MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4875d59463480da5963ea594424abfbfab68afcde3feaad8becb11713a906450. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4875d59463480da5963ea594424abfbfab68afcde3feaad8becb11713a906450
SHA3-384 hash: 1e58197adcbb7d3715ed7a2e1875c52e8a1ef8e251aa64f333fe7ac7c44ae53f6fade6c03c60b69c87de0880c720871c
SHA1 hash: cd2a9780ae3a0b8a9463e50b832fe183579bd51f
MD5 hash: 2157a79a48e694cb0fb052819aa995b5
humanhash: zulu-monkey-solar-minnesota
File name:ohshit.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'655 bytes
First seen:2025-01-03 18:11:26 UTC
Last seen:2025-01-03 23:01:16 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:viEO9bjEFah8VFLhyvO39ioGcWPYH2mNOf6+wYWw:viEO9b+G2NyvO3YoGcWPYWmNOf6+wYWw
TLSH T17C518E94338100382DFA9A2F73E9182479B6D05B7CC49F15DDF878BA446DE8C7B8CA46
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://190.123.44.73/bins/main_x8605466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555 Miraielf mirai ua-wget
http://190.123.44.73/bins/main_mips261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1 Miraielf mirai ua-wget
http://190.123.44.73/bins/main_arcn/an/an/a
http://190.123.44.73/bins/main_i468n/an/an/a
http://190.123.44.73/bins/main_i686n/an/an/a
http://190.123.44.73/bins/main_x86_646c22bec08f6ce62b43664b22028e033d496990b06a053c4aee5168b3af787c55 Miraielf mirai ua-wget
http://190.123.44.73/bins/main_mpsl2322a5098627d113e939e6ac7ddb5c80ed5e253a650c6b6e1737baa4617db415 Miraielf mirai ua-wget
http://190.123.44.73/bins/main_arm0b423d1b9e7a9e6719bf77dfa5363998d04f9edad2ee8e2de911c7ae995a391a Miraielf mirai ua-wget
http://190.123.44.73/bins/main_arm55d94992dac0b6d592f86b0d59af84c52168f05d7aa1713a0c4fd62820be71630 Miraielf mirai ua-wget
http://190.123.44.73/bins/main_arm65b1cf87888710837c0007fd20877644abec191d7fed82763a15b959d591444d4 Miraielf mirai ua-wget
http://190.123.44.73/bins/main_arm7cf40305398ee234528ebd18bb54b13e1bb94f90a501636857e25ba114bb1c9c6 Miraielf mirai ua-wget
http://190.123.44.73/bins/main_ppcb1d611c59c43c5f2ae26da403ac6f4c59f721d91716cd5c07e3293351db8124c Miraielf mirai ua-wget
http://190.123.44.73/bins/main_spcn/an/an/a
http://190.123.44.73/bins/main_m68k7cca33815eaccd864db722658cce4a234c32280e2ee7266c9fecd8601652c95f Miraielf mirai ua-wget
http://190.123.44.73/bins/main_sh4fd893a3ee002cd623137b4f65fda5624232eb22e53f5fec40601bc26e7eed29a Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6778292d1ada70779825de4clinux22vpnfull_triage
Tags:
gafgyt mirai
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug bash lolbin remote
Link:
https://www.filescan.io/uploads/67782873885f9fd08ee85d24/reports/07ad3093-ef29-445d-9556-3246dca76fb6/overview
Result
Verdict:
MALICIOUS
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4875d59463480da5963ea594424abfbfab68afcde3feaad8becb11713a906450
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4875d59463480da5963ea594424abfbfab68afcde3feaad8becb11713a906450/
Threat name:
Win32.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-01-03 18:12:04 UTC
File Type:
Text (Shell)
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jb25lfddjag2lfr6uwkeesv7x6vwrl6n4p7kvwf6zmixcouqmria._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/250103-ws51kawngz/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Traces itself
Mirai
Mirai family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4875d59463480da5963ea594424abfbfab68afcde3feaad8becb11713a906450

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 4875d59463480da5963ea594424abfbfab68afcde3feaad8becb11713a906450

(this sample)

Mirai

elf 05466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555

  
URLhaus
https://urlhaus.abuse.ch/url/3387527/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3387540/
  
Dropping
MD5 4f7c51c3fbe937bb9659cb47a53b3f64
  
Dropping
SHA256 05466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555

Comments