MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb3c93a6f4ff83533c2c255ae54a27cc810cc8e0e7462f4c304f53c47a90bbba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	eb3c93a6f4ff83533c2c255ae54a27cc810cc8e0e7462f4c304f53c47a90bbba
SHA3-384 hash:	7c55ef84e81ed34bf1a5dd2312c53154dca184488fc3095354bec204b3f838774449b713b031767c30bfec3ea3378297
SHA1 hash:	f754ef46736ee0bb14ff0ad913ff23d705c6985d
MD5 hash:	02544147db4a306df75e581687cd50b9
humanhash:	echo-comet-island-alaska
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'019 bytes
First seen:	2025-10-06 19:04:19 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:iRahmlRAnElRJCXlR1ePlRa8azvZlRaeaFvjlR9NG9z4gelRMjclR5SvlRj8jzqw:iumleElWXl6PlYBzvZlYfFvjlLKz4ZlZ
TLSH	T170514D8B03254A392C677A57FDBAAE8CB1C050F55CE5BF04AADC64B5628DDCA3044B92
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://162.245.188.165/hiddenbin/Space.arc	fa674e015498f1a8e7917488350ec21d4a8929c85a41c65df43d95abc932c1af	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.x86	08ab80d5503cd46bd8a508bc545775815097f0c4b02a7b1bc0883c994f40d6c5	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.x86_64	e4a8518076e685e4a641409942a2f5aeeae8f9b7815b1e4ece84edc741f24f78	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.i686	7a7ac86a4c7b3917fe73503de117c7364c96b5301501dcd26fa61c1b38dd60c1	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.mips	bead45b7a39648d314de67d19bce64e13388c637b01228b0195dfa41739ec0a8	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.mips64	n/a	n/a	elf ua-wget
http://162.245.188.165/hiddenbin/Space.mpsl	77b962f4d02ca719a08b9a24ef8ace5a985c7c58bfc8b67cf8e3891ea9682674	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.arm	42de9a3994e564666c30484a5a4ce03541445929d72b8ec5da1062dcd8ddbfef	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.arm5	859a1b343da3263e6a4443a00c7e9577dcfc1623aede26957d4ae888ccc7e036	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.arm6	cf427f9f07ca6505d761d8a3590a18bd3eba8b9010d2f6e3b33262f069ae62d5	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.arm7	168e741f69172608656e3511aea8fcace087e464cfacbff4b38c5a4315800357	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.ppc	500be21663f92eab16fa4a35fdd68307a9927728ddfedd46ee0c9842b773b845	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.sparc	n/a	n/a	elf ua-wget
http://162.245.188.165/hiddenbin/Space.m68k	c6482fd288a3cbd31e549f8ab6c1ef9d68453a2568c54a7048c8536252288995	Mirai	mirai opendir
http://162.245.188.165/hiddenbin/Space.sh4	6700d3422052a2ac4b2c52e42bbadf1b5eaebdb3a88a1a3e5c80885dad79ffb7	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-06T16:26:00Z UTC

Last seen:

2025-10-07T10:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/eb3c93a6f4ff83533c2c255ae54a27cc810cc8e0e7462f4c304f53c47a90bbba/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/47107726-5248-48a3-aadd-d952025ce54f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/eb3c93a6f4ff83533c2c255ae54a27cc810cc8e0e7462f4c304f53c47a90bbba

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eb3c93a6f4ff83533c2c255ae54a27cc810cc8e0e7462f4c304f53c47a90bbba/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-10-06 19:19:14 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5m6jhjxu76bvgpbmevnoksrhzsaqzsha45dc6tbqj5j4i6uqxo5a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251006-xw8fjatzf1/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/eb3c93a6f4ff/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.