MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221
SHA3-384 hash: 662883bf3159cce31b40c20318533a16b85507cc8ef059dee2833012a0885925b80bbf36c15277cae3f109ccd04e2d5c
SHA1 hash: 80a984a63b9004ad93c88ee0cf6165cdb48e3df2
MD5 hash: 85e5354484584cd6a1c6a47638c538d2
humanhash: hydrogen-quebec-alaska-oven
File name:ohshit.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'685 bytes
First seen:2024-12-30 13:38:02 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vSEa9bs9FahNmFLhOvW3GJoScuP2H2mN4f++KYgw:vSEa9b+GGNOvW32oScuP2WmN4f++KYgw
TLSH T13D51E2E4C381007C3DF299AE71B90D15B2BCE893F8D09F159CDA78B9416DE287C41A4A
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://205.185.113.47/bins/main_x8605466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555 Mirai32-bit elf mirai x86-32
http://205.185.113.47/bins/main_mips261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1 Miraielf mirai ua-wget
http://205.185.113.47/bins/main_arcn/an/an/a
http://205.185.113.47/bins/main_i468n/an/an/a
http://205.185.113.47/bins/main_i686n/an/an/a
http://205.185.113.47/bins/main_x86_646c22bec08f6ce62b43664b22028e033d496990b06a053c4aee5168b3af787c55 Miraielf mirai ua-wget
http://205.185.113.47/bins/main_mpsl2322a5098627d113e939e6ac7ddb5c80ed5e253a650c6b6e1737baa4617db415 Miraielf mirai ua-wget
http://205.185.113.47/bins/main_arm0b423d1b9e7a9e6719bf77dfa5363998d04f9edad2ee8e2de911c7ae995a391a Miraielf mirai ua-wget
http://205.185.113.47/bins/main_arm55d94992dac0b6d592f86b0d59af84c52168f05d7aa1713a0c4fd62820be71630 Miraielf mirai ua-wget
http://205.185.113.47/bins/main_arm65b1cf87888710837c0007fd20877644abec191d7fed82763a15b959d591444d4 Miraielf mirai ua-wget
http://205.185.113.47/bins/main_arm7cf40305398ee234528ebd18bb54b13e1bb94f90a501636857e25ba114bb1c9c6 Miraielf mirai ua-wget
http://205.185.113.47/bins/main_ppcn/an/an/a
http://205.185.113.47/bins/main_spcn/an/an/a
http://205.185.113.47/bins/main_m68kn/an/an/a
http://205.185.113.47/bins/main_sh4fd893a3ee002cd623137b4f65fda5624232eb22e53f5fec40601bc26e7eed29a Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6772a23f1bb06b8884798bfdlinux22vpnfull_triage
Tags:
gafgyt mirai
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug bash lolbin medusa mirai remote
Link:
https://www.filescan.io/uploads/6772a23fa561e5a2873bd82e/reports/f012bb29-ed24-4e4e-b474-773851390bee/overview
Result
Verdict:
MALICIOUS
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221/
Threat name:
Win32.Trojan.Mirai
Create hunting rule
Status:
Malicious
First seen:
2024-12-25 01:35:46 UTC
File Type:
Text (Shell)
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktxpvfuq6vfjtjfzqxjkqj7hs6f7z6dfdneqboyvwkwimo644iqq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/241230-qxeraawmdk/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Traces itself
Mirai
Mirai family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 54eefa9690f54a99a4b985d2a827e7978bfcf8651b4900bb15b2ac863bdce221

(this sample)

Mirai

elf 261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1

  
URLhaus
https://urlhaus.abuse.ch/url/3383182/
  
Delivery method
Distributed via web download
  
Dropping
MD5 1d7394c2ea5a7ab2c932281be7c11bdd
  
Dropping
SHA256 261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1

Comments