MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05c003f71e2855ddab581100481ef24d21d840964102b09f0d2c5d465448ddb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	05c003f71e2855ddab581100481ef24d21d840964102b09f0d2c5d465448ddb0
SHA3-384 hash:	934bf2f5bea7d481609b3ad25672254ae71286bfdb52287d9b9f2a00e0961a38cc91d796bf497eab105a34d6a6140ae2
SHA1 hash:	165c0e31998ee028231bfd15b71ff0eb2789a13b
MD5 hash:	73312136da2bc23b32be911b3b621d22
humanhash:	mobile-asparagus-fifteen-football
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'907 bytes
First seen:	2025-12-21 19:47:48 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:7P2knk2JMJtDtbiBFZQZuZ9YESYEnE2EhE8F7iwQwbwcQWyWbDbJUfFRSvnvhM3m:5k2JM/pbiB3IuZGGcvyBxbw4vhM3m
TLSH	T17B516DDB020C5B71D61885DFB7F235B471AAE183E6DED605FA40082C0FCAD4C769AE51
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnaarch64xnxn	b60ebe01143a71e127714a3c7c82be18c97c57d803cb60b1737aab0161b8462e	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxni386xnxn	cc08d1e6c384658eeac77c0284e59b30ad9cec728eedddd559a747f76b09dc6f	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	2685f3d9afbcb738bf037f896b7dde927551b526951005edfe98bd001c6204b4	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnm68kxnxn	e590f58d83aa6cfbf4446ed4629efc99751686af8ce16b9048522c807affa189	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	da3ea7ca7fc68a3d970f540d001c85f3fa670bd3a6dc9e75397faedd6579d39d	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnmipsxnxn	25909af8dab6595f8982de4491ce46ce66961a89d7457d0cce97d60155a616d1	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnor1kxnxn	051e97db9e4dd0bcfdb81535884b1d2d12960abc7d44da5757ba0472cd5be46b	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	d4db575b43ecf3584cb58ba44c96e1f53936d6888e749e195da832912d8f5ea4	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnriscv32xnxn	4fdb9f7d3361690c4558b67ccb6a7374e9e5b7f3ff10060b3a123d33d9b77de7	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnriscv64xnxn	3eda71feefea8eddb0628ea62ceffa13dcf450b2724dace78bb3fe36e1666e44	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnsh2xnxn	79275fc868353e050c7681f7d5fd73fef27f744b7b396f1a7134904f64201772	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnsh4xnxn	7b18a4ab208cc82154562dccf44de196ac8ebbc09b9abcf5f1944277a8da2283	Mirai	elf mirai opendir ua-wget
http://41.216.189.149/bins/xnxnxnxnxnxnxnxnx86_64xnxn	972f77de3af0c2f6f11fd09ad7e5b79c63e867c3579db885a228124dfea5d0d9	Mirai	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm evasive mirai

Link:

https://www.filescan.io/uploads/69484efa3f8fdbf8e94dc09e/reports/1f2be20b-105c-49f1-a4c1-3c14b7f8b7a1/overview

Verdict:

Malicious

File Type:

text

First seen:

2025-12-21T17:43:00Z UTC

Last seen:

2025-12-22T04:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/05c003f71e2855ddab581100481ef24d21d840964102b09f0d2c5d465448ddb0/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/910250e4-fa57-442c-b7cb-2407d9a99378

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/05c003f71e2855ddab581100481ef24d21d840964102b09f0d2c5d465448ddb0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/05c003f71e2855ddab581100481ef24d21d840964102b09f0d2c5d465448ddb0/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2025-12-21 19:49:09 UTC

File Type:

Text (Shell)

AV detection:

9 of 38 (23.68%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=axaah5y6fbk53k2yceaeqhxsjuq5qqewieblbhynfroumvci3wya._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251223-lpgtfsslbt/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/05c003f71e2855ddab581100481ef24d21d840964102b09f0d2c5d465448ddb0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.