🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6447a059d57eb02a91eea1a8e674ccb00aa27badf894d7d82bae1327d58b7fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6447a059d57eb02a91eea1a8e674ccb00aa27badf894d7d82bae1327d58b7fa
SHA3-384 hash: a0fc82de347e3b9db9837cefa2a0c4feac7700c162f4806be77b75675ba18a5d410c4739f24becf4decd3849e836fe94
SHA1 hash: 38ada4dd2dd634c72dc05d52aa0c38430277b996
MD5 hash: ec4aedb3c7ec02db353ade26cb958cf4
humanhash: sad-cold-fruit-march
File name:vc.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:836 bytes
First seen:2026-11-03 02:18:34 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:5NIhNUljBK8Zu3NtrMjHI7IdJX7M7IQLBjC6HnJFUkl7UwHB:5NC2l15E3bUpJLE+4HIU
TLSH T14B016BF6EAB18D30381CC425FD8C12E469C74E7F41E93887C8DA5821B66C44D949AF71
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
Tags:mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2650.13099.30925.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
busybox
Link:
https://www.filescan.io/uploads/6ae945c92479a273b7123e5f/reports/8cfd4a18-97ce-4dd6-b2f3-0d0f37ff3c19/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-11-03T01:10:00Z UTC
Last seen:
2026-11-04T19:04:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a6447a059d57eb02a91eea1a8e674ccb00aa27badf894d7d82bae1327d58b7fa/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/26fc316a-b2aa-4def-b762-fc3365bd611a
Behavior Graph:
Download SVG
%3 guuid=af4e8ad6-3900-0000-cb94-840d3e030000 pid=830 /usr/bin/sudo guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831 /tmp/sample.bin guuid=af4e8ad6-3900-0000-cb94-840d3e030000 pid=830->guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831 execve guuid=4629e9d8-3900-0000-cb94-840d40030000 pid=832 /usr/bin/mount guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831->guuid=4629e9d8-3900-0000-cb94-840d40030000 pid=832 execve guuid=994af1d8-3900-0000-cb94-840d41030000 pid=833 /usr/bin/grep guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831->guuid=994af1d8-3900-0000-cb94-840d41030000 pid=833 execve guuid=5a3c34da-3900-0000-cb94-840d42030000 pid=834 /usr/bin/find guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831->guuid=5a3c34da-3900-0000-cb94-840d42030000 pid=834 execve guuid=4759f0e0-3900-0000-cb94-840d43030000 pid=835 /usr/bin/rm guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831->guuid=4759f0e0-3900-0000-cb94-840d43030000 pid=835 execve guuid=699950e1-3900-0000-cb94-840d44030000 pid=836 /usr/bin/wget net send-data write-file guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831->guuid=699950e1-3900-0000-cb94-840d44030000 pid=836 execve guuid=73a57a0a-3a00-0000-cb94-840d45030000 pid=837 /usr/bin/chmod guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831->guuid=73a57a0a-3a00-0000-cb94-840d45030000 pid=837 execve guuid=5143db0a-3a00-0000-cb94-840d46030000 pid=838 /usr/bin/dash zombie guuid=783c93d8-3900-0000-cb94-840d3f030000 pid=831->guuid=5143db0a-3a00-0000-cb94-840d46030000 pid=838 clone e80c5b93-a3af-5753-bea6-2ca06a077496 45.61.183.64:80 guuid=699950e1-3900-0000-cb94-840d44030000 pid=836->e80c5b93-a3af-5753-bea6-2ca06a077496 send: 133B guuid=60e5e30a-3a00-0000-cb94-840d47030000 pid=839 /usr/bin/dash guuid=5143db0a-3a00-0000-cb94-840d46030000 pid=838->guuid=60e5e30a-3a00-0000-cb94-840d47030000 pid=839 clone guuid=e3adf50a-3a00-0000-cb94-840d48030000 pid=840 /tmp/q net zombie