MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df78602fd918d9e393d5d8aaf01fa76e01b615578cdbf513589319932fe3099b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df78602fd918d9e393d5d8aaf01fa76e01b615578cdbf513589319932fe3099b
SHA3-384 hash: 74ff84b3fee01a49627419826a6b258b9023e6807031c6854f01ff86a1dfbf8a5229fe12d0886b61c67d7526c4869690
SHA1 hash: a96153f84be7176d41ec06e3c5220a8b127f5233
MD5 hash: a5708cee048fccb682dcc648e5b1d377
humanhash: beer-batman-fillet-carbon
File name:df78602fd918d9e393d5d8aaf01fa76e01b615578cdbf513589319932fe3099b
Download: download sample
Signature Mirai
Create hunting rule
File size:548 bytes
First seen:2026-08-04 12:02:52 UTC
Last seen:2026-08-04 12:36:59 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:bK1nkcy+1QFbkb/vrFHNPReBrlPyh4F1FHN7RBrl7hh4FmL59SqR:b9c11Qdmr1dReBrVBF11LBreFm3SqR
TLSH T1E8F02BD92A10287BB70D4D2D765DCBE864425CBA6CC83E4550BFAE38840DB0C7165FEB
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c2hunter
Tags:mirai sh wraith

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a71d50f17474f5b65e6154f/reports/b241b8e8-ea56-4c7e-b278-9c08eb00c19f/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-04T09:13:00Z UTC
Last seen:
2026-08-05T12:59:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/df78602fd918d9e393d5d8aaf01fa76e01b615578cdbf513589319932fe3099b/results?tab=lookup
Score:
90%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/df78602fd918d9e393d5d8aaf01fa76e01b615578cdbf513589319932fe3099b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df78602fd918d9e393d5d8aaf01fa76e01b615578cdbf513589319932fe3099b/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 08:31:13 UTC
File Type:
Text (Shell)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=354gal6zddm6he6v3cvpah5hnya3mfkxrtn7ke2ysmmzgl7dbgnq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260804-n77tpsv1dw/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
File and Directory Permissions Modification
Executes dropped EXE
Family: Mirai
Malware Config
C2 Extraction:
94.154.43.231
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/df78602fd918d9e393d5d8aaf01fa76e01b615578cdbf513589319932fe3099b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
http://94.154.43.231:3001/install.sh

Comments