MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121
SHA3-384 hash: 76790beec0798d3dbdf8de13689ed55b5ec3d73ea1b6488d153bc7f4b9c09838f762f9e7b6347e7328434b4db83b6d13
SHA1 hash: 5b018d9a5dc81ef04086bb7c1a79dd668d0ea1eb
MD5 hash: 5b7fdc5332deede32b34d985a57302c8
humanhash: wyoming-fourteen-orange-cold
File name:k
Download: download sample
Signature Mirai
Create hunting rule
File size:1'058 bytes
First seen:2025-09-28 16:29:59 UTC
Last seen:2025-09-29 15:46:06 UTC
File type: sh
MIME type:text/plain
ssdeep 12:dZoJ2egeKNWKDbnPZM5ZMoOF7+MB05+XLWyTkXLWygDNkSX2yTkX2ygDNkSXtvk+:E22IbO5zOt+MB0Cq2k2kS0mkQksXS8bv
TLSH T18411E7CF11B09C325CD5499E71934C14B4CBC9FC1ACACF89648A043AB8C9918F276F9A
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://194.31.222.17/v/armv7lc3788d92bfc3a08dbcca4476832c46b099bcad182c56cdbccf837eb0edb6cd77 Miraiarm elf geofenced mirai ua-wget USA
http://194.31.222.17/kk/armv7lc08227c99e5c062c360c13a7e23e0eba8786615f3a68c8b4abe1305898084cc5 Miraielf mirai ua-wget
http://194.31.222.17/kk/armv5l196d4187438354ffda9b8a211b1dbb69e789036bc98c9b533584c38ee1b6ad9d Miraielf mirai ua-wget
http://194.31.222.17/kk/armv4lfa2969618c11630496f8784ca73bfb3734ceb7b7d6bc861729ab1080a3e70a55 Miraielf mirai ua-wget
http://s.cuckstudios.su/k36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121 MiraiDEU geofenced mirai opendir sh ua-wget USA

