MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab0f6d0f11c019698dd9e5339f79beb17edaaf501875243ead4cadc2eeff4176. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	ab0f6d0f11c019698dd9e5339f79beb17edaaf501875243ead4cadc2eeff4176
SHA3-384 hash:	4a05eb52b1e22ead5ffe864aae5876a5aa60db25efb52e9e9b45bdcec1a56928093b3d9aaf02d40386ad150588523893
SHA1 hash:	f2da4b2f04758c29371b1cd9f60c2981ef5bfae8
MD5 hash:	48149ae4cae2073413e8188c20c0bf69
humanhash:	island-johnny-connecticut-oscar
File name:	g
Download:	download sample
Signature	Mirai Create hunting rule
File size:	481 bytes
First seen:	2025-10-19 16:08:40 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:tfLwVIjZElGgyx0FZExLSAjZENNNIl5sz5ZEfFa0LKiSLSZEANI3XZElJNHb:tzwcuo9lUNNIl5sL0c0LKFsle3pGN7
TLSH	T1EEF0588FE460278B08C4FE49B17248596029D2CA3CF69BDEFDDC24A991A95147116B8A
Magika	batch
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://23.177.185.39/arm	f6038ff963fc43473bd69ee8b571b6bcdc88d7bb3231ec5727e835232edee6a7	Mirai	elf mirai ua-wget
http://23.177.185.39/arm5	b5f97c4c0ff408de365da6735bf940d1a6a7f7465be68509db8e313f3dcf174f	Mirai	elf gafgyt mirai ua-wget
http://23.177.185.39/arm6	625c60b9a8b0347d5a3988d73bf19d9c5bc9bf126fa8720dd28c648edb4a0975	Mirai	elf gafgyt mirai ua-wget
http://23.177.185.39/arm7	ffe536b3d11dd297b8155ecf55695ef88518cc6e35976efed155b6328444bfb5	Mirai	elf mirai ua-wget
http://23.177.185.39/mips	2cae01a9c5ccb06c91d94ba45a9aaec9f804f60f9bf86cdf97daf5ceacae8f4f	Mirai	32-bit elf gafgyt mirai Mozi
http://23.177.185.39/mpsl	9b9764585122f6e0d842fb301963fed0cb6cba5a12740fec2c660d1f636bafd5	Mirai	elf gafgyt mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68f50d3711ff3db29f63f0f7/reports/20ef6d2c-beb8-4aca-9e94-6e5d98c050d4/overview

Verdict:

Malicious

File Type:

text

First seen:

2025-10-19T16:25:00Z UTC

Last seen:

2025-10-19T16:34:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ab0f6d0f11c019698dd9e5339f79beb17edaaf501875243ead4cadc2eeff4176/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/683ecfcb-3b3a-46a9-b51b-91bf5826a7cc

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ab0f6d0f11c019698dd9e5339f79beb17edaaf501875243ead4cadc2eeff4176

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ab0f6d0f11c019698dd9e5339f79beb17edaaf501875243ead4cadc2eeff4176/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-10-19 16:13:29 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vmhw2dyryamwtdoz4uzz66n6wf7nvl2qdb2sipvnjsw4f3x7if3a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251019-tn7bqabl2y/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ab0f6d0f11c019698dd9e5339f79beb17edaaf501875243ead4cadc2eeff4176

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.