MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f6e8fbc39b6a884656a876369e76594a5c77a599761abc50fd583a76a2711c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	6f6e8fbc39b6a884656a876369e76594a5c77a599761abc50fd583a76a2711c0
SHA3-384 hash:	62ada6ef6fac6b358ee54f0eb75a2682afb9e499dd00c12148c255f82ca7761d516bfa299ca3339c56867c571cec241b
SHA1 hash:	6890c9e99ef5639ef81be6b3d0895a039c21a119
MD5 hash:	a46f7fbe62383dd0dde54ade5dd83b09
humanhash:	monkey-mountain-tango-illinois
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'104 bytes
First seen:	2025-07-11 11:10:53 UTC
Last seen:	2025-07-12 07:40:39 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:5YnIiYcc6QWQxlReRSs+A6e4i8kZKwHY3CCHChslIYl4Bl83:5YIiYcXQWQxlst+A6e4i8kZKwHY3Csjl
TLSH	T1E541C0CD10F34452E1808E44F3FB824AF047D98A2ED78FE9ED1D3E65444AD60349DA29
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://93.123.109.218/test/x86_64	0799d34500f933b78d36d7e2df399d9b775caad2c57720a592217357054e8f68	Mirai	elf mirai ua-wget
http://93.123.109.218/test/aarch64	9895cc4f07222ab988cd48fb176ab2449c31b7c1bfa50e7b0aacbe859c7bf863	Mirai	mirai sh ua-wget
http://93.123.109.218/test/m68k	76a70e9ef68947e5707d900def98c0ac6700069f6a32cc8f7734ca377b11809d	Mirai	elf mirai ua-wget
http://93.123.109.218/test/mips	50ae0b14c6bc868c962b823b7ea6df03d199bef95e494922a1b415fddb06125b	Mirai	elf mirai ua-wget
http://93.123.109.218/test/mipsel	b9237a8501a25adf856280eac04de2f4e061658664f8ec16019c2d79dbd66da4	Mirai	elf gafgyt mirai ua-wget
http://93.123.109.218/test/powerpc	a29feb48cc40af62f48c0a646467b23754f2518ae6fdf91bf50966d19bdc8461	Mirai	elf mirai ua-wget
http://93.123.109.218/test/sparc	52deab119875c4fbcaa3a857d6170dd2f90f4a4cefb7ede4e0f481af87534fd6	Mirai	elf mirai ua-wget
http://93.123.109.218/test/sh4	d1d7ad22e7d853e7faf86daaa06110b870fd43fd9bfede9afc3892b8673ff817	Mirai	elf mirai ua-wget
http://93.123.109.218/test/arc	32da516341a337782c915114f45bdd54e79cdc55befd02b346b0054499aacddc	Mirai	elf mirai ua-wget
http://93.123.109.218/test/csky	f8a5e083ceea1d00b5442c1c051131022fdddf8807ab4862048a75b2c8899bda	Mirai	elf mirai ua-wget
http://93.123.109.218/test/i486	9e7f464e3612ab5203d7d8de701f83a3410081bf85dba7215a7fac58bd47c3dc	Mirai	elf mirai opendir ua-wget x86
http://93.123.109.218/test/armv4l	db751fd8db933b446652fa0b5f116c18c5790add5140e9302bb3a36bfd785e1c	Mirai	elf mirai ua-wget
http://93.123.109.218/test/armv5l	8bb974a5ec6b9311a56f4fa22ff38ccaefc80d3dbddd7616f8588cfd37e6caa7	Mirai	elf mirai ua-wget
http://93.123.109.218/test/armv6l	a70d6c5aa29c661fc8c25ac9c8658af00a90c631b65df818110cc960fa4ecb7f	Mirai	elf mirai ua-wget
http://93.123.109.218/test/armv7l	4651620d09b486b7f227efd44d2ce23c085e48cdb233efe8733683ac06656377	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6870f152c9eb9747376857e9linux22vpnfull_triage

Tags:

shellcode agent hype

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/ef3ab078-39bf-4f04-9c0c-341bebf4e83b

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6f6e8fbc39b6a884656a876369e76594a5c77a599761abc50fd583a76a2711c0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6f6e8fbc39b6a884656a876369e76594a5c77a599761abc50fd583a76a2711c0/

Verdict:

Malicious

Threat:

downloader.mirai/bash

Link:

https://tip.neiki.dev/file/6f6e8fbc39b6a884656a876369e76594a5c77a599761abc50fd583a76a2711c0

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2025-07-11 11:11:15 UTC

File Type:

Text (Shell)

AV detection:

14 of 38 (36.84%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n5xi7pbzw2uiizlkq5rwtz3fsss4o6szs5q2xrip2wb2o2rhchaa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/250711-naagyatybt/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Enumerates running processes

Modifies init.d

Modifies rc script

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.91

Link:

https://yomi.yoroi.company/submissions/6f6e8fbc39b6a884656a876369e76594a5c77a599761abc50fd583a76a2711c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.