MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6db1fba2a8cabe40c2c16e34a200e28035fc8dcefa09b8e30781d3a544e20658. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	6db1fba2a8cabe40c2c16e34a200e28035fc8dcefa09b8e30781d3a544e20658
SHA3-384 hash:	f5da86178651f3929fd86a389a7a491aaab3fc49d159fcf0155055dfdeb94d8b26aa87d4820c142683bbb9d771f07c68
SHA1 hash:	af32a3023e89a81634ee44c8892958ee13692fd2
MD5 hash:	7df32d74f5ffc611e70c21212cedafbe
humanhash:	bluebird-network-carpet-arizona
File name:	8UsA.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'980 bytes
First seen:	2025-10-04 09:20:13 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vOQFsJ4BFlzuJlKWAss0AYLDZAdksmAkgxDwTFEIhVyPS:vsiF6lKVssbYLGdJlkqDwTfE6
TLSH	T15F41DAE4255207352956AF37B6A9041436E3D2539CE09DB460FDF8AF418FE483343E52
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.209.143.62/bins/UnHAnaAW.x86	42efa473fa16cd174a1394892b7163f4e47c0434d1138d120135451514465617	Mirai	elf geofenced mirai opendir ua-wget USA x86
http://213.209.143.62/bins/UnHAnaAW.mips	1aeffd0f72ac38ac1af0f86a925957eb88cff0184d6628b48ee9f452dcf8ce9c	Mirai	elf geofenced mips mirai opendir ua-wget USA
http://213.209.143.62/bins/UnHAnaAW.mpsl	f91fa8a4c5e27570471adaa1d53a68ad32a4c38f8f9f12d74bbf5614b3baaf14	Mirai	elf geofenced mips mirai opendir ua-wget USA
http://213.209.143.62/bins/UnHAnaAW.arm4	n/a	n/a	elf ua-wget
http://213.209.143.62/bins/UnHAnaAW.arm5	4bab044accc55cd8b091514d74bfb44eaaea95272ee653e93948925e24b25c7a	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://213.209.143.62/bins/UnHAnaAW.arm6	9f32df4b92beb06bfed9f04284c434379715cfcba0a62fa6bd568928c146dfd4	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://213.209.143.62/bins/UnHAnaAW.arm7	51bb3572999cd4a4b25fd0cc06b061674df3373767c789ceff16b677a2e4bdc5	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://213.209.143.62/bins/UnHAnaAW.ppc	74e244774df73843123066181b2bb2ee1b7a62fedc22e6e936adc6e21307e42c	Mirai	elf geofenced mirai opendir PowerPC ua-wget USA
http://213.209.143.62/bins/UnHAnaAW.m68k	267631b2edbac998aeea63a6867c1d121d1f27e3d9e601504148dabb56d40657	Mirai	elf geofenced m68k mirai opendir ua-wget USA
http://213.209.143.62/bins/UnHAnaAW.sh4	139cf5e5c3b4a3175dfda683eaefe4e6bd5310afa3d6d679363a224a6c69feea	Mirai	elf geofenced mirai opendir SuperH ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-04T06:29:00Z UTC

Last seen:

2025-10-05T10:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6db1fba2a8cabe40c2c16e34a200e28035fc8dcefa09b8e30781d3a544e20658/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/92554f66-7bb2-42b2-94aa-0685441938eb

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6db1fba2a8cabe40c2c16e34a200e28035fc8dcefa09b8e30781d3a544e20658

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6db1fba2a8cabe40c2c16e34a200e28035fc8dcefa09b8e30781d3a544e20658/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/6db1fba2a8cabe40c2c16e34a200e28035fc8dcefa09b8e30781d3a544e20658

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-10-04 09:22:37 UTC

File Type:

Text (Shell)

AV detection:

23 of 36 (63.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nwy7xivizk7ebqwbny2keahcqa27zdoo7ie3ryyhqhj2krhcazma._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:echobot family:mirai antivm botnet defense_evasion discovery linux trojan

Link:

https://tria.ge/reports/251004-lbn1lszyex/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Unexpected DNS network traffic destination

Contacts a large (168255) amount of remote hosts

Creates a large amount of network flows

Detected Echobot

Echobot

Echobot family

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6db1fba2a8ca/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/6db1fba2a8cabe40c2c16e34a200e28035fc8dcefa09b8e30781d3a544e20658

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.