MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 484d1d2b5cc7d45631f9f50ae3d11985ed186f7442bcb449c9508cd994d88013. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	484d1d2b5cc7d45631f9f50ae3d11985ed186f7442bcb449c9508cd994d88013
SHA3-384 hash:	481adcd2bbfb152aaa9d698626e387ad8e5892df92361d38c5ac12d0f82621eefad44dc40953acf28fd53f71b2e5aede
SHA1 hash:	f1a3679d0debf0879a71a8b16c7d3c8ad7023c48
MD5 hash:	274a1c47eab6440b9ebf0e0bb855c856
humanhash:	colorado-network-victor-beer
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'881 bytes
First seen:	2026-03-27 07:25:57 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:/xwCzC2JMlb3bbiBJn0nuZxuE+uEnE2EhEITRu606bwoWQQQJ3JJUfJ/c1z1hM3G:Bu2JMZLbiB58uZAAcvy1tbwc5hM3G
TLSH	T1525101DF0104CB32EA4D854FB7F4B1746D4BAC82B6DB8A04E949089D6FE6D4DB395E80
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnaarch64xnxn	855cafa0b413bfdd57795fcbaa83bb14d0194d1f169e636668afdb68488ec659	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxni386xnxn	9c421cd0a3044517f0846538755487b1b8ba2997864e085d55c96ff1f2fbf632	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	8629b5abe7127bba2f1286efe92590f0d84f32a36c0ca9f3eb1a985252c5195b	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnm68kxnxn	9ff06b44763dc160eb7e4b00bcb3e13eac978bb0ee4179a4d349c5e3e936f23a	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	93364a69cb1b2954bf5bef5e971b15632e67b8eeaf14c25852ec5f6224f3eb80	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnmipsxnxn	2c72d08c353b457f38c23e2b699129fe1f7cf4cbb6355acfc7ff759bfb04db75	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnor1kxnxn	46401229f879d821617bf4dc1183c652f1877aa2f33466c6a5c18fa9a31c85d3	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	a35364635b95a8aa9f4e92b09575cd0e1e5757e991f12fbf31de6d16c07a938b	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnriscv32xnxn	1807bb43d04c293682eaf7e4a0360535bdff2e79d018b903b273bfd72d5134d1	Mirai	gafgyt
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnriscv64xnxn	d4a66df5d2c16d10b41fd9045ec600f554573324b2eaeaf18d7dd5e1b02d4f9e	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnsh2xnxn	5cf489b1e70926f2ad7a737196ffc28f19a04d3f092971ccbaa95e9c3ce54576	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnsh4xnxn	f5993fc13954dffc409be76117877dfe1bec4334225455ca6924a1f65ee6056f	Mirai	mirai
http://194.59.30.207/bins/xnxnxnxnxnxnxnxnx86_64xnxn	3f627119aee81a21ebabbbbe2e2ed465a98707ce6376f11e2eb4349261dbbd91	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/69c631172346b9da57aa8f69/reports/6ca76923-86b5-49bf-a37b-e813f4556e4f/overview

Result

Gathering data

Verdict:

Malicious

File Type:

text

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/484d1d2b5cc7d45631f9f50ae3d11985ed186f7442bcb449c9508cd994d88013/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c2d592a7-34a4-4bc6-958f-08d473f8d768

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/484d1d2b5cc7d45631f9f50ae3d11985ed186f7442bcb449c9508cd994d88013

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/484d1d2b5cc7d45631f9f50ae3d11985ed186f7442bcb449c9508cd994d88013/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/484d1d2b5cc7d45631f9f50ae3d11985ed186f7442bcb449c9508cd994d88013

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-03-25 22:57:39 UTC

File Type:

Text (Shell)

AV detection:

9 of 36 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jbgr2k24y7kfmmpz6ufohuizqxwrq33uik6lisojkcgntfgyqajq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260327-h9pg9abz2r/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/484d1d2b5cc7d45631f9f50ae3d11985ed186f7442bcb449c9508cd994d88013

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.