MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc7a3a3011af7a6c6c16faa4333abd31f38a79bd4f24dd8bfaaca7b5f0f3c271. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc7a3a3011af7a6c6c16faa4333abd31f38a79bd4f24dd8bfaaca7b5f0f3c271
SHA3-384 hash: c98c17739004e96b6fa9ab32ab2a5ef479cd67894a08bf8535af2cc6f9cdc35315e046d576f36b02fcd175b0807d7f02
SHA1 hash: 559f263ba47da51ad7952ce226505e871d5adc79
MD5 hash: 5c801bb08ee941ca96be2f9a3f815326
humanhash: ceiling-october-magnesium-white
File name:1.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:3'614 bytes
First seen:2025-11-22 22:38:49 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 96:iZotSFEZD6voDZSXgbSZ7iHQrZhQl3a9Z9Ut2JZ2zsfGZs5OZIZtk9mVLZwF6d8K:OotSFUD6vodSXgb+7iHQlhQJa79Ut2vN
TLSH T1517181CF0291233C9C694F9A36B7A445F0A8B9D186C75E0DF69F26AD804DECC69015FE
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://41.216.189.47/bins/Labelloperc80.x86687c207fe67928a2b28fd9297b1948a5798cf44fdea2a78b4f37e108bbc6a65b Miraielf geofenced mirai opendir ua-wget USA x86
http://41.216.189.47/bins/Labelloperc80.mips8cee4bdef3b61a30f88f568645271966e08a911f35a1789321ece9208f70002a Miraielf geofenced mips mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.arc7185ecbfcea16fe14279d4987cf089d3a73bdf00c7753d41965fb53a9a062828 Miraiarc elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.i468n/an/aelf ua-wget
http://41.216.189.47/bins/Labelloperc80.i686177bf81579972b2bc5ee92be2821e236f8371b29fbef18211a9a3f6f7de5005c Miraielf geofenced mirai opendir ua-wget USA x86
http://41.216.189.47/bins/Labelloperc80.x86_64e45089dbc4d090f899c3fd4fe79dff3453bd14430fb2d80287df86d0797d3019 Miraielf geofenced mirai opendir ua-wget USA x86
http://41.216.189.47/bins/Labelloperc80.mpsl23e236b3f9f57e650b8cdf4b14ea9fb2c42e2838ec1d86735f19f1b4abb2bf38 Miraielf geofenced mips mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.armb83b21233fe01a08bbf7954206c990c2488ea8a63d692bca6cca548fdd4ce96f Miraiarm elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.arm5c07e75dc4a897fe9070e935447a75b93fb24c097225a325ad9edb6fb3c46217f Miraiarm elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.arm6dc8d4b79a40a3a6e2cdc3de3ba215489786dd70c3f8d13cd5a8e0a057800d8b5 Miraiarm elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.arm7ffdceda21ce896e022d8c3204577d79e3b533e6d72646f7e71625fd77e18956a Miraiarm elf geofenced mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.ppc6cf2151f2040da257acf79348c996e76788214f2483fd3ed7a9b3be08b24d724 Miraielf geofenced mirai opendir PowerPC ua-wget USA
http://41.216.189.47/bins/Labelloperc80.spc627e0a286e2dcce770a2ba52400f521642214674e5091861cecc040a86eefe86 Miraielf geofenced mirai opendir sparc ua-wget USA
http://41.216.189.47/bins/Labelloperc80.m68kd76113845f06187a98ceb28ec0b6416782119f213d8dca5b55d73beca8eb8a42 Miraielf geofenced m68k mirai opendir ua-wget USA
http://41.216.189.47/bins/Labelloperc80.sh4a048f2586cde7ff912e3ec551becfae32c0946068f68469b9bf8927b805462a2 Miraielf geofenced mirai opendir SuperH ua-wget USA

Intelligence

File Origin
# of uploads :
1
# of downloads :
29
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive medusa mirai
Link:
https://www.filescan.io/uploads/69223b94f96b58f0dc804f8d/reports/e6f73b2f-984d-49ab-8792-01fc33cb699e/overview
Result
Gathering data
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/fc7a3a3011af7a6c6c16faa4333abd31f38a79bd4f24dd8bfaaca7b5f0f3c271
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc7a3a3011af7a6c6c16faa4333abd31f38a79bd4f24dd8bfaaca7b5f0f3c271/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-11-22 22:39:15 UTC
File Type:
Text (Shell)
AV detection:
20 of 36 (55.56%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7r5dumarv55gy3aw7ksdgov5ghzyu6n5j4sn3c72vst3l4htyjyq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251122-2k2wtszpfl/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
UPX packed file
Deletes log files
Enumerates running processes
File and Directory Permissions Modification
Deletes Audit logs
Deletes journal logs
Deletes system logs
Executes dropped EXE
Mirai family
Mirai
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fc7a3a3011af/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.42
Link:
https://yomi.yoroi.company/submissions/fc7a3a3011af7a6c6c16faa4333abd31f38a79bd4f24dd8bfaaca7b5f0f3c271

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh fc7a3a3011af7a6c6c16faa4333abd31f38a79bd4f24dd8bfaaca7b5f0f3c271

(this sample)

Mirai

elf 3e40743f7f7a4108ddbcea21b053a0493483e7aa54feeb597f247105eee0b99d

Mirai

elf 687c207fe67928a2b28fd9297b1948a5798cf44fdea2a78b4f37e108bbc6a65b

  
URLhaus
https://urlhaus.abuse.ch/url/3713034/
  
Delivery method
Distributed via web download
  
Dropping
MD5 0f7a847472f4749aef37c6b560c29679
  
Dropping
SHA256 687c207fe67928a2b28fd9297b1948a5798cf44fdea2a78b4f37e108bbc6a65b

Comments