MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f249411dec3c14a6d9b98265f415b666648b6f73bd36d02b0ca3d00782a7fd45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	f249411dec3c14a6d9b98265f415b666648b6f73bd36d02b0ca3d00782a7fd45
SHA3-384 hash:	cbd9580c7b5c094fc83186e5b140ac712f74a8a2e63b5a11f9e424a20ff00e4a20ca05512b15031ef2fcb7a300c57307
SHA1 hash:	ead10341827d2d55fd91ed1c92e2b0c5ec2103ce
MD5 hash:	d013d026e061b50dfd64e98eda1b0a63
humanhash:	maryland-queen-march-uncle
File name:	mq.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'666 bytes
First seen:	2025-04-26 13:47:43 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:1tEftuvtutztBytBEtlstxUtDSwHRYtE6HattMtBUtPd8teW:1mfcUNtByQ/s/U1+C6Hac4skW
TLSH	T19A315EDB31B509746CA1E86B32F94C007EDDD5DF18CAAF9969ED74E540CEE08A009787
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://79.51.28.70/mqms	f0502450289ff1ce8a4af7f5c23b195215c11eb3d6bbe74ea346c9566e3f74ed	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqml	8ed34b2dd9053a75e0c5725ede96caaee40ea60f323b7c1895988c1bd3c541a1	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqsh	9d2416936b2f52277bc4d3290bfe9d292bb27c73a18ffd8fdc0d3ef5fee5c37a	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mq86	82d61e75591b7abba048d18ef677a605775a61a35fb24299b1fc73e1d1310791	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqar6	91d3e213970b5accf6b12716474b441e9b61b4a329b686d0b3460315a7c05969	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqi686	a604ef590b5e54ca722fc3d230755cca5b3e903d519cd8a4aa539d4622f08caf	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqppc	a1c60bd10012670c1f37abdb017e859527be90b78d2e8f06648fb2b1b88a5c72	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqi586	de33018a79c245cd6fa760710a746e84058b9acca142b564d8a86d6b6ccb48e7	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqm68k	3eee9ff8f0af3bbc786f598b8c8cb25310af74dbe85fd95ab07741950ea14a68	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqar4	6ccc3b79d1b5efe8b657a1a6b205066bdebd552d903c226915ce699984dba293	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqar5	6f7e2ad3dcbfc20e232b62d2807cd0c053c5b0e623229dcecda961ff6388dd23	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqar7	d7a270fae6f03d112a40d25285e755b44ce6f633951c65f2a817bdeaadb273f2	Mirai	censys elf mirai ua-wget
http://79.51.28.70/mqspcr	17b9792f8ec24a420e432ad986bad63a11d3bddb3b6aa34b62ee596a26ecb402	Mirai	censys elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680ce54dcc5fb3600cc2b44elinux22vpnfull_triage

Tags:

trojan botnet agent

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

bash lolbin remote

Link:

https://www.filescan.io/uploads/680ce416218c4a98ade308e5/reports/f9c7d6af-0ae1-4299-ba70-9cdd6267b2fd/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f249411dec3c14a6d9b98265f415b666648b6f73bd36d02b0ca3d00782a7fd45

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f249411dec3c14a6d9b98265f415b666648b6f73bd36d02b0ca3d00782a7fd45/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-04-26 13:48:11 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6jeuchpmhqkknwnzqjs7ifnwmzsiw33txu3nakymupiapavh7vcq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250426-q356esxms4/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f249411dec3c14a6d9b98265f415b666648b6f73bd36d02b0ca3d00782a7fd45

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.