MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 139b71d7bd0809d76320112a13e12d40ef7f0cc8a634e7626ab18f7a9117836e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	139b71d7bd0809d76320112a13e12d40ef7f0cc8a634e7626ab18f7a9117836e
SHA3-384 hash:	bbd809e8795c55a0fde5750d21fb2c4bf74d6437d3e8451d37e5fec2cd9db98eec2c0a57d6dda82c5db166a6892a1151
SHA1 hash:	e606b3753dfc83c1b554403ec79fc21746806197
MD5 hash:	5f989d978a4f3bd91c74b3a2b132135b
humanhash:	finch-uniform-fifteen-finch
File name:	gay
Download:	download sample
Signature	Mirai Create hunting rule
File size:	308 bytes
First seen:	2025-04-09 10:58:25 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:bxzi6FG3GjzYta0LKiRrF0oXzYhCI5rF5oXzYhQ:+GjzX0LKKzKOXzUQ
TLSH	T1A7E086D934611E4490D5ED48B4BFAD2E10B5A2C522578F1AE9ED387E4A4DF00F418B0A
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.39.207.117/arm7	4609c07c381e508ccdaf2ade1709ded444c168ca7333144d5cf91784b77b1b6b	Mirai	mirai ua-wget
http://185.39.207.117/mips	1d19f1c237dd347fdab214d49246b665b45326f9bb238fbc98aaf1cbded16660	Mirai	ddos elf mirai
http://185.39.207.117/mpsl	77adfd58c50986b6d252a69e969fc4155ae57c9e5a7fe4e90e93526755a4ccde	Gafgyt	ddos elf gafgyt mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f656eb71beff15dccdfaa1linux22vpnfull_triage

Tags:

trojan agent virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/67f652fe2d430c849e0f0f8d/reports/4e30489e-0d6e-42d9-b7e0-5bb8006f25cd/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/139b71d7bd0809d76320112a13e12d40ef7f0cc8a634e7626ab18f7a9117836e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/139b71d7bd0809d76320112a13e12d40ef7f0cc8a634e7626ab18f7a9117836e/

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2025-04-09 10:48:05 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=conxdv55bae5oyzacevbhyjnidxx6dgiuy2ooytkwghxveixqnxa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250409-m45z9sykt2/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.