Intelligence

File Origin
# of uploads :
2
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32150.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
ps1
First seen:
2025-09-28T13:39:00Z UTC
Last seen:
2025-09-28T13:39:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p
Link:
https://opentip.kaspersky.com/36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/537a2c80-a7e7-4e0a-91ce-d000a621b5e4
Behavior Graph:
Download SVG
%3 guuid=03aa8ba9-1600-0000-6695-2709c20c0000 pid=3266 /usr/bin/sudo guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274 /tmp/sample.bin guuid=03aa8ba9-1600-0000-6695-2709c20c0000 pid=3266->guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274 execve guuid=a1ed46ac-1600-0000-6695-2709cc0c0000 pid=3276 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=a1ed46ac-1600-0000-6695-2709cc0c0000 pid=3276 clone guuid=ebd451ad-1600-0000-6695-2709d50c0000 pid=3285 /usr/bin/rm delete-file guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=ebd451ad-1600-0000-6695-2709d50c0000 pid=3285 execve guuid=9038aead-1600-0000-6695-2709d70c0000 pid=3287 /usr/bin/rm delete-file guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=9038aead-1600-0000-6695-2709d70c0000 pid=3287 execve guuid=1bb130ae-1600-0000-6695-2709d80c0000 pid=3288 /usr/bin/rm delete-file guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=1bb130ae-1600-0000-6695-2709d80c0000 pid=3288 execve guuid=4291a0ae-1600-0000-6695-2709d90c0000 pid=3289 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=4291a0ae-1600-0000-6695-2709d90c0000 pid=3289 clone guuid=c7d148af-1600-0000-6695-2709dd0c0000 pid=3293 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=c7d148af-1600-0000-6695-2709dd0c0000 pid=3293 clone guuid=25ea91af-1600-0000-6695-2709e00c0000 pid=3296 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=25ea91af-1600-0000-6695-2709e00c0000 pid=3296 clone guuid=bb783fbc-1600-0000-6695-2709fd0c0000 pid=3325 /usr/bin/chmod guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=bb783fbc-1600-0000-6695-2709fd0c0000 pid=3325 execve guuid=f76f87bc-1600-0000-6695-2709fe0c0000 pid=3326 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=f76f87bc-1600-0000-6695-2709fe0c0000 pid=3326 clone guuid=1ddb15bd-1600-0000-6695-2709010d0000 pid=3329 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=1ddb15bd-1600-0000-6695-2709010d0000 pid=3329 clone guuid=9a6f3ac5-1600-0000-6695-2709040d0000 pid=3332 /usr/bin/chmod guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=9a6f3ac5-1600-0000-6695-2709040d0000 pid=3332 execve guuid=97c989c5-1600-0000-6695-2709050d0000 pid=3333 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=97c989c5-1600-0000-6695-2709050d0000 pid=3333 clone guuid=808228c6-1600-0000-6695-2709080d0000 pid=3336 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=808228c6-1600-0000-6695-2709080d0000 pid=3336 clone guuid=caae34d0-1600-0000-6695-27091f0d0000 pid=3359 /usr/bin/chmod guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=caae34d0-1600-0000-6695-27091f0d0000 pid=3359 execve guuid=96c778d0-1600-0000-6695-2709210d0000 pid=3361 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=96c778d0-1600-0000-6695-2709210d0000 pid=3361 clone guuid=ce310ed1-1600-0000-6695-2709240d0000 pid=3364 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=ce310ed1-1600-0000-6695-2709240d0000 pid=3364 clone guuid=02abaed9-1600-0000-6695-2709360d0000 pid=3382 /usr/bin/chmod guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=02abaed9-1600-0000-6695-2709360d0000 pid=3382 execve guuid=89ba09da-1600-0000-6695-2709380d0000 pid=3384 /usr/bin/dash guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=89ba09da-1600-0000-6695-2709380d0000 pid=3384 clone guuid=c897aadb-1600-0000-6695-27093e0d0000 pid=3390 /usr/bin/grep guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=c897aadb-1600-0000-6695-27093e0d0000 pid=3390 execve guuid=d98919dc-1600-0000-6695-2709400d0000 pid=3392 /usr/bin/sed guuid=9509f4ab-1600-0000-6695-2709ca0c0000 pid=3274->guuid=d98919dc-1600-0000-6695-2709400d0000 pid=3392 execve guuid=8c6355ac-1600-0000-6695-2709cd0c0000 pid=3277 /usr/bin/cat guuid=a1ed46ac-1600-0000-6695-2709cc0c0000 pid=3276->guuid=8c6355ac-1600-0000-6695-2709cd0c0000 pid=3277 execve guuid=b4f35bac-1600-0000-6695-2709ce0c0000 pid=3278 /usr/bin/grep guuid=a1ed46ac-1600-0000-6695-2709cc0c0000 pid=3276->guuid=b4f35bac-1600-0000-6695-2709ce0c0000 pid=3278 execve guuid=07b664ac-1600-0000-6695-2709cf0c0000 pid=3279 /usr/bin/grep guuid=a1ed46ac-1600-0000-6695-2709cc0c0000 pid=3276->guuid=07b664ac-1600-0000-6695-2709cf0c0000 pid=3279 execve guuid=243369ac-1600-0000-6695-2709d00c0000 pid=3280 /usr/bin/grep guuid=a1ed46ac-1600-0000-6695-2709cc0c0000 pid=3276->guuid=243369ac-1600-0000-6695-2709d00c0000 pid=3280 execve guuid=d35d6eac-1600-0000-6695-2709d10c0000 pid=3281 /usr/bin/cut guuid=a1ed46ac-1600-0000-6695-2709cc0c0000 pid=3276->guuid=d35d6eac-1600-0000-6695-2709d10c0000 pid=3281 execve guuid=58b5acae-1600-0000-6695-2709da0c0000 pid=3290 /usr/bin/cp write-file guuid=4291a0ae-1600-0000-6695-2709d90c0000 pid=3289->guuid=58b5acae-1600-0000-6695-2709da0c0000 pid=3290 execve guuid=0e8f52af-1600-0000-6695-2709de0c0000 pid=3294 /usr/bin/chmod guuid=c7d148af-1600-0000-6695-2709dd0c0000 pid=3293->guuid=0e8f52af-1600-0000-6695-2709de0c0000 pid=3294 execve guuid=159a9caf-1600-0000-6695-2709e10c0000 pid=3297 /usr/bin/wget net send-data write-file guuid=25ea91af-1600-0000-6695-2709e00c0000 pid=3296->guuid=159a9caf-1600-0000-6695-2709e10c0000 pid=3297 execve 287749b9-1937-53b1-8818-44b73ae22708 194.31.222.17:80 guuid=159a9caf-1600-0000-6695-2709e10c0000 pid=3297->287749b9-1937-53b1-8818-44b73ae22708 send: 136B guuid=80071fbd-1600-0000-6695-2709020d0000 pid=3330 /usr/bin/wget net send-data write-file guuid=1ddb15bd-1600-0000-6695-2709010d0000 pid=3329->guuid=80071fbd-1600-0000-6695-2709020d0000 pid=3330 execve guuid=80071fbd-1600-0000-6695-2709020d0000 pid=3330->287749b9-1937-53b1-8818-44b73ae22708 send: 137B guuid=a6c832c6-1600-0000-6695-2709090d0000 pid=3337 /usr/bin/wget net send-data write-file guuid=808228c6-1600-0000-6695-2709080d0000 pid=3336->guuid=a6c832c6-1600-0000-6695-2709090d0000 pid=3337 execve guuid=a6c832c6-1600-0000-6695-2709090d0000 pid=3337->287749b9-1937-53b1-8818-44b73ae22708 send: 137B guuid=002a18d1-1600-0000-6695-2709260d0000 pid=3366 /usr/bin/wget net send-data write-file guuid=ce310ed1-1600-0000-6695-2709240d0000 pid=3364->guuid=002a18d1-1600-0000-6695-2709260d0000 pid=3366 execve guuid=002a18d1-1600-0000-6695-2709260d0000 pid=3366->287749b9-1937-53b1-8818-44b73ae22708 send: 137B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121
Threat name:
Script.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-09-28 16:33:22 UTC
File Type:
Text (Shell)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g34u663rp7woglufcnqou47q7rc6fifll54qyi4sapvocn2e4eqq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250928-t2qacsbq5y/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 36f94f7b717fece32e851360ea73f0fc45e2a0ab5f790c239203eae13744e121

(this sample)

Mirai

elf c3788d92bfc3a08dbcca4476832c46b099bcad182c56cdbccf837eb0edb6cd77

  
URLhaus
https://urlhaus.abuse.ch/url/3628282/
  
Delivery method
Distributed via web download
  
Dropping
MD5 2343ab12999843c88fd9ea2539fb228d
  
Dropping
SHA256 c3788d92bfc3a08dbcca4476832c46b099bcad182c56cdbccf837eb0edb6cd77
  
URLhaus
https://urlhaus.abuse.ch/url/3628297/

Comments