guuid=60e5e30a-3a00-0000-cb94-840d47030000 pid=839->guuid=e3adf50a-3a00-0000-cb94-840d48030000 pid=840 execve 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=e3adf50a-3a00-0000-cb94-840d48030000 pid=840->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=65d326ab-3a00-0000-cb94-840d49030000 pid=841 /tmp/q guuid=e3adf50a-3a00-0000-cb94-840d48030000 pid=840->guuid=65d326ab-3a00-0000-cb94-840d49030000 pid=841 clone guuid=c43e35ab-3a00-0000-cb94-840d4a030000 pid=842 /tmp/q dns net send-data zombie guuid=e3adf50a-3a00-0000-cb94-840d48030000 pid=840->guuid=c43e35ab-3a00-0000-cb94-840d4a030000 pid=842 clone guuid=c43e35ab-3a00-0000-cb94-840d4a030000 pid=842->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 195B 23e2521c-2276-5b10-9f45-76ffff9c8572 45.61.183.64:60195 guuid=c43e35ab-3a00-0000-cb94-840d4a030000 pid=842->23e2521c-2276-5b10-9f45-76ffff9c8572 send: 9B guuid=b3343eab-3a00-0000-cb94-840d4b030000 pid=843 /tmp/q guuid=c43e35ab-3a00-0000-cb94-840d4a030000 pid=842->guuid=b3343eab-3a00-0000-cb94-840d4b030000 pid=843 clone guuid=8b4e54ab-3a00-0000-cb94-840d4c030000 pid=844 /tmp/q guuid=c43e35ab-3a00-0000-cb94-840d4a030000 pid=842->guuid=8b4e54ab-3a00-0000-cb94-840d4c030000 pid=844 clone guuid=aa2b5eab-3a00-0000-cb94-840d4d030000 pid=845 /tmp/q net net-scan send-data guuid=c43e35ab-3a00-0000-cb94-840d4a030000 pid=842->guuid=aa2b5eab-3a00-0000-cb94-840d4d030000 pid=845 clone guuid=5f9d65ab-3a00-0000-cb94-840d4e030000 pid=846 /tmp/q net net-scan send-data guuid=c43e35ab-3a00-0000-cb94-840d4a030000 pid=842->guuid=5f9d65ab-3a00-0000-cb94-840d4e030000 pid=846 clone guuid=aa2b5eab-3a00-0000-cb94-840d4d030000 pid=845|network network activity to 4098 IP addresses review logs to see them all guuid=aa2b5eab-3a00-0000-cb94-840d4d030000 pid=845->guuid=aa2b5eab-3a00-0000-cb94-840d4d030000 pid=845|network network guuid=5f9d65ab-3a00-0000-cb94-840d4e030000 pid=846|network network activity to 4097 IP addresses review logs to see them all guuid=5f9d65ab-3a00-0000-cb94-840d4e030000 pid=846->guuid=5f9d65ab-3a00-0000-cb94-840d4e030000 pid=846|network network
Score:
74%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a6447a059d57eb02a91eea1a8e674ccb00aa27badf894d7d82bae1327d58b7fa
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6447a059d57eb02a91eea1a8e674ccb00aa27badf894d7d82bae1327d58b7fa/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-11-03 02:17:27 UTC
File Type:
Text (Shell)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uzchubm5k7vqfki65ini4z2mzmakuj5236eu27mcxlqte7kyw75a._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet credential_access defense_evasion discovery linux
Link:
https://tria.ge/reports/261103-cryejsex3x/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Reads process memory
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (61059) amount of remote hosts
Creates a large amount of network flows
Family: Mirai
Malware Config
C2 Extraction:
trigay.zencloud.store
Malware Family:
mirai
Create hunting rule
Malicious:
True
Tags:
detect-debug-environment shell sets-process-name self-delete
Source:
https://www.virussign.com/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/a6447a059d57eb02a91eea1a8e674ccb00aa27badf894d7d82bae1327d58b7fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_49674744
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_sh, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments