🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07b2c7f049942aa30ab203ead3b6df75b65161da3a169d93d9d48014a50bf2a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07b2c7f049942aa30ab203ead3b6df75b65161da3a169d93d9d48014a50bf2a6
SHA3-384 hash: 2cf2e306cfa446d240d1a9b52182a6ef8eade144623a5e0e8276b48a5d845d5ee6718767f9bf12e66697780c23e50d63
SHA1 hash: d38ffd1309ef62fc4547d1c88e6e4b38e6a21cd4
MD5 hash: 81ffd47c63946e4ebcb471ba408a55b0
humanhash: summer-north-low-india
File name:li
Download: download sample
Signature Mirai
Create hunting rule
File size:429 bytes
First seen:2025-10-18 00:52:34 UTC
Last seen:2025-10-18 01:58:11 UTC
File type: sh
MIME type:text/plain
ssdeep 6:LG1DkIk/oT0Df1DHWX+oTHl1x7X5oMARV1KEogGV1RAoa1la0LKiAoN:eJT0DiT97CMARW9NhL0LK2N
TLSH T17BE0A79BB55817AA880EEE36B4238A0BD012E3D351304B55F8D934B58EA8B087434E2B
Magika txt
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://42.112.26.45/mips0b92cb77fec808a81df7037d623f112a33c759a5f7cf13681d2ff71c8471fcef Miraielf gafgyt mirai ua-wget
http://42.112.26.45/mipsel46f9306573975efd01e93530fbb3417b76f5e605f51059ea18c74f8481622403 Miraielf mirai
http://42.112.26.45/arc08e1e16849d33d3be443de6aa42842a8aaff58806728d439f1999f91fbf2ca08 Miraielf mirai ua-wget
http://42.112.26.45/arm18b40a18fe04c05ee7bbdc7a07125633eb803dd7cd9f198e89a2b824df628c5c Miraielf mirai ua-wget
http://42.112.26.45/arm5be61d9c23d4359b4a4d4911f0f8fc09f69124f3cf991856d5c871e23568c5cd2 Miraielf mirai ua-wget
http://42.112.26.45/arm748f8ba323a18feb719e4cba9d502e85a73e89c0e7d4c6a5b2dae7e808b19f692 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
42
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Labled as:
TrojanDownloader/Linux.Mirai
Link:
https://www.hybrid-analysis.com/sample/07b2c7f049942aa30ab203ead3b6df75b65161da3a169d93d9d48014a50bf2a6
Verdict:
Malicious
File Type:
text
First seen:
2025-10-17T22:01:00Z UTC
Last seen:
2025-10-17T22:20:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/07b2c7f049942aa30ab203ead3b6df75b65161da3a169d93d9d48014a50bf2a6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2b6acb93-f0c4-4bd9-895a-8261659d62aa
Behavior Graph:
Download SVG
%3 guuid=8d21422c-1900-0000-df68-b4ea390b0000 pid=2873 /usr/bin/sudo guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883 /tmp/sample.bin guuid=8d21422c-1900-0000-df68-b4ea390b0000 pid=2873->guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883 execve guuid=2a830b2f-1900-0000-df68-b4ea450b0000 pid=2885 /usr/bin/wget net send-data write-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=2a830b2f-1900-0000-df68-b4ea450b0000 pid=2885 execve guuid=380ca06f-1900-0000-df68-b4ead70b0000 pid=3031 /usr/bin/chmod guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=380ca06f-1900-0000-df68-b4ead70b0000 pid=3031 execve guuid=3aa6f76f-1900-0000-df68-b4ead90b0000 pid=3033 /usr/bin/dash guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=3aa6f76f-1900-0000-df68-b4ead90b0000 pid=3033 clone guuid=cad88370-1900-0000-df68-b4eadd0b0000 pid=3037 /usr/bin/rm delete-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=cad88370-1900-0000-df68-b4eadd0b0000 pid=3037 execve guuid=50fec070-1900-0000-df68-b4eadf0b0000 pid=3039 /usr/bin/wget net send-data write-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=50fec070-1900-0000-df68-b4eadf0b0000 pid=3039 execve guuid=61cf6ab3-1900-0000-df68-b4ea6d0c0000 pid=3181 /usr/bin/chmod guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=61cf6ab3-1900-0000-df68-b4ea6d0c0000 pid=3181 execve guuid=2274e3b3-1900-0000-df68-b4ea6e0c0000 pid=3182 /usr/bin/dash guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=2274e3b3-1900-0000-df68-b4ea6e0c0000 pid=3182 clone guuid=9ca682b4-1900-0000-df68-b4ea700c0000 pid=3184 /usr/bin/rm delete-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=9ca682b4-1900-0000-df68-b4ea700c0000 pid=3184 execve guuid=280cd1b4-1900-0000-df68-b4ea710c0000 pid=3185 /usr/bin/wget net send-data write-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=280cd1b4-1900-0000-df68-b4ea710c0000 pid=3185 execve guuid=a3dff5f8-1900-0000-df68-b4eaba0c0000 pid=3258 /usr/bin/chmod guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=a3dff5f8-1900-0000-df68-b4eaba0c0000 pid=3258 execve