MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8a32c23632480af1bb7c2f582bcf8ff7c3ac34598f4df283bdb318c9dc3510d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8a32c23632480af1bb7c2f582bcf8ff7c3ac34598f4df283bdb318c9dc3510d
SHA3-384 hash: c1f76dfd24ecd3bb8b20a349698caa44bf6f068d5cedeea7a221fad334c45f8dcdda2b5f5963235fdf3a3dd2c3701e4c
SHA1 hash: f263518d837d6023a7006b2707bb2ba464cf1be5
MD5 hash: 343cfa8490f330bb2b0192515476454a
humanhash: burger-ohio-hawaii-hotel
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'617 bytes
First seen:2025-11-22 23:46:43 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 96:YZotSFEZD6voDZSXgbSZ7iHQrZhQl3a9Z9Ut2JZ2zsfGZs5OZIZtk9mVLZwF6d8K:gotSFUD6vodSXgb+7iHQlhQJa79Ut2vN
TLSH T1167181CF0291233C9C694F9A36B7A445F0A8B9D186C75E0DF69F26AD804DECC69015FE
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://41.216.189.47/bins/Labelloperc80.x86687c207fe67928a2b28fd9297b1948a5798cf44fdea2a78b4f37e108bbc6a65b Miraielf geofenced mirai opendir ua-wget USA x86
http://41.216.189.47/bins/Labelloperc80.mips8cee4bdef3b61a30f88f568645271966e08a911f35a1789321ece9208f70002a Miraielf geofenced mips mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.arc7185ecbfcea16fe14279d4987cf089d3a73bdf00c7753d41965fb53a9a062828 Miraiarc elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.i468n/an/aelf ua-wget
http://41.216.189.47/bins/Labelloperc80.i686177bf81579972b2bc5ee92be2821e236f8371b29fbef18211a9a3f6f7de5005c Miraielf geofenced mirai opendir ua-wget USA x86
http://41.216.189.47/bins/Labelloperc80.x86_64e45089dbc4d090f899c3fd4fe79dff3453bd14430fb2d80287df86d0797d3019 Miraielf geofenced mirai opendir ua-wget USA x86
http://41.216.189.47/bins/Labelloperc80.mpsl23e236b3f9f57e650b8cdf4b14ea9fb2c42e2838ec1d86735f19f1b4abb2bf38 Miraielf geofenced mips mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.armb83b21233fe01a08bbf7954206c990c2488ea8a63d692bca6cca548fdd4ce96f Miraiarm elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.arm5c07e75dc4a897fe9070e935447a75b93fb24c097225a325ad9edb6fb3c46217f Miraiarm elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.arm6dc8d4b79a40a3a6e2cdc3de3ba215489786dd70c3f8d13cd5a8e0a057800d8b5 Miraiarm elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.arm7ffdceda21ce896e022d8c3204577d79e3b533e6d72646f7e71625fd77e18956a Miraiarm elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.ppc6cf2151f2040da257acf79348c996e76788214f2483fd3ed7a9b3be08b24d724 Miraielf geofenced mirai opendir PowerPC ua-wget USA
http://41.216.189.47/bins/Labelloperc80.spc627e0a286e2dcce770a2ba52400f521642214674e5091861cecc040a86eefe86 Miraielf geofenced mirai opendir sparc ua-wget USA
http://41.216.189.47/bins/Labelloperc80.m68kd76113845f06187a98ceb28ec0b6416782119f213d8dca5b55d73beca8eb8a42 Miraielf geofenced m68k mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.sh4a048f2586cde7ff912e3ec551becfae32c0946068f68469b9bf8927b805462a2 Miraielf geofenced mirai opendir SuperH ua-wget USA

Intelligence

File Origin
# of uploads :
1
# of downloads :
24
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive medusa mirai
Link:
https://www.filescan.io/uploads/69224b84f96b58f0dc8058d2/reports/bf105b88-f94f-4099-8659-d0d59a778afd/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-22T20:36:00Z UTC
Last seen:
2025-11-24T07:34:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen
Link:
https://opentip.kaspersky.com/d8a32c23632480af1bb7c2f582bcf8ff7c3ac34598f4df283bdb318c9dc3510d/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d8a32c23632480af1bb7c2f582bcf8ff7c3ac34598f4df283bdb318c9dc3510d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8a32c23632480af1bb7c2f582bcf8ff7c3ac34598f4df283bdb318c9dc3510d/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/d8a32c23632480af1bb7c2f582bcf8ff7c3ac34598f4df283bdb318c9dc3510d
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-11-22 23:47:19 UTC
File Type:
Text (Shell)
AV detection:
16 of 24 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3crsyi3desak6g5xyl2yfphy756dvq2ftd2n6kb33myyzhodkegq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251122-3szl4svlfy/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes journal logs
Deletes system logs
Executes dropped EXE
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d8a32c236324/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
Link:
https://yomi.yoroi.company/submissions/d8a32c23632480af1bb7c2f582bcf8ff7c3ac34598f4df283bdb318c9dc3510d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh d8a32c23632480af1bb7c2f582bcf8ff7c3ac34598f4df283bdb318c9dc3510d

(this sample)

Mirai

elf 3e40743f7f7a4108ddbcea21b053a0493483e7aa54feeb597f247105eee0b99d

Mirai

elf 687c207fe67928a2b28fd9297b1948a5798cf44fdea2a78b4f37e108bbc6a65b

  
URLhaus
https://urlhaus.abuse.ch/url/3713034/
  
Delivery method
Distributed via web download
  
Dropping
MD5 0f7a847472f4749aef37c6b560c29679
  
Dropping
SHA256 687c207fe67928a2b28fd9297b1948a5798cf44fdea2a78b4f37e108bbc6a65b
  
URLhaus
https://urlhaus.abuse.ch/url/3714849/
  
URLhaus
https://urlhaus.abuse.ch/url/3714853/

Comments