MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ace32e96562485d09034c5b8d4dda859e5705092c467d5ffdb9b5296343431f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	ace32e96562485d09034c5b8d4dda859e5705092c467d5ffdb9b5296343431f7
SHA3-384 hash:	2e08881061d9e8be1635e395819c23fedfbd14f545b32ce2584a66fc43bdfe8c2e311fe652393bb1406e449e1aa3d358
SHA1 hash:	ffc652fc6766661ab6f76eeacee2d231e41b14c0
MD5 hash:	001334445b3709131c5cf331ba16479b
humanhash:	spaghetti-carolina-thirteen-fanta
File name:	zte
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'685 bytes
First seen:	2025-12-03 08:16:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:q0F2ZkNPhFKX0F2wkB7hFKX0F2oiko4fhFKX0F2RkthFKX0F2QLkQ2hVDhFKX0F8:vdUrtU8lYhh7qeoU5VxKNKA
TLSH	T1715130CB15CA97F0DDA599D171F948046CC2F697A4D3DE42E9E824A88C8ED8072D1EC9
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://158.94.210.88//Yboats.x86	551d4e941a5e0687c830d3d62b342f58081d9da51bbb1e0bdaac84b22afa9349	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.mips	025b91b0113ab068d7465001b42aff05895b521a0f69e4398493be6fc7771cd0	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.mpsl	0736885e677bd68b361aea496c36c7035f04a1ba48520f6e11bdf791906dca2e	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.arm	9e5161c87467747f187a6a2187bfced7c879ce172f86b4a8e6fb601e2b239b5f	Mirai	elf gafgyt mirai ua-wget
http://158.94.210.88//Yboats.arm5	66f8c92f52b3624d772aab0a43ee237f0d80e69f4c058f8e0a7eaefb92d0f54c	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.arm6	9a598c801604aacb47b2cddd1ea34849174777eccafb43f0a713a61072c45aa5	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.arm7	a8a1552be0e3cb87561624788c2ef3898812465ddd432337893d4bed75133f71	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.ppc	4f36c02269bd197c493c0a51a7358377d1f2b6b69167db60dbbb231802585e2c	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.m68k	64d6b4663f85c86d68de53d3be0b964468cbb3ac83e04e24be8485168616844a	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.spc	bcee999cac8f6fb61ccc6eaa4d6ab7b046f1c47de8accae3226e1f057d58680a	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.i686	22225ac56d5b1e5cc24ec6a09623d49b9d64148bc88509957687f80d1f5ab6eb	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.sh4	53d5bfedbe9335244088648533751e5260a82bb8359a8cd7540a76b9e880990d	Mirai	elf mirai ua-wget
http://158.94.210.88//Yboats.arc	85e693f744d7d39903d77827ee449b3faee30b092deeb1d9d7391b452444e4f9	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

medusa mirai

Link:

https://www.filescan.io/uploads/692ff2078e26c121ec9538c8/reports/424b2d95-b7a4-4e9e-9615-7a2f098c9fa2/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-03T06:30:00Z UTC

Last seen:

2025-12-03T07:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ace32e96562485d09034c5b8d4dda859e5705092c467d5ffdb9b5296343431f7/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ace32e96562485d09034c5b8d4dda859e5705092c467d5ffdb9b5296343431f7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ace32e96562485d09034c5b8d4dda859e5705092c467d5ffdb9b5296343431f7/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-12-03 08:17:14 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vtrs5fswesc5bebuyw4njxnilhsxauesyrt5l763tnjjmnbugh3q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251203-j6s7psgr9t/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

File and Directory Permissions Modification

Executes dropped EXE

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ace32e965624/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/ace32e96562485d09034c5b8d4dda859e5705092c467d5ffdb9b5296343431f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.