MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263
SHA3-384 hash: 3202773f64462a9f1398f686c921a3f4dfe02ad6642527cfc49314b340b48b5f8ea13155e328657553104f19853a6189
SHA1 hash: 4a7d316451e9a189c0ea9a98398076a3f35752b2
MD5 hash: 35fd299cb4a8e42a906f407ad1e8bc6b
humanhash: wolfram-fanta-early-earth
File name:wget.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'458 bytes
First seen:2025-12-01 12:10:02 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:Ymfbj8hps1/mKDee3IKNIym/lAKs/A6xxpQ9P6oYNIkKXgWX+85KPS2ef85eQe9f:VP8TsxglA9A6xx4P6oirWX+kl8Xne
TLSH T17B51F38F042C2D0AE72DCB1633B36D4653A847A951A7CF9EAFC026375C48A5070DFE22
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://91.92.241.59/odin.arm0768380847fec204052caea7d521b23d739ee8fedbc23831bf2549bae3fb03de Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm523699b08a3a0ec5228028064a2ee8efc12e9f90102a07b858116df90241624a1 Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm5nd89b9aa7f0ac337077c5614d1d8321d1a0dff5280560bde0a8339c0dba0abd5d Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm6c3d826404b0e9fbc0382b9b1a871acf72cda3f2f81b5306cd3b9f8741d9d4c27 Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm728d1f0ec378ee8de8fb6a2c4b7513d01b551990bd072f62cd381c38bb5d0a5b1 Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.m68k49bdea75a582c656e0b7c07fcafbd9d3ce01bae6c7802cc87cb2b9419c89640c Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.mips5a7827d9681297873e4fbc739522260acd2734824add84af2744248acf661a60 Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.mpsle439140f9ab57169b1821f08acbf095ce275c3d4e3107b4d52da9179c3e17661 Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.ppcbec77d584ebd3438d6cc13880e26ed059392e0633937e0de6409620caf683cfd Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.sh438f94df99e0a5ef8257dc20350f75bd3f5b9452388acf68bd16c90fa28adc3ad Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.spc3ccec93311c41cc3a813b5762e249706c4cc3fd2c04894585300e05221268a01 Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.x6442c98a7aaed9dfdb48a02009c3ef41c71bf0e6c3a8d5d3b9bab1bae6d8799d96 Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/odin.x86893cd4107f8be6a0f86d1dbf376352a029700c64b41a6cb69b47e4289d11bca1 Miraielf geofenced mirai ua-wget USA
http://91.92.241.59/bizy.arm57469dee5a6679cd1b1293c38a1ed1c7800381936df68c87739786541f607ba60 Miraielf geofenced ua-wget USA
http://91.92.241.59/bizy.arm64dfc23150298b0236500ebaa09bffa740238c3db5597e43c77244e30195f25db Miraielf geofenced ua-wget USA
http://91.92.241.59/bizy.arm734ec04f0ab17549a20bd7fb257497059e087cd64be342b483a72a2ca64ddd20c Miraielf geofenced ua-wget USA
http://91.92.241.59/bizy.arm83d6f8bc6d911441bac88de85f9b6270b36fa6e4206f11b5f8bf39ca03bb8a264 Miraielf geofenced ua-wget USA
http://91.92.241.59/bizy.mips16ebf82f00bc0105348c208b7a2b2fcf9eb775e7adc23bf2744c001bf9b15fc1 Miraielf geofenced ua-wget USA
http://91.92.241.59/bizy.mpsl766a44d44822cfbb7f163219868b8f08f6654acd3a386a7d7fc52ecd9924fef7 Miraielf geofenced ua-wget USA
http://91.92.241.59/bizy.mipssn/an/aelf geofenced ua-wget USA
http://91.92.241.59/bizy.mpslsn/an/aelf geofenced ua-wget USA
http://91.92.241.59/bizy.riscvn/an/aelf geofenced ua-wget USA
http://91.92.241.59/bizy.x86da3e18e3ef495fb7983a2357550d64833b22ab3c4d93d17ac62b7a5d76adee86 Miraielf geofenced ua-wget USA
http://91.92.241.59/bizy.x641d71d8dd402e9cff4e742db2b32ad9e29925f19624f5168cb2419301e74b1b9b Miraielf geofenced ua-wget USA
http://91.92.241.59/bizy.mips64n/an/aelf geofenced ua-wget USA
http://91.92.241.59/bizy.mpsl64n/an/aelf geofenced ua-wget USA

Intelligence

File Origin
# of uploads :
1
# of downloads :
25
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/692d85bad0d5e7288b52d0a2/reports/3c56024e-dda8-406f-9130-6c2fdbc15aca/overview
Result
Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-10T09:34:00Z UTC
Last seen:
2025-11-10T10:25:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263/
Threat name:
Script-Shell.Trojan.Geninst
Create hunting rule
Status:
Malicious
First seen:
2025-11-10 04:07:33 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=khn6amwx56gripsgsi3cjuel4hdhwkur5kh7pitjzhr7iwnyajrq._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251201-pca2xshz6e/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
UPX packed file
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Contacts a large (61980) amount of remote hosts
Creates a large amount of network flows
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 51dbe032d7ef8d143e46923624d08be1c67b2a91ea8ff7a269c9e3f459b80263

(this sample)

Mirai

elf 0768380847fec204052caea7d521b23d739ee8fedbc23831bf2549bae3fb03de

  
URLhaus
https://urlhaus.abuse.ch/url/3720822/
  
Delivery method
Distributed via web download
  
Dropping
MD5 624879c93026e7d05c29df2d3469c856
  
Dropping
SHA256 0768380847fec204052caea7d521b23d739ee8fedbc23831bf2549bae3fb03de

Comments