MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff23bfbcd6ac2d275559311789d9a6a0d448d3c6d3918a815a2feecb754e37dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	ff23bfbcd6ac2d275559311789d9a6a0d448d3c6d3918a815a2feecb754e37dc
SHA3-384 hash:	feee1c87ff8df9dc9352d6def28d8f80bad92e4ab2cee963871542faf79c41b93d93838625a25ba949b1539d18748df5
SHA1 hash:	cec2298a7aa613f60061c034fe463b9730678c03
MD5 hash:	66ae98b05f273d1c32ba90c876db7ace
humanhash:	pip-london-saturn-magnesium
File name:	giga.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'359 bytes
First seen:	2025-07-18 10:16:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:irs+rEyExLrPNoPN0LroKrNmrJyJYxJr7OrfOrwHwAOrzurSFSRrOF:irs+rEyExLrPyP6LroKrNmrJyJYxJr7x
TLSH	T10741BBC40E9343721C759E3BE9AB42483E95D8A739C56EA394FC3CEA544DF0471A0E63
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://161.97.77.188/HBTs/top1miku.x86	64aa14e4bba9920161c083819452da01e173458619866025b454e29117f427c3	Mirai	elf mirai opendir ua-wget x86
http://161.97.77.188/HBTs/top1miku.mips	6dba5a43486ad2c883f236754e25806a860f5063fcf73e225f4f86c1c1741ead	Mirai	elf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.mpsl	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arm	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arm5	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arm6	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arm7	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.ppc	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.m68k	af5ef5773b4f244557be125fa269d59bfa897f6ad5ddbbd600a224a7fe38fdb8	Mirai	elf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.sh4	200f50c4e8e10d7cd12823b2ff9dcc4fd4643094ee0cb1bbd321a636af1acdc4	Mirai	elf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.spc	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arc	380cdfff39fab66e0d2f0e3217f0e2573374ebbde28f6a96343e2cb72c0ca944	Mirai	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4b636311-982f-4676-bed4-9692912f41b0

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ff23bfbcd6ac2d275559311789d9a6a0d448d3c6d3918a815a2feecb754e37dc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff23bfbcd6ac2d275559311789d9a6a0d448d3c6d3918a815a2feecb754e37dc/

Verdict:

Malicious

Threat:

Linux.Downloader.Medusa

Link:

https://tip.neiki.dev/file/ff23bfbcd6ac2d275559311789d9a6a0d448d3c6d3918a815a2feecb754e37dc

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-07-18 10:17:25 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=74r37pgwvqwsovkzgelytwngudkeru6g2oiyvak2f7xmw5kog7oa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/250718-ma6dyayxbs/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Enumerates running processes

Modifies init.d

Modifies rc script

File and Directory Permissions Modification

Executes dropped EXE

Mirai

Mirai family

Malware Config

C2 Extraction:

top1miku.duckdns.org

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/ff23bfbcd6ac2d275559311789d9a6a0d448d3c6d3918a815a2feecb754e37dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.