MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfd1f0be53cfb0e9a04d243d6e84298b2ee999ac23a217b3a900a209bb3b88e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfd1f0be53cfb0e9a04d243d6e84298b2ee999ac23a217b3a900a209bb3b88e5
SHA3-384 hash: 8caa2c1bd16d098c6e63e4d3a377262312e3956cd74c3efca858bffc861132992e5de59f864cad1b14b45a718c3502f5
SHA1 hash: 7e2a3569c4d79b8275f266d0b6050cd65da1ca09
MD5 hash: 8448c94aedac14e244368b68bdf76ef0
humanhash: uncle-romeo-sweet-violet
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:6'359 bytes
First seen:2026-02-28 14:33:52 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 192:ni3mBYnOBqT0p8367C12/Vk7sZxgnAdqPOZwqPOZwJofIFoNwDGvGpiLFUr8JMxA:ni3mBYnOBqT0p8367C12/Vk7sZxgnAdO
TLSH T187D12DF2B496627DDD9FCC3A9121696D1085AA8B27870E68C7ED307A7C89FCD1C449C3
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x863256c835e73b163a6cfabc8d9bd25f589bfeaae780af4acb89f57cb163bb7ef8 Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mips6e47162196d5df15717ec7ded37e9482ffa91eca0a4be1a0b79df3b0e38ccded Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arc03052b7ea3d80c3fa053f35cc1c3b00b5a18df51dbfb5df5db9d7e66a9707e1c Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i468n/an/aelf ua-wget
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i686d486c6efdba18482230997e2fc3069bbd8c9f0033df69e52f3ee42627600c921 Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x86_64a043c68516caff545cf2d60b96ea47d63f7996640a735b138188acaf253d9456 Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mpslbda95274f046e313e9d21e415aa1dffd7892ef83021ed3720fafa78cc331440f Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm1bff5bcd75bb6af3874b2a18b975c16825649f141dbeda1ea2152b8937b9d424 Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm58789c35824204284924a4f523938dc18e93a3b07967e6319e718c0ac95ade8fa Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm6c12601f8c9258a80722b147878d99e10ffe9252bb3373a1b62813b4145ee6229 Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm7b8cfddc51a547b11dd5f36f7711b901a701b8346fe3a83a61fc2411e2b4179eb Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.ppc4f424be0353c60fda7efccac20e54a098a150328688f2a40adf0901bae75219a Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.spc769dbb9461f3b119bf700bb5b44edc475975bbe078a4b911ac36496bc8bd8af4 Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.m68k314f44fa3879fd01ec61eea36b7aa02d9753339bb607072260596892b3f85966 Miraimirai opendir
http://142.54.160.11/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.sh42fb7cb98eab2f6445437455ca13b4a24f212ccf81cebb3ade7551c5a7de8d2bf Miraimirai opendir

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

Result
Gathering data
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/bfd1f0be53cfb0e9a04d243d6e84298b2ee999ac23a217b3a900a209bb3b88e5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfd1f0be53cfb0e9a04d243d6e84298b2ee999ac23a217b3a900a209bb3b88e5/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-02-28 14:34:31 UTC
File Type:
Text (Shell)
AV detection:
15 of 36 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7i7bpstz6yoticneq6w5bbjrmxotgnmeorbpm5jacratoz3rdsq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260228-rxkszaax8b/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes journal logs
Deletes system logs
Executes dropped EXE
Mirai
Mirai family
Malware Config
C2 Extraction:
matrix1.anondns.net
matrix2.anondns.net
matrix3.anondns.net
matrix4.anondns.net
matrix5.anondns.net
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bfd1f0be53cf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/bfd1f0be53cfb0e9a04d243d6e84298b2ee999ac23a217b3a900a209bb3b88e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh bfd1f0be53cfb0e9a04d243d6e84298b2ee999ac23a217b3a900a209bb3b88e5

(this sample)

Mirai

elf f67ddc1877424f9729c8ff95046f55559cc68e2a68ce20f7b1c38041e4d7e26e

Mirai

elf 3256c835e73b163a6cfabc8d9bd25f589bfeaae780af4acb89f57cb163bb7ef8

  
URLhaus
https://urlhaus.abuse.ch/url/3787537/
  
Delivery method
Distributed via web download
  
Dropping
MD5 ed927733ff3c4d7840c3f39b687b333b
  
Dropping
SHA256 3256c835e73b163a6cfabc8d9bd25f589bfeaae780af4acb89f57cb163bb7ef8

Comments