MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f343ba54420da60b23802a510c5b5dfd9780873891d447040b63037fedfc5030. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f343ba54420da60b23802a510c5b5dfd9780873891d447040b63037fedfc5030
SHA3-384 hash:	17025820772c21514f12007356179d7a118c492a4fc0f64e2e7df582e7cac15d3ab88df5d9eb61465c3409644f013376
SHA1 hash:	27d55c50e382a775b196cb34537334cc48d9c8ae
MD5 hash:	60ca337f255f3be9e3b82aed75c34e62
humanhash:	romeo-dakota-pennsylvania-ink
File name:	gpon
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	79 bytes
First seen:	2026-08-08 12:32:32 UTC
Last seen:	2026-08-08 12:45:04 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	3:TKH4vSCAtFiFHf6Lf9HKuKaRaa2QX9:hZAts1IFl5X9
TLSH	T16DA012D4A900A9327C48C91532280930408241A4983D011480010C0034017007A0DE12
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec
Tags:	mirai

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

57

Origin country :

IR

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a7723815c7aac90e8d56572/reports/b1f6ce65-cfed-4626-98b1-d9db0d0a046d/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-08T10:01:00Z UTC

Last seen:

2026-08-08T12:58:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/f343ba54420da60b23802a510c5b5dfd9780873891d447040b63037fedfc5030/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/467c3b27-375f-4324-8a89-ce290aeb5cc8

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

41%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/f343ba54420da60b23802a510c5b5dfd9780873891d447040b63037fedfc5030

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f343ba54420da60b23802a510c5b5dfd9780873891d447040b63037fedfc5030/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6nb3uvccbwtawi4afjiqyw257wlybbzyshkeobalmmbx73p4kaya._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:lzrd botnet defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/260808-prenna1tg1/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to shm directory

UPX packed file

Creates/modifies Cron job

Enumerates running processes

Modifies init.d

Modifies rc script

Modifies systemd

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Family: Mirai

Malware Config

C2 Extraction:

8.8.8.8
94.154.43.46

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/f343ba54420da60b23802a510c5b5dfd9780873891d447040b63037fedfc5030