MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48f59527a700f3e75a01be9f0cf94f058e9a28a549864856116300f58cc93e13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	48f59527a700f3e75a01be9f0cf94f058e9a28a549864856116300f58cc93e13
SHA3-384 hash:	a4015f802491b628ab0b03bcc811e69e9a1fc796047a8c2166da1d5b2a0a25fec88d5e11a4f0a1142c810260ad2edcf0
SHA1 hash:	f523a037d1cb6f1333e082a4e702b565ddf6f8e7
MD5 hash:	3c80f90e2189bbcb7dfaa459d3a98882
humanhash:	romeo-sierra-fix-violet
File name:	real.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'844 bytes
First seen:	2024-12-27 09:46:22 UTC
Last seen:	2024-12-27 11:06:22 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:98zizboZjoW+oNC6o1S8oK2BzmKoWhrUojfloaAo2/soHNTx8zizbLjk+HC6DS8Z:98zizboZjoW+oNC6o1S8oPVoWhrUoTl6
TLSH	T1E151824EA7927099CF56CF07BF6328CA8105A1EA948B5FD5B5D4CC2C6074AD8F2E050E
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

87

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.Shell.DeleteHistory-2.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676e77978a4d48ee35fffdfalinux22vpnfull_triage

Tags:

ransomware downloader mirai agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug evasive lolbin remote

Link:

https://www.filescan.io/uploads/676e7799a561e5a2873ae854/reports/2c309999-b9d4-4755-a999-00dd6a0aafa9/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/48f59527a700f3e75a01be9f0cf94f058e9a28a549864856116300f58cc93e13

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/48f59527a700f3e75a01be9f0cf94f058e9a28a549864856116300f58cc93e13/

ReversingLabs TitaniumCloud Script-Shell.Trojan.Geninst

Threat name:

Script-Shell.Trojan.Geninst

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-27 09:47:04 UTC

File Type:

Text (Shell)

AV detection:

14 of 23 (60.87%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jd2zkj5hadz6owqbx2pqz6kpawhjukffjgdeqvqrmmapldgjhyjq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/241227-lr7gwstpbv/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (229203) amount of remote hosts

Creates a large amount of network flows

Mirai

Mirai family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/48f59527a700f3e75a01be9f0cf94f058e9a28a549864856116300f58cc93e13