MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84136594594e278c123268fb9e99f998988f6a78ae2b62c24600f4827546f1bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	84136594594e278c123268fb9e99f998988f6a78ae2b62c24600f4827546f1bc
SHA3-384 hash:	b97c5e8e42ba0a5e12ee84bd29e9621ee689b48ef010a865644519281a5e097eb41deb03fff69625e5c845a8c47e400e
SHA1 hash:	aceb623bcd080ca284b38561d6537d136f7fa2d7
MD5 hash:	daef17eb08ab26530e932aac41676de2
humanhash:	ten-stream-cardinal-foxtrot
File name:	x.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'058 bytes
First seen:	2025-07-01 06:46:40 UTC
Last seen:	2025-07-02 03:17:03 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:PhOUQhUKYhUSNI7qhUqKHhUSAhUEhU07hU4tYhUNhU4qh5u:PhkJY+qHIIxt7u+4h5u
TLSH	T1CE11EEEB24601A614C68ED1B7563C91D341DE5CFBE6B4F88788F4ABE4BC67053814B08
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.208.158.140/arm	8271f1f986b352fff15ea4a77cc5fec53c1d9dcca742d4a9c9d2ab6891eab18a	Mirai	elf gafgyt mirai ua-wget
http://185.208.158.140/arm5	575ef1a01819dd1f1c2c0fb09b0001725599230fc4ce03d197b52751ff85a341	Mirai	elf mirai ua-wget
http://185.208.158.140/arm6	6402c8ac9e7bcc47f493ed249ef2b5a0e1b0b317e0dbd8012b61d3507c67fd0e	Mirai	elf mirai ua-wget
http://185.208.158.140/arm7	37d405a2afcd051f24faa7d536ac292e28148575a2ee02766b92046f413a3c57	Mirai	elf mirai ua-wget
http://185.208.158.140/mips	7b02048872ec82be36a7a9c28d8479a1c884a2df339416c822554211e6d5b05e	Mirai	elf gafgyt mirai ua-wget
http://185.208.158.140/mipsel	f0c4dc9e697cc34437766c67140cc210be04bd62997bf2ace3c389e3d9e32ff7	Mirai	elf mirai ua-wget
http://185.208.158.140/powerpc	cefd6e28cd1c138a151a1721dbbe1a53b410424b259179faa792fcc8063952ba	Mirai	elf mirai ua-wget
http://185.208.158.140/sh4	dfc72b2b40890a9747c242f69db7c4941794bf89c5ff0ef75dab6e1338c6cd6f	Mirai	elf mirai ua-wget
http://185.208.158.140/sparc	36eb14fd17bd36eb37ce29bdffe3109b88ffef2387f94647593d267b3214b134	Mirai	elf mirai ua-wget
http://185.208.158.140/x86_64	1d9f46542a855257b2a801c72449db0482435d1bb05cffccc0ad56a82e4631e6	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6863848c0fceda814b478a59linux22vpnfull_triage

Tags:

n/a

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/615f7bf4-3c3f-40c8-9c56-5a917e48c072

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/84136594594e278c123268fb9e99f998988f6a78ae2b62c24600f4827546f1bc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/84136594594e278c123268fb9e99f998988f6a78ae2b62c24600f4827546f1bc/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2025-07-01 06:34:45 UTC

File Type:

Text (Shell)

AV detection:

16 of 37 (43.24%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qqjwlfczjytyyersnd5z5gpztcmi62tyvyvwfqsgad2ie5kg6g6a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250701-hkcr6a1xdt/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/84136594594e278c123268fb9e99f998988f6a78ae2b62c24600f4827546f1bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.