MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da41519dee4258748b015782fd41b7cafc50017055cd618a080f2560e3d8e096. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da41519dee4258748b015782fd41b7cafc50017055cd618a080f2560e3d8e096
SHA3-384 hash: 56d2038d2b846972fc65fb1264618a025151ac75b8831f548da24ae9e3c9182980eda8457b2fc5787290467aaad62939
SHA1 hash: 6e83a4ff304decd7d70ef40aeeae270fe156a538
MD5 hash: 020e8aef3d63b9455e9a4ad3c1052389
humanhash: sweet-north-pennsylvania-avocado
File name:hidden.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'354 bytes
First seen:2025-03-29 15:27:45 UTC
Last seen:2025-03-29 19:27:15 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vp3i4pyn98peOejOpPqkpg1ILppEcJpqvepUZs3pj++pVw0pUZKpoNCp0005ai:vk4698kO0kmILYmGekCk+s0mKMCcz
TLSH T1E24180C561854339ACFBDA2A72F98C48B1A198C7A4CB6F14E5DCB8A5808DD54B840BD6
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.141.182/main_x86a03d0a1356cb1a22f0bc4a232f561c406a6072816dd109e619186e00ccf6621a Miraicensys elf mirai moobot
http://176.65.141.182/main_mipsa9246d5d98dd3a07391a6bd7a86c9ae4488df7e2a5c5babfb3250be4773d1ff7 Miraicensys elf mirai moobot
http://176.65.141.182/main_mpsl6b9b34312bccb963518166aed28bfb26597113393dd52a1e915a21f626150990 Miraicensys elf mirai moobot
http://176.65.141.182/main_armdcb50cb8051684e5a00aa177dc76a7d16f6402050fc478a608f6c9b87a621119 Miraicensys elf mirai moobot
http://176.65.141.182/main_arm51b754fade3c32ad195938ce9045cc81e6158367c72edee9019f904c78f48405c Miraicensys elf mirai moobot
http://176.65.141.182/main_arm60ef683cbb05703c1d3eb11761c918ac0d05045dde58d93bbc685fe21b5e8b6da Miraicensys elf mirai moobot
http://176.65.141.182/main_arm79c5ab60db0c154601652024f9ec695dfc7990cc379ea718531d393d0f073d27f Miraicensys elf mirai moobot
http://176.65.141.182/main_ppc3188267507e7b287eb8e1fdbe6a2ed1a3b1fc987ed32ffd5885377ff5352c159 Miraicensys elf mirai moobot
http://176.65.141.182/main_m68kfc67e573af10c615e1508be14edf1b2013cc9391609fff7753c13ca9223b0fcf Miraicensys elf mirai moobot
http://176.65.141.182/main_spcn/an/an/a
http://176.65.141.182/main_i686n/an/an/a
http://176.65.141.182/main_sh4b5ec111066098220bd6a79c77c95c5390651ba063cfd416051742093b6729341 Miraicensys elf mirai moobot
http://176.65.141.182/main_arcn/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
69
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67e813c7cfd0a37f830989e5linux22vpnfull_triage
Tags:
medusa agent virus
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/da41519dee4258748b015782fd41b7cafc50017055cd618a080f2560e3d8e096
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da41519dee4258748b015782fd41b7cafc50017055cd618a080f2560e3d8e096/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2025-03-29 15:28:30 UTC
File Type:
Text (Shell)
AV detection:
17 of 24 (70.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3javdhpoijmhjcybk6bp2qnxzl6faalqkxgwdcqib4swby6y4cla._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/250329-sweq1axnw5/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Traces itself
Mirai
Mirai family
Malware Config
C2 Extraction:
web.project4443.xyz
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/da41519dee42/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da41519dee4258748b015782fd41b7cafc50017055cd618a080f2560e3d8e096

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh da41519dee4258748b015782fd41b7cafc50017055cd618a080f2560e3d8e096

(this sample)

Mirai

elf 157eaac67fff10a2ae990e38c8058481c8e031eb5685fe94a8bc8ff9b13dd6d4

  
URLhaus
https://urlhaus.abuse.ch/url/3494870/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3494886/
  
URLhaus
https://urlhaus.abuse.ch/url/3494898/
  
Dropping
MD5 66bb5426a32642736fdc257bacb6f177
  
Dropping
SHA256 157eaac67fff10a2ae990e38c8058481c8e031eb5685fe94a8bc8ff9b13dd6d4

Comments