MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae9bc27d53679248d34adfc5e9e601c1f2fe23b7968fa6a29324a8dfbaa3a746. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	ae9bc27d53679248d34adfc5e9e601c1f2fe23b7968fa6a29324a8dfbaa3a746
SHA3-384 hash:	4df308d4d6a07f0b926ca353577a683a224ce89dba6ff6ea36cab27f2ec45e40711167ce4b750ef0de27cb8