MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 399f47b818893f2122ea50db8630f27a062b9666f9f7c4f93354e3eb48090738. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 399f47b818893f2122ea50db8630f27a062b9666f9f7c4f93354e3eb48090738
SHA3-384 hash: 9108c394b7f6e5f0ffb822f0cb12b9e2d94443ecb026852de8a78cdf75195a228de5bc1e50e5ab43a6d219201985ffd6
SHA1 hash: 05b07ba7519445d5b924c222cab180a2f34203a2
MD5 hash: d69c0c4c646ff8c3c7e38263daf1f00e
humanhash: summer-louisiana-video-bakerloo
File name:t
Download: download sample
Signature Mirai
Create hunting rule
File size:585 bytes
First seen:2025-12-20 09:34:57 UTC
Last seen:2025-12-21 00:31:59 UTC
File type: sh
MIME type:text/plain
ssdeep 12:iuZDSHHWEZSqHWE0yzvS0yzMHWEfIjDSfIMHWEKDS7HWp:iuZ2nWEU8WE0yza0yzGWEfZfhWEK2DWp
TLSH T14EF0E7DF026104F15681E969FA934C79F00656D939C90B8CE8AE0C35158D92CB421F99
Magika batch
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://6yd.ru/mips7650d567c04ce00a1fa50841f42593319fa13f99c94daefc0febae5b48ab00d4 Mirai32-bit elf mirai ua-wget
http://6yd.ru/mpsl9597a80f69b1dcf45c78cbb72cc519e19c4299eef0d2b3e6c3bdc9aa19210255 Miraielf mirai ua-wget
http://6yd.ru/arm4n/an/aelf mirai ua-wget
http://6yd.ru/arm5371e0cffe2f794224ef69193da697e7d2a8a18b6df44d4f90488797e3630143c Miraielf mirai ua-wget
http://6yd.ru/arm7da83bdfce452041df71007b1463e562cc3403c9d01ed9fd97e6bc96ea47d2e36 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive mirai
Link:
https://www.filescan.io/uploads/69466ec2e126b9ff4389d0c1/reports/daec7fe4-12d7-4a80-8685-9e7a6dbab5a3/overview
Verdict:
Malicious
File Type:
text
First seen:
2025-12-20T06:50:00Z UTC
Last seen:
2025-12-20T16:48:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/399f47b818893f2122ea50db8630f27a062b9666f9f7c4f93354e3eb48090738/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/be0ce384-5f3f-4fa9-a80b-f847ab672f4f
Behavior Graph:
Download SVG
%3 guuid=c66cb1ed-1600-0000-6254-f0bfc00c0000 pid=3264 /usr/bin/sudo guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272 /tmp/sample.bin guuid=c66cb1ed-1600-0000-6254-f0bfc00c0000 pid=3264->guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272 execve guuid=ba40edef-1600-0000-6254-f0bfca0c0000 pid=3274 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=ba40edef-1600-0000-6254-f0bfca0c0000 pid=3274 clone guuid=5c9b0cfb-1600-0000-6254-f0bfe40c0000 pid=3300 /usr/bin/chmod guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=5c9b0cfb-1600-0000-6254-f0bfe40c0000 pid=3300 execve guuid=6faa85fb-1600-0000-6254-f0bfe60c0000 pid=3302 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=6faa85fb-1600-0000-6254-f0bfe60c0000 pid=3302 clone guuid=fd2938fc-1600-0000-6254-f0bfea0c0000 pid=3306 /usr/bin/rm delete-file guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=fd2938fc-1600-0000-6254-f0bfea0c0000 pid=3306 execve guuid=c34085fc-1600-0000-6254-f0bfec0c0000 pid=3308 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=c34085fc-1600-0000-6254-f0bfec0c0000 pid=3308 clone guuid=79862245-1700-0000-6254-f0bf7f0d0000 pid=3455 /usr/bin/chmod guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=79862245-1700-0000-6254-f0bf7f0d0000 pid=3455 execve guuid=9b365945-1700-0000-6254-f0bf810d0000 pid=3457 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=9b365945-1700-0000-6254-f0bf810d0000 pid=3457 clone guuid=8b04d345-1700-0000-6254-f0bf850d0000 pid=3461 /usr/bin/rm delete-file guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=8b04d345-1700-0000-6254-f0bf850d0000 pid=3461 execve guuid=38730e46-1700-0000-6254-f0bf870d0000 pid=3463 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=38730e46-1700-0000-6254-f0bf870d0000 pid=3463 clone guuid=39879d77-1700-0000-6254-f0bfe90d0000 pid=3561 /usr/bin/chmod guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=39879d77-1700-0000-6254-f0bfe90d0000 pid=3561 execve guuid=c6005078-1700-0000-6254-f0bfea0d0000 pid=3562 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=c6005078-1700-0000-6254-f0bfea0d0000 pid=3562 clone guuid=41293579-1700-0000-6254-f0bfed0d0000 pid=3565 /usr/bin/rm delete-file guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=41293579-1700-0000-6254-f0bfed0d0000 pid=3565 execve guuid=414aaa79-1700-0000-6254-f0bfef0d0000 pid=3567 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=414aaa79-1700-0000-6254-f0bfef0d0000 pid=3567 clone guuid=1d053e82-1700-0000-6254-f0bf000e0000 pid=3584 /usr/bin/chmod guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=1d053e82-1700-0000-6254-f0bf000e0000 pid=3584 execve guuid=9ef7b282-1700-0000-6254-f0bf020e0000 pid=3586 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=9ef7b282-1700-0000-6254-f0bf020e0000 pid=3586 clone guuid=a5c4a383-1700-0000-6254-f0bf070e0000 pid=3591 /usr/bin/rm delete-file guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=a5c4a383-1700-0000-6254-f0bf070e0000 pid=3591 execve guuid=40edfa83-1700-0000-6254-f0bf080e0000 pid=3592 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=40edfa83-1700-0000-6254-f0bf080e0000 pid=3592 clone guuid=bb6341f5-1700-0000-6254-f0bf320f0000 pid=3890 /usr/bin/chmod guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=bb6341f5-1700-0000-6254-f0bf320f0000 pid=3890 execve guuid=5e78b8f5-1700-0000-6254-f0bf340f0000 pid=3892 /usr/bin/dash guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=5e78b8f5-1700-0000-6254-f0bf340f0000 pid=3892 clone guuid=2e1cb2f6-1700-0000-6254-f0bf380f0000 pid=3896 /usr/bin/rm delete-file guuid=db3f8bef-1600-0000-6254-f0bfc80c0000 pid=3272->guuid=2e1cb2f6-1700-0000-6254-f0bf380f0000 pid=3896 execve guuid=4268fbef-1600-0000-6254-f0bfcb0c0000 pid=3275 /usr/bin/wget dns net send-data write-file guuid=ba40edef-1600-0000-6254-f0bfca0c0000 pid=3274->guuid=4268fbef-1600-0000-6254-f0bfcb0c0000 pid=3275 execve 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=4268fbef-1600-0000-6254-f0bfcb0c0000 pid=3275->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 48B a426af05-0fe5-5064-9002-84e3f002b7b9 6yd.ru:80 guuid=4268fbef-1600-0000-6254-f0bfcb0c0000 pid=3275->a426af05-0fe5-5064-9002-84e3f002b7b9 send: 125B guuid=a5078efc-1600-0000-6254-f0bfed0c0000 pid=3309 /usr/bin/wget dns net send-data write-file guuid=c34085fc-1600-0000-6254-f0bfec0c0000 pid=3308->guuid=a5078efc-1600-0000-6254-f0bfed0c0000 pid=3309 execve guuid=a5078efc-1600-0000-6254-f0bfed0c0000 pid=3309->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 48B guuid=a5078efc-1600-0000-6254-f0bfed0c0000 pid=3309->a426af05-0fe5-5064-9002-84e3f002b7b9 send: 125B guuid=432d1c46-1700-0000-6254-f0bf880d0000 pid=3464 /usr/bin/wget dns net send-data write-file guuid=38730e46-1700-0000-6254-f0bf870d0000 pid=3463->guuid=432d1c46-1700-0000-6254-f0bf880d0000 pid=3464 execve guuid=432d1c46-1700-0000-6254-f0bf880d0000 pid=3464->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 48B guuid=432d1c46-1700-0000-6254-f0bf880d0000 pid=3464->a426af05-0fe5-5064-9002-84e3f002b7b9 send: 125B guuid=b4cac079-1700-0000-6254-f0bff00d0000 pid=3568 /usr/bin/wget dns net send-data write-file guuid=414aaa79-1700-0000-6254-f0bfef0d0000 pid=3567->guuid=b4cac079-1700-0000-6254-f0bff00d0000 pid=3568 execve guuid=b4cac079-1700-0000-6254-f0bff00d0000 pid=3568->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 48B guuid=b4cac079-1700-0000-6254-f0bff00d0000 pid=3568->a426af05-0fe5-5064-9002-84e3f002b7b9 send: 125B guuid=aeae0984-1700-0000-6254-f0bf090e0000 pid=3593 /usr/bin/wget dns net send-data write-file guuid=40edfa83-1700-0000-6254-f0bf080e0000 pid=3592->guuid=aeae0984-1700-0000-6254-f0bf090e0000 pid=3593 execve guuid=aeae0984-1700-0000-6254-f0bf090e0000 pid=3593->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 48B guuid=aeae0984-1700-0000-6254-f0bf090e0000 pid=3593->a426af05-0fe5-5064-9002-84e3f002b7b9 send: 125B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/399f47b818893f2122ea50db8630f27a062b9666f9f7c4f93354e3eb48090738
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/399f47b818893f2122ea50db8630f27a062b9666f9f7c4f93354e3eb48090738/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-20 09:39:16 UTC
File Type:
Text (Shell)
AV detection:
12 of 36 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hgpupoayre7scixkkdnymmhspidcxftg7h34j6jtktr6wsaja44a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251223-nvz84awlav/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/399f47b818893f2122ea50db8630f27a062b9666f9f7c4f93354e3eb48090738

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 399f47b818893f2122ea50db8630f27a062b9666f9f7c4f93354e3eb48090738

(this sample)

Mirai

elf 928d101b33e8a77fd10953f11ec339510ab21adb5019c0433120c7fb93a3e811

  
URLhaus
https://urlhaus.abuse.ch/url/3737801/
  
Delivery method
Distributed via web download
  
Dropping
MD5 44669f227c04ab41375427463a1d909c
  
Dropping
SHA256 928d101b33e8a77fd10953f11ec339510ab21adb5019c0433120c7fb93a3e811

Comments