MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a642661259f2493c9d259526b8c92cc40b38812dbf6ed715bf12b4215e5691be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	a642661259f2493c9d259526b8c92cc40b38812dbf6ed715bf12b4215e5691be
SHA3-384 hash:	d7d8edde13cd5b00e46879ebdfb17584adad0aaf0cd0aff75254da624e46f019871f1a2b6d3c5d612b6942078248727d
SHA1 hash:	c3041a2da52d0d04f76a5f5209ecc6fd97197f89
MD5 hash:	6757eec1328f3432758018b379294492
humanhash:	foxtrot-montana-mirror-carbon
File name:	wget_telnet.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'333 bytes
First seen:	2025-10-27 04:41:43 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:pIIdYsIaMnh2apwMZByZhV8R47AF3OH8ENpuNlwNpE:pZexP0aGuBwhqSdGcs
TLSH	T10841F2ED02802F7A35068A2563E755AC9C468FD1718A579CD58A7C2B8C0F61C7BF9D83
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.35.154/powerpc.uhavenobotsxd	2fc813a289298e34f20e9ffadb2a8ba2dad96edcdd988cdf05228e676713b890	Mirai	elf geofenced mirai PowerPC ua-wget USA
http://94.154.35.154/mips.uhavenobotsxd	f44a199d532e67a8f84ffc93aa8ddda9596a00d875be5ea49e5d1f8226d5ed3b	Mirai	elf geofenced mips mirai ua-wget USA
http://94.154.35.154/mipsel.uhavenobotsxd	0d018abf429ec83041512259b9a49a50a43473506496536aaf4848670ca71a73	Mirai	elf geofenced mips mirai ua-wget USA
http://94.154.35.154/arm.uhavenobotsxd	18d0cc7b40a193a55589f14b91d4f3243f32dc354f5265422eae9637f84fa891	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm5.uhavenobotsxd	d060e726d0e3433b3a88e2f132404be1c02664c8705f320c7b2a187ce04d78b3	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm6.uhavenobotsxd	25b423780d37da72f154b884c64c96ec29fe38687744344da924a321b13459e5	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm7.uhavenobotsxd	122100a11ee0c4d3508dd7d091c3ed462e918b9aa0e725fb2a8228ad87c0c785	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/sparc.uhavenobotsxd	n/a	n/a	elf ua-wget
http://94.154.35.154/m68k.uhavenobotsxd	n/a	n/a	elf ua-wget
http://94.154.35.154/sh4.uhavenobotsxd	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-27T03:10:00Z UTC

Last seen:

2025-10-27T03:30:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a642661259f2493c9d259526b8c92cc40b38812dbf6ed715bf12b4215e5691be/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/25ba7c38-95ea-4d67-ad88-bf9cf309b5b1

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a642661259f2493c9d259526b8c92cc40b38812dbf6ed715bf12b4215e5691be

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a642661259f2493c9d259526b8c92cc40b38812dbf6ed715bf12b4215e5691be/

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2025-10-27 04:42:32 UTC

File Type:

Text (Shell)

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uzbgmesz6jetzhjfsutlrsjmyqftrajnx5xnofn7ck2ccxswsg7a._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251027-fbyxxshy2h/

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a642661259f2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a642661259f2493c9d259526b8c92cc40b38812dbf6ed715bf12b4215e5691be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.