MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe
SHA3-384 hash: bf9c6f2f531b2920c29a112745bb8c3c5430e5418edec49ce752df98c9debde3704b978ab45bc85e3565a2b6f8a16caa
SHA1 hash: 5c73fd6499a56044ff2eafc88396281fe1e35f30
MD5 hash: 95711725c9693e12f855b052d2bf974d
humanhash: apart-triple-happy-high
File name:f
Download: download sample
Signature Mirai
Create hunting rule
File size:819 bytes
First seen:2025-12-22 16:40:39 UTC
Last seen:2025-12-23 01:32:28 UTC
File type: sh
MIME type:text/plain
ssdeep 24:/9ZOekRD3v6hLkRD3v6nRkRD3v6M5dM5nkRD3v6rOOkRD3v6rFkRD3vXw:FZTkR6kR6kRTI9kRskRikRTw
TLSH T1D901D3CF10445E315DC845DC3AD354295C418AE319E4461D6EDE856359C6F1C7B5CE7C
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://130.12.180.64/splmipsdcb690747a11527c5ad9919521ffd27a29563f24c19df3d7f9218fdea6e88622 Miraielf mirai ua-wget
http://130.12.180.64/splmpsl0cffd5f3473dde6aecb03030cb95efa81c7e1a1bc218528dc318348af422c8cc Miraielf mirai ua-wget
http://130.12.180.64/splarm8f6a29ee517a7bb5d9c3db16b8363420c732d8a9d7993da16006a05a6b80c836 Miraielf mirai ua-wget
http://130.12.180.64/splarm599126f681aa44a7d9b99678bdc492133341e2de0ca22c50b014a1e43b8ae2d91 Miraielf mirai ua-wget
http://130.12.180.64/splarm77cc0c7d015dfef9d1917318d0ec9b7cb9d1bb80d8b2b0bff615814bc2a0726eb Miraielf mirai ua-wget
http://130.12.180.64/splarm6fa62bcbb4cff0013ab416aaa10c8fe9b2c3beb731db15f27eafba9f81d761343 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
35
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe
Verdict:
Malicious
File Type:
text
First seen:
2025-12-22T14:43:00Z UTC
Last seen:
2025-12-23T23:20:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/74c35ec0-38ad-4a03-96c3-08d420e5a4c1
Behavior Graph:
Download SVG
%3 guuid=94eff7d0-1600-0000-8ac5-17e7940e0000 pid=3732 /usr/bin/sudo guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740 /tmp/sample.bin guuid=94eff7d0-1600-0000-8ac5-17e7940e0000 pid=3732->guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740 execve guuid=0c2710d3-1600-0000-8ac5-17e79e0e0000 pid=3742 /usr/bin/cp guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=0c2710d3-1600-0000-8ac5-17e79e0e0000 pid=3742 execve guuid=4371b8d7-1600-0000-8ac5-17e7ae0e0000 pid=3758 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=4371b8d7-1600-0000-8ac5-17e7ae0e0000 pid=3758 clone guuid=8e5817dc-1600-0000-8ac5-17e7c80e0000 pid=3784 /usr/bin/chmod guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=8e5817dc-1600-0000-8ac5-17e7c80e0000 pid=3784 execve guuid=874454dc-1600-0000-8ac5-17e7c90e0000 pid=3785 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=874454dc-1600-0000-8ac5-17e7c90e0000 pid=3785 clone guuid=0c87bddd-1600-0000-8ac5-17e7d30e0000 pid=3795 /usr/bin/rm delete-file guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=0c87bddd-1600-0000-8ac5-17e7d30e0000 pid=3795 execve guuid=6b8dfedd-1600-0000-8ac5-17e7d60e0000 pid=3798 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=6b8dfedd-1600-0000-8ac5-17e7d60e0000 pid=3798 clone guuid=79d80ee3-1600-0000-8ac5-17e7f00e0000 pid=3824 /usr/bin/chmod guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=79d80ee3-1600-0000-8ac5-17e7f00e0000 pid=3824 execve guuid=7485ade3-1600-0000-8ac5-17e7f10e0000 pid=3825 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=7485ade3-1600-0000-8ac5-17e7f10e0000 pid=3825 clone guuid=339d3ce5-1600-0000-8ac5-17e7f50e0000 pid=3829 /usr/bin/rm delete-file guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=339d3ce5-1600-0000-8ac5-17e7f50e0000 pid=3829 execve guuid=45c57be5-1600-0000-8ac5-17e7f70e0000 pid=3831 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=45c57be5-1600-0000-8ac5-17e7f70e0000 pid=3831 clone guuid=e8f8ccec-1600-0000-8ac5-17e7160f0000 pid=3862 /usr/bin/chmod guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=e8f8ccec-1600-0000-8ac5-17e7160f0000 pid=3862 execve guuid=702b1ded-1600-0000-8ac5-17e7170f0000 pid=3863 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=702b1ded-1600-0000-8ac5-17e7170f0000 pid=3863 clone guuid=45a3b4ee-1600-0000-8ac5-17e71f0f0000 pid=3871 /usr/bin/rm delete-file guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=45a3b4ee-1600-0000-8ac5-17e71f0f0000 pid=3871 execve guuid=4408f2ee-1600-0000-8ac5-17e7200f0000 pid=3872 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=4408f2ee-1600-0000-8ac5-17e7200f0000 pid=3872 clone guuid=cbb405f6-1600-0000-8ac5-17e7390f0000 pid=3897 /usr/bin/chmod guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=cbb405f6-1600-0000-8ac5-17e7390f0000 pid=3897 execve guuid=e44d45f6-1600-0000-8ac5-17e73b0f0000 pid=3899 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=e44d45f6-1600-0000-8ac5-17e73b0f0000 pid=3899 clone guuid=38b815f7-1600-0000-8ac5-17e7400f0000 pid=3904 /usr/bin/rm delete-file guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=38b815f7-1600-0000-8ac5-17e7400f0000 pid=3904 execve guuid=6db659f7-1600-0000-8ac5-17e7420f0000 pid=3906 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=6db659f7-1600-0000-8ac5-17e7420f0000 pid=3906 clone guuid=b965b6fc-1600-0000-8ac5-17e7550f0000 pid=3925 /usr/bin/chmod guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=b965b6fc-1600-0000-8ac5-17e7550f0000 pid=3925 execve guuid=8cc11afd-1600-0000-8ac5-17e7570f0000 pid=3927 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=8cc11afd-1600-0000-8ac5-17e7570f0000 pid=3927 clone guuid=79df05fe-1600-0000-8ac5-17e75b0f0000 pid=3931 /usr/bin/rm delete-file guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=79df05fe-1600-0000-8ac5-17e75b0f0000 pid=3931 execve guuid=dde960fe-1600-0000-8ac5-17e75d0f0000 pid=3933 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=dde960fe-1600-0000-8ac5-17e75d0f0000 pid=3933 clone guuid=2766d006-1700-0000-8ac5-17e7770f0000 pid=3959 /usr/bin/chmod guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=2766d006-1700-0000-8ac5-17e7770f0000 pid=3959 execve guuid=76c61a07-1700-0000-8ac5-17e7780f0000 pid=3960 /usr/bin/dash guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=76c61a07-1700-0000-8ac5-17e7780f0000 