MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65d60f4a208eb2dedea7e6c091bd505862ae97d1c8ccafc7d7212c796a0f59b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	65d60f4a208eb2dedea7e6c091bd505862ae97d1c8ccafc7d7212c796a0f59b7
SHA3-384 hash:	47480d24220b8dffd084057c7602ea35956f17221d63baa68b660bf0b816b826c509ba84b4ed74156e656fc903e9c554
SHA1 hash:	3c79631c853500030a8e290c80f35240e7c4c3d5
MD5 hash:	ce6dc48e47d481b66a961e667f6a6f6a
humanhash:	don-lithium-undress-cola
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'329 bytes
First seen:	2025-09-25 18:13:48 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:143F4JU1LMdcKMe8/fvR2M5pIiSWO6NXCmCQ3gSv:bpRQ3gSv
TLSH	T19E41C6F6A38BCB03D27D8BCA3E650406B015C36BB49F8734DCE9FAC90490E8C7155A85
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://157.20.32.209/bins/morte.x86	20eec1f49d7ab9223b5d47b6f464aed12e418942570966eae401968088463f1a	Mirai	mirai opendir
http://157.20.32.209/bins/morte.mips	1cb41b9c1a9e8123336054934a6ade938b976b5dbb87e852c742ef3f1fa9cdbb	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arc	4704e07f48738bd7b4cd44cec97a7c5526a4419fa665fd425ba217425916024a	Mirai	mirai opendir
http://157.20.32.209/bins/morte.i468	n/a	n/a	elf ua-wget
http://157.20.32.209/bins/morte.i686	a1617a2f4c04b81e7d8fa32fd63a09ed977cd7607b24b76055b36fdea3112c89	Mirai	mirai opendir
http://157.20.32.209/bins/morte.x86_64	16ba16bf6f0d4de4341bf38820777755012f008554f5e482b88cd4a85e97eb8b	Mirai	mirai opendir
http://157.20.32.209/bins/morte.mpsl	9f142d179fbde485e13d3364d65180ee6d62449aff02e35d87447ca0f9417210	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arm	f6d0afe358d658d05afad447734fee5a590e953c6c0f98cbd217a867521f8754	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arm5	17bb63761f5c8c1601c331cf193c55c09d4619053f9572b3648ef69e49fd1a89	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arm6	b3cd17f0afa885b377f8b04679e75f7f0827189f0b3f025a3814d156b4db1c38	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arm7	09d4f358af13014b924279b5b4318a7da185db5a95b1175fac33a87e93f00b35	Mirai	mirai opendir
http://157.20.32.209/bins/morte.ppc	1dc7e464cdaabeaa49a759a198d6a69d7cfc69014337f7fe1881dc9f3efdb8dd	Mirai	mirai opendir
http://157.20.32.209/bins/morte.sh4	bb8425e14a2cc5ce0d44da49e2b28d19e081b6352f48c376c7b0f9b0c92e3054	Mirai	mirai opendir
http://157.20.32.209/bins/morte.spc	e43b10988feae69a629b29ad0826d88d485372dabbed9421f2e1094147da7c01	Mirai	mirai opendir
http://157.20.32.209/bins/morte.m68k	cdab74aed8c37c66f1370e839cd48ae264c4bda7f1aae193b516e1c9a52a93ea	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/68d58799c564c8e81d07dc9c/reports/48032641-f0a4-49dc-baee-2354a04b3348/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-21T07:54:00Z UTC

Last seen:

2025-09-21T07:54:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/65d60f4a208eb2dedea7e6c091bd505862ae97d1c8ccafc7d7212c796a0f59b7/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1faf1d42-299e-4291-b498-e272e169bb3c

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/65d60f4a208eb2dedea7e6c091bd505862ae97d1c8ccafc7d7212c796a0f59b7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/65d60f4a208eb2dedea7e6c091bd505862ae97d1c8ccafc7d7212c796a0f59b7/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/65d60f4a208eb2dedea7e6c091bd505862ae97d1c8ccafc7d7212c796a0f59b7

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2025-09-21 13:29:16 UTC

File Type:

Text (Shell)

AV detection:

14 of 38 (36.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mxla6srar2zn5xvh43ajdpkqlbrk5f6rzdgk7r6xeewhs2qplg3q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery linux persistence upx

Link:

https://tria.ge/reports/250925-wx25ga1mz8/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

UPX packed file

Enumerates active TCP sockets

Enumerates running processes

Modifies init.d

Modifies rc script

File and Directory Permissions Modification

Executes dropped EXE

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/65d60f4a208e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/65d60f4a208eb2dedea7e6c091bd505862ae97d1c8ccafc7d7212c796a0f59b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.