MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad8dc63bf6a91bf6f0220c59bd6fd6c754c344ae9f1b15aa4ecc875d3a60827f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	ad8dc63bf6a91bf6f0220c59bd6fd6c754c344ae9f1b15aa4ecc875d3a60827f
SHA3-384 hash:	06c122bd90713f6e8d165026d2c7bba440418cdc8c169bcf5a793d2d8c3401b58c84e75d51f16ef9a0508b8779b2e3f6
SHA1 hash:	bfc8e882d58076d2993aa8c4531fe8c90543e275
MD5 hash:	535f981323353419b58fc06f6afd5bda
humanhash:	kansas-fillet-fish-zulu
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'933 bytes
First seen:	2025-10-28 16:39:42 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:pJk4942JMvRxRbiBTtituZLsEcsEnE2EhEmHnscicbwGukYEvxvJUfTbYb9bhM3S:FS2JMZnbiBxQuZ44cvyZpbwYFhM3S
TLSH	T1DE516D9E0200DB31D70C8A5FF7F2B1B4A10FA183E6EBCF46A950186C0EC9D4CB686E51
Magika	txt
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnaarch64xnxn	n/a	n/a	elf ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxni386xnxn	n/a	n/a	elf ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	8baceab3c5fc2c2f0a922f885af62a5d04d55c2417881308252f80f89e7c41ad	Mirai	elf mirai ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnm68kxnxn	0d5f90b844bf0664e51af4ab6849902b124a9b358540dc475e12be709ea45e6d	Mirai	elf mirai ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	4ee68a0324780ca8d6d5c84508e888f5e5275622239a40126da8f326bf907ceb	Mirai	elf mirai ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnmipsxnxn	n/a	n/a	elf ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnor1kxnxn	5e5684195b4195fb3213ded585f3d739936d45b6ea088aa774c7fbdad867b923	Mirai	elf mirai ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	n/a	n/a	elf ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnriscv32xnxn	aa6ddb30d15ce6c0a83afbe6dd9a560e1e5d9fd48bf3a86cac2e7b89be4d4115	Mirai	elf mirai ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnriscv64xnxn	d078a3e7322a77f9a9eb36622e3e19ee75fa6725c6309c2d486460085687cd42	Mirai	elf mirai ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnsh2xnxn	2a344233a93dd8f98b6797e4aa5ed6f21d2360972d150bd268537a3881dc74f0	Mirai	elf mirai ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnsh4xnxn	57a118c474cdb8c7fefb7995a14db626ad4ef30aabbe0180422c6761e8e355fa	Mirai	elf mirai ua-wget
http://196.251.115.216/bins/xnxnxnxnxnxnxnxnx86_64xnxn	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/ad8dc63bf6a91bf6f0220c59bd6fd6c754c344ae9f1b15aa4ecc875d3a60827f/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/4cf43f13-0abe-4296-b847-f19a4e5b4be6

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ad8dc63bf6a91bf6f0220c59bd6fd6c754c344ae9f1b15aa4ecc875d3a60827f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ad8dc63bf6a91bf6f0220c59bd6fd6c754c344ae9f1b15aa4ecc875d3a60827f/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2025-10-28 16:40:54 UTC

File Type:

Text (Shell)

AV detection:

7 of 24 (29.17%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vwg4mo7wven7n4bcbrm3236wy5kmgrfot4nrlksozsdv2otaqj7q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251028-t61xnaak2w/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ad8dc63bf6a91bf6f0220c59bd6fd6c754c344ae9f1b15aa4ecc875d3a60827f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.