MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90
SHA3-384 hash: 9c9fe2a16b3b068798edbb62f982beedefa4ba706fbeaa60f9e6461e407198a54c625f025db694e6df519709339fb312
SHA1 hash: 8ca7e6e2324e79b68053245c66c08d5a36db8d78
MD5 hash: aef4cc5d4571ec7f0beeb59fea216eab
humanhash: paris-idaho-grey-fruit
File name:w.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:815 bytes
First seen:2025-12-23 03:02:27 UTC
Last seen:2025-12-23 10:25:16 UTC
File type: sh
MIME type:text/plain
ssdeep 24:cf8UR5iNIx2GRKSoaYOXK0iNckRoFpfD0Gge1JPsn:YTxLRwahX2+kRoHfD6SPs
TLSH T1A20125CF105DA52161CC8F603197C55818A0DDE21A160EACDFDC48B386E8E10B77AFD8
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://130.12.180.127/ntarm4n/an/aelf ua-wget
http://130.12.180.127/ntarm5e5e9346a47bce22519a79482111400fa4d1cb57614773f44d27c47574d1fa442 Miraiarm elf geofenced mirai ua-wget USA
http://130.12.180.127/ntarm64822e668692794fad83477e8ba761b11c25d57428ee6665f0f0cef3e7ba4873a Miraiarm elf geofenced mirai ua-wget USA
http://130.12.180.127/ntarm781aad7c6c7e13e69d0759539801b14a00e44d1363adf39ba5ecddb1874709e91 Miraiarm elf geofenced mirai ua-wget USA
http://130.12.180.127/ntsh4b7f840ae5abdf8f07a1ec90a5841a7f875ccec5c064482eee8f935d12f9c8fa6 Miraielf geofenced mirai SuperH ua-wget USA
http://130.12.180.127/ntppc562f58604b6c7b9a5a7f174b53301b48afc8fab79fff7de2086ea8943978b735 Miraielf geofenced mirai PowerPC ua-wget USA
http://130.12.180.127/ntmips67d445a8aafcd3e7c47746cfcda4ad4a92f00fe2b67fb4f4564d9a5b6f219491 Miraielf geofenced mips mirai ua-wget USA
http://130.12.180.127/ntmpsla97f2be659972982b61aee906b13d8ea4e9e16a2d1284c33f8ed99d8ea41ff59 Miraielf geofenced mips mirai ua-wget USA
http://130.12.180.127/ntspcff07e6e405b5008d7f2227624d592cd35a30b45bcdf0ee2a91ef6d9f7aff9c73 Miraielf geofenced mirai sparc ua-wget USA
http://130.12.180.127/ntx868198e09fd8d9e79cd05d5b00f01c4199706fc156a45ac0bf74f251c8f36d385e Miraielf geofenced mirai ua-wget USA x86
http://130.12.180.127/ntm68k93b5e35d52129a8f694081b56cd71ca7bd3f53481c32b80e4d653a6039a90af6 Miraielf geofenced m68k mirai ua-wget USA

