MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9d5b1831ec251f9ed3b236c8e6cae7b1a702475270aa88a89bf75f8331b5754. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	e9d5b1831ec251f9ed3b236c8e6cae7b1a702475270aa88a89bf75f8331b5754
SHA3-384 hash:	19237a176dd0cb674c91e9904153129cab3e4f99fec71e8cfa5e3f1e5ab9aa1e3a82fc668b7ebac6b48f9c6c7e3db78c
SHA1 hash:	c92014ecd308ccd9b61aa22824e0c252f9f7238a
MD5 hash:	5ad376cb4f8cbcd0c706ff0296792ce8
humanhash:	lion-pennsylvania-don-mockingbird
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'959 bytes
First seen:	2025-10-10 21:47:45 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:i2dXdhml2dRdnEl2dOdCXl2dKdePl2da9dazvZl2dabdaFvjl2d9NDd9z4gel2dC:i2ZPml23BEl2YQXl2wIPl2s9szvZl2sA
TLSH	T175510CC712514D3928EABF23FDB98E3C718350D26CEA2F0496DD34E56B8ED88B045A57
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://194.15.36.146/hiddenbin/Space.arc	56bd1b48f8db438754bded3f05cb4d9944fee172224d4235c1cb9a11d2ecea50	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.x86	2b3278f237bcb42acf9a7dc0c7cd89dd64ce8c5df0b5a8c30b2e65ee489f6888	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.x86_64	27436ba71018b3a4ec0e504f1d2e3ad04f7c81c58ae346a8941934ee001510e2	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.i686	016a9a76a26fefd49b87659d0d411cf84f36a398828e02b5e05f4311c469f3cd	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.mips	0c6fbefff60b55620701578c981cd61db08d31cef8563f676284027b5e8ca202	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.mips64	n/a	n/a	elf ua-wget
http://194.15.36.146/hiddenbin/Space.mpsl	655619ecafda045861f66908fa5dce2fb05c4b64a86b4433da44bce1791013f6	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.arm	677ce88a8ff6b50bdedd92059a67c3725a9640e9b75a7f7c0ce3a0b08e1286af	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.arm5	d43aa485bf4e714d5327522f6977df2fc7eff2b0462ab7ce30faccc876d62901	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.arm6	aa0c1ba4e1667df285d67b7b9ab3b571aa490183a4950b75cec6227a6d472169	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.arm7	c6b577ce9bf3dc36b30edbcddebd2e4590ad923f9992d2a8235b0102684efe3f	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.ppc	9dc8f37913ae60c6614bad1145e3bdcff9523d30e80dc0e21c51bf47f0c95086	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.sparc	n/a	n/a	elf ua-wget
http://194.15.36.146/hiddenbin/Space.m68k	38411265e5542ad8d0e01e1a92dda4d7f03115ed41c3a707d464b8b004432bf1	Mirai	mirai opendir
http://194.15.36.146/hiddenbin/Space.sh4	b508517f4a76c33772d1f2ca1652ef0d0f27a296320d4b9f0faf7aa372e45fe9	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-09T22:13:00Z UTC

Last seen:

2025-10-10T20:41:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen

Link:

https://opentip.kaspersky.com/e9d5b1831ec251f9ed3b236c8e6cae7b1a702475270aa88a89bf75f8331b5754/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/537b62d0-b440-4e74-b409-c7f21ab864dd

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e9d5b1831ec251f9ed3b236c8e6cae7b1a702475270aa88a89bf75f8331b5754

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e9d5b1831ec251f9ed3b236c8e6cae7b1a702475270aa88a89bf75f8331b5754/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/e9d5b1831ec251f9ed3b236c8e6cae7b1a702475270aa88a89bf75f8331b5754

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-10-10 03:07:23 UTC

File Type:

Text (Shell)

AV detection:

15 of 29 (51.72%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5hk3day6yji7t3j3enwi43fopmnhajdve4fkrcujx527qmy3k5ka._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251010-1qx96abk6z/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/e9d5b1831ec251f9ed3b236c8e6cae7b1a702475270aa88a89bf75f8331b5754

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.