MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 704b52c19b27124dfd2fd4c876edb0ade42f00dc967c9e6fddef24313460be8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	704b52c19b27124dfd2fd4c876edb0ade42f00dc967c9e6fddef24313460be8e
SHA3-384 hash:	de89ee217758735d62ca425c149bdc48eb4b8e5b15438d8b0b13f9e9bcea27cad2ba21a95d88fdca3ffa39498acdb9dc
SHA1 hash:	22049446876e6ae5d225b1e28dcc9814145f4752
MD5 hash:	1ea851ebfeee89f77f682127048a64c5
humanhash:	football-fix-aspen-fifteen
File name:	poop.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'025 bytes
First seen:	2025-02-24 16:06:27 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:hLJT3XMMpNIBSFyoKSLvrKM3PUwxl9aqH9owtF6ulxHTtlhyYR:hLJAMpNIIFFKSLvrXfNxl9BH9Vr5b5Xv
TLSH	T1C411B4DA22A06B3E98D1DCCDB0A2462CA83AC8D930870F4CDDDC88378D998747E11E0C
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://107.189.31.150/main_arm	8e23a2d4025bf2ac0d15928a8a2f4aa722a2dab746aee09ab785509454faa85c	Mirai	bash curl mirai wget
http://107.189.31.150/main_arm5	0f9929ac7c0377d023a3c64bc900ab074df50b4e29566d01378317bb40227970	Mirai	bash curl mirai wget
http://107.189.31.150/main_arm6	f7f3c322a4796c8f4ddbe31d04e4e20e2580d9bf1c0afe77a75f9df8ddc1fe57	Mirai	bash curl mirai wget
http://107.189.31.150/main_arm7	82503a647c85f2356b8d999b471ddc4b66e5dfcfa65d004ab8a5634bc646c4d0	Mirai	bash curl mirai wget
http://107.189.31.150/main_mk68k	n/a	n/a	n/a
http://107.189.31.150/main_mips	a4437f36b9e9ea14a720a9bb72e02e183ac8a4a2358d2fbaf9964cca0a23f575	Mirai	bash curl mirai wget
http://107.189.31.150/main_mpsl	721793c49c1b4a2f92edbcf20a6b88b4653d0eaa55f09208f8a9148223982cb7	Mirai	bash curl mirai wget
http://107.189.31.150/main_ppc	0f4f5d108e9d02e27c1e1cc9cba6adac0b1f7dce606aeb2937f3455b9f29fc0f	Mirai	bash curl mirai wget
http://107.189.31.150/main_sh4	1cbae66ac49906ea27a6efcb367a3289c1d410c54af7f9704a98cffcd369d6ec	Mirai	bash curl mirai wget
http://107.189.31.150/main_x86	aec295c0007b93bf5472f19a4d0c905aa62fa460104b41fc7c3541151aaafd43	Mirai	bash curl mirai wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67bc993128ab76d43a5ce18dlinux22vpnfull_triage

Tags:

hype sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bash busybox evasive lolbin remote

Link:

https://www.filescan.io/uploads/67bc99386222db7f23da1f64/reports/67ab3205-8bd0-4b4c-b89a-06f98d0d21e1/overview

Result

Verdict:

UNKNOWN

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/704b52c19b27124dfd2fd4c876edb0ade42f00dc967c9e6fddef24313460be8e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/704b52c19b27124dfd2fd4c876edb0ade42f00dc967c9e6fddef24313460be8e/

Threat name:

Document-HTML.Trojan.Vigorf

Status:

Malicious

First seen:

2025-02-24 16:07:14 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=obfvfqm3e4je37jp2tehn3nqvxsc6ag4sz6j436554sdcndax2ha._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250224-tknefa1nz6/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/704b52c19b27124dfd2fd4c876edb0ade42f00dc967c9e6fddef24313460be8e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.