🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfdcdb7006f5e6a9e0dfda2f33e1b1a91e90a52f04d4d523d2315090736ea5e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfdcdb7006f5e6a9e0dfda2f33e1b1a91e90a52f04d4d523d2315090736ea5e0
SHA3-384 hash: e2b4eaf97f1bcb946ceaf7e2caef3747c0d08bb3af57393b34acb85a47fe1abc8a94d4141aec21dd6d87a2cd6d833e12
SHA1 hash: 7ae19baf37b84cc847134c085272880b42fb3fd5
MD5 hash: af2a5f4774b7acaee6b61db5056d473e
humanhash: lactose-ack-carpet-lithium
File name:g1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:535 bytes
First seen:2026-11-14 06:57:13 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:nyQoMvCQoTKauQoiH/SCQvgQUa3WuQxKb4QOOLQxm7:y8CBuwmgha3xoy4dOLom7
TLSH T102F036DE236EC914E007D7613564DBB7A46C4E9574F00B6CE9F8CC71DD856153215F41
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Latin
URLMalware sample (SHA256 hash)SignatureTags
http://185.34.144.138:8888/b2.mipselfce7a33cda37dba4aeade9c75f82e172dbd89a1b254cd18edd76b5dd3707bdd2 Miraiua-wget
http://185.34.144.138:8888/b2.armhfa762a142c7c08f991ddffd189f0f226719c570166a72f370e486b0850f9dcc17 Miraiua-wget
http://185.34.144.138:8888/b2.armel6f49f9b2749cd13d1b8112c23480da8e0af241d9b3b9b74580a606f9aa197226 Miraiua-wget
http://185.34.144.138:8888/b2.mips858ff0cbca65b0149a8b45f3c3207190e423c80a46affbbfe0ec6d6a32b9c425 Miraiua-wget
http://185.34.144.138:8888/b2.aarch647872199f2579403f94d7b6b78ca41d9ed16e80626f3684f10ece69fff062d660 Miraiua-wget
http://185.34.144.138:8888/b2.mips64el24d67e8b085a20f33e8fe491255dbcde54498cff125a701deef1319a78a005ab Miraiua-wget
http://185.34.144.138:8888/b2.i68643191bb9ca34c5dfcf286477b64824981fe7c1681f80461df1e43d34be9b7414 Miraiua-wget
http://185.34.144.138:8888/b2.mips64e5156795ff8dc357a40362cc744d5ab09666be4bb02445cdbbf8f83697c77a11 Miraiua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
14
Origin country :
US US
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/73f2b5e8-d929-44a5-9131-f7bc2032b240
Behavior Graph:
Download SVG
%3 guuid=3d4e08dc-1700-0000-e1ea-de653e030000 pid=830 /usr/bin/sudo guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831 /tmp/sample.bin guuid=3d4e08dc-1700-0000-e1ea-de653e030000 pid=830->guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831 execve guuid=4f2c291d-1800-0000-e1ea-de6540030000 pid=832 /usr/bin/wget net send-data write-file guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=4f2c291d-1800-0000-e1ea-de6540030000 pid=832 execve guuid=67403bb9-1800-0000-e1ea-de6541030000 pid=833 /usr/bin/chmod guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=67403bb9-1800-0000-e1ea-de6541030000 pid=833 execve guuid=f771f7b9-1800-0000-e1ea-de6542030000 pid=834 /usr/bin/dash guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=f771f7b9-1800-0000-e1ea-de6542030000 pid=834 clone guuid=b7491bbb-1800-0000-e1ea-de6544030000 pid=836 /usr/bin/wget net send-data write-file guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=b7491bbb-1800-0000-e1ea-de6544030000 pid=836 execve guuid=ca0e1f74-1900-0000-e1ea-de6545030000 pid=837 /usr/bin/chmod guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=ca0e1f74-1900-0000-e1ea-de6545030000 pid=837 execve guuid=fa6da974-1900-0000-e1ea-de6546030000 pid=838 /usr/bin/dash guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=fa6da974-1900-0000-e1ea-de6546030000 pid=838 clone guuid=89eec675-1900-0000-e1ea-de6548030000 pid=840 /usr/bin/wget net send-data write-file guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=89eec675-1900-0000-e1ea-de6548030000 pid=840 execve guuid=d4428da5-1900-0000-e1ea-de6549030000 pid=841 /usr/bin/chmod guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=d4428da5-1900-0000-e1ea-de6549030000 pid=841 execve guuid=b670e9a5-1900-0000-e1ea-de654a030000 pid=842 /usr/bin/dash guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=b670e9a5-1900-0000-e1ea-de654a030000 pid=842 clone guuid=bb029aa6-1900-0000-e1ea-de654c030000 pid=844 /usr/bin/wget net send-data write-file guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=bb029aa6-1900-0000-e1ea-de654c030000 pid=844 execve guuid=df0e8cd9-1900-0000-e1ea-de654d030000 pid=845 /usr/bin/chmod guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=df0e8cd9-1900-0000-e1ea-de654d030000 pid=845 execve guuid=90f41eda-1900-0000-e1ea-de654e030000 pid=846 /usr/bin/dash guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=90f41eda-1900-0000-e1ea-de654e030000 pid=846 clone guuid=5abf48db-1900-0000-e1ea-de6550030000 pid=848 /usr/bin/wget net send-data write-file guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=5abf48db-1900-0000-e1ea-de6550030000 pid=848 execve guuid=311a5404-1a00-0000-e1ea-de6551030000 pid=849 /usr/bin/chmod guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=311a5404-1a00-0000-e1ea-de6551030000 pid=849 execve guuid=e4c1fa04-1a00-0000-e1ea-de6552030000 pid=850 /usr/bin/dash guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=e4c1fa04-1a00-0000-e1ea-de6552030000 pid=850 clone guuid=0b952606-1a00-0000-e1ea-de6554030000 pid=852 /usr/bin/wget net send-data write-file guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=0b952606-1a00-0000-e1ea-de6554030000 pid=852 execve guuid=c7d2873b-1a00-0000-e1ea-de6555030000 pid=853 /usr/bin/chmod guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=c7d2873b-1a00-0000-e1ea-de6555030000 pid=853 execve guuid=a868203c-1a00-0000-e1ea-de6556030000 pid=854 /usr/bin/dash guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=a868203c-1a00-0000-e1ea-de6556030000 pid=854 clone guuid=c6de4f3d-1a00-0000-e1ea-de6558030000 pid=856 /usr/bin/wget net send-data write-file guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=c6de4f3d-1a00-0000-e1ea-de6558030000 pid=856 execve guuid=6b5bec6a-1a00-0000-e1ea-de6559030000 pid=857 /usr/bin/chmod guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=6b5bec6a-1a00-0000-e1ea-de6559030000 pid=857 execve guuid=d71f726b-1a00-0000-e1ea-de655a030000 pid=858 /tmp/y6 net send-data guuid=5915a5de-1700-0000-e1ea-de653f030000 pid=831->guuid=d71f726b-1a00-0000-e1ea-de655a030000 pid=858 execve e36468cf-4a34-5792-8dce-9794c49e2881 185.34.144.138:8888 guuid=4f2c291d-1800-0000-e1ea-de6540030000 pid=832->e36468cf-4a34-5792-8dce-9794c49e2881 send: 143B guuid=b7491bbb-1800-0000-e1ea-de6544030000 pid=836->e36468cf-4a34-5792-8dce-9794c49e2881 send: 142B guuid=89eec675-1900-0000-e1ea-de6548030000 pid=840->e36468cf-4a34-5792-8dce-9794c49e2881 send: 142B guuid=bb029aa6-1900-0000-e1ea-de654c030000 pid=844->e36468cf-4a34-5792-8dce-9794c49e2881 send: 141B guuid=5abf48db-1900-0000-e1ea-de6550030000 pid=848->e36468cf-4a34-5792-8dce-9794c49e2881 send: 144B guuid=0b952606-1a00-0000-e1ea-de6554030000 pid=852->e36468cf-4a34-5792-8dce-9794c49e2881 send: 145B guuid=c6de4f3d-1a00-0000-e1ea-de6558030000 pid=856->e36468cf-4a34-5792-8dce-9794c49e2881 send: 141B guuid=d71f726b-1a00-0000-e1ea-de655a030000 pid=858->e36468cf-4a34-5792-8dce-9794c49e2881 send: 35B 30dc1a32-75a0-5780-b1d2-bc2c54e5b985 185.34.144.138:443 guuid=d71f726b-1a00-0000-e1ea-de655a030000 pid=858->30dc1a32-75a0-5780-b1d2-bc2c54e5b985 send: 112B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/bfdcdb7006f5e6a9e0dfda2f33e1b1a91e90a52f04d4d523d2315090736ea5e0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfdcdb7006f5e6a9e0dfda2f33e1b1a91e90a52f04d4d523d2315090736ea5e0/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-11-14 07:00:38 UTC
File Type:
Text (Shell)
AV detection:
4 of 36 (11.11%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7onw4ag6xtktyg73ixthynrvepjbjjpatknki6sgfija43ouxqa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/261114-hrc2hawy9j/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
File and Directory Permissions Modification
Executes dropped EXE
Traces itself
Malware Family:
bashdlod
Create hunting rule
Malicious:
True
Tags:
shell
Link:
https://intel.virussign.com/intelligence/file/bfdcdb7006f5e6a9e0dfda2f33e1b1a91e90a52f04d4d523d2315090736ea5e0
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Mirai

sh bfdcdb7006f5e6a9e0dfda2f33e1b1a91e90a52f04d4d523d2315090736ea5e0

(this sample)

Mirai

elf fce7a33cda37dba4aeade9c75f82e172dbd89a1b254cd18edd76b5dd3707bdd2

  
Dropping
MD5 ee80e28026190e521af4cfec44615d1e
  
Dropping
SHA256 fce7a33cda37dba4aeade9c75f82e172dbd89a1b254cd18edd76b5dd3707bdd2

Comments