MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 971736da477c2c4a7892cd8e8c9bd1979931beacbcc25242a2d8d8c222c91c78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	971736da477c2c4a7892cd8e8c9bd1979931beacbcc25242a2d8d8c222c91c78
SHA3-384 hash:	eeb92b61057810b2db6009b099a4ec5487307ed05cf24da73c6ed1dfc4ab70b7a6edef1df23ae243195d719e1a4ebfd5
SHA1 hash:	cc6ef9b971b7529045361dda87fc7d1151e34d15
MD5 hash:	98a4a803ee4cc21501d1cdf083f510ae
humanhash:	delaware-wisconsin-steak-violet
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	6'329 bytes
First seen:	2025-11-05 05:12:28 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:XU3mBKXOBqTGp83crC12fNk7sBpgnAlMPOZyMPOZyxofI9aNwDYPGpi79Ur8xuxm:XU3mBKXOBqTGp83crC12fNk7sBpgnAlE
TLSH	T1A7D13EF6B48A52BCDD9FC83E511029BD5086B99B26870D6887EE247A7C99FCC5C409C3
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x86	8d3700377e881e7ea2e629abca7c2207d4888b53ac4becc945bb06a6a238def4	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mips	8df88b9d94011e6719628b683f8819bdf9c820de9f69f0e3557e954fa27052fe	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arc	216c1fe4013d8e6a226268bb8f0ddcd86c76a6dfb3b43f59fb9d53681e9b33e5	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i468	n/a	n/a	elf ua-wget
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i686	41788139d7648f3575028597231d705cc9cd2a92ac29bd9ee4f8fee9d1fe5040	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.x86_64	cfee5c898cdaf6b80e842642d7a761e3978ef95c48522c247cfa2b7ed4a20349	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.mpsl	e7d10efe665c48875742fbb2e801d45c9bd8f5ff801bfd1b9d7737b7901eb3b4	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm	fc508da563689afd81fe2e869a23c466eecf24b5030cf6ef3ea8dd22358d0492	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm5	c3d7ec62233b511d43d850c716e4eeb8cde98c3c5ffac55644a2baed6de41751	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm6	3f119af8a38034d479b64c0df1e968455ebe9ac252e99d343cbda6da4fb95cfd	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm7	15598cecd0d6be2d9b5cd9812b55d409d80d080f51007d779f7e890dea5c2c8a	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.ppc	8576a00f145bae25947c3812fbd9cc8c801f6e734fea1885d3845ffee3bc7e5e	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.spc	da32f8b9d90fd290c41e0a5810512d6a63237af574cfb37a3a3475fede9fdc71	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.m68k	4cca40a378396d30956ac1732764cc02a5500699e8a5352f51220be1960ca981	Mirai	elf mirai opendir
http://194.87.245.7/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.sh4	eaded8049ec850d0f92456846375d3677547adef18e7aa399064b92413be3e1a	Mirai	elf mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-04T17:12:00Z UTC

Last seen:

2025-11-05T13:06:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/971736da477c2c4a7892cd8e8c9bd1979931beacbcc25242a2d8d8c222c91c78/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/9a999176-237e-4427-a1e7-4160abd9f0b2

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/971736da477c2c4a7892cd8e8c9bd1979931beacbcc25242a2d8d8c222c91c78

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/971736da477c2c4a7892cd8e8c9bd1979931beacbcc25242a2d8d8c222c91c78/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2025-11-04 23:27:15 UTC

File Type:

Text (Shell)

AV detection:

18 of 36 (50.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s4ltnwshpqweu6eszwhizg6rs6mtdpvmxtbfeqvc3dmmeiwjdr4a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251105-fxjecsyjhv/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

UPX packed file

Deletes log files

Enumerates running processes

File and Directory Permissions Modification

Deletes Audit logs

Deletes journal logs

Deletes system logs

Executes dropped EXE

Mirai family

Mirai

Malware Config

C2 Extraction:

jhfhfdkhdfdk32.duckdns.org

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/971736da477c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.42

Link:

https://yomi.yoroi.company/submissions/971736da477c2c4a7892cd8e8c9bd1979931beacbcc25242a2d8d8c222c91c78

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.