MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7
SHA3-384 hash: fc1b4b6610b0f1d1a1731a0b8959c92413b0ed53120ca7bb621cdec88ffc116ffdf8b4ca7cea04db9884a9e388ccc6c2
SHA1 hash: 6784b7fcd5a3256a357efcfebddb07ba9ed41625
MD5 hash: 22c3bfa29febe6feb693913be304b601
humanhash: blossom-sixteen-mockingbird-artist
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:6'419 bytes
First seen:2025-12-06 19:41:11 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 192:7e3mB87OBqvwp83mnC12DJk7sV9gnABWPOZkWPOZkFofI5MNwDKzGpi35Ur8FYxQ:7e3mB87OBqvwp83mnC12DJk7sV9gnABy
TLSH T157D124F2B4C5527CDD5FC83E915069BD1189B58B2A5B4DA88BAD30A57C8AFDC2C40DC3
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x86233e3afe8173a71f015c77ba93c12df40d0831168fa14888717f2240ba1a43eb Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mipsb6f248d426e6c610037c7845b4533f0152a37702a9f9c8062cdf51ec3038c17d Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arc38c706c7f53415b957a10b9602de9a31418684e5ab213f26e35af857c7790e7c Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i468n/an/aua-wget
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i686df6d0caa58dad9d7ab9c9403f50ecd81d2bc3c58793b442cd02edcbbaa301479 Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x86_648b40ce04524582dc1287b362841198d83d9cb504a54e3e6c3ac34fdacc9329b2 Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mpslb2f39e61a8489485c6a66157f7e45c021ec0f12f3d0e4e4c693e79873f339edb Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.armbb51e25885d5e77d1c772a51053f9f03fbb64cff853caf5cc55623a393ddb4fd Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm5d5e4ffc2e4c397856efe92f8a482932de1262d0503657cb1334fab456cae3208 Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm67951f9e0f8fe6894ec53c3f96a4b21dc35983c6601f536e27d86c59baf53fbe1 Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm7b74fb7bead733da7f79387a8ca81e45d5b683da8e9d5271e68cca1d2534b3c4b Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.ppc1fe6e046f9aeef0f006d2fe497b2dd85085f966764e981e83cb22f55cf97df4a Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.spc1735716a2d040292b4eb9a50d2b1c55b260da4b0e53e4ac39b24a90f5d521e75 Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.m68ke9d8b0c1b91b2b345ae90146e56b88b418db3158c33999bf92759c9807e93c39 Miraimirai opendir
http://185.133.173.243/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.sh47b612d6d0fb78b64bea7803d5be303f20905f359045fa11a89f5124711fca20e Miraimirai opendir

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-12-06T17:38:00Z UTC
Last seen:
2025-12-06T20:21:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p
Link:
https://opentip.kaspersky.com/e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-06 19:42:31 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5cunsb7dyoasqgknktlzej2z6lvqm3fxvwfhj5iy52lyyzgrqxlq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251206-yetfqayrgq/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes journal logs
Deletes system logs
Executes dropped EXE
Mirai
Mirai family
Malware Config
C2 Extraction:
frohncrop77.duckdns.org
catelcro.duckdns.org
fishertriv.duckdns.org
lizadesm.duckdns.org
yukivela.duckdns.org
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e8a8d907e3c3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
Link:
https://yomi.yoroi.company/submissions/e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh e8a8d907e3c38128194d54d7922759f2eb066cb7ad8a74f518ee978c64d185d7

(this sample)

Mirai

elf c0c21b6350119f97b0a9f4cea84cae8ab952a5a089fd4c308ba4a7704eb6eb7d

Mirai

elf 233e3afe8173a71f015c77ba93c12df40d0831168fa14888717f2240ba1a43eb

  
URLhaus
https://urlhaus.abuse.ch/url/3728091/
  
Delivery method
Distributed via web download
  
Dropping
MD5 b4328c8a1261a5bfb59a5dc08638984a
  
Dropping
SHA256 233e3afe8173a71f015c77ba93c12df40d0831168fa14888717f2240ba1a43eb

Comments