MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3abe5d64be21e3aa39a68c2058d5b56fd3b2d68094abe1b3d6bd151d23380a3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3abe5d64be21e3aa39a68c2058d5b56fd3b2d68094abe1b3d6bd151d23380a3b
SHA3-384 hash: 9d669d0300b8bf515ddecdbd833d4c871f4d7aa25eeb2472511a0bdb97473b0458f0f2c31e2d5a9b1fecff28e7a23fb6
SHA1 hash: a0c7a13bf8943d1efc3a95511e10e75dde41cca3
MD5 hash: 5cc93845c2b0e1997ab3b1972a8cd012
humanhash: johnny-indigo-harry-floor
File name:cat.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'847 bytes
First seen:2026-08-31 16:14:29 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:HwjCi0F8fSAW4KoFsO66SAR0wqFsn6ATCwiMID:Hw+iy8qAW4KoWO66SAR0wqFs6AuwiMID
TLSH T1233141891075D911C286EF29B0E1CEA4D347F5B572B04BF3E4531DBB8099E413425EBB
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://36.255.97.23/iran.x86_64ddf8521dbe928d6d6e65e93e78cb4489f7c8b3a42c3dd052cba3bbeb47f332c2 Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.aarch64n/an/an/a
http://36.255.97.23/iran.m68ka81c82cadfd7e2cd54fb0e7e1e084f2366c3d5737397338aeb6b1e50c7fc9c19 Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.mips3214eb4ea8edc4bb6d22114d28ef7e3310c672e0a35ba1ab3fcf2e7631a05f46 Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.mipsel2865abd41c17e7c2ca709d3eb1379c1f0d131aad747f7a5ca35d1577aaa8d51e Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.powerpc385884f1abffb3bcf21993a7c1eeef71e8efd0133db39999b7727deab03afe8b Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.sparcbc1c89c2718f93ee6b67cead554821d5f43e7a71c41af42b01ca0a179a28f7c7 Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.sh47111537e12bc687f39e26784758fb300eec35abd5a87deab520fed68d1bf6426 Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.arcc05b30ad48093af5e1106d500aa72e3d3169ba8853c664e99afe8924535b9702 Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.i4867127ded6917a21c3870d60ff2fb01c1aad65b7988f459b36c12c7c15657162e0 Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.armv4l5b6faf5f73ab5bea73407797a30e9c9114491dd23ba867b4f603d8324789d2a2 Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.armv5l175f58869ba1f7d50fdfd0744d60a62a23e89ff3a2a757625a707d4c3aa560da Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.armv6l5f1d4024dced8e8cb685fa9bfe4ff7141e79937283060eab0d54b175ddddf8ec Mirai36-255-97-23 elf mirai ua-wget
http://36.255.97.23/iran.armv7ld54bd2dfb9071f8e94fcd38edec3a25d86319b802dd82853278f02303d863496 Mirai36-255-97-23 elf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
46
Origin country :
US US
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3e9d2e97-6ac8-4df0-9a8d-a966a307434e
Behavior Graph:
Download SVG
%3 guuid=f3b8fa3d-1b00-0000-ac46-d7ecdd080000 pid=2269 /usr/bin/sudo guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277 /tmp/sample.bin guuid=f3b8fa3d-1b00-0000-ac46-d7ecdd080000 pid=2269->guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277 execve guuid=66a55c43-1b00-0000-ac46-d7ece7080000 pid=2279 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=66a55c43-1b00-0000-ac46-d7ece7080000 pid=2279 execve guuid=b865d74e-1b00-0000-ac46-d7ecef080000 pid=2287 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=b865d74e-1b00-0000-ac46-d7ecef080000 pid=2287 execve guuid=eaa5404f-1b00-0000-ac46-d7ecf1080000 pid=2289 /home/sandbox/x86_64 guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=eaa5404f-1b00-0000-ac46-d7ecf1080000 pid=2289 execve guuid=ea441850-1b00-0000-ac46-d7ecf5080000 pid=2293 /usr/bin/wget net send-data guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=ea441850-1b00-0000-ac46-d7ecf5080000 pid=2293 execve guuid=ebd03d54-1b00-0000-ac46-d7ecfc080000 pid=2300 /usr/bin/curl guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=ebd03d54-1b00-0000-ac46-d7ecfc080000 