MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05df307cdb2f2efd2563e03027bed1bddcc8b0067a48af2949e18bb1e39b3b83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	05df307cdb2f2efd2563e03027bed1bddcc8b0067a48af2949e18bb1e39b3b83
SHA3-384 hash:	a3538923dd464a7ccc67ec9fdb500806aae41a1ac614032ce12cfb4ba2bd27f684a17bcab00c284f31a3caed4aace5b2
SHA1 hash:	3f08ea1fc5bbcf12967c80a0dd927ff48b3dbee0
MD5 hash:	60f9eb9a23741f849155463e874bb783
humanhash:	pluto-india-black-gee
File name:	poop.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'305 bytes
First seen:	2025-02-25 01:31:40 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:hhlGc2BuGGDwMANINQwGYJCuK8aG/gnPrGD4wUgyGzmYHGayaaGzG9FG3Z5G9wR:hycn0MANIkYdK8N/GSDJNzmRa7zH3uC
TLSH	T1C92112CA212D6136BD045E86BC7B423F9905C4A5604F0E469B8C4426FBB89DFFE12EC8
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://107.189.31.150/RpcSecurity.arm	0e020f7814a832c3bc5e1d413285fd5a3d5ab089d2b9d3b616c885893d4ce648	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.arm5	3ce56b7dfbbbca091a12381a7299fa7d34d6d80c6e2dc83e4d6f7e1b3b377da5	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.arm6	1b5aa74abb1a7b06835f1391c20cd911c2c41aa9e766e5bf29e3275ada8bef5e	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.arm7	75980b2ddfc50e722ae8a1fcb01c19b599195af2dcc06f6b0649cd74023af0ed	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.mk68k	75980b2ddfc50e722ae8a1fcb01c19b599195af2dcc06f6b0649cd74023af0ed	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.mips	n/a	n/a	n/a
http://107.189.31.150/RpcSecurity.mpsl	98f9724f7811a80d2488626b84dc7dd7a9368422249dc68fa5bfa8a54864d6b0	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.ppc	fd7ab428e75259a190bae7e96006eff573baeb56592bdfede526c096e661ca8d	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.sh4	2b0e08eb77ad61ab0c9b81595b046713194715ebe19f3b7519c5aba54e10e01e	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.x86	cc0d2187e8a958986bfe86d30ae30fc3c1fa418e5c8b6ed948adc85174e09c8c	Mirai	bash curl mirai wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67bd1d97a0fd713c335caa48linux22vpnfull_triage

Tags:

downloader backdoor trojan

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/67bd1d993afc3763bec4f706/reports/834d8ab2-fda9-49d0-ae82-8085840662d1/overview

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/05df307cdb2f2efd2563e03027bed1bddcc8b0067a48af2949e18bb1e39b3b83

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/05df307cdb2f2efd2563e03027bed1bddcc8b0067a48af2949e18bb1e39b3b83/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2025-02-25 01:32:10 UTC

File Type:

Text (Shell)

AV detection:

15 of 38 (39.47%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=axpta7g3f4xp2jld4aycppwrxxomrmagpjek6kkj4gf3dy43hobq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250225-bx1lessnt8/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/05df307cdb2f2efd2563e03027bed1bddcc8b0067a48af2949e18bb1e39b3b83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.