MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a317f3324d12a58bb0546c81d132afd2dae24b1f56478396fd02bd0580cea85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a317f3324d12a58bb0546c81d132afd2dae24b1f56478396fd02bd0580cea85
SHA3-384 hash: 828da47dd013c4d176b8013de5458b4036c7fd51a03d2ecccd9478679eaf02bff5e8fd85969b1e7244192bd73826a5aa
SHA1 hash: 98ce6c50f8a2a1694dd86c0119ac542eabef038c
MD5 hash: 5edb734febf6d3e843b97c94fa060b7d
humanhash: pizza-utah-single-magazine
File name:dvr.sh
Download: download sample
File size:647 bytes
First seen:2025-12-21 09:31:49 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 12:t9TZDcHWrFHWfzvwzMHWNIjDUIMHWBaD2rHWq:t9TZiWZWfzYzGWN5hWBaCTWq
TLSH T12CF062CF02990B612080F99EFEE31C64A009E6D924D6DB5CFD4D0C76139D99DBC15F66
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.132.180.48/mipsn/an/aelf geofenced mips ua-wget USA
http://45.132.180.48/mpsln/an/aelf geofenced mips ua-wget USA
http://45.132.180.48/arm49a2715c54d3741d6d4dbbc1bb4455cc31fac4fb3189632ac2eddc2bef2c7e47e Miraiarm elf geofenced mirai ua-wget USA
http://45.132.180.48/arm5fd853807beb17822d8654b02f8ab34feb54f60e2d844cdce29a0a4976725739c Miraiarm elf geofenced mirai ua-wget USA
http://45.132.180.48/arm7n/an/aarm elf geofenced ua-wget USA

Intelligence

File Origin
# of uploads :
1
# of downloads :
31
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive mirai
Link:
https://www.filescan.io/uploads/6947bea884afa5547b5b5286/reports/cecff809-8bda-42e4-9d2f-a03b342381e4/overview
Verdict:
Malicious
File Type:
text
First seen:
2025-12-21T07:23:00Z UTC
Last seen:
2025-12-21T10:03:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4a317f3324d12a58bb0546c81d132afd2dae24b1f56478396fd02bd0580cea85/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/91329043-cbd2-4675-846e-d23dcdc0123c
Behavior Graph:
Download SVG
%3 guuid=a5d78091-1900-0000-855b-61efa3080000 pid=2211 /usr/bin/sudo guuid=c4bc6493-1900-0000-855b-61efa9080000 pid=2217 /tmp/sample.bin guuid=a5d78091-1900-0000-855b-61efa3080000 pid=2211->guuid=c4bc6493-1900-0000-855b-61efa9080000 pid=2217 execve guuid=1e0fa693-1900-0000-855b-61efab080000 pid=2219 /usr/bin/mkdir guuid=c4bc6493-1900-0000-855b-61efa9080000 pid=2217->guuid=1e0fa693-1900-0000-855b-61efab080000 pid=2219 execve guuid=a6799294-1900-0000-855b-61efae080000 pid=2222 /usr/bin/dash guuid=c4bc6493-1900-0000-855b-61efa9080000 pid=2217->guuid=a6799294-1900-0000-855b-61efae080000 pid=2222 clone guuid=ee23aa94-1900-0000-855b-61efaf080000 pid=2223 /usr/bin/wget guuid=a6799294-1900-0000-855b-61efae080000 pid=2222->guuid=ee23aa94-1900-0000-855b-61efaf080000 pid=2223 execve
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4a317f3324d12a58bb0546c81d132afd2dae24b1f56478396fd02bd0580cea85
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a317f3324d12a58bb0546c81d132afd2dae24b1f56478396fd02bd0580cea85/
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2025-12-21 09:32:32 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jiyx6mze2evfroyfi3eb2ezk7uw24jfr6vshqolp2av5awam5kcq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251223-lda7ja1qct/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4a317f3324d12a58bb0546c81d132afd2dae24b1f56478396fd02bd0580cea85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 4a317f3324d12a58bb0546c81d132afd2dae24b1f56478396fd02bd0580cea85

(this sample)

Mirai

elf 9a2715c54d3741d6d4dbbc1bb4455cc31fac4fb3189632ac2eddc2bef2c7e47e

  
URLhaus
https://urlhaus.abuse.ch/url/3738783/
  
Delivery method
Distributed via web download
  
Dropping
MD5 54da405cd49ded413dd36884aee18ede
  
Dropping
SHA256 9a2715c54d3741d6d4dbbc1bb4455cc31fac4fb3189632ac2eddc2bef2c7e47e

Comments