Intelligence

File Origin
# of uploads :
2
# of downloads :
38
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox mirai
Link:
https://www.filescan.io/uploads/694a066fa7163552ba04034a/reports/81fe0aed-125f-4fe2-950b-1685ab8e82c4/overview
Verdict:
Malicious
File Type:
text
First seen:
2025-12-23T00:09:00Z UTC
Last seen:
2025-12-23T00:37:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7e8b9160-20cf-4913-b267-546d2844aa0e
Behavior Graph:
Download SVG
%3 guuid=8fa440f1-1b00-0000-d5ea-5080ca0b0000 pid=3018 /usr/bin/sudo guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026 /tmp/sample.bin guuid=8fa440f1-1b00-0000-d5ea-5080ca0b0000 pid=3018->guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026 execve guuid=3e8b8cf3-1b00-0000-d5ea-5080d30b0000 pid=3027 /usr/bin/busybox net send-data guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=3e8b8cf3-1b00-0000-d5ea-5080d30b0000 pid=3027 execve guuid=5165b6f5-1b00-0000-d5ea-5080db0b0000 pid=3035 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=5165b6f5-1b00-0000-d5ea-5080db0b0000 pid=3035 execve guuid=10f0fef5-1b00-0000-d5ea-5080dc0b0000 pid=3036 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=10f0fef5-1b00-0000-d5ea-5080dc0b0000 pid=3036 clone guuid=189418f6-1b00-0000-d5ea-5080de0b0000 pid=3038 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=189418f6-1b00-0000-d5ea-5080de0b0000 pid=3038 execve guuid=16d6a7f9-1b00-0000-d5ea-5080e80b0000 pid=3048 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=16d6a7f9-1b00-0000-d5ea-5080e80b0000 pid=3048 execve guuid=589325fa-1b00-0000-d5ea-5080ea0b0000 pid=3050 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=589325fa-1b00-0000-d5ea-5080ea0b0000 pid=3050 clone guuid=82e6a7fa-1b00-0000-d5ea-5080ed0b0000 pid=3053 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=82e6a7fa-1b00-0000-d5ea-5080ed0b0000 pid=3053 execve guuid=a2a7f2fd-1b00-0000-d5ea-5080f80b0000 pid=3064 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=a2a7f2fd-1b00-0000-d5ea-5080f80b0000 pid=3064 execve guuid=9a4f3afe-1b00-0000-d5ea-5080f90b0000 pid=3065 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=9a4f3afe-1b00-0000-d5ea-5080f90b0000 pid=3065 clone guuid=5c67e0fe-1b00-0000-d5ea-5080fd0b0000 pid=3069 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=5c67e0fe-1b00-0000-d5ea-5080fd0b0000 pid=3069 execve guuid=0d18dc02-1c00-0000-d5ea-5080080c0000 pid=3080 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=0d18dc02-1c00-0000-d5ea-5080080c0000 pid=3080 execve guuid=40f14703-1c00-0000-d5ea-50800a0c0000 pid=3082 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=40f14703-1c00-0000-d5ea-50800a0c0000 pid=3082 clone guuid=43a8ca03-1c00-0000-d5ea-50800e0c0000 pid=3086 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=43a8ca03-1c00-0000-d5ea-50800e0c0000 pid=3086 execve guuid=52587507-1c00-0000-d5ea-5080190c0000 pid=3097 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=52587507-1c00-0000-d5ea-5080190c0000 pid=3097 execve guuid=d652ec07-1c00-0000-d5ea-50801b0c0000 pid=3099 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=d652ec07-1c00-0000-d5ea-50801b0c0000 pid=3099 clone guuid=c765ab08-1c00-0000-d5ea-50801f0c0000 pid=3103 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=c765ab08-1c00-0000-d5ea-50801f0c0000 pid=3103 execve guuid=3a01950b-1c00-0000-d5ea-5080260c0000 pid=3110 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=3a01950b-1c00-0000-d5ea-5080260c0000 pid=3110 execve guuid=2b0d310c-1c00-0000-d5ea-5080290c0000 pid=3113 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=2b0d310c-1c00-0000-d5ea-5080290c0000 pid=3113 clone guuid=fde8800d-1c00-0000-d5ea-50802e0c0000 pid=3118 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=fde8800d-1c00-0000-d5ea-50802e0c0000 pid=3118 execve guuid=88cd8610-1c00-0000-d5ea-5080340c0000 pid=3124 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=88cd8610-1c00-0000-d5ea-5080340c0000 pid=3124 execve guuid=7871d710-1c00-0000-d5ea-5080360c0000 pid=3126 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=7871d710-1c00-0000-d5ea-5080360c0000 pid=3126 clone guuid=dfd79211-1c00-0000-d5ea-5080390c0000 pid=3129 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=dfd79211-1c00-0000-d5ea-5080390c0000 pid=3129 execve guuid=9d272f15-1c00-0000-d5ea-5080410c0000 pid=3137 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=9d272f15-1c00-0000-d5ea-5080410c0000 pid=3137 execve guuid=0859b215-1c00-0000-d5ea-5080430c0000 pid=3139 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=0859b215-1c00-0000-d5ea-5080430c0000 pid=3139 clone guuid=5e41f616-1c00-0000-d5ea-5080470c0000 pid=3143 