MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ebe4354a45759e6c84ba527f0a07a935aa8d4065a4e824183696fc7ce6d5b7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	0ebe4354a45759e6c84ba527f0a07a935aa8d4065a4e824183696fc7ce6d5b7a
SHA3-384 hash:	2328316a787415273bdfd4246aca7751ce74943ebf1c18ba0bc9c9a5078622d9742aef4f17861a30b64270a06a48a0bc
SHA1 hash:	2a62343c42ae11b6e59ae5c1d3712eaaef31b983
MD5 hash:	06a3797b87d7cab256cf1a02217cf821
humanhash:	venus-red-winter-saturn
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'028 bytes
First seen:	2025-01-02 06:56:20 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:sedx5shTQ2pM3amgQmyZtzeUa7zte9VOYmz:6RQAgFE
TLSH	T1A411878F43B03010C9C4DD4AB4625664D224DFC136F516FEF9CA197192DDFC9A456B8B
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://nouuu.eye-network.ru/wev86	dfd01cc32d00e7b8bb9409092992c97a36e15756c74f3e1642d7b37a9a9f8453	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/vevhea4	01a3bfb833716e087c45be1a80d33daa4f5b4319794b77b8abf8daad5fc63e58	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/ngwa5	f599495bfe3b8eadc1be4eda341eab7ff8bae632236e213e03768c7d31b368a1	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/woega6	1a972d4dfc453352be0a970f216e0d3a6457cfbfafeab045b2603d0edf459094	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/ivwebcda7	b8f563125ea97a9b9a74627ac8c315a962a48a76881bc6c430ece8a560a87f8e	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/debvps	db25424a25f9a2b6df9f1b23a849865c15b613576538f14021e6709318196018	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/fbhervbhsl	87c57bbac06b1d709595e2ba150b8295e3d70c419e7c7f6e621d8b64260e064c	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/fqkjei686	48aeb716656f78e79aac447a57d21e668159c30adc3fefd790744e253459e8b9	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/gnjqwpc	24e6fb618094f824dbda678e38f995e88ea4fc2f2dc4713d029810464f365b35	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/qbfwdbg	e8647500a41bda114a197d02f36cb9521f6053b34d5056306324dbfff0c6857a	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/jefne64	1b89f0a38b1684cff2e66a4330ea5c78de73e1828da8084b9f61d2702c58d872	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/wlw68k	015285df586d2588c6689b31f1152bab23583be423eb84b668413a49a9a38969	Mirai	elf mirai ua-wget
http://nouuu.eye-network.ru/wrjkngh4	2e1c233cb8c158cbffc07032c63710dfeed433b4c0746601f9b7fcd2ec84cd58	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.DownLoader.37.24037.21267.UNOFFICIAL

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677638d774a2bd296e251145linux22vpnfull_triage

Tags:

malware

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/677638d04c768bd101b007bd/reports/7943cf32-6e15-40c8-9886-1a6f489aa5e6/overview

Result

Verdict:

UNKNOWN

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/0ebe4354a45759e6c84ba527f0a07a935aa8d4065a4e824183696fc7ce6d5b7a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ebe4354a45759e6c84ba527f0a07a935aa8d4065a4e824183696fc7ce6d5b7a/

Threat name:

Document-HTML.Trojan.Heuristic

Status:

Malicious

First seen:

2025-01-02 06:52:31 UTC

File Type:

Text (Shell)

AV detection:

10 of 23 (43.48%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b27egvfek5m6nscluut7bid2snnkrvagljhieqmdnfx4pttnln5a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250102-hqx1aa1rfr/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0ebe4354a45759e6c84ba527f0a07a935aa8d4065a4e824183696fc7ce6d5b7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.