pid=2300 execve guuid=41e6f95b-1b00-0000-ac46-d7ec0e090000 pid=2318 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=41e6f95b-1b00-0000-ac46-d7ec0e090000 pid=2318 execve guuid=fde87a5c-1b00-0000-ac46-d7ec11090000 pid=2321 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=fde87a5c-1b00-0000-ac46-d7ec11090000 pid=2321 clone guuid=10029e5d-1b00-0000-ac46-d7ec14090000 pid=2324 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=10029e5d-1b00-0000-ac46-d7ec14090000 pid=2324 execve guuid=e7a7d365-1b00-0000-ac46-d7ec23090000 pid=2339 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=e7a7d365-1b00-0000-ac46-d7ec23090000 pid=2339 execve guuid=262c2166-1b00-0000-ac46-d7ec25090000 pid=2341 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=262c2166-1b00-0000-ac46-d7ec25090000 pid=2341 clone guuid=cd2bb066-1b00-0000-ac46-d7ec28090000 pid=2344 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=cd2bb066-1b00-0000-ac46-d7ec28090000 pid=2344 execve guuid=2645c46e-1b00-0000-ac46-d7ec39090000 pid=2361 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=2645c46e-1b00-0000-ac46-d7ec39090000 pid=2361 execve guuid=b1e04e6f-1b00-0000-ac46-d7ec3a090000 pid=2362 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=b1e04e6f-1b00-0000-ac46-d7ec3a090000 pid=2362 clone guuid=9add1a70-1b00-0000-ac46-d7ec3f090000 pid=2367 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=9add1a70-1b00-0000-ac46-d7ec3f090000 pid=2367 execve guuid=1f031477-1b00-0000-ac46-d7ec4d090000 pid=2381 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=1f031477-1b00-0000-ac46-d7ec4d090000 pid=2381 execve guuid=c1fb5377-1b00-0000-ac46-d7ec4f090000 pid=2383 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=c1fb5377-1b00-0000-ac46-d7ec4f090000 pid=2383 clone guuid=fc3fd877-1b00-0000-ac46-d7ec52090000 pid=2386 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=fc3fd877-1b00-0000-ac46-d7ec52090000 pid=2386 execve guuid=07973180-1b00-0000-ac46-d7ec5f090000 pid=2399 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=07973180-1b00-0000-ac46-d7ec5f090000 pid=2399 execve guuid=c2f56880-1b00-0000-ac46-d7ec61090000 pid=2401 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=c2f56880-1b00-0000-ac46-d7ec61090000 pid=2401 clone guuid=f5860082-1b00-0000-ac46-d7ec68090000 pid=2408 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=f5860082-1b00-0000-ac46-d7ec68090000 pid=2408 execve guuid=4dd4d986-1b00-0000-ac46-d7ec70090000 pid=2416 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=4dd4d986-1b00-0000-ac46-d7ec70090000 pid=2416 execve guuid=ec141f87-1b00-0000-ac46-d7ec72090000 pid=2418 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=ec141f87-1b00-0000-ac46-d7ec72090000 pid=2418 clone guuid=2701df87-1b00-0000-ac46-d7ec76090000 pid=2422 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=2701df87-1b00-0000-ac46-d7ec76090000 pid=2422 execve guuid=ec7d0392-1b00-0000-ac46-d7ec83090000 pid=2435 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=ec7d0392-1b00-0000-ac46-d7ec83090000 pid=2435 execve guuid=bb80a592-1b00-0000-ac46-d7ec85090000 pid=2437 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=bb80a592-1b00-0000-ac46-d7ec85090000 pid=2437 clone guuid=bfa35096-1b00-0000-ac46-d7ec8b090000 pid=2443 /usr/bin/wget net send-data guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=bfa35096-1b00-0000-ac46-d7ec8b090000 pid=2443 execve guuid=7782779e-1b00-0000-ac46-d7ec95090000 pid=2453 /usr/bin/curl net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=7782779e-1b00-0000-ac46-d7ec95090000 pid=2453 execve guuid=49938eab-1b00-0000-ac46-d7eca2090000 pid=2466 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=49938eab-1b00-0000-ac46-d7eca2090000 pid=2466 execve guuid=311ff8ab-1b00-0000-ac46-d7eca3090000 pid=2467 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=311ff8ab-1b00-0000-ac46-d7eca3090000 pid=2467 clone guuid=3b34dfac-1b00-0000-ac46-d7eca5090000 pid=2469 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=3b34dfac-1b00-0000-ac46-d7eca5090000 pid=2469 execve guuid=7fcaecb4-1b00-0000-ac46-d7ecb1090000 pid=2481 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=7fcaecb4-1b00-0000-ac46-d7ecb1090000 pid=2481 execve guuid=f7616cb5-1b00-0000-ac46-d7ecb4090000 pid=2484 /home/sandbox/i486 guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=f7616cb5-1b00-0000-ac46-d7ecb4090000 pid=2484 execve guuid=bdd2c3b8-1b00-0000-ac46-d7ecba090000 pid=2490 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=bdd2c3b8-1b00-0000-ac46-d7ecba090000 pid=2490 execve guuid=6e554dc0-1b00-0000-ac46-d7ecca090000 pid=2506 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=6e554dc0-1b00-0000-ac46-d7ecca090000 pid=2506 execve guuid=fdfe91c1-1b00-0000-ac46-d7ecce090000 pid=2510 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=fdfe91c1-1b00-0000-ac46-d7ecce090000 pid=2510 clone guuid=58b57cc3-1b00-0000-ac46-d7ecd2090000 pid=2514 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=58b57cc3-1b00-0000-ac46-d7ecd2090000 pid=2514 execve guuid=d2f9cbca-1b00-0000-ac46-d7ecdf090000 pid=2527 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=d2f9cbca-1b00-0000-ac46-d7ecdf090000 pid=2527 execve guuid=b99b2dcc-1b00-0000-ac46-d7ece2090000 pid=2530 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=b99b2dcc-1b00-0000-ac46-d7ece2090000 pid=2530 clone guuid=a74613ce-1b00-0000-ac46-d7ece5090000 pid=2533 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=a74613ce-1b00-0000-ac46-d7ece5090000 pid=2533 execve guuid=7aaf0adc-1b00-0000-ac46-d7ecfd090000 pid=2557 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=7aaf0adc-1b00-0000-ac46-d7ecfd090000 pid=2557 execve guuid=1a7500dd-1b00-0000-ac46-d7ec000a0000 pid=2560 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=1a7500dd-1b00-0000-ac46-d7ec000a0000 pid=2560 clone guuid=f51753de-1b00-0000-ac46-d7ec040a0000 pid=2564 /usr/bin/wget net send-data write-file guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=f51753de-1b00-0000-ac46-d7ec040a0000 pid=2564 execve guuid=f20bffe5-1b00-0000-ac46-d7ec160a0000 pid=2582 /usr/bin/chmod guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=f20bffe5-1b00-0000-ac46-d7ec160a0000 pid=2582 execve guuid=b596afe6-1b00-0000-ac46-d7ec190a0000 pid=2585 /usr/bin/dash guuid=c2fd0343-1b00-0000-ac46-d7ece5080000 pid=2277->guuid=b596afe6-1b00-0000-ac46-d7ec190a0000 pid=2585 clone 9f94c833-f468-536a-8d47-6a467b637537 36.255.97.23:80 guuid=66a55c43-1b00-0000-ac46-d7ece7080000 pid=2279->9f94c833-f468-536a-8d47-6a467b637537 send: 138B guuid=54420250-1b00-0000-ac46-d7ecf4080000 pid=2292 /home/sandbox/x86_64 zombie guuid=eaa5404f-1b00-0000-ac46-d7ecf1080000 pid=2289->guuid=54420250-1b00-0000-ac46-d7ecf4080000 pid=2292 clone guuid=0be02750-1b00-0000-ac46-d7ecf6080000 pid=2294 /home/sandbox/x86_64 write-config zombie guuid=54420250-1b00-0000-ac46-d7ecf4080000 pid=2292->guuid=0be02750-1b00-0000-ac46-d7ecf6080000 pid=2294 clone guuid=ea441850-1b00-0000-ac46-d7ecf5080000 pid=2293->9f94c833-f468-536a-8d47-6a467b637537 send: 139B guuid=a45d2951-1b00-0000-ac46-d7ecf8080000 pid=2296 /home/sandbox/x86_64 net send-data guuid=0be02750-1b00-0000-ac46-d7ecf6080000 pid=2294->guuid=a45d2951-1b00-0000-ac46-d7ecf8080000 pid=2296 clone f7d121ad-e3d9-5161-8ba5-d1ae7150ef4b 36.255.97.23:7777 guuid=a45d2951-1b00-0000-ac46-d7ecf8080000 pid=2296->f7d121ad-e3d9-5161-8ba5-d1ae7150ef4b send: 16B guuid=68574251-1b00-0000-ac46-d7ecf9080000 pid=2297 /home/sandbox/x86_64 guuid=a45d2951-1b00-0000-ac46-d7ecf8080000 pid=2296->guuid=68574251-1b00-0000-ac46-d7ecf9080000 pid=2297 clone guuid=bb354a51-1b00-0000-ac46-d7ecfa080000 pid=2298 /home/sandbox/x86_64 guuid=68574251-1b00-0000-ac46-d7ecf9080000 pid=2297->guuid=bb354a51-1b00-0000-ac46-d7ecfa080000 pid=2298 clone guuid=10029e5d-1b00-0000-ac46-d7ec14090000 pid=2324->9f94c833-f468-536a-8d47-6a467b637537 send: 136B guuid=cd2bb066-1b00-0000-ac46-d7ec28090000 pid=2344->9f94c833-f468-536a-8d47-6a467b637537 send: 136B guuid=9add1a70-1b00-0000-ac46-d7ec3f090000 pid=2367->9f94c833-f468-536a-8d47-6a467b637537 send: 138B guuid=fc3fd877-1b00-0000-ac46-d7ec52090000 pid=2386->9f94c833-f468-536a-8d47-6a467b637537 send: 139B guuid=f5860082-1b00-0000-ac46-d7ec68090000 pid=2408->9f94c833-f468-536a-8d47-6a467b637537 send: 137B guuid=2701df87-1b00-0000-ac46-d7ec76090000 pid=2422->9f94c833-f468-536a-8d47-6a467b637537 send: 135B guuid=bfa35096-1b00-0000-ac46-d7ec8b090000 pid=2443->9f94c833-f468-536a-8d47-6a467b637537 send: 135B guuid=7782779e-1b00-0000-ac46-d7ec95090000 pid=2453->9f94c833-f468-536a-8d47-6a467b637537 send: 84B guuid=3b34dfac-1b00-0000-ac46-d7eca5090000 pid=2469->9f94c833-f468-536a-8d47-6a467b637537 send: 136B guuid=a975b8b8-1b00-0000-ac46-d7ecb9090000 pid=2489 /home/sandbox/i486 guuid=f7616cb5-1b00-0000-ac46-d7ecb4090000 pid=2484->guuid=a975b8b8-1b00-0000-ac46-d7ecb9090000 pid=2489 clone guuid=770ed5b8-1b00-0000-ac46-d7ecbb090000 pid=2491 /home/sandbox/i486 write-config zombie guuid=a975b8b8-1b00-0000-ac46-d7ecb9090000 pid=2489->guuid=770ed5b8-1b00-0000-ac46-d7ecbb090000 pid=2491 clone guuid=bdd2c3b8-1b00-0000-ac46-d7ecba090000 pid=2490->9f94c833-f468-536a-8d47-6a467b637537 send: 138B guuid=cfc7cfb9-1b00-0000-ac46-d7ecbd090000 pid=2493 /home/sandbox/i486 net send-data guuid=770ed5b8-1b00-0000-ac46-d7ecbb090000 pid=2491->guuid=cfc7cfb9-1b00-0000-ac46-d7ecbd090000 pid=2493 clone guuid=cfc7cfb9-1b00-0000-ac46-d7ecbd090000 pid=2493->f7d121ad-e3d9-5161-8ba5-d1ae7150ef4b send: 475B guuid=cfc7cfb9-1b00-0000-ac46-d7ecbd090000 pid=2494 /home/sandbox/i486 guuid=cfc7cfb9-1b00-0000-ac46-d7ecbd090000 pid=2493->guuid=cfc7cfb9-1b00-0000-ac46-d7ecbd090000 pid=2494 clone guuid=58b57cc3-1b00-0000-ac46-d7ecd2090000 pid=2514->9f94c833-f468-536a-8d47-6a467b637537 send: 138B guuid=a74613ce-1b00-0000-ac46-d7ece5090000 pid=2533->9f94c833-f468-536a-8d47-6a467b637537 send: 138B guuid=f51753de-1b00-0000-ac46-d7ec040a0000 pid=2564->9f94c833-f468-536a-8d47-6a467b637537 send: 138B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3abe5d64be21e3aa39a68c2058d5b56fd3b2d68094abe1b3d6bd151d23380a3b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3abe5d64be21e3aa39a68c2058d5b56fd3b2d68094abe1b3d6bd151d23380a3b/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-31 16:13:50 UTC
File Type:
Text (Shell)
AV detection:
10 of 36 (27.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hk7f2zf6ehr2uongrqqfrvnvn7j3fvuassv6dm6wxukr2izybi5q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/260831-tqg5lswbja/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Enumerates running processes
Modifies init.d
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
Gafgyt
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3abe5d64be21/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/3abe5d64be21e3aa39a68c2058d5b56fd3b2d68094abe1b3d6bd151d23380a3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 3abe5d64be21e3aa39a68c2058d5b56fd3b2d68094abe1b3d6bd151d23380a3b

(this sample)

Mirai

elf ddf8521dbe928d6d6e65e93e78cb4489f7c8b3a42c3dd052cba3bbeb47f332c2

  
URLhaus
https://urlhaus.abuse.ch/url/3910562/
  
Delivery method
Distributed via web download
  
Dropping
MD5 62c4ced3ddc37cc0aedf9997d86b2f46
  
Dropping
SHA256 ddf8521dbe928d6d6e65e93e78cb4489f7c8b3a42c3dd052cba3bbeb47f332c2

Comments