MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38f1d87bf24013ce3ec1049b758b5ee54a49eba35a5cb0057f559b9290028300. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	38f1d87bf24013ce3ec1049b758b5ee54a49eba35a5cb0057f559b9290028300
SHA3-384 hash:	8bb5177b186e014c3dc89a14f4899dd0b3b37a66fcb45eba502f60783d5755b586b97e5694046754987a5dfccd47d034
SHA1 hash:	34833e7ebcb2639d7e5544a9fa394edb26c8bb13
MD5 hash:	c885b8f159c202023f6efdcd37e2de91
humanhash:	angel-charlie-wisconsin-delta
File name:	xwget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'617 bytes
First seen:	2025-08-08 17:29:26 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:VPWyGjqspu/Rq1ClA9AYrjtE1xH7/LuZi1qP6oYDJ521+lly33zbdlRB4E81v:V0jA/c195E1xb6s1qP6ocz21+lly3DbM
TLSH	T1EA51BADE45252C4EF2199B4B73BB8C0921768FB9109FCF8D9FC5392A9D4CA24B093E51
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.209.150.187/odin.arm	9a36946cbdf2682af5b0227ee93b120c3c0543f260076bb2094638a71b68e294	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.arm5n	d89b9aa7f0ac337077c5614d1d8321d1a0dff5280560bde0a8339c0dba0abd5d	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.arm7	bdde0035d6b37dce2fff359848916a559640206659024577d4fa61608b4931bc	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.m68k	a11b9aef373169010a4822273a8a16fb4deb9e386166e4b94aa791f34a25f39e	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.mips	a25ff39e978fa88f79d10bcd25a86bc48d196af8e2046be47a886ce4dd6a6650	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.mpsl	96f1e58ca140b8babe3873412dc17b203d2b87df2e70886625c249d3db092789	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.ppc	e7834d6e7af525e9200c4f98255f6a3db500d86e1a1d254610c1f5d47a90575b	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.sh4	b185e773d0014ff89e12a4ba6075282488a1b130af190e3d8c064d618c11cf7e	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.spc	3ccec93311c41cc3a813b5762e249706c4cc3fd2c04894585300e05221268a01	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.x86	aa14c7945115ba63c093f4ca508af7a9b20198c432a70b68cab2f52bad4121c7	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/bizy.arm5	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.arm6	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.arm7	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.arm8	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mips	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mpsl	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mipss	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mpsls	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.riscv	e2fbe4a0085cfa107069c0a614ecae10e3b1b04f1ecfee287f2d5abdc2b79a13	Mirai	elf mirai ua-wget
http://213.209.150.187/bizy.x86	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.x64	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mips64	2fa27985ef9b46d3584dcff9ec777b1fdd62ea98a7660490cc3ebb5fc5b79172	Mirai	elf mirai ua-wget
http://213.209.150.187/bizy.mpsl64	8b35595ec94e07930eaf57ce734a1d48ab90db9ee97073bedda788574786eeda	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/5cc7fd63-2507-4ae3-b8e3-57fb42ca5cf8

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/38f1d87bf24013ce3ec1049b758b5ee54a49eba35a5cb0057f559b9290028300

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/38f1d87bf24013ce3ec1049b758b5ee54a49eba35a5cb0057f559b9290028300/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/38f1d87bf24013ce3ec1049b758b5ee54a49eba35a5cb0057f559b9290028300

Threat name:

Script-Shell.Trojan.Geninst

Status:

Malicious

First seen:

2025-08-08 17:30:50 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hdy5q67siaj44pwbasnxlc264vfet25dljolabl7kwnzfeacqmaa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250808-v2ts8abl9t/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

UPX packed file

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Contacts a large (14560) amount of remote hosts

Creates a large amount of network flows

Mirai

Mirai family

Malware Config

C2 Extraction:

104d.hldns.ru

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/38f1d87bf24013ce3ec1049b758b5ee54a49eba35a5cb0057f559b9290028300

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.