MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49a666501d238f8c07ed3b5a1395ff31aa8c059c88f3680196caeb2302dd1bfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49a666501d238f8c07ed3b5a1395ff31aa8c059c88f3680196caeb2302dd1bfe
SHA3-384 hash: 57a2b1c44acc1eb78d3f0d18c4691dec9a22de52036759dec0a7ded966ebae2d5729d983be62b73190255ae618b4143c
SHA1 hash: d685baa108af7910b0c353531652c2f654304edf
MD5 hash: 883237106559b38b15b0d34804e8a72a
humanhash: two-seventeen-pasta-pennsylvania
File name:mag
Download: download sample
Signature Mirai
Create hunting rule
File size:2'858 bytes
First seen:2025-08-22 23:23:56 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:cwXZlH76f76VI2Q6XF6PttiNI7c+miNI7cbJ8NI7cr/6KM6Kk1KziriB5bLoTUm7:cUl3XAlhsUgCCDI0UdQQ08EG+am/FeCH
TLSH T10151C8EF715316DE4D4C6E0FF1B1446CB861E2C590968BA6F94C3C7E62D9904B034B6A
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.125.66.56/arm1c6ad7da3701f41af453d1701d5656e256a6dcf08023270b2926685b82a19d07 Miraiddos DEU elf geofenced mirai
http://45.125.66.56/arm5ff2d4387cb624cfb0eb01dfe59d09c8acc09eec41873016cc1590b6cffdd10c7 Miraiddos DEU elf geofenced mirai
http://45.125.66.56/arm65e29e6ac19c524f249a4e5800d6458735f5d131a6d9d59ea37dc716f7215dc31 Miraiddos DEU elf geofenced mirai
http://45.125.66.56/arm7b772d55640399dee9b277a0ffd7ef8f65bb87363dbfdd0634cb88328528f369d Mirai404 censys DEU elf geofenced mirai ua-wget
http://45.125.66.56/mips6d8b92be20e13565fd61d105c44acadca0a7dac38eca5bc5693c5867b84fe62f Miraiddos DEU elf geofenced mirai
http://45.125.66.56/mpsl3c2e72b972e03e620def95ca99d0af072db842dd0d016891fc30527770190a92 Miraiddos DEU elf geofenced mirai
http://45.125.66.56/spc39fae3e0e9e2ba27ffa0eb62a244b16552abc21083dfceeb66dfc080c316696c MiraiDEU elf geofenced mirai ua-wget
http://45.125.66.56/sh4ac4a61edcb0c971f8f6b4b13f51e4105b4c838a344022091f1dcf351240a80b5 MiraiDEU elf geofenced mirai ua-wget
http://45.125.66.56/ppcfd07238570884beaa7f26c644408b18524fd2cc7c3b765ec24a0e9a36069d45a MiraiDEU elf geofenced mirai ua-wget
http://45.125.66.56/x86_64c39196e5ab865850c997492cc40ea9e9533ce1bcf915b255647f4ad82418be25 MiraiDEU elf geofenced mirai ua-wget
http://45.125.66.56/x86b137e7049facd81bf0e15a0bb6b0135732a43e126b799e903798f05ef87ca98e Miraiddos DEU elf gafgyt geofenced mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
25
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Malicious
Labled as:
Bash.MiraiA.Generic
Link:
https://www.hybrid-analysis.com/sample/49a666501d238f8c07ed3b5a1395ff31aa8c059c88f3680196caeb2302dd1bfe
Verdict:
Malicious
File Type:
text
First seen:
2025-08-23T00:21:00Z UTC
Last seen:
2025-08-23T00:21:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/49a666501d238f8c07ed3b5a1395ff31aa8c059c88f3680196caeb2302dd1bfe/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/49a666501d238f8c07ed3b5a1395ff31aa8c059c88f3680196caeb2302dd1bfe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49a666501d238f8c07ed3b5a1395ff31aa8c059c88f3680196caeb2302dd1bfe/
Threat name:
Script-Shell.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-08-23 00:16:56 UTC
File Type:
Text (Shell)
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jgtgmua5eohyyb7nhnnbhfp7ggviybm4rdzwqamwzlvsgaw5dp7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 49a666501d238f8c07ed3b5a1395ff31aa8c059c88f3680196caeb2302dd1bfe

(this sample)

Mirai

elf c21d7c148613fb4ab451aac48986372ff50b566dfff298f6acb585633c8788ad

  
URLhaus
https://urlhaus.abuse.ch/url/3464203/
  
Delivery method
Distributed via web download
  
Dropping
MD5 3725ca06329a35c602f5640d4fbf58dd
  
Dropping
SHA256 c21d7c148613fb4ab451aac48986372ff50b566dfff298f6acb585633c8788ad

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments