MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e99d808e5265bd5555f57a9b7b963759cb053f08789637f45822ea33b389b49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	7e99d808e5265bd5555f57a9b7b963759cb053f08789637f45822ea33b389b49
SHA3-384 hash:	81eca96bb83abf8702fdab549d06c80e0741481da9cacec10f130617b16a5cf36b707a674858ab9e13922dec9462cee6
SHA1 hash:	bb0c7003d9758c254621fa3d35f5d1a8abeba3c9
MD5 hash:	33e6b34033da6f5848bd79d084f1a048
humanhash:	lion-vermont-nitrogen-nine
File name:	l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	912 bytes
First seen:	2025-02-04 17:11:39 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:ghYbxUzgG2Xcqfj4rEiTgNI7EgKKmt+JKzh:ayXGO1fj0EiTFEgb1JKd
TLSH	T1F31191DF9A241B020519DE8DF66799E9B056D5CB268B0FE4AEDD383D88ECD147025B08
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.188.83.11/mips	4bdcfa4fdf3a5973f0769c3c3f91a884c0ffc5864c9899bd7ee11be95247e479	Mirai	404 censys elf mirai
http://103.188.83.11/mpsl	3d19066949ebfd287907986918e5eedbd812612939010006fc6d8b0f17b9c69e	Mirai	404 censys elf mirai
http://103.188.83.11/x86	ce5797cd8b13c2f33236d3a9a3bc06cd8812b418b8b52d8bc48de1d851c5bd4b	Mirai	404 censys elf mirai
http://103.188.83.11/arm	b05c179f2de94587825897a488435e73ccb35b635ba835e696186d0c64d6baac	Mirai	404 censys elf mirai
http://103.188.83.11/arm5	1f2104c71f9224fb0fe7a16fd4d23f1e4ac4a7c515f23d0313361844b58fd9e8	Mirai	404 censys elf mirai
http://103.188.83.11/arm6	4852934e3236386fdfd9c06d744a470061d32c03fe747cb25af20473b6b971d3	Mirai	404 censys elf mirai
http://103.188.83.11/arm7	d1d4cbbd012a7f0e277c8f0b282deed56cb5dea53897f9c415c8f71862fcb38c	Mirai	404 censys elf mirai
http://103.188.83.11/sh4	7a1e106c4ac39a252631878122e8922c604518cc6122248de98c2e9b5615cbe4	Mirai	404 censys elf gafgyt mirai
http://103.188.83.11/ppc	75c879ce2d22e33e310ed366a91624a9b6be6b4a879b3d60f8065f1640dfd80a	Mirai	404 censys elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a24ba451193558eb19600alinux22vpnfull_triage

Tags:

agent hype sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive lolbin remote

Link:

https://www.filescan.io/uploads/67a24a71cb31fe187ed41c1f/reports/5ee470d0-6b93-4832-9540-5350dee1a86b/overview

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/7e99d808e5265bd5555f57a9b7b963759cb053f08789637f45822ea33b389b49

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7e99d808e5265bd5555f57a9b7b963759cb053f08789637f45822ea33b389b49/

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2025-02-04 17:14:11 UTC

File Type:

Text (Shell)

AV detection:

12 of 23 (52.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p2m5qchfezn5kvk7k6u3poldowolau7qq6ewg72fqixkgozytneq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250204-vr2q3svqbj/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7e99d808e5265bd5555f57a9b7b963759cb053f08789637f45822ea33b389b49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.