MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e4f6ecd3c5416e21f901fdf8b9f0c6e213fc3e500472c63cb1309a43162d290. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	9e4f6ecd3c5416e21f901fdf8b9f0c6e213fc3e500472c63cb1309a43162d290
SHA3-384 hash:	37feaafaabcfa8b8b9a247266eb906e6e6b798a8663f05a5f4429fb916c90d8abc3828e5128aec334c408651ae2d3a11
SHA1 hash:	dd5f69b7d8c1b9a65ea1d8f4bffbb247a2ad02ec
MD5 hash:	24237e8c6c523a0632bf228f6d49152c
humanhash:	video-echo-december-indigo
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	860 bytes
First seen:	2025-06-27 05:15:03 UTC
Last seen:	2025-06-28 03:21:24 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:PhtURUKJUSNI7PUqKOUSBU9U0qU4tJUAU4qhuu:Phem5qNhuu
TLSH	T13E11949F14707C9649799E2F72738618701C96CEA96B8F88AC4F587E8DC77083418F05
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.208.158.140/arm	8271f1f986b352fff15ea4a77cc5fec53c1d9dcca742d4a9c9d2ab6891eab18a	Mirai	elf gafgyt mirai ua-wget
http://185.208.158.140/arm5	575ef1a01819dd1f1c2c0fb09b0001725599230fc4ce03d197b52751ff85a341	Mirai	elf mirai ua-wget
http://185.208.158.140/arm6	6402c8ac9e7bcc47f493ed249ef2b5a0e1b0b317e0dbd8012b61d3507c67fd0e	Mirai	elf mirai ua-wget
http://185.208.158.140/arm7	37d405a2afcd051f24faa7d536ac292e28148575a2ee02766b92046f413a3c57	Mirai	elf mirai ua-wget
http://185.208.158.140/mips	7b02048872ec82be36a7a9c28d8479a1c884a2df339416c822554211e6d5b05e	Mirai	elf gafgyt mirai ua-wget
http://185.208.158.140/mipsel	f0c4dc9e697cc34437766c67140cc210be04bd62997bf2ace3c389e3d9e32ff7	Mirai	elf mirai ua-wget
http://185.208.158.140/powerpc	cefd6e28cd1c138a151a1721dbbe1a53b410424b259179faa792fcc8063952ba	Mirai	elf mirai ua-wget
http://185.208.158.140/sh4	dfc72b2b40890a9747c242f69db7c4941794bf89c5ff0ef75dab6e1338c6cd6f	Mirai	elf mirai ua-wget
http://185.208.158.140/sparc	36eb14fd17bd36eb37ce29bdffe3109b88ffef2387f94647593d267b3214b134	Mirai	elf mirai ua-wget
http://185.208.158.140/x86_64	1d9f46542a855257b2a801c72449db0482435d1bb05cffccc0ad56a82e4631e6	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685e2a7520e741bf6270d205

Tags:

n/a

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5fa2cb21-9b2e-4db1-982d-63dbf14bab6a

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9e4f6ecd3c5416e21f901fdf8b9f0c6e213fc3e500472c63cb1309a43162d290

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9e4f6ecd3c5416e21f901fdf8b9f0c6e213fc3e500472c63cb1309a43162d290/

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2025-06-27 05:15:28 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tzhw5tj4kqloeh4qd7pyxhymnyqt7q7fabdsyy6lcme2imlc2kia._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250627-fxv36avxe1/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9e4f6ecd3c5416e21f901fdf8b9f0c6e213fc3e500472c63cb1309a43162d290

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 9e4f6ecd3c5416e21f901fdf8b9f0c6e213fc3e500472c63cb1309a43162d290

(this sample)

19da04015acaedbae56e0a3ffa9e7f848c0a287d6307e23c898c7a5ff4b9af84

URLhaus

https://urlhaus.abuse.ch/url/3570300/

Delivery method

Distributed via web download

Dropping

MD5 357b1387f396bfcc83dde25158b6ce8b

Dropping

SHA256 19da04015acaedbae56e0a3ffa9e7f848c0a287d6307e23c898c7a5ff4b9af84

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample