MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f7725dd065cffa81dc152b638de312869ac82778d9c233af718c4883d35da66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	3f7725dd065cffa81dc152b638de312869ac82778d9c233af718c4883d35da66
SHA3-384 hash:	5c96606ad017a5c7addd7f578f2a7beaa8169559e029b01b733a62ad63b196dd6bfd875bef91328037ff214c4e75d01b
SHA1 hash:	06e22b294afac65743b5426e256a33ca4f384db6
MD5 hash:	f381bddccaa8b5cf7af9e3479f7bce05
humanhash:	rugby-sink-east-blossom
File name:	m
Download:	download sample
Signature	Mirai Create hunting rule
File size:	917 bytes
First seen:	2025-04-17 09:59:43 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:3rWKIw+u5ZMoOF7+MB05dQhEvfQhEMDNkmgrQht8TfQht8gDNkmWrQtKZDfQtjD4:yRk5zOt+MB0ltmk0f7k/0KZUFka+Ykd
TLSH	T1E011A3CF11B68C266C414ED974924924F8C6D9E56ACACE8BE18D0976F0CCE1CB452E69
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://95.215.108.183/skid.armv5l	9878b4183be068b638e04656a02c5679f02a5a982e472cc1c497cc654345f3b6	Mirai	ddos elf mirai
http://95.215.108.183/skid.armv7l	n/a	n/a	ddos elf mirai
http://95.215.108.183/skid.mips	n/a	n/a	ddos elf mirai
http://95.215.108.183/skid.mipsel	n/a	n/a	ddos elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6800d7522203b3e10cd0298dlinux22vpnfull_triage

Tags:

mirai agent virus shell

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6800d153e9c1e257979bd953/reports/5a8f3e72-2478-4e71-ade4-3f4ac85a9848/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3f7725dd065cffa81dc152b638de312869ac82778d9c233af718c4883d35da66

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3f7725dd065cffa81dc152b638de312869ac82778d9c233af718c4883d35da66/

Threat name:

Script.Downloader.Heuristic

Status:

Malicious

First seen:

2025-04-17 10:03:29 UTC

File Type:

Text (Shell)

AV detection:

5 of 38 (13.16%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h53slxiglt72qhobkk3drxrrfbu2zatxrwocgoxxddciqpjv3jta._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250417-l3kr9s1xgt/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.