MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7308d85aa1acfcb9800f78200674f8b5497d3838d5170ac5e3717118f1634984. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	7308d85aa1acfcb9800f78200674f8b5497d3838d5170ac5e3717118f1634984
SHA3-384 hash:	70bcefcab956be7f4f20bde6014c4f06a76f5331d219e824d8fb53615b95df5c3589e41028d38f68ec27432cb45c7c08
SHA1 hash:	db8735837258b7e78e64163cea557f5eb43c2d94
MD5 hash:	41de0463e22eabb06861aaf3b28a5e50
humanhash:	pluto-uranus-echo-one
File name:	hidden.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'575 bytes
First seen:	2025-01-25 15:21:47 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vCzITCiPz13C575wtCn8B5LCIRD1CX7Xw8sCubpCiPFCFmRC5ixbCox9C5UTcaCb:vj52dCnx5F7ZbVKa0
TLSH	T14C51939A371743302E66F4E3B9E90858B3D6E4E6D4CC9ED687D878AD844DF0CA0C09D2
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://193.143.1.66/bins/hold.x86	b0d4c5f574262235ac9b84f14ab01c858aed158598ac0eac7b9c1197921429e6	Mirai	32-bit elf mirai x86-32
http://193.143.1.66/bins/hold.mips	ec4e12ae7910f54381dd7c325364147b17f96e0d1f5c7cfa8d818c1fc487c3e9	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.mpsl	0496421dac7fc4aac7bd6d45ba1b929727804e101c3690dcedd73231aba3af07	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.arm	1577bfddedee491e4f51793662f011edce5e40dd8ba17f2671c4df818aca5c76	Mirai	elf mirai opendir
http://193.143.1.66/bins/hold.arm5	1c9b4984eb0598462c2d486d0f34191c0ebe55b6f91e763ed3c0e01624585290	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.arm6	4630f8cb2a102cfc5202eef3f49f0073127f6afd07afb07110b5b44bde43a7dc	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.arm7	4d71abad98597a404007e8dc9cbec5d749e21230ff503b7574062b04378aaeb6	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.ppc	99ceabbc5d279884f3663071e0622a6ae8910b342a9f70f94938a676e900678c	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.m68k	a1c846734a90b87cc64ed64f51af377f5082ab719ccc35614a865e4b309025ba	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.spc	c4220f5cfce574e2c2d8e5527f4dee2021bd8410406cafa705d974ab097e30a2	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.i686	c4220f5cfce574e2c2d8e5527f4dee2021bd8410406cafa705d974ab097e30a2	Mirai	elf opendir
http://193.143.1.66/bins/hold.sh4	691a2404ffd4acd39d74b956c463fee7082dd0fb1acc52783663d9d50c1490e8	Mirai	elf mirai ua-wget
http://193.143.1.66/bins/hold.arc	691a2404ffd4acd39d74b956c463fee7082dd0fb1acc52783663d9d50c1490e8	Mirai	elf opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Gathering data

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

bash lolbin remote

Link:

https://www.filescan.io/uploads/6795019cff3580ba7f0c49b2/reports/9f58489e-f3eb-43cc-bd38-2f41727e01f3/overview

Result

Verdict:

MALICIOUS

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7308d85aa1acfcb9800f78200674f8b5497d3838d5170ac5e3717118f1634984

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7308d85aa1acfcb9800f78200674f8b5497d3838d5170ac5e3717118f1634984/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-01-25 15:22:04 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=omenqwvbvt6ltaappaqam5hywvex2oby2ulqvrpdofyrr4ldjgca._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250125-srwhysykh1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7308d85aa1acfcb9800f78200674f8b5497d3838d5170ac5e3717118f1634984

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.