MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d608cbe87a439f554a10cbd6c4293a0e1cf437429937789ecb29776b25cc8071. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d608cbe87a439f554a10cbd6c4293a0e1cf437429937789ecb29776b25cc8071
SHA3-384 hash: 1584579357a011ea4cac79e8155450a333804aa04fdad427f2b26d5dba3a862d3d555801afcd7efd7c9606539b1f6270
SHA1 hash: 8e37398cc09b588dd7e53288685f3593b59010b0
MD5 hash: 3fde976c2ed89284583c04ccb07b9fc2
humanhash: autumn-north-stream-undress
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'344 bytes
First seen:2025-12-12 06:43:24 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 96:itEit34t+2tPot9ctJEtiKto6tZCLtMqtndKtzQtSOtiWtv/b:R
TLSH T1A46174E523428B356D5B8912A3688A5D3741A8DFE0DF5F2567FC39BB5C8CEC8AC01741
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://103.77.241.135/00101010101001/eccox.x869036551da73941f878a85893be775522fe0eb1c1965366f31d72c09b5b30f6a7 Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.mips98e16b51ed65da74476d17494db30e253315be868337e169e9da6357c168f02b Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.arcf17c93977d0f270b430612d7cb068e07be2db0e2d9eca19c3251457c641448a5 Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.i468n/an/aelf ua-wget
http://103.77.241.135/00101010101001/eccox.i6866868f97baab397a54a04819a316568052043159326d77550b6e261f9b5e81911 Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.x86_64655a2aa50cfede51675392e9ae13739f5e625a2ca02f2c83a49257cf0cd78253 Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.mpsl15a9337cc167ef32907f14c696b952b172a702aa8481ea56ffc4e5289b6b41fe Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.armc3cdfdab58ead270ef4f6cbdb2ef23957715c9d51248a4e0247ddcdaba9babbb Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.arm5d2d72fc8005eccd847c3d6a7445bd3d190f61d1ae953d8a05efe7d800104a708 Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.arm6248e96d200d592265e80263e79a08f0134da513f19f623a8e024028f9d36b8e5 Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.arm78a836d836e8f4672e84e1379495443cf1c222825e964dbd46dc7837424969a53 Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.ppc22241ef4be31f44f82c52470a52e68fc604fe449634393e3f43b72c3e5d6be26 Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.spcn/an/aelf ua-wget
http://103.77.241.135/00101010101001/eccox.m68k5f8e01aa310c709c8c15601f45bd2e4ccb5945dc44692c449a9860fda3810b1f Miraielf mirai ua-wget
http://103.77.241.135/00101010101001/eccox.sh4ae4597137c434428e6cc72dea6275cf19d019c6b78417cd6d22c60f49228f364 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive medusa mirai
Link:
https://www.filescan.io/uploads/693bb9bd1eac7b9b76a721cf/reports/83007cc8-8f52-4672-b71b-357d96032f5e/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-12-12T03:52:00Z UTC
Last seen:
2025-12-12T04:37:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p
Link:
https://opentip.kaspersky.com/d608cbe87a439f554a10cbd6c4293a0e1cf437429937789ecb29776b25cc8071/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d608cbe87a439f554a10cbd6c4293a0e1cf437429937789ecb29776b25cc8071
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d608cbe87a439f554a10cbd6c4293a0e1cf437429937789ecb29776b25cc8071/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/d608cbe87a439f554a10cbd6c4293a0e1cf437429937789ecb29776b25cc8071
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-12-12 06:44:14 UTC
File Type:
Text (Shell)
AV detection:
16 of 24 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2yemx2d2iopvksqqzplmikj2byopin2cte3xrhwlff3wwjomqbyq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251212-hhkd8acs2d/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
UPX packed file
Checks SCSI settings
Checks hardware identifiers (DMI)
File and Directory Permissions Modification
Executes dropped EXE
Mirai
Mirai family
Malware Config
C2 Extraction:
draft22.duckdns.org
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d608cbe87a43/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d608cbe87a439f554a10cbd6c4293a0e1cf437429937789ecb29776b25cc8071

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh d608cbe87a439f554a10cbd6c4293a0e1cf437429937789ecb29776b25cc8071

(this sample)

Mirai

elf f5427c4f5808a6bc1da015f3ec7886023c25c49db7b10d8f1447f377640256df

Mirai

elf 9036551da73941f878a85893be775522fe0eb1c1965366f31d72c09b5b30f6a7

  
URLhaus
https://urlhaus.abuse.ch/url/3727052/
  
Delivery method
Distributed via web download
  
Dropping
MD5 4b15099cf2a7b71dd0b1a7d67fe86387
  
Dropping
SHA256 9036551da73941f878a85893be775522fe0eb1c1965366f31d72c09b5b30f6a7
  
URLhaus
https://urlhaus.abuse.ch/url/3725189/

Comments