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=5e41f616-1c00-0000-d5ea-5080470c0000 pid=3143 execve guuid=355d461b-1c00-0000-d5ea-50804d0c0000 pid=3149 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=355d461b-1c00-0000-d5ea-50804d0c0000 pid=3149 execve guuid=2ae68e1b-1c00-0000-d5ea-50804f0c0000 pid=3151 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=2ae68e1b-1c00-0000-d5ea-50804f0c0000 pid=3151 clone guuid=826a751c-1c00-0000-d5ea-5080530c0000 pid=3155 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=826a751c-1c00-0000-d5ea-5080530c0000 pid=3155 execve guuid=4fb88d1f-1c00-0000-d5ea-50805b0c0000 pid=3163 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=4fb88d1f-1c00-0000-d5ea-50805b0c0000 pid=3163 execve guuid=c0de0820-1c00-0000-d5ea-50805d0c0000 pid=3165 /home/sandbox/ntx86 delete-file net guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=c0de0820-1c00-0000-d5ea-50805d0c0000 pid=3165 execve guuid=7a9b6420-1c00-0000-d5ea-50805f0c0000 pid=3167 /usr/bin/busybox net send-data write-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=7a9b6420-1c00-0000-d5ea-50805f0c0000 pid=3167 execve guuid=bfe90d25-1c00-0000-d5ea-5080720c0000 pid=3186 /usr/bin/chmod guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=bfe90d25-1c00-0000-d5ea-5080720c0000 pid=3186 execve guuid=60b36825-1c00-0000-d5ea-5080750c0000 pid=3189 /usr/bin/dash guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=60b36825-1c00-0000-d5ea-5080750c0000 pid=3189 clone guuid=43b94226-1c00-0000-d5ea-50807a0c0000 pid=3194 /usr/bin/rm delete-file guuid=4a203bf3-1b00-0000-d5ea-5080d20b0000 pid=3026->guuid=43b94226-1c00-0000-d5ea-50807a0c0000 pid=3194 execve 5e5f7305-15b5-5488-9f49-ae1b177ec723 130.12.180.127:80 guuid=3e8b8cf3-1b00-0000-d5ea-5080d30b0000 pid=3027->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 83B guuid=189418f6-1b00-0000-d5ea-5080de0b0000 pid=3038->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 83B guuid=82e6a7fa-1b00-0000-d5ea-5080ed0b0000 pid=3053->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 83B guuid=5c67e0fe-1b00-0000-d5ea-5080fd0b0000 pid=3069->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 83B guuid=43a8ca03-1c00-0000-d5ea-50800e0c0000 pid=3086->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 82B guuid=c765ab08-1c00-0000-d5ea-50801f0c0000 pid=3103->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 82B guuid=fde8800d-1c00-0000-d5ea-50802e0c0000 pid=3118->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 83B guuid=dfd79211-1c00-0000-d5ea-5080390c0000 pid=3129->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 83B guuid=5e41f616-1c00-0000-d5ea-5080470c0000 pid=3143->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 82B guuid=826a751c-1c00-0000-d5ea-5080530c0000 pid=3155->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 82B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=c0de0820-1c00-0000-d5ea-50805d0c0000 pid=3165->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e1185b20-1c00-0000-d5ea-50805e0c0000 pid=3166 /home/sandbox/ntx86 net send-data zombie guuid=c0de0820-1c00-0000-d5ea-50805d0c0000 pid=3165->guuid=e1185b20-1c00-0000-d5ea-50805e0c0000 pid=3166 clone guuid=e1185b20-1c00-0000-d5ea-50805e0c0000 pid=3166->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 9c578459-fc2d-5995-9925-ebe708f9b2a3 94.156.152.67:18129 guuid=e1185b20-1c00-0000-d5ea-50805e0c0000 pid=3166->9c578459-fc2d-5995-9925-ebe708f9b2a3 send: 10B guuid=7ca36920-1c00-0000-d5ea-5080600c0000 pid=3168 /home/sandbox/ntx86 guuid=e1185b20-1c00-0000-d5ea-50805e0c0000 pid=3166->guuid=7ca36920-1c00-0000-d5ea-5080600c0000 pid=3168 clone guuid=03946e20-1c00-0000-d5ea-5080620c0000 pid=3170 /home/sandbox/ntx86 guuid=e1185b20-1c00-0000-d5ea-50805e0c0000 pid=3166->guuid=03946e20-1c00-0000-d5ea-5080620c0000 pid=3170 clone guuid=7a9b6420-1c00-0000-d5ea-50805f0c0000 pid=3167->5e5f7305-15b5-5488-9f49-ae1b177ec723 send: 83B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-23 03:03:13 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpfecfexz44tcsoscyxynojrzxmrnnjrpcki27ihk4hv5d6qt6ia._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251223-djrsgavnhy/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 63ca411497cf393149d2162f86b931cdd916b53178948d7d07570f5e8fd09f90

(this sample)

Mirai

elf 8bb6df5f2c61a955dcbc98b25150d0ae232bc52bb2a0ebc748b87b39778eb5ce

Mirai

elf e5e9346a47bce22519a79482111400fa4d1cb57614773f44d27c47574d1fa442

  
URLhaus
https://urlhaus.abuse.ch/url/3740755/
  
Delivery method
Distributed via web download
  
Dropping
MD5 74d55af8860ba46c47a93381f52ad543
  
Dropping
SHA256 e5e9346a47bce22519a79482111400fa4d1cb57614773f44d27c47574d1fa442

Comments