MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e18ada282a9283c02c7f53d77c24e62b73fe93253bc42e30241430ee4a57365c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	e18ada282a9283c02c7f53d77c24e62b73fe93253bc42e30241430ee4a57365c
SHA3-384 hash:	39fdb0e9704599eb4482a668b4219fc6c183b6f026d3764acf355f7bc40d6891a8012c106320e5850db254cad4692c11
SHA1 hash:	dde1cad7239f38f9073d4ab63402efa0e67c9948
MD5 hash:	57394846cf2d6082bb41c7a2e95cb520
humanhash:	illinois-fanta-ten-network
File name:	pay
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'033 bytes
First seen:	2025-07-12 17:14:09 UTC
Last seen:	2025-07-13 07:22:30 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v1dsdWR1deMdel9R1dZNKdZG9R1dsZdsdtR1dRd0R1dvMdvU9R1dTd0R1d/dkR1Z:vrYQre4elfrZ4ZGfrsXsFr/urv4vUfrD
TLSH	T10741D68549C380B66CB28F33E569C674749D6097BDC0EE2284ED7CF6884DF046C66DA3
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://196.251.66.32/HBTs/top1miku.x86	effabb0c89d67dc1deaaff5d5a7512613f0c6d6a3c86c773d05a3062890673ba	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.mips	a77e7186ad2e7b858f23a9f1d3d5d6365481fcf8bf212a6d49b50ba9f9ae046f	Gafgyt	elf gafgyt mirai ua-wget
http://196.251.66.32/HBTs/top1miku.mpsl	425dc69ffcd048df8726f1cb3716901322750e3bfc56803135c3a803eeab6369	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.arm4	n/a	n/a	elf ua-wget
http://196.251.66.32/HBTs/top1miku.arm5	046a329591855ebf9749429465feda29ac2e8fc327fc2d4664ba4255a9cda5d4	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.arm6	0c7fa0d266b490427b6857294ee1500691ed8506884baff619f1d51049bc4c52	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.arm7	b5bce493d05031ba446080722dfb270aec7c97fc4378e639723d637adea784d2	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.ppc	4adaa8fbc175e4a169c4767bc147fe1b288888cddfa4f1b39abc3fe250806ff7	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.m68k	eb6913d816c810b0846bc7bf8dd6a19152cf078b0e4ddac040eda89ae0de8ac1	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.sh4	b3f1e7014dfba66c06190cfa803ea2dc947f59a0b6f437f3ec6f9263b34cb4a0	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=687297f0c9eb974737689968linux22vpnfull_triage

Tags:

downloader shellcode agent

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/abf92761-812f-40c1-bc0f-2b8fb9a9a3e0

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e18ada282a9283c02c7f53d77c24e62b73fe93253bc42e30241430ee4a57365c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e18ada282a9283c02c7f53d77c24e62b73fe93253bc42e30241430ee4a57365c/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-07-10 18:14:00 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4gfnukbkskb4ald7kplxyjhgfnz75ezfhpcc4mbecqyo4ssxgzoa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:demons antivm botnet defense_evasion discovery execution linux

Link:

https://tria.ge/reports/250712-vr467stwav/

Behaviour

Command and Scripting Interpreter: Unix Shell

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware Config

C2 Extraction:

hbtxhuy.duckdns.org

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e18ada282a9283c02c7f53d77c24e62b73fe93253bc42e30241430ee4a57365c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.