc8782aef93b67606bb54982152c815aa82
SHA3-384 hash:	feed3c1f2ff2b3b544c871d41dc838b657a3eb45c6fdc2aae0970f0a02efa839349a92bf468d63e1bdd10538bb2c9e53
SHA1 hash:	e004ec287238cd5fac9c2bb0e6b0743918c2c0b7
MD5 hash:	c55ceb36332b578f346c04fc585021d8
humanhash:	uranus-mango-georgia-florida
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'798 bytes
First seen:	2025-10-13 09:36:56 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:ipJi2pID9jpZDe/a/qspy3/LA7spIhjpGpfpsOsxEpRKAJpuR7LpD8UBJpUf5pWD:i+2W9jkIExEjif6EuAJq7LCKi5wPyEmW
TLSH	T1F351AF8518814B396CF6D92E73B9A408B1F980CBB4DB6F16DCDC74E6808DD59BC40B8E
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.141.49/main_x86	f31b2a135b8ddcb9722663b8ec4520b8924a2c38b8dd3c99e6bf6d19544aa91e	Mirai	elf mirai ua-wget
http://176.65.141.49/main_mips	0ebf90fd660237531739c37f1425f2d4e5f6ff31d1bae5b5a98c935bc21867ad	Mirai	elf mirai ua-wget
http://176.65.141.49/main_arc	n/a	n/a	elf ua-wget
http://176.65.141.49/main_i468	n/a	n/a	elf ua-wget
http://176.65.141.49/main_i686	n/a	n/a	elf ua-wget
http://176.65.141.49/main_x86_64	ee7c32f57efb86a285514da96e2598f7d81688c177ec3de92e4f828cd23b47f7	Mirai	elf mirai ua-wget
http://176.65.141.49/main_mpsl	43eb865a957058c8def3999c593386106d5b29598233768cc051e88a1ab96508	Mirai	elf mirai ua-wget
http://176.65.141.49/main_arm	dd0d12712ab5d8e4b26dbd5a059bd53d7e064ec8db2f2cf2a42e043c8dea2b7f	Mirai	elf mirai ua-wget
http://176.65.141.49/main_arm5	b3ae8570a382da334ef90b15c0fa21202d5115d32e2c7031e15576d6824adf18	Mirai	elf mirai ua-wget
http://176.65.141.49/main_arm6	e742ad42f67f70b3affdc31018fdea67666ab740b48adf4d0488c08fe21db994	Mirai	elf mirai ua-wget
http://176.65.141.49/main_arm7	9783c5a5f2e0a5e430ad7a84a5ef5572eec1ee2600e00c24b69f7140ca96bb6b	Mirai	elf mirai ua-wget
http://176.65.141.49/main_ppc	94f74449bbff8ee640fa827d4eca9a376df175ddad43dbcda1a2a2372e588cd8	Mirai	elf mirai ua-wget
http://176.65.141.49/main_spc	n/a	n/a	elf ua-wget
http://176.65.141.49/main_m68k	042febd0f4564e3ee998b8e38962c58a73b41cf1caac748c3cd4f54122d6c281	Mirai	elf mirai ua-wget
http://176.65.141.49/main_sh4	9d89128c9ddd6b99a29bb271a8f5555dfd27dffde8a1bccff44661e9c84a4c3a	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-13T07:50:00Z UTC

Last seen:

2025-10-13T10:00:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bf1e49c7a7d5e451eb8280d36d465bc8782aef93b67606bb54982152c815aa82/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/9c5d320a-d095-40a6-a2b7-3ae283b4c1b5

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bf1e49c7a7d5e451eb8280d36d465bc8782aef93b67606bb54982152c815aa82

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf1e49c7a7d5e451eb8280d36d465bc8782aef93b67606bb54982152c815aa82/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-10-13 09:37:35 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x4petr5h2xsfd24cqdjw2rs3zb4cv34twz3ano2utaqvfsavvkba._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/251013-llql7axmz4/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Traces itself

Mirai

Mirai family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/bf1e49c7a7d5e451eb8280d36d465bc8782aef93b67606bb54982152c815aa82

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.