MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a21d9dad02f7d0f812415718b382417ee5214ebefd2af8e8119e2f5c34d10cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	6a21d9dad02f7d0f812415718b382417ee5214ebefd2af8e8119e2f5c34d10cc
SHA3-384 hash:	8157319d32df8d47cdd8da243a190745f22a7e1cb1631491bffa68ef1593480cd4b2817323e1d9963216551422c1fc42
SHA1 hash:	c7d46a72d697c75d7f9f86c51f6863d008fdcce9
MD5 hash:	0219e003b6509770234e3b2213f97755
humanhash:	sierra-failed-hotel-texas
File name:	hidden.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'562 bytes
First seen:	2025-01-16 15:26:10 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vlS/sQW3L8oQ5kLPy/NCog7o7ovQrpSXcLPrBaBjd:vlS/cL8oQ52PEfg7o7ovQdSXc7daBjd
TLSH	T1F951A3CA359443323D6669B3B1B984D8B3D7D6ED91C49EA093F838A8E0CDF18754C791
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://193.143.1.66/nA0diE1/pecga.x86	fc139908a4cc0fa85ab1415b23e985863b4deb45b8cae876ac4583b58265660c	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.mips	dbc242b30bd1a02528949d6159b36b0487d3cc60a53fd2f1d407c25e2a80c508	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.mpsl	3d5754f374ebf513f7f4f9628121b4dbd2ece485eb40c6e8ac72acb2813bed79	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.arm	22ba65ade0c5700d09f2309de4d41ba7942f462ac06e3cc3026f2d0483e4ddb0	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.arm5	30482b8f60b505ad06cab6af1715dbd63f896de0b91e054cc08f3f8130a7c280	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.arm6	4f717dfd2a079f475a71771194d4538a841d4826ef27d0b18b5b3ae4cc18e269	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.arm7	4e64cc3e81967c1b53542f1565097c315fb288621762aaf4b754f4a5ddd03678	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.ppc	b8fb124043b6406a2810bbd85b43f8af96d2e55e4c01a9d574ae9508eb3de9f6	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.m68k	1e862bdb67f1e9545edc9c43c69855ab2b974d27653ea8b91fead08b33ab1709	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.spc	03d0cc1607db3d49d7658c9f00e097a2f03b5d3ba682f0454777acc7f5e189d1	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.i686	03d0cc1607db3d49d7658c9f00e097a2f03b5d3ba682f0454777acc7f5e189d1	Mirai	elf opendir
http://193.143.1.66/nA0diE1/pecga.sh4	49c99a5dc72acb985d59341471ac50cf09d80fb75a8adfe1d358e185c8407270	Mirai	elf mirai opendir
http://193.143.1.66/nA0diE1/pecga.arc	66e4960eb68af43115d0db277b6694616375749b41e6cfdab4ceaccb2853678f	Mirai	elf mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678925484487910100df9f8dlinux22vpnfull_triage

Tags:

downloader ransomware agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug bash lolbin remote

Link:

https://www.filescan.io/uploads/6789257235e3ead4b82e1869/reports/fbb7d8fc-6df4-4163-bfda-56f03f61fe30/overview

Result

Verdict:

MALICIOUS

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6a21d9dad02f7d0f812415718b382417ee5214ebefd2af8e8119e2f5c34d10cc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6a21d9dad02f7d0f812415718b382417ee5214ebefd2af8e8119e2f5c34d10cc/

Threat name:

Win32.Trojan.Okiru

Status:

Malicious

First seen:

2025-01-16 15:27:04 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=niq5twwqf56q7ajecvyywobec7xfefhl57jk7dubdhrplq2ncdga._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250116-svq3msxnam/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6a21d9dad02f7d0f812415718b382417ee5214ebefd2af8e8119e2f5c34d10cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.