MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263
SHA3-384 hash:	3202773f64462a9f1398f686c921a3f4dfe02ad6642527cfc49314b340b48b5f8ea13155e328657553104f19853a6189
SHA1 hash:	4a7d316451e9a189c0ea9a98398076a3f35752b2
MD5 hash:	35fd299cb4a8e42a906f407ad1e8bc6b
humanhash:	wolfram-fanta-early-earth
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'458 bytes
First seen:	2025-12-01 12:10:02 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:Ymfbj8hps1/mKDee3IKNIym/lAKs/A6xxpQ9P6oYNIkKXgWX+85KPS2ef85eQe9f:VP8TsxglA9A6xx4P6oirWX+kl8Xne
TLSH	T17B51F38F042C2D0AE72DCB1633B36D4653A847A951A7CF9EAFC026375C48A5070DFE22
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.92.241.59/odin.arm	17816a9d39ce0bafc3daf58c7f7cfc87b334836e99ebf91b9f34fde0f5a6906e	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm5	093c5c0565b1163bcb6781bf7438c8545491f23b04c1d2a5bfc9fd1b32d24575	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm5n	dbf86895de55f46b6285a83ea0de3bfd9ed3e9fbd51946ff0fc5fa8c1dd36593	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm6	9d19d39c7c4e72ca4d80c67823baa5d76a9acb70644f2dd5175694ebdfdf3983	Mirai	elf gafgyt geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm7	5bb7ac86b01c0f2dd4aa56b7c0a1a66d65cd0745d9760c533edb7024f45eacc3	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.m68k	49bdea75a582c656e0b7c07fcafbd9d3ce01bae6c7802cc87cb2b9419c89640c	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.mips	2833555c03ca8a40b802e28102316e83a5d845492407e2bb6b4dd62eb697a666	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.mpsl	636c15620eceafdad3636111bbdc899a52f268e53fde8dab00317a03435af76a	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.ppc	f8b4ffca6e00578afd1d78515181286b4af01f3f48e9cfdab08501e57e2c367f	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.sh4	59c4247a1979787119f212c0d57453f4ec0a88b8fad31a5bccb599e126132e94	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.spc	f177141de21dcf7183bd66bef83f7e752f48265c437ff9f019e6d2d37a0a84c2	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.x64	42c98a7aaed9dfdb48a02009c3ef41c71bf0e6c3a8d5d3b9bab1bae6d8799d96	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.x86	cb8ce67a72b563bc42ec188e02382985f0f06150783db97a3d7b858ed47378fb	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/bizy.arm5	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.arm6	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.arm7	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.arm8	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mips	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mpsl	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mipss	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mpsls	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.riscv	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.x86	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.x64	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mips64	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mpsl64	n/a	n/a	elf geofenced ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/692d85bad0d5e7288b52d0a2/reports/3c56024e-dda8-406f-9130-6c2fdbc15aca/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-10T09:34:00Z UTC

Last seen:

2025-12-02T01:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/65f755c4-150b-414a-95d7-a7a80ee52fc5

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263/

Threat name:

Script-Shell.Trojan.Geninst

Status:

Malicious

First seen:

2025-11-10 04:07:33 UTC

File Type:

Text (Shell)

AV detection:

14 of 38 (36.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=khn6amwx56gripsgsi3cjuel4hdhwkur5kh7pitjzhr7iwnyajrq._file

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251201-pca2xshz6e/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

UPX packed file

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Contacts a large (61980) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.