MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5dc559d3657be1932e73f41fb270a35fd0bdca988398b33e548245fa3f486a7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	5dc559d3657be1932e73f41fb270a35fd0bdca988398b33e548245fa3f486a7c
SHA3-384 hash:	671e736165d3cf34b00702b959f9e03eca60f8e4b652d79e025deb50a674d748134e180e8e7b3455ca4eb477737be732
SHA1 hash:	874fd9282ddb7d68c04c4cdcd0c65a522b9ccec2
MD5 hash:	27a5bc0dc3501e3405dd2466b2c93498
humanhash:	low-mexico-oven-arizona
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'881 bytes
First seen:	2026-10-03 23:54:57 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:ir2JMS0biBqfuZlE4EnE2EhEqACbw/2JUftGhM3a:ir2JMS0biBqfuZllcvyyCbwfGhM3a
TLSH	T1DD5199DA02944A319F49C64EB7F67174A14AB0C3AEDBC754A9444EAD4FC9FEC3281F80
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnaarch64xnxn	9a04188b6ad2333a3b42afa12df8f2c24ba0f3b9d4f611c2b5fb935b4575fe03	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxni386xnxn	5bf1ded1fb864a9fb9c253cf24b8041ee43981448fb1e65f82cd3b78e335b9d9	Gafgyt	censys elf gafgyt ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	e1ba355538caccded191ac108e43cf28cdb6c2d679606ea4c43bfc9a539cb4f5	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnm68kxnxn	645f46b23cd98a80ddc50b154e4a1070a3c96a4ba3e01773530a622b26661930	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	cbf6aee947974053f64e4271a2284ee811aa3bfffd8dfd89c323fd72ab1d822a	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnmipsxnxn	171491086484e054f0a6b87fd270ce68fa7a71a18b4268c2fa8fb286a54e44f4	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnor1kxnxn	ae67fcaa77bc85f3ea583405e6c5cf9501bb3d885d7f85b858aedca6c39c1064	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	dba846bc50334572d41e61227ed36c064b471c51f1a6f4448616555a2a26361f	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnriscv32xnxn	e274274ca20dc64f1451059173a8d8a9777003acea918bdbcede3ba65d110439	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnriscv64xnxn	773d95b11262aa245ccec682067b4239468ca29b88d7bf8cd7adeb5ebaf43b7c	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnsh2xnxn	35a4d5bc3466d9bf32924392eb20af3196110d408fdc84b919dc39e5b08ed937	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnsh4xnxn	c6ba88a6719810a2a90dec141b049237fe7ea664ee91f0b0b39d29f688884863	Mirai	censys elf mirai ua-wget
http://5.175.222.236/bins/xnxnxnxnxnxnxnxnx86_64xnxn	8ebe45253cc20cd7a504518b836ecf40e6b189861d56c442340d57b3039041f0	Mirai	censys elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ac196056d1510f4c194a604/reports/df52807c-be84-4e8d-85f3-75922dca1acf/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-10-03T21:12:00Z UTC

Last seen:

2026-10-05T04:26:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5dc559d3657be1932e73f41fb270a35fd0bdca988398b33e548245fa3f486a7c/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/86b21543-f4bd-4c2a-9644-b7b01c9308ec

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5dc559d3657be1932e73f41fb270a35fd0bdca988398b33e548245fa3f486a7c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5dc559d3657be1932e73f41fb270a35fd0bdca988398b33e548245fa3f486a7c/

Threat name:

Win32.Trojan.Ravartar

Status:

Malicious

First seen:

2026-10-03 23:55:36 UTC

File Type:

Text (Shell)

AV detection:

15 of 38 (39.47%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lxcvtu3fppqzgltt6qp3e4fdl7il3suyqomlgpsuqjc7up2inj6a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261003-3ynrsszz8k/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5dc559d3657be1932e73f41fb270a35fd0bdca988398b33e548245fa3f486a7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.