MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 728cf81748d50637c3c4a6aa58d127b8f8e18f124c6cc4d0ddba183cd6abadae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	728cf81748d50637c3c4a6aa58d127b8f8e18f124c6cc4d0ddba183cd6abadae
SHA3-384 hash:	24e93a2bac820ec066948d3af1683f35b982a997b6ff41ac24a46ea83b5203b1b07c5cb3e7c2c62a71832b9b449379ec
SHA1 hash:	05ceb6666d4396bd81d4073081cf46cf8f4f9dca
MD5 hash:	95df5ec1520a7ebb105c8dd9d482efc1
humanhash:	rugby-butter-pizza-eleven
File name:	hcl.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	407 bytes
First seen:	2025-11-28 19:10:12 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:KqKhXPx2+4w0XveBUqKhL6x20+twSeBUqKsPDx2C0rNmieBUqKf6gx2T6Tro6oen:KLpDKyULLEwynUwscXU51M+oK
TLSH	T1E0E0128B93633401C182C76B338F108C61B0D3E702CB9AAC048B14BDDDABD64BBD0B40
Magika	javascript
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.92.242.138/.Sx86_64UNO	f59a38cab434d0f8afbe90abbf1313fd39cd141df1e3e77a3146a5df95b031f9	Mirai	elf geofenced mirai ua-wget USA x86
http://91.92.242.138/.Sx86UNO	909b82b9579f85a138a94a8a5dcb6685cd13bc103d0ef876f4e5640bc3baccc0	Mirai	elf geofenced mirai ua-wget USA x86
http://91.92.242.138/.SarmUNO	n/a	n/a	n/a
http://91.92.242.138/.Sarm7UNO	e125b2c1b0bfcb3c993c00b0580829434ef66452b54efd7edb12f4ae6a1d41a7	Mirai	arm elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.DownLoader.764.30609.27093.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/6929f3a71b65ca0bb926e28d/reports/3aae9f62-0bff-4986-9a7b-fcb52802e73c/overview

Verdict:

Malicious

File Type:

text

First seen:

2025-11-28T16:29:00Z UTC

Last seen:

2025-11-29T03:28:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/728cf81748d50637c3c4a6aa58d127b8f8e18f124c6cc4d0ddba183cd6abadae/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/c4f8c0c0-1656-416c-904e-4c68afa3bd1e

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/728cf81748d50637c3c4a6aa58d127b8f8e18f124c6cc4d0ddba183cd6abadae

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/728cf81748d50637c3c4a6aa58d127b8f8e18f124c6cc4d0ddba183cd6abadae/

Threat name:

Document-HTML.Hacktool.Heuristic

Status:

Malicious

First seen:

2025-11-28 19:00:39 UTC

File Type:

Text (Shell)

AV detection:

4 of 36 (11.11%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=okgpqf2i2uddpq6eu2vfrujhxd4oddysjrwmjug5ximdzvvlvwxa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251128-xvkyvawkdz/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/728cf81748d50637c3c4a6aa58d127b8f8e18f124c6cc4d0ddba183cd6abadae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.