MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5086f4d3eff992a3c5c5936266cdd2ffd8a3952f49b8e58b40c44e9ea5619d55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	5086f4d3eff992a3c5c5936266cdd2ffd8a3952f49b8e58b40c44e9ea5619d55
SHA3-384 hash:	f5e854f41fbca680e08267532559ac4e2f12aa1adabd3065e68dcb2e7062c18695c568f165875f72e0c677a2f61bac91
SHA1 hash:	544131850f56e8d34f321cb8afce435c19f9fcb5
MD5 hash:	0759af58c7af255f303cb3e26a1d28f6
humanhash:	summer-lemon-hot-hamper
File name:	hidden.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'061 bytes
First seen:	2025-05-11 13:57:27 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vp/z/U/p/W/Rp/KO/K7p/R5/RCpp/Rm/RRjLp/R7/RYHJp/Rs/RzLp/o/pp///O6:vFzCFkRFLuFR1RCpFRURRjLFRbRYpFR7
TLSH	T10141958521C253B2ACF5DA5271B99C0C3091A8DBA6F62F0AD8DC74E4C0DDD48B192FE2
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.141.210/navo.x86	bdb702657db4a6fb1616b42e6a2cd457a76e48e866edeea479be35711b518447	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.mips	d06165b8132be657be9e85cc65cc5f2d701656d9ed3f0250defc4d0746c7927b	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.mpsl	741ba2d53d54dc42195da1268d8680ab395f74d79bb90710910d9d597fc7b152	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.arm	c3c2ed4c2a13f3244b9ad4f21816703bb5bddb7aa8505888c838c2a7eece9dbe	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.arm5	fa7577577f7cee474d3276a04db1543b3bdb1bba1ca7a05262f67588360ee077	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.arm6	cdd280215ecf04e93af5a7bb70005d71bf860a52bff3e691135d585eff09bcc5	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.arm7	d338e32bb255f02484b9a24117a0cc0fbc151eed3bb690a83b14f015dd757811	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.ppc	db3d12a2e4ebbffe25f4088c934f8d51feb3b50c435086bbe80459edf5d8e2c7	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.m68k	17d4ee1b8bac608dc2e6333a73a145509392fc65f2700c327405033a6f352bdf	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.x86_64	a82dbcea4986e0340fa08abfa26a123832f62de58bf37e27ab1cda7fb40b96da	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.sh4	c89055af96171ca11e02cda5da78991bc1d496ce0f15df3d9709fc52e7cebd20	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6820addce16384d6a70384a3linux22vpnfull_triage

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

bash lolbin mirai remote

Link:

https://www.filescan.io/uploads/6820acef0b64e174c421b86c/reports/7d14c384-9c4b-4b10-b157-8a805c0938ed/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5086f4d3eff992a3c5c5936266cdd2ffd8a3952f49b8e58b40c44e9ea5619d55

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5086f4d3eff992a3c5c5936266cdd2ffd8a3952f49b8e58b40c44e9ea5619d55/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-05-11 13:58:10 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kcdpju7p7gjkhrofsnrgntos77mkhfjpjg4olc2ayrhj5jlbtvkq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250511-q9vy2azthv/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Traces itself

Mirai

Mirai family

Malware Config

C2 Extraction:

mywebh.kro.kr

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5086f4d3eff9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5086f4d3eff992a3c5c5936266cdd2ffd8a3952f49b8e58b40c44e9ea5619d55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.