MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6da85ae8c2b9529158daf279ea01f65e91f9a2ef219150a35f5efe558b68773f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	6da85ae8c2b9529158daf279ea01f65e91f9a2ef219150a35f5efe558b68773f
SHA3-384 hash:	6d90df2b5e562c9981f5397ce93ba90b267e372058f746706ba377ddefaf1184aa1ac284591be03e4a2e8be5a2e24a3f
SHA1 hash:	9ecd9527504773f4cddeb8da3411c89eec9d541e
MD5 hash:	e2bc7c492db36a179686078aa04eb12f
humanhash:	south-florida-iowa-alabama
File name:	poop.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'174 bytes
First seen:	2025-02-25 08:12:12 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:hhlGc2BuGGDwMANINQwGYJCuK8aG/gnPrGD4wmYHGayaaGzG9FG3Z5G9wR:hycn0MANIkYdK8N/GSDJmRa7zH3uC
TLSH	T17021EDCA212D613A7D044E86BC7B463F9905C4A5214F0E47DB8C4426FBB899FFA12EC8
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://107.189.31.150/RpcSecurity.arm	0e020f7814a832c3bc5e1d413285fd5a3d5ab089d2b9d3b616c885893d4ce648	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.arm5	3ce56b7dfbbbca091a12381a7299fa7d34d6d80c6e2dc83e4d6f7e1b3b377da5	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.arm6	1b5aa74abb1a7b06835f1391c20cd911c2c41aa9e766e5bf29e3275ada8bef5e	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.arm7	75980b2ddfc50e722ae8a1fcb01c19b599195af2dcc06f6b0649cd74023af0ed	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.mk68k	75980b2ddfc50e722ae8a1fcb01c19b599195af2dcc06f6b0649cd74023af0ed	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.mpsl	98f9724f7811a80d2488626b84dc7dd7a9368422249dc68fa5bfa8a54864d6b0	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.ppc	fd7ab428e75259a190bae7e96006eff573baeb56592bdfede526c096e661ca8d	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.sh4	2b0e08eb77ad61ab0c9b81595b046713194715ebe19f3b7519c5aba54e10e01e	Mirai	bash curl mirai wget
http://107.189.31.150/RpcSecurity.x86	cc0d2187e8a958986bfe86d30ae30fc3c1fa418e5c8b6ed948adc85174e09c8c	Mirai	bash curl mirai wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67bd7be728ab76d43a5cff5flinux22vpnfull_triage

Tags:

downloader backdoor trojan

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/67bd7b996222db7f23dad585/reports/69c81520-a5b7-40f0-afba-684d98151fe3/overview

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/6da85ae8c2b9529158daf279ea01f65e91f9a2ef219150a35f5efe558b68773f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6da85ae8c2b9529158daf279ea01f65e91f9a2ef219150a35f5efe558b68773f/

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2025-02-25 06:27:30 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nwufv2gcxfjjcwg26j46uapwl2i7tixpegivbi27l37flc3io47q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250225-j4g2nazjv9/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6da85ae8c2b9529158daf279ea01f65e91f9a2ef219150a35f5efe558b68773f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.