MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f10c8d380c3cc39f75e9ac81f7b9319de411b7ffdee341b0fcacd641b4e63993. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f10c8d380c3cc39f75e9ac81f7b9319de411b7ffdee341b0fcacd641b4e63993
SHA3-384 hash: bce7efc998a5bc808b2d71a332d238d797ac783887e408f78231c7ce0d77ee54e419b101b20514e1608039a9efda944e
SHA1 hash: 2d76a0bee8fc79459713241a2d93941db0b76ebc
MD5 hash: d1953ae146aa3dbbdd3bc67681ac293e
humanhash: ceiling-georgia-kilo-enemy
File name:giga.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:674 bytes
First seen:2026-07-09 06:55:46 UTC
Last seen:2026-07-09 21:30:44 UTC
File type: sh
MIME type:text/plain
ssdeep 12:QvWXOp3dKU2hCUKAMzhKdqxcRphviR9hviRAYNkhviR60LKDhviR1OhviRWH:QvQhBh9M0owptQtbYWtoKDt8OtjH
TLSH T16C017058E55539618510BE24F0A38112E127F78433762724BA4D763ABC9C5047138DE6
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://217.60.195.160/gigatex/arm1c38405a026f44a612256e5e8ca0af5f1e7292731f5dc71b54a4c41490cd7745 Miraielf mirai ua-wget
http://217.60.195.160/gigatex/arm533d9b53c42674663d0d7d23c251a7dce5f2ea7992a42540e421ab3956e621595 Miraielf mirai ua-wget
http://217.60.195.160/gigatex/arm796069c829691d2cdddc8e746d0395a8fd2ccc301dbbd3648923b441a5c1d61a3 Miraielf mirai ua-wget
http://217.60.195.160/gigatex/mipsf4639d96df747932f57bf16fa9d91907e782396194d7aa6eb861c4c08be3e81a Miraielf mirai ua-wget
http://217.60.195.160/gigatex/mipseld83eabdd4c96140622d434cbb7ada82121376fc91bada095895f86981823c609 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
66
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader
Link:
https://www.filescan.io/uploads/6a4f45f790cf785479acfcc3/reports/2f6a2dc1-4f48-4e55-8a98-fc3da3e0d153/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-07-09T04:53:00Z UTC
Last seen:
2026-07-10T19:27:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f10c8d380c3cc39f75e9ac81f7b9319de411b7ffdee341b0fcacd641b4e63993/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/90c43ffc-fd38-4dc1-9d44-feaabb5a7db6
Behavior Graph:
Download SVG
%3 guuid=84cfe56e-1900-0000-d185-d63a24140000 pid=5156 /usr/bin/sudo guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157 /tmp/sample.bin guuid=84cfe56e-1900-0000-d185-d63a24140000 pid=5156->guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157 execve guuid=dbed5278-1900-0000-d185-d63a26140000 pid=5158 /usr/bin/rm guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=dbed5278-1900-0000-d185-d63a26140000 pid=5158 execve guuid=c79bd478-1900-0000-d185-d63a27140000 pid=5159 /usr/bin/wget net send-data write-file guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=c79bd478-1900-0000-d185-d63a27140000 pid=5159 execve guuid=98f60c81-1900-0000-d185-d63a30140000 pid=5168 /usr/bin/chmod guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=98f60c81-1900-0000-d185-d63a30140000 pid=5168 execve guuid=ae897e81-1900-0000-d185-d63a31140000 pid=5169 /usr/bin/dash guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=ae897e81-1900-0000-d185-d63a31140000 pid=5169 clone guuid=65b37582-1900-0000-d185-d63a33140000 pid=5171 /usr/bin/wget net send-data write-file guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=65b37582-1900-0000-d185-d63a33140000 pid=5171 execve guuid=81fa2687-1900-0000-d185-d63a34140000 pid=5172 /usr/bin/chmod guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=81fa2687-1900-0000-d185-d63a34140000 pid=5172 execve guuid=c20f9187-1900-0000-d185-d63a35140000 pid=5173 /usr/bin/dash guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=c20f9187-1900-0000-d185-d63a35140000 pid=5173 clone guuid=2025ab88-1900-0000-d185-d63a37140000 pid=5175 /usr/bin/wget net send-data write-file guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=2025ab88-1900-0000-d185-d63a37140000 pid=5175 execve guuid=200d3f8e-1900-0000-d185-d63a38140000 pid=5176 /usr/bin/chmod guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=200d3f8e-1900-0000-d185-d63a38140000 pid=5176 execve guuid=ef77c78e-1900-0000-d185-d63a39140000 pid=5177 /usr/bin/dash guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=ef77c78e-1900-0000-d185-d63a39140000 pid=5177 clone guuid=e9b48590-1900-0000-d185-d63a3b140000 pid=5179 /usr/bin/wget net send-data write-file guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=e9b48590-1900-0000-d185-d63a3b140000 pid=5179 execve guuid=27b1ee94-1900-0000-d185-d63a3c140000 pid=5180 /usr/bin/chmod guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=27b1ee94-1900-0000-d185-d63a3c140000 pid=5180 execve guuid=204c3b95-1900-0000-d185-d63a3d140000 pid=5181 /usr/bin/dash guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=204c3b95-1900-0000-d185-d63a3d140000 pid=5181 clone guuid=f53cdd95-1900-0000-d185-d63a3f140000 pid=5183 /usr/bin/wget net send-data write-file guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=f53cdd95-1900-0000-d185-d63a3f140000 pid=5183 execve guuid=af70439a-1900-0000-d185-d63a40140000 pid=5184 /usr/bin/chmod guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=af70439a-1900-0000-d185-d63a40140000 pid=5184 execve guuid=ab26819a-1900-0000-d185-d63a41140000 pid=5185 /usr/bin/dash guuid=84e15970-1900-0000-d185-d63a25140000 pid=5157->guuid=ab26819a-1900-0000-d185-d63a41140000 pid=5185 clone bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 217.60.195.160:80 guuid=c79bd478-1900-0000-d185-d63a27140000 pid=5159->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 140B guuid=65b37582-1900-0000-d185-d63a33140000 pid=5171->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 141B guuid=2025ab88-1900-0000-d185-d63a37140000 pid=5175->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 141B guuid=e9b48590-1900-0000-d185-d63a3b140000 pid=5179->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 141B guuid=f53cdd95-1900-0000-d185-d63a3f140000 pid=5183->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 143B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f10c8d380c3cc39f75e9ac81f7b9319de411b7ffdee341b0fcacd641b4e63993
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f10c8d380c3cc39f75e9ac81f7b9319de411b7ffdee341b0fcacd641b4e63993/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-07-09 06:56:38 UTC
File Type:
Text (Shell)
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6egi2oamhtbz65pjvsa7pojrtxsbdn7733rudmh4vtlednhghgjq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260709-hp74vsdx3q/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f10c8d380c3cc39f75e9ac81f7b9319de411b7ffdee341b0fcacd641b4e63993

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh f10c8d380c3cc39f75e9ac81f7b9319de411b7ffdee341b0fcacd641b4e63993

(this sample)

Mirai

elf 3da275fe401f717f6d94d34f576289ae0d805cdbe6a6bcb0e3d034a92f46bc0e

  
Dropping
MD5 93be36ebde26dac6ceaf27788bcfb0ce
  
Dropping
SHA256 3da275fe401f717f6d94d34f576289ae0d805cdbe6a6bcb0e3d034a92f46bc0e
  
URLhaus
https://urlhaus.abuse.ch/url/3865670/
  
Delivery method
Distributed via web download

Comments