MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6079ea25296385cfe96350ee7430c77b8c2fcf765bd0e9934b88ab664380fa65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	6079ea25296385cfe96350ee7430c77b8c2fcf765bd0e9934b88ab664380fa65
SHA3-384 hash:	10b0fd1f93523988cb4b61d24dec8335b87998962448dc858fce5c95c3758b63666f2d157f54ae51b2cddb14edcbe4f5
SHA1 hash:	79b106819f97fdaca2bf747de7fb4582930d70f4
MD5 hash:	c8a866a143079951c282431df3fe9931
humanhash:	summer-social-venus-gee
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'881 bytes
First seen:	2026-02-21 08:26:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:4N2JMkWbiB81uZnE2EnE2EhEmS0bwVYJUfXIhM3+:4N2JMkWbiB81uZnncvyw0bwBIhM3+
TLSH	T12B519CAA02448F71DB4986AE67F575B4B10FA0D3E7EF8B08A944499D4FDBE4C2285F40
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnaarch64xnxn	4034d3c1d40097edcfda1c7f97ff057dc11b8dc2f25a16e53bc2122cb6af07ae	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxni386xnxn	411aec2600ebb8e2dff75750ea2c6ddba1e61188a9dd140de45fcf27fa9cc4aa	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	c2a52b8b04f72b7c281232d32dcbc3756ad7f4a9d28bd2d42a394a4e628ddb3d	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnm68kxnxn	516cc2dacae1a1d55ad57744aefc133d0b10b83033740c824fa827bc197735d7	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	314acaf706a13f709d8064d418248e10d9bf72416a64041389fd6ee6db39b748	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnmipsxnxn	03ce826ffbd8436e6cdb27e25a9c8483d677e608fa111b1d36a0379f1f3299da	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnor1kxnxn	5284f88167faa897e66e1535c8a75962b6a89e767bad3b554f6b383093eeb029	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	a3be89eae3abf909aadaa3d7021c77d491ed6425cc665725651be53131ba4ffc	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnriscv32xnxn	037def81f4d4987a0c5fa5b5f10c8a7771111b3ca75d49cf2cc8daf7945c516b	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnriscv64xnxn	a7d2bbd8da4d8aa35b1e760b6f27289705840a0bf8507df2be3997445e0362e9	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnsh2xnxn	caaccc18a6befc7484853a9b74bc3529f50bd3cc37ce78071128fc92f4a15b9d	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnsh4xnxn	329cec30ee710011f22b50e4c719d4bc0938ebdf5472eb166fff7d0bc1295728	Mirai	elf mirai ua-wget
http://185.242.3.231/bins/xnxnxnxnxnxnxnxnx86_64xnxn	2f475bc50b4cf52ad87921d41b4171768b78e7dc76297a58683815aa5c747661	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/69996c6197feb4afd6505d44/reports/3c7d4c08-d870-49d2-a4fa-714f4c872df9/overview

Result

Gathering data

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/6079ea25296385cfe96350ee7430c77b8c2fcf765bd0e9934b88ab664380fa65/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/fdf8aced-85b1-4228-8f71-6d9598defb9e

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6079ea25296385cfe96350ee7430c77b8c2fcf765bd0e9934b88ab664380fa65

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6079ea25296385cfe96350ee7430c77b8c2fcf765bd0e9934b88ab664380fa65/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/6079ea25296385cfe96350ee7430c77b8c2fcf765bd0e9934b88ab664380fa65

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-02-21 08:27:22 UTC

File Type:

Text (Shell)

AV detection:

4 of 36 (11.11%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mb46ujjjmoc472ldkdxhimghpogc7t3wlpiote2lrcvwmq4a7jsq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260221-kch1baft6c/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6079ea25296385cfe96350ee7430c77b8c2fcf765bd0e9934b88ab664380fa65

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.