MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe77e80c4d156ec1cf5e831cc6c4bb7cca37f15cc19ac7e360ad5b7aa2f6fede. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	fe77e80c4d156ec1cf5e831cc6c4bb7cca37f15cc19ac7e360ad5b7aa2f6fede
SHA3-384 hash:	d8394d4762cb177c44b6a29da90ea78664c22d09cc4584f08841507b38c25e9904520de75dee70979143d3f8336ab2dc
SHA1 hash:	9829fd4223e266ee0869a681d34a91e0b9f1ef4e
MD5 hash:	8f5dcaf5c98fa349d8c6f093f404ff87
humanhash:	nevada-snake-dakota-neptune
File name:	newreaxe.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'183 bytes
First seen:	2026-02-14 13:06:39 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:i+/RC2Qa8tnAm+ukOo2VYhA9djRgkLthJmrAuUqTrGTV/36cdpo1:ilVF9h5F1LZmsmK13dq
TLSH	T1AA6196F693D246305EA55733A378A904BD89E1F3B0862E209CFB25BEF84CE047005E97
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.x86	9d4303eab069f7f9052f482f94a2cf36d007bc8273348f007e2fb31659fcc255	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.mips	f037b103394bc2621207bfc87a644c2d3921db5f0bc8830e22758038b9af6296	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arc	31e871bf22741430a6da836e773480da675d3094e573cc0776645ba206578293	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.i686	e77b92e6a48b0db91fa71a25942b9944cd9e954413c87ef00b65a4e48e4d0757	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.x86_64	c032550cc344c3f14b7c564ea58a3c5159ed4e8edb4266f59bfc3e7e8a13ea9e	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.mpsl	d91b528a22124afd79cdc73a5ed158f43b6c07bf90fa854aab581ce151abfec6	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arm	4b7d3b3cb2b1399e9f86a5e84691c33d3a4f806a65eec0c2e113cce4a9324182	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arm5	c83eeb7ecd43733b6531c7c91ae8fbc7e964b33542a0187461006a039b869daf	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arm6	a60936c68f3e00253a0befa778d9517e15e8c8352f728c22b4a64378c6bca8a5	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.arm7	888a0bbfc855fdd57b1ffc7959b837e1f75fb344b6a871eb3a96865ebf4938d8	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.ppc	61ea6093dea9f115fc84463f00f4466a9904156cad729b88701a8d89a8866383	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.spc	2f94a82d6fa107ca045c7f6bc371d42d4900c4e2548502c23c47b490a8784aa1	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.m68k	c73c4346f62573bc8eea16c12e3b3dd57d7f5d08d9f61bea278c08fe819709fa	Mirai	elf mirai ua-wget
http://192.3.154.52/x7k2m9v8b/m9x7k2v8b3.sh4	17e065d59586f2fc634de3340309c609b8ed11c7606df41e6583cba42571169f	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/6990738a930564ff3ca0edd5/reports/08d09eab-8514-4805-be3f-2f3e1924a747/overview

Verdict:

Malicious

File Type:

unix shell

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/fe77e80c4d156ec1cf5e831cc6c4bb7cca37f15cc19ac7e360ad5b7aa2f6fede/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b889c4a1-f434-41cd-bcf2-3a641fd206e4

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fe77e80c4d156ec1cf5e831cc6c4bb7cca37f15cc19ac7e360ad5b7aa2f6fede

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fe77e80c4d156ec1cf5e831cc6c4bb7cca37f15cc19ac7e360ad5b7aa2f6fede/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/fe77e80c4d156ec1cf5e831cc6c4bb7cca37f15cc19ac7e360ad5b7aa2f6fede

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-02-13 06:29:00 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7z36qdcncvxmdt26qmomnrf3ptfdp4k4ygnmpy3avvnxvixw73pa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260214-qcsseacw8b/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fe77e80c4d15/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fe77e80c4d156ec1cf5e831cc6c4bb7cca37f15cc19ac7e360ad5b7aa2f6fede

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh