MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2cdacaa2059fbeb6bfaad78de529911ec37b37a4f487e166c5dfc6ddefd1eaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	c2cdacaa2059fbeb6bfaad78de529911ec37b37a4f487e166c5dfc6ddefd1eaa
SHA3-384 hash:	9ec3260e63413f87468970cc30ee0446e6a17b68102fd0a2ef1576bdac154e6be40659f708ef72d3dcbea1f3a9197c51
SHA1 hash:	9fa848bcb9d854c0b145505e330b1adbebf3705e
MD5 hash:	f9cf2ba4e97f15ee52318486d908709f
humanhash:	hydrogen-equal-louisiana-earth
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'999 bytes
First seen:	2026-02-03 18:51:59 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ItkzYskc3kqOqsFk0VBkqeskyLkBTB5JkgAgaNk6XLkPTPNI8ksko7ksfkaAaXXe:iOhPZsFl/jIFfGXLaJ5PtJHOj2hi
TLSH	T14C51B4D510B18B743E65996AF3A44C1C3A84B49760C71F96AEDC38E560CFDA535807E2
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://144.172.108.230/Orbt/Orbt.x86	955c8992a9f4377d52d5eaa260768bcf9219d965d69e335ba8a7bec2547116e5	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.mips	336a746f6be5c835eb03aa9805e3f5c96d4d1657a59389b1c2a9a53b112dc005	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.arc	f3639e05ddc7cc0a5d0ebb36a683c1c6dec5ddcdd835fbbd4ad0da19e7495402	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.i468	n/a	n/a	n/a
http://144.172.108.230/Orbt/Orbt.i686	3aca404aad07d2f41b0572148b28433b7b752a77e1fd5fed7bbdc67824e75b12	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.x86_64	2e97b806c426ac28a8782964bfcac48e93955635b70c12ac283d3f717ef12b70	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.mpsl	505b9c302899cf898d8812c22bf1c36e9e10bc818c0e538c9f8ade3f37771e1a	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.arm	b6416c2b6acbd2208c0ee0fce606241e27a1dabfe13c2d54926b5c0e01a4ebe8	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.arm5	0b5a44d310d868e79d7ef9ead43c6080e0479684513099cec7d3deaf3c5c9676	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.arm6	0bd753010fee80888a5969498a1215139f2548a90cad6298e01bcf54c40b94c3	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.arm7	70274d5c4fb81f75f3b7aff57483e0126b79b51256227ea6fc1c0f8555406b2b	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.ppc	44dfb4a3d329e43f9c5d1963465e9ce571b9d01f95c8534798ed9155634db8d1	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.spc	2fda4a4cb3f07146a3441f3a1a78289fd29492bb8022ad13ca94af648e2f5d33	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.m68k	8559a2a4b9ebe51f096a49cce3a70536b9db169bc593351fc25853a1fa329eaf	Mirai	elf mirai ua-wget
http://144.172.108.230/Orbt/Orbt.sh4	7f602b7a2d5994fea011550a7eef299c31f21fc3134f244d5e05b127f1e24524	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Result

Gathering data

Verdict:

Malicious

File Type:

Script

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/c2cdacaa2059fbeb6bfaad78de529911ec37b37a4f487e166c5dfc6ddefd1eaa/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d91e33a1-f27f-4a25-ba98-6561a14180f2

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c2cdacaa2059fbeb6bfaad78de529911ec37b37a4f487e166c5dfc6ddefd1eaa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c2cdacaa2059fbeb6bfaad78de529911ec37b37a4f487e166c5dfc6ddefd1eaa/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/c2cdacaa2059fbeb6bfaad78de529911ec37b37a4f487e166c5dfc6ddefd1eaa

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-02-03 18:40:20 UTC

File Type:

Text (Shell)

AV detection:

20 of 36 (55.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ylg2zkralh56w272vv4n4uuzchwdpm32j5eh4ftmlx6g3xx5d2va._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260203-xh539ad19c/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware Config

C2 Extraction:

mirailoversddos.duckdns.org

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c2cdacaa2059/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/c2cdacaa2059fbeb6bfaad78de529911ec37b37a4f487e166c5dfc6ddefd1eaa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh