MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec603b07c2a4128e131fa9d1cb85f85e3b9faab9b7aa4e47a520bd468bb9d495. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec603b07c2a4128e131fa9d1cb85f85e3b9faab9b7aa4e47a520bd468bb9d495
SHA3-384 hash: 8d2bad4cdd042cd1dfe489da4e6195f934014c59d9d581fef94a66cd002d46d91b166cdd1b0b52c5f20be3e589217bcb
SHA1 hash: 933b5126dfc24528f96add6bbe49c450491f9a9d
MD5 hash: f3cc231de0a43a080273340f349c0290
humanhash: florida-nineteen-oklahoma-august
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:6'359 bytes
First seen:2025-09-08 16:28:36 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 192:mv3mBdmOBqahp83nCC12e8k7s4wgnAEXPOZ1XPOZ1oofIstNwD7OGpiSsUr8oZxq:mv3mBdmOBqahp83nCC12e8k7s4wgnAED
TLSH T1C8D13DF6B48A527CDD9FCD3A5111697D208AAA8B268B1D6887FE20757C89FCD5C00DC3
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x866cb36240da45d8c3b466112edd6baf0350b0e5685b8817a0c434e4d534dc7870 Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mips7f7d00873b065f74ae0e0556ac8402b66eac982c19a5979f951bd1fc91ef25aa Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arc88b8fa947ddcd84970d4f4b435a31671d3c4adff1945bc280e236a40399428ef Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i468n/an/aelf ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i6865e8d43bf46ad6204b146a597cfe2aee6149432d21dca367df216d99ef932597e Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x86_641ebc93b5c1511cc7e67ef989ef283e5ec32e56dd9b345c6223cbc635af0db5c3 Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mpslf2bc092763442f06632d3b8dac66bd3931d7c9bcd680a8dc420535f13288f782 Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.armdcdeff018be69684cebb86e70cc401ff8170c69c1247a13a1d9c2a61c32617cd Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm59f58cee6db752837a715b3fde32630bb64720cc043e2c2591cd724ffc1c7c9a6 Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm6c564751efba71824b641fab24cbca09bcf56167f220596524876168e41b2584b Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm7787b0dad0d8bbd742919873d1206b1fa3af2082513f0bd1f2d2a1ff4c862e5f3 Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.ppc5e8572aed0a9e3f971fe2f865b9015f41f88621eff078fd7c2d1e4041803d52b Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.spcaaf116bd2079f72db4485475b16733a916a2e5f5d16abc31e4ab3ff58cdd302d Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.m68k431ad14af2cb999bb03b86b80f7717431f2d3d1b9bffce48559d143816191dd3 Miraielf mirai ua-wget
http://196.251.84.55/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.sh4e6de6d9aa9f6f742f6c2e743c2788285691b276341092adddd3405a7e958a944 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-08T13:50:00Z UTC
Last seen:
2025-09-08T13:50:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ec603b07c2a4128e131fa9d1cb85f85e3b9faab9b7aa4e47a520bd468bb9d495/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ec603b07c2a4128e131fa9d1cb85f85e3b9faab9b7aa4e47a520bd468bb9d495
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec603b07c2a4128e131fa9d1cb85f85e3b9faab9b7aa4e47a520bd468bb9d495/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-09-08 16:37:48 UTC
File Type:
Text (Shell)
AV detection:
18 of 38 (47.37%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5rqdwb6cuqji4ey7vhi4xbpyly5z7kvzw6ve4r5fec6unc5z2skq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/250908-tzsygayjv6/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes journal logs
Deletes system logs
Executes dropped EXE
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ec603b07c2a4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh ec603b07c2a4128e131fa9d1cb85f85e3b9faab9b7aa4e47a520bd468bb9d495

(this sample)

Mirai

elf 6cb36240da45d8c3b466112edd6baf0350b0e5685b8817a0c434e4d534dc7870

  
URLhaus
https://urlhaus.abuse.ch/url/3620221/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3620232/
  
URLhaus
https://urlhaus.abuse.ch/url/3620243/
  
Dropping
MD5 12999887e1cd9b08fd60a8f2f83db9ee
  
Dropping
SHA256 6cb36240da45d8c3b466112edd6baf0350b0e5685b8817a0c434e4d534dc7870

Comments