MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ea92c451464cab5d927bdc740a75b26f5b960fc77f39fcef0ecfc3be406dfdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	1ea92c451464cab5d927bdc740a75b26f5b960fc77f39fcef0ecfc3be406dfdc
SHA3-384 hash:	ab999810e0256529340efd463d1c0498a4139119ab60cb0c55c7fbe5db61b720e64e9fa09bf94e43903fdf672a60fb4d
SHA1 hash:	c075b8a6ec6c228eace74ac39399e51e8162f309
MD5 hash:	a6a1256f1ae2633fdb53bbfeafff2ef2
humanhash:	speaker-california-angel-edward
File name:	tv.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	496 bytes
First seen:	2025-02-19 15:01:49 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	6:hD6FXX+Y1BCg6FaE59+Gc6FeSso1J6FNx0FiTiV6Fm8xR6FuNFITT7tW0v:2X+5Mo+NSso1q8iTiP8xRcVnv
TLSH	T1B8F05ECA11546F908422D9B931AB59F4A194C7CA2E8FCFC56DBE093DD9C8D1CB818A4D
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.150.218.193/12	n/a	n/a	n/a
http://83.150.218.193/b2	2c577a591c4656fa4426e8ee040cce64052b53c01f7da044bc580630be883bc8	Mirai	elf mirai ua-wget
http://83.150.218.193/b3	57c6b7c1422806dc37c1aa9cf20a151d1ec2f514cdbee65939ab292934397f59	Mirai	elf mirai ua-wget
http://83.150.218.193/b4	abd6abe413e7d646311df6fb5b9f0a1760b5753a976355ac81072200b05dc14c	Mirai	elf mirai ua-wget
http://83.150.218.193/b5	34c56a87e3f9fb244587cdeb232a0b0c5d5c17c6a62ce8214c5c795b05727f2a	Mirai	elf mirai ua-wget
http://83.150.218.193/b6	66bdd791941a9696efd797bae16fc8e2342e973e70eee2eb5fe9970cd6754288	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b5f33e28ab76d43a5bea09linux22vpnfull_triage

Tags:

agent hype sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/67b5f27ff535776018bb0555/reports/1c3443e7-3e26-4ed4-a464-198abc7162df/overview

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/1ea92c451464cab5d927bdc740a75b26f5b960fc77f39fcef0ecfc3be406dfdc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ea92c451464cab5d927bdc740a75b26f5b960fc77f39fcef0ecfc3be406dfdc/

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2025-02-20 04:29:12 UTC

AV detection:

12 of 38 (31.58%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d2usyriumtfllwjhxxdubj23e323syh4o7zz7txq5t6dxzag37oa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/250219-segh9stkeq/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1ea92c451464cab5d927bdc740a75b26f5b960fc77f39fcef0ecfc3be406dfdc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.