MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62d0c7bae202281d404963224fe393d8e1d953dc6c869a0eac5ccaecb08bb222. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	62d0c7bae202281d404963224fe393d8e1d953dc6c869a0eac5ccaecb08bb222
SHA3-384 hash:	657fcc3bc9fd5a8bddd14d7e34304fd64e3c4b95df438992e024f2df603a3932a0185e356724e6f9febf5e083c3a4d0b
SHA1 hash:	1a9ce6b9e995904a2a35bc4c8e806152f491301e
MD5 hash:	f16ad811ff7d2f12dee85b63ec02942c
humanhash:	bravo-pip-sixteen-louisiana
File name:	curl.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'795 bytes
First seen:	2025-12-01 10:50:26 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:Ymfbj8teTYes1cxXg1D3OStNIyE/ymGlAKs/AmyJxlrloExhymeP6o4cw8muLWNm:VP8tos1kWlA9Ahx5hhOP6o7sB5+CHOh
TLSH	T1B2513B8E056C3D2BF719DF26B3B3AD1A137447E450A7CF9DAFA016269C09B5060CF522
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.92.241.59/odin.arm	17816a9d39ce0bafc3daf58c7f7cfc87b334836e99ebf91b9f34fde0f5a6906e	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm5	093c5c0565b1163bcb6781bf7438c8545491f23b04c1d2a5bfc9fd1b32d24575	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm5n	dbf86895de55f46b6285a83ea0de3bfd9ed3e9fbd51946ff0fc5fa8c1dd36593	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm6	9d19d39c7c4e72ca4d80c67823baa5d76a9acb70644f2dd5175694ebdfdf3983	Mirai	elf gafgyt geofenced mirai ua-wget USA
http://91.92.241.59/odin.arm7	5bb7ac86b01c0f2dd4aa56b7c0a1a66d65cd0745d9760c533edb7024f45eacc3	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.m68k	49bdea75a582c656e0b7c07fcafbd9d3ce01bae6c7802cc87cb2b9419c89640c	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.mips	2833555c03ca8a40b802e28102316e83a5d845492407e2bb6b4dd62eb697a666	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.mpsl	636c15620eceafdad3636111bbdc899a52f268e53fde8dab00317a03435af76a	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.ppc	f8b4ffca6e00578afd1d78515181286b4af01f3f48e9cfdab08501e57e2c367f	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.sh4	59c4247a1979787119f212c0d57453f4ec0a88b8fad31a5bccb599e126132e94	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.spc	f177141de21dcf7183bd66bef83f7e752f48265c437ff9f019e6d2d37a0a84c2	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.x64	42c98a7aaed9dfdb48a02009c3ef41c71bf0e6c3a8d5d3b9bab1bae6d8799d96	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/odin.x86	cb8ce67a72b563bc42ec188e02382985f0f06150783db97a3d7b858ed47378fb	Mirai	elf geofenced mirai ua-wget USA
http://91.92.241.59/bizy.arm5	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.arm6	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.arm7	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.arm8	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mips	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mpsl	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mipss	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mpsls	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.riscv	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.x86	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.x64	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mips64	n/a	n/a	elf geofenced ua-wget USA
http://91.92.241.59/bizy.mpsl64	n/a	n/a	elf geofenced ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/692d731fd0d5e7288b52b8bb/reports/76f2a7b6-63e9-4b4c-89d5-24e341983d80/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-01T07:58:00Z UTC

Last seen:

2025-12-01T08:38:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/62d0c7bae202281d404963224fe393d8e1d953dc6c869a0eac5ccaecb08bb222/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/cc7f8fa2-6820-42f0-ba2a-688f908b5f16

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/62d0c7bae202281d404963224fe393d8e1d953dc6c869a0eac5ccaecb08bb222

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/62d0c7bae202281d404963224fe393d8e1d953dc6c869a0eac5ccaecb08bb222/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/62d0c7bae202281d404963224fe393d8e1d953dc6c869a0eac5ccaecb08bb222

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2025-12-01 10:51:12 UTC

File Type:

Text (Shell)

AV detection:

12 of 38 (31.58%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mlimpoxcaiub2qcjmmre7y4t3dq5su64nsdjudvmltfozmelwira._file

Result

Malware family:

n/a

Score:

9/10

Tags:

antivm defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251201-mxw4sahs9b/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Contacts a large (62308) amount of remote hosts

Creates a large amount of network flows

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/62d0c7bae202/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/62d0c7bae202281d404963224fe393d8e1d953dc6c869a0eac5ccaecb08bb222

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.