pid=3960 clone guuid=8429d407-1700-0000-8ac5-17e7800f0000 pid=3968 /usr/bin/rm delete-file guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=8429d407-1700-0000-8ac5-17e7800f0000 pid=3968 execve guuid=194f2308-1700-0000-8ac5-17e7810f0000 pid=3969 /usr/bin/rm delete-file guuid=ad55dcd2-1600-0000-8ac5-17e79c0e0000 pid=3740->guuid=194f2308-1700-0000-8ac5-17e7810f0000 pid=3969 execve guuid=94c8c1d7-1600-0000-8ac5-17e7af0e0000 pid=3759 /usr/bin/busybox net send-data write-file guuid=4371b8d7-1600-0000-8ac5-17e7ae0e0000 pid=3758->guuid=94c8c1d7-1600-0000-8ac5-17e7af0e0000 pid=3759 execve f22fee75-ab34-540d-95fe-696883c6f4ad 130.12.180.64:80 guuid=94c8c1d7-1600-0000-8ac5-17e7af0e0000 pid=3759->f22fee75-ab34-540d-95fe-696883c6f4ad send: 83B guuid=9c8a07de-1600-0000-8ac5-17e7d70e0000 pid=3799 /usr/bin/busybox net send-data write-file guuid=6b8dfedd-1600-0000-8ac5-17e7d60e0000 pid=3798->guuid=9c8a07de-1600-0000-8ac5-17e7d70e0000 pid=3799 execve guuid=9c8a07de-1600-0000-8ac5-17e7d70e0000 pid=3799->f22fee75-ab34-540d-95fe-696883c6f4ad send: 83B guuid=be3082e5-1600-0000-8ac5-17e7f80e0000 pid=3832 /usr/bin/busybox net send-data write-file guuid=45c57be5-1600-0000-8ac5-17e7f70e0000 pid=3831->guuid=be3082e5-1600-0000-8ac5-17e7f80e0000 pid=3832 execve guuid=be3082e5-1600-0000-8ac5-17e7f80e0000 pid=3832->f22fee75-ab34-540d-95fe-696883c6f4ad send: 82B guuid=4ff8f7ee-1600-0000-8ac5-17e7210f0000 pid=3873 /usr/bin/busybox net send-data write-file guuid=4408f2ee-1600-0000-8ac5-17e7200f0000 pid=3872->guuid=4ff8f7ee-1600-0000-8ac5-17e7210f0000 pid=3873 execve guuid=4ff8f7ee-1600-0000-8ac5-17e7210f0000 pid=3873->f22fee75-ab34-540d-95fe-696883c6f4ad send: 83B guuid=2d8b61f7-1600-0000-8ac5-17e7430f0000 pid=3907 /usr/bin/busybox net send-data write-file guuid=6db659f7-1600-0000-8ac5-17e7420f0000 pid=3906->guuid=2d8b61f7-1600-0000-8ac5-17e7430f0000 pid=3907 execve guuid=2d8b61f7-1600-0000-8ac5-17e7430f0000 pid=3907->f22fee75-ab34-540d-95fe-696883c6f4ad send: 83B guuid=0d6b71fe-1600-0000-8ac5-17e75e0f0000 pid=3934 /usr/bin/busybox net send-data write-file guuid=dde960fe-1600-0000-8ac5-17e75d0f0000 pid=3933->guuid=0d6b71fe-1600-0000-8ac5-17e75e0f0000 pid=3934 execve guuid=0d6b71fe-1600-0000-8ac5-17e75e0f0000 pid=3934->f22fee75-ab34-540d-95fe-696883c6f4ad send: 83B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-22 16:36:45 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d3bypise4djiq2gxztxehgfgafyx6bqjwzeooqla5l6u7v7s727a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251223-k1emss1nct/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 1ec387a244e0d28868d7ccee4398a601717f0609b648e74160eafd4fd7f2febe

(this sample)

Mirai

elf 5827ab22c27a3de7ae37378f9fc1af2e2216b5b68787f2523a850f8b267f9989

  
URLhaus
https://urlhaus.abuse.ch/url/3740356/
  
Delivery method
Distributed via web download
  
Dropping
MD5 b9c63cdf057bb23f02215eb0b59c80fd
  
Dropping
SHA256 5827ab22c27a3de7ae37378f9fc1af2e2216b5b68787f2523a850f8b267f9989

Comments