MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aac633e60c2b4e64ff31452731ec8989a2b966088bb570a8998e68ae4af95754. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	aac633e60c2b4e64ff31452731ec8989a2b966088bb570a8998e68ae4af95754
SHA3-384 hash:	b38df5c33d10754e90f1a043d104ed21b4c2cbe69492d6a232eb23aa559d68ae90bca610c8a076e25801430df06f004c
SHA1 hash:	a2d21b46bd36b720ecace7f1e44dad49d97f7709
MD5 hash:	e862eee7506b038e1644773bf3bcea9b
humanhash:	purple-kilo-moon-idaho
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'907 bytes
First seen:	2025-11-25 16:05:38 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:I52JMo6biBIXuZjEwEnE2EhEoYqbwfsJUfv8hM3M:I52JMo6biBIXuZjjcvywqbwL8hM3M
TLSH	T1915124BB01094B35FA09864FF7FA7275B12BA59396EBCE08E944281D6FC5D5C3292E40
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnaarch64xnxn	a6a8d27ddba9cf0cf4fdfec639a2648323ef386d322440152d9b51434230fdb5	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxni386xnxn	073ec3866b43b90f6b49c75321cd2f05ab12727cf675d5bea982b89189fd2dd7	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	6981f1338726ce7eeb71d44bbd05852f593d9b7fc15e9e09ff9a98847ed82c01	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnm68kxnxn	df66a629a30752d80d21946d2186ca71a5cfe47d9f9da7d4de5c5fa90842666d	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	7d3b34b3a2d78da9d9b9b17c97df35d46eb5f5daeb4343c54092210a3a547d86	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnmipsxnxn	a26425304033bc85f9edb81f75f4a1799d69b8f1b1b8f4fdc2ee5cef6e8a378d	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnor1kxnxn	f6c2681ed37a3082023624a434a63671d1e6eafab6d25a7d12cc27ea613b6a78	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	3ba0c66de6922d0c00cf3f16afd778356e963c3762e555302c3290f463a73cae	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnriscv32xnxn	f63adc851293e6cab4e383a6da3051ab3c931985d34dc7ced37efe0b2cb39821	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnriscv64xnxn	e9a0ada6a11f89896723d5f75a35c5cf10945b1048533fecb827edd6e3bbda17	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnsh2xnxn	4291e4390c75d53d528f6db16ac5beb562e9291cd840382496c46da50ef3b3a0	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnsh4xnxn	8c574f94d0885544b9d692f7a0d5ccee8bcd23c6929b1b6d16471142643a35c1	Mirai	elf mirai ua-wget
http://213.209.143.26/bins/xnxnxnxnxnxnxnxnx86_64xnxn	3431a3ea2c40415974bd5a958bbdb768cb2c9d46297fc8c72412dc1304f35ccc	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm evasive mirai

Link:

https://www.filescan.io/uploads/6925d3f538120d7dbca0ce62/reports/730cd86b-1272-4a9f-8f3a-a2fef4026727/overview

Verdict:

Malicious

File Type:

text

First seen:

2025-11-25T15:43:00Z UTC

Last seen:

2025-11-26T00:31:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/aac633e60c2b4e64ff31452731ec8989a2b966088bb570a8998e68ae4af95754/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/292ba39c-a104-4eee-a9a6-222a7709821e

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/aac633e60c2b4e64ff31452731ec8989a2b966088bb570a8998e68ae4af95754

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aac633e60c2b4e64ff31452731ec8989a2b966088bb570a8998e68ae4af95754/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2025-11-25 16:06:14 UTC

File Type:

Text (Shell)

AV detection:

4 of 36 (11.11%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vlddhzqmfnhgj7zriuttd3ejrgrlszqiro2xbkezrzuk4sxzk5ka._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251125-tj6jmayphq/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/aac633e60c2b4e64ff31452731ec8989a2b966088bb570a8998e68ae4af95754

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.