MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82
SHA3-384 hash: d59219431268a5a7a0575c59faecf074848204a88363ea9e8daba7d354613da5712084ccc8a1a165dc611c62fee229fc
SHA1 hash: 21341c7f8894705b6734526be23813605cd43e64
MD5 hash: 3bf9b2455244ba753f64198da7a1c39c
humanhash: december-tennis-fillet-potato
File name:pwn.xml
Download: download sample
Signature Mirai
Create hunting rule
File size:646 bytes
First seen:2026-01-23 04:56:12 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 12:FE8i9pAC7PkxGWi2jTKg9dzCXDdg0XgUC0P:FE8G/LWi2jT6XDdP62
TLSH T199F07D9F6164CE214ABCC5BAF3B94508A0928445F2F45FE3D3854C73AE8694C3AD131D
Magika xml
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://130.12.180.20:36695/x86_64d7b47e5af2494044202f87f02040bd06364679dd2f70bab53292c44c91eb397d Miraielf geofenced mirai ua-wget USA x86

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade opendir
Link:
https://www.filescan.io/uploads/697300ababc6d3ca6dec2f7a/reports/c95e86ae-cc11-4490-b9da-453f6a959dbe/overview
Verdict:
Malicious
Labled as:
TrojanDownloader/Linux.NetLoader
Link:
https://www.hybrid-analysis.com/sample/1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/9d3c1997-9423-4007-9c89-e648a57b7c3a
Behavior Graph:
Download SVG
%3 guuid=db56fa86-1600-0000-0ba3-9e076f0f0000 pid=3951 /usr/bin/sudo guuid=1211c088-1600-0000-0ba3-9e07760f0000 pid=3958 /tmp/sample.bin guuid=db56fa86-1600-0000-0ba3-9e076f0f0000 pid=3951->guuid=1211c088-1600-0000-0ba3-9e07760f0000 pid=3958 execve guuid=345efa88-1600-0000-0ba3-9e07770f0000 pid=3959 /usr/bin/rm guuid=1211c088-1600-0000-0ba3-9e07760f0000 pid=3958->guuid=345efa88-1600-0000-0ba3-9e07770f0000 pid=3959 execve guuid=30f17d89-1600-0000-0ba3-9e07790f0000 pid=3961 /usr/bin/wget net send-data write-file guuid=1211c088-1600-0000-0ba3-9e07760f0000 pid=3958->guuid=30f17d89-1600-0000-0ba3-9e07790f0000 pid=3961 execve guuid=2c9cbf90-1600-0000-0ba3-9e07920f0000 pid=3986 /usr/bin/curl net send-data write-file guuid=1211c088-1600-0000-0ba3-9e07760f0000 pid=3958->guuid=2c9cbf90-1600-0000-0ba3-9e07920f0000 pid=3986 execve guuid=5d1f7aa5-1600-0000-0ba3-9e07e70f0000 pid=4071 /usr/bin/chmod guuid=1211c088-1600-0000-0ba3-9e07760f0000 pid=3958->guuid=5d1f7aa5-1600-0000-0ba3-9e07e70f0000 pid=4071 execve b74d60aa-ce52-59bb-a391-58d03c545629 130.12.180.20:36695 guuid=30f17d89-1600-0000-0ba3-9e07790f0000 pid=3961->b74d60aa-ce52-59bb-a391-58d03c545629 send: 140B guuid=2c9cbf90-1600-0000-0ba3-9e07920f0000 pid=3986->b74d60aa-ce52-59bb-a391-58d03c545629 send: 89B
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-01-23 05:02:00 UTC
File Type:
Text
AV detection:
2 of 36 (5.56%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dn6lkezrzzif5twcudffwb75docdzs3icf2tacyrejmj7mdidsba._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260123-fns77say4g/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 1b7cb51331ce505ecec2a0ca5b07fd1b843ccb681175300b1122589fb0681c82

(this sample)

Mirai

elf d7b47e5af2494044202f87f02040bd06364679dd2f70bab53292c44c91eb397d

  
URLhaus
https://urlhaus.abuse.ch/url/3762383/
  
Delivery method
Distributed via web download
  
Dropping
MD5 1d83b3d592ac45db69b7e2ec9d6bf01f
  
Dropping
SHA256 d7b47e5af2494044202f87f02040bd06364679dd2f70bab53292c44c91eb397d

Comments