MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87215147170ffa0381f19fb051799108de8bca24f4a2ca9a1372cd8285565d6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	87215147170ffa0381f19fb051799108de8bca24f4a2ca9a1372cd8285565d6e
SHA3-384 hash:	29706d36730358411b34ceae01ab16ad9eccda3f7095c541b6ff1601d5d2e1b7b72b63e68ae02e9f1caee6c0146c0208
SHA1 hash:	3a4e197c50598a8252c46e92b9e81703e359efcc
MD5 hash:	e37813e57866f5bdbcd20758a479be4b
humanhash:	fruit-video-rugby-solar
File name:	wa
Download:	download sample
Signature	Mirai Create hunting rule
File size:	964 bytes
First seen:	2025-07-01 06:46:36 UTC
Last seen:	2025-07-01 20:43:12 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:zWApUKUKSUSNI7wUqKzUS6U+U0XU4tSUVU4jgu:zWAvLcZFgu
TLSH	T1C211BCDF546069A54968DE2F7172D20CB02C89CEA95B9F8C9A4F58BE4FD3A183114B88
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.208.158.140/arm	8271f1f986b352fff15ea4a77cc5fec53c1d9dcca742d4a9c9d2ab6891eab18a	Mirai	elf gafgyt mirai ua-wget
http://185.208.158.140/arm5	575ef1a01819dd1f1c2c0fb09b0001725599230fc4ce03d197b52751ff85a341	Mirai	elf mirai ua-wget
http://185.208.158.140/arm6	6402c8ac9e7bcc47f493ed249ef2b5a0e1b0b317e0dbd8012b61d3507c67fd0e	Mirai	elf mirai ua-wget
http://185.208.158.140/arm7	37d405a2afcd051f24faa7d536ac292e28148575a2ee02766b92046f413a3c57	Mirai	elf mirai ua-wget
http://185.208.158.140/mips	7b02048872ec82be36a7a9c28d8479a1c884a2df339416c822554211e6d5b05e	Mirai	elf gafgyt mirai ua-wget
http://185.208.158.140/mipsel	f0c4dc9e697cc34437766c67140cc210be04bd62997bf2ace3c389e3d9e32ff7	Mirai	elf mirai ua-wget
http://185.208.158.140/powerpc	cefd6e28cd1c138a151a1721dbbe1a53b410424b259179faa792fcc8063952ba	Mirai	elf mirai ua-wget
http://185.208.158.140/sh4	dfc72b2b40890a9747c242f69db7c4941794bf89c5ff0ef75dab6e1338c6cd6f	Mirai	elf mirai ua-wget
http://185.208.158.140/sparc	36eb14fd17bd36eb37ce29bdffe3109b88ffef2387f94647593d267b3214b134	Mirai	elf mirai ua-wget
http://185.208.158.140/x86_64	1d9f46542a855257b2a801c72449db0482435d1bb05cffccc0ad56a82e4631e6	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6863865337c3436779482741

Tags:

n/a

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2dfe0f7a-00a1-446a-97e8-1d0d1836a8cb

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/87215147170ffa0381f19fb051799108de8bca24f4a2ca9a1372cd8285565d6e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/87215147170ffa0381f19fb051799108de8bca24f4a2ca9a1372cd8285565d6e/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/87215147170ffa0381f19fb051799108de8bca24f4a2ca9a1372cd8285565d6e

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2025-07-01 06:34:39 UTC

File Type:

Text (Shell)

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q4qvcryxb75ahaprt6yfc6mrbdpixsre6srmvgqtolgyfbkwlvxa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250701-hlecdasqt8/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/87215147170ffa0381f19fb051799108de8bca24f4a2ca9a1372cd8285565d6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.