MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 768aadcb776b4adb4869d8a795f78187b2b43c2a8ccc148548b313a76259f13d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	768aadcb776b4adb4869d8a795f78187b2b43c2a8ccc148548b313a76259f13d
SHA3-384 hash:	4a78b4890a30dd4b7a5d59cf709680db7135b826051fb2fbeceaacb1e740762fd976e68eab1db0fbb74f675a614d3c64
SHA1 hash:	4eddfcdbc63d7370193c7e9484100deb4ced803c
MD5 hash:	5df392cfa823695575a9e9a43989df3d
humanhash:	blossom-edward-september-red
File name:	xx.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	457 bytes
First seen:	2025-02-20 17:32:03 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	6:oHT2LcHsyHTLJ62yHTu8HsyHTZEZsyHfhbg2yHfmFhV8O0:y2LcMyzLE2yzu8MyzZby/hry/qV8j
TLSH	T184F0E58E1434B230590E4E91BBF29706B28FB2D16D280B3F980A44F78CAD74CB019F89
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

76

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b76812a0fd713c335c157flinux22vpnfull_triage

Tags:

agent virus hype

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

lolbin mirai remote

Link:

https://www.filescan.io/uploads/67b767473f58745ac0b38c04/reports/b41e7300-851c-423e-955c-bb4a6e42f8db/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/768aadcb776b4adb4869d8a795f78187b2b43c2a8ccc148548b313a76259f13d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/768aadcb776b4adb4869d8a795f78187b2b43c2a8ccc148548b313a76259f13d/

ReversingLabs TitaniumCloud Script.Trojan.Multiverze

Threat name:

Script.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-20 17:32:20 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o2fk3s3xnnfnwsdj3ctzl54bq6zlipbkrtgbjbkiwmj2oysz6e6q._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet defense_evasion linux

Link:

https://tria.ge/reports/250220-v4d6js1jh1/

Behaviour

Writes file to tmp directory

Changes its process name

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Mirai

Mirai family

Malware Config

C2 Extraction:

nnmmab.0u8n.com

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/768aadcb776b4adb4869d8a795f78187b2b43c2a8ccc148548b313a76259f13d