MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f45ee1b7fdebe004d82f67fe458d64feef68ec3e638fc313b8836a72f140313. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	6f45ee1b7fdebe004d82f67fe458d64feef68ec3e638fc313b8836a72f140313
SHA3-384 hash:	85026c5cbdef0a2b80f9e729e261edc133cc62edf305c04146040f84230c228dd9fd4337e087191536a71bb97943854f
SHA1 hash:	da8913a2995eae8006557cf6e17fb75803841b3c
MD5 hash:	b8788bb8bc43b9b80f1ff926563d2971
humanhash:	saturn-india-fish-arkansas
File name:	p
Download:	download sample
Signature	Mirai Create hunting rule
File size:	827 bytes
First seen:	2026-06-28 04:59:00 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaWCird5ACEBfCYSaeOC2vCnnGauD:kXCKysE2hi0ziQvZohaWX8lOkDwnG7
TLSH	T131016BDE86006D1040699A3E72975590B420C3CE194A0FF87FDC5E7DFBD9904B076E88
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://129.121.114.124/B16	e56d34da542f3a9b7865bd302da2967e3d84f46dde7183fc75147890fcfcbc50	Mirai	elf mirai ua-wget
http://129.121.114.124/sxR	686c9f6ea24a16f1cabc40d7787ed700377d0289a00f0f5bfc49a2c5d88cc4da	Mirai	elf mirai ua-wget
http://129.121.114.124/8Xx	985caa66c6d413fcb1b88743fa36a74b5f325b2574d061b3eccaf63a61a8da5e	Mirai	elf mirai ua-wget
http://129.121.114.124/eQA	25a8145fe4b271a2468953a1a74a48f273402e0abaa185fe868f0131d4658c75	Mirai	elf mirai ua-wget
http://129.121.114.124/6F8	55d38ae5923cd336221378583617758a55ee114fe777eb3cb5ca04bc6200356f	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a40aa30e01da56f025d45a6/reports/5ffb0f6b-a7ee-47a2-a0d1-99d01c760b3f/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-28T02:04:00Z UTC

Last seen:

2026-06-29T18:07:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/6f45ee1b7fdebe004d82f67fe458d64feef68ec3e638fc313b8836a72f140313/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/0a6975b5-c795-452f-b65a-7b1e3288d0ba

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6f45ee1b7fdebe004d82f67fe458d64feef68ec3e638fc313b8836a72f140313

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6f45ee1b7fdebe004d82f67fe458d64feef68ec3e638fc313b8836a72f140313/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/6f45ee1b7fdebe004d82f67fe458d64feef68ec3e638fc313b8836a72f140313

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2026-06-28 04:59:32 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n5c64g37327aatmc6z76iwgwj7xpndwd4y4pymj3ra3kolyuamjq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260628-fmmzssft3n/

Behaviour

Reads runtime system information

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/6f45ee1b7fdebe004d82f67fe458d64feef68ec3e638fc313b8836a72f140313

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.