MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e88f8552938dea2319b3cc2578b1da642f85d7ca9255df9738bdd34413b9bada. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	e88f8552938dea2319b3cc2578b1da642f85d7ca9255df9738bdd34413b9bada
SHA3-384 hash:	136484b432c70343b89fef17551113b1d5824c7f1e45f3ae1bbe9ffcdd3f42724c60cd62f92d46386a9b280da7c63ef6
SHA1 hash:	3cf9cf0ac9a885b1aaef917dac1d83479531f674
MD5 hash:	1510b857c0799cfdd56a8c0a0069f1c5
humanhash:	island-don-east-table
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	4'250 bytes
First seen:	2026-09-16 12:28:31 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:iyTGXSMhePiGiucW5LSS4uXfnyFMRGYMLIVoAXo4tu:uL04uPyFMRy
TLSH	T15591708521010F715C9D8E5A7AA9C954BBB360D7E0875FC1BCDD3CB8A0ECFA87847662
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.30/fvbig/sever1078.x86	df2138b5f78bf656fac4e1453ba216b33c39eeb2629a4f29a84286451a0ffba7	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.mips	a300459f6bd29df095a925e7c8088e3bcc39c66244e0e1f287b376c9be0255ee	Mirai	94-154-43-30 elf mirai ua-wget
http://94.154.43.30/fvbig/sever1078.arc	d5fe36de7d2e6bc4bace677ea65418bef42633d5bdcaf1ad9cd31a161cd4c379	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.i586	n/a	n/a	94-154-43-30 ua-wget
http://94.154.43.30/fvbig/sever1078.i686	edd7962579709705e29928b0132002f280487b3e5dcb852a61f20be1f27945e4	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.x86_64	06eac5c94e1eab3915d3ebbca025fa2d387d55ea84da3a0ba93c4df0b024ac72	Mirai	94-154-43-30 elf mirai ua-wget
http://94.154.43.30/fvbig/sever1078.mpsl	bd575d17baec66f6556c33cfb2d2ebc053de1ae13234712f08a58bfce253be45	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.arm	94c866d1292dda6607ce269dc94a22b0783fc3621b70c1217bc846ce74bdb33c	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.arm5	e9f6959f043be31163d59d701f85ca85be9840c86e19447c654b3173e30e87be	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.arm6	a487f9757a5e72306f82e15b4705fef2d5ca44d750e10426bac372f77462e1a8	Mirai	94-154-43-30 elf mirai ua-wget
http://94.154.43.30/fvbig/sever1078.arm6l	075aefc21a08ead9b27f0edcdf02708b5efb4ed57445b3711dde74aee4669208	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.arm7	08dcd8eea833e10462afcf66bd0c5df4df0277e7fbb87f2740c62b5317ae0c8e	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.armeabi-v7a	07155228d3dba753cf1e6acce8e108322e8b140b4cdbdf919d0fcb3d4968ec65	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.arm64	c6b7910f82351fd0904f911576ce7194c3a19f5b3c25c54220d191b3a9462b1e	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.android	152dd9320f039a81608ae60255521ab60eeaf099f3b78af9a81b778fe1a8059e	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.ppc	b41030998554f1bd4d5d2cdfff210ae7f986f6716d160a03ecf410ebaf197551	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.spc	aa8e64912ba89b60f50b919430374d24c4cc4e8bb55fa9227b52af6bd81a7d65	Mirai	94-154-43-30 elf ua-wget
http://94.154.43.30/fvbig/sever1078.m68k	a5e9f1eea37f8efd12e1c0de00376fe54ad32456d3f8664384959d9977a8bc37	Mirai	94-154-43-30 elf mirai ua-wget
http://94.154.43.30/fvbig/sever1078.sh4	271b6fe19bd85d7fab97983428de5b5c5b937011ab5e2231bd7bfddb3897bbbb	Mirai	94-154-43-30 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-16T09:47:00Z UTC

Last seen:

2026-09-16T14:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e88f8552938dea2319b3cc2578b1da642f85d7ca9255df9738bdd34413b9bada/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8c6d997f-a686-4370-a105-c3800ac64b23

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e88f8552938dea2319b3cc2578b1da642f85d7ca9255df9738bdd34413b9bada

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e88f8552938dea2319b3cc2578b1da642f85d7ca9255df9738bdd34413b9bada/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-09-16 12:28:01 UTC

File Type:

Text (Shell)

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5chykuutrxvcggntzqsxrmo2mqxylv6ksjk57fzyxxjuie5zxlna._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/260916-pny8wsbk8w/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Reads system network configuration

UPX packed file

Creates/modifies Cron job

Enumerates active TCP sockets

Enumerates running processes

Modifies systemd

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (68969) amount of remote hosts

Creates a large amount of network flows

Family: Mirai

Malware Config

C2 Extraction:

bigbigvol.qd.je

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e88f8552938d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/e88f8552938dea2319b3cc2578b1da642f85d7ca9255df9738bdd34413b9bada

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh