MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e011e366a071eedc3182865d528cd3b3bffdd12d4f66a11a6f3c2389c28b6715. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	e011e366a071eedc3182865d528cd3b3bffdd12d4f66a11a6f3c2389c28b6715
SHA3-384 hash:	a6f1ebb303efd2e8f7d3b3d2d45ba1b0a2c6e96a1c759809eb782c1a7ba66b87e29d61fdb6fd37116790115633310d21
SHA1 hash:	e292ecb36f290793620822276fa9726b4dcb828a
MD5 hash:	048abc2e885a20ecd21570ef0dcae668
humanhash:	nebraska-summer-connecticut-seven
File name:	2.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'180 bytes
First seen:	2025-11-19 22:01:58 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:/oldGVVkDw+oUUPFy+8nJh+JRmHQqL1/2uNQ:/oldGVVkDw+oUUPFy+DJRmHQqL1DQ
TLSH	T1A26185BA014407716CE26BD7637D404C7092929748F6BF22A7ED28E88D8DFDCBC41667
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://41.216.189.88/00101010101001/S3o.x86	5569bf3426d939b9fd9f33f275e86f1e78faf9a157cc6aa803aef1f3df7db933	Mirai	elf geofenced mirai opendir ua-wget USA x86
http://41.216.189.88/00101010101001/S3o.mips	cf65e78b52b19e3ac5a1a3f10f571a60fd11b47a72e47e54bad00dcc10624166	Mirai	elf geofenced mips mirai opendir ua-wget USA
http://41.216.189.88/00101010101001/S3o.arc	44b6c1d1e7526a23c24fa5f7cb939015f40c5cb722b4e879e89ed9a63b6db212	Mirai	arc elf geofenced mirai opendir ua-wget USA
http://41.216.189.88/00101010101001/S3o.i468	n/a	n/a	elf ua-wget
http://41.216.189.88/00101010101001/S3o.i686	6b8dbe5cea96bfaa75c318614b27fd139f5aba3d7ef63181dc939fa0fd2ce10e	Mirai	elf geofenced mirai opendir ua-wget USA x86
http://41.216.189.88/00101010101001/S3o.x86_64	d3cf20462308c14ecdae9a05a63526cf586de84f919e6b6a380834d98afdc17e	Mirai	elf geofenced mirai opendir ua-wget USA x86
http://41.216.189.88/00101010101001/S3o.mpsl	b2a9a313364beca9f0c8ca3bfa4309d39b836a0852cf7953ce379353983f28ba	Mirai	elf geofenced mips mirai opendir ua-wget USA
http://41.216.189.88/00101010101001/S3o.arm	ab2941f4781a5fdff78181e878fe8b065e5decd73a1949a99b12b724934cde58	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://41.216.189.88/00101010101001/S3o.arm5	55270354a25e6f143ab99369d1e5129dd6a9f629924aea60f59e520b79cdb4ce	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://41.216.189.88/00101010101001/S3o.arm6	6aea4b3f8dd415b9716ee71775fd0706098e6a3d8dea933f0ed77343082a3125	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://41.216.189.88/00101010101001/S3o.arm7	b5ad80ac7cba318becb4dec3b9b8ed907de90a28788a8b32cc925eed7ca5f17b	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://41.216.189.88/00101010101001/S3o.ppc	0e7ff0d9b6a39fc2196676905c970f18c7c48b88f39c7568d230b07c28b70f44	Mirai	elf geofenced mirai opendir PowerPC ua-wget USA
http://41.216.189.88/00101010101001/S3o.spc	662cb3f68599553021643f28a830300a3abb6b8b977225b834e93282b5f38a78	Mirai	elf geofenced mirai opendir sparc ua-wget USA
http://41.216.189.88/00101010101001/S3o.m68k	e9a1cb2b8cf0c4a1eb4948e6a336fc2a56257c4a65fa00a28ed50c98b02cfa74	Mirai	elf geofenced m68k mirai opendir ua-wget USA
http://41.216.189.88/00101010101001/S3o.sh4	2580a0151f1ddf68044938a1c2e65fe3d39f916d902598fd88970ea48988a393	Mirai	elf geofenced mirai opendir SuperH ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/691e3e8f5bbff1003f0ae1d3/reports/06d3539f-e355-41e6-9045-5019d479ad4f/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-19T19:29:00Z UTC

Last seen:

2025-11-21T06:26:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e011e366a071eedc3182865d528cd3b3bffdd12d4f66a11a6f3c2389c28b6715/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4c3bdadb-4ff0-409e-9639-d8c389f66967

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e011e366a071eedc3182865d528cd3b3bffdd12d4f66a11a6f3c2389c28b6715

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e011e366a071eedc3182865d528cd3b3bffdd12d4f66a11a6f3c2389c28b6715/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-11-19 22:03:28 UTC

File Type:

Text (Shell)

AV detection:

20 of 36 (55.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ai6gzvaohxnymmcqzovfdgtwo773ujnj5tkcgtphqrytqulm4kq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251119-1x9a1agn9y/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e011e366a071eedc3182865d528cd3b3bffdd12d4f66a11a6f3c2389c28b6715

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.