guuid=9a715cf9-1900-0000-df68-b4eabb0c0000 pid=3259 /usr/bin/dash guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=9a715cf9-1900-0000-df68-b4eabb0c0000 pid=3259 clone guuid=c145b0fa-1900-0000-df68-b4eabd0c0000 pid=3261 /usr/bin/rm delete-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=c145b0fa-1900-0000-df68-b4eabd0c0000 pid=3261 execve guuid=48e9fdfa-1900-0000-df68-b4eabf0c0000 pid=3263 /usr/bin/wget net send-data write-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=48e9fdfa-1900-0000-df68-b4eabf0c0000 pid=3263 execve guuid=974e1b2f-1a00-0000-df68-b4ea1f0d0000 pid=3359 /usr/bin/chmod guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=974e1b2f-1a00-0000-df68-b4ea1f0d0000 pid=3359 execve guuid=6fe1602f-1a00-0000-df68-b4ea200d0000 pid=3360 /usr/bin/dash guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=6fe1602f-1a00-0000-df68-b4ea200d0000 pid=3360 clone guuid=c8930030-1a00-0000-df68-b4ea220d0000 pid=3362 /usr/bin/rm delete-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=c8930030-1a00-0000-df68-b4ea220d0000 pid=3362 execve guuid=c4744b30-1a00-0000-df68-b4ea230d0000 pid=3363 /usr/bin/wget net send-data write-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=c4744b30-1a00-0000-df68-b4ea230d0000 pid=3363 execve guuid=9a22b471-1a00-0000-df68-b4eabe0d0000 pid=3518 /usr/bin/chmod guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=9a22b471-1a00-0000-df68-b4eabe0d0000 pid=3518 execve guuid=35e4fe71-1a00-0000-df68-b4eac00d0000 pid=3520 /usr/bin/dash guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=35e4fe71-1a00-0000-df68-b4eac00d0000 pid=3520 clone guuid=d9b5d873-1a00-0000-df68-b4eac40d0000 pid=3524 /usr/bin/rm delete-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=d9b5d873-1a00-0000-df68-b4eac40d0000 pid=3524 execve guuid=6bbd2174-1a00-0000-df68-b4eac60d0000 pid=3526 /usr/bin/wget net send-data write-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=6bbd2174-1a00-0000-df68-b4eac60d0000 pid=3526 execve guuid=184850b5-1a00-0000-df68-b4ea390e0000 pid=3641 /usr/bin/chmod guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=184850b5-1a00-0000-df68-b4ea390e0000 pid=3641 execve guuid=c46b8bb5-1a00-0000-df68-b4ea3b0e0000 pid=3643 /usr/bin/dash guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=c46b8bb5-1a00-0000-df68-b4ea3b0e0000 pid=3643 clone guuid=be5514b6-1a00-0000-df68-b4ea3f0e0000 pid=3647 /usr/bin/rm delete-file guuid=da22d02e-1900-0000-df68-b4ea430b0000 pid=2883->guuid=be5514b6-1a00-0000-df68-b4ea3f0e0000 pid=3647 execve 7e1f030a-193f-5ef8-b58f-206d09d04b13 42.112.26.45:80 guuid=2a830b2f-1900-0000-df68-b4ea450b0000 pid=2885->7e1f030a-193f-5ef8-b58f-206d09d04b13 send: 131B guuid=50fec070-1900-0000-df68-b4eadf0b0000 pid=3039->7e1f030a-193f-5ef8-b58f-206d09d04b13 send: 133B guuid=280cd1b4-1900-0000-df68-b4ea710c0000 pid=3185->7e1f030a-193f-5ef8-b58f-206d09d04b13 send: 130B guuid=48e9fdfa-1900-0000-df68-b4eabf0c0000 pid=3263->7e1f030a-193f-5ef8-b58f-206d09d04b13 send: 130B guuid=c4744b30-1a00-0000-df68-b4ea230d0000 pid=3363->7e1f030a-193f-5ef8-b58f-206d09d04b13 send: 131B guuid=6bbd2174-1a00-0000-df68-b4eac60d0000 pid=3526->7e1f030a-193f-5ef8-b58f-206d09d04b13 send: 131B
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07b2c7f049942aa30ab203ead3b6df75b65161da3a169d93d9d48014a50bf2a6/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/07b2c7f049942aa30ab203ead3b6df75b65161da3a169d93d9d48014a50bf2a6
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-10-18 00:47:57 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6zmp4cjsqvkgcvsapvnhnw7ow3fcyo2hilj3e6z2sabjjil6kta._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251018-g1fy3sax5g/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/07b2c7f049942aa30ab203ead3b6df75b65161da3a169d93d9d48014a50bf2a6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 07b2c7f049942aa30ab203ead3b6df75b65161da3a169d93d9d48014a50bf2a6

(this sample)

Mirai

elf bbde3202e384d91663bd5e6fbba0da48a2eb99c371637b335d2e929d2a0c17a4

  
URLhaus
https://urlhaus.abuse.ch/url/3680312/
  
Delivery method
Distributed via web download
  
Dropping
MD5 96de8d8b3127d1dd7e264944abe8d574
  
Dropping
SHA256 bbde3202e384d91663bd5e6fbba0da48a2eb99c371637b335d2e929d2a0c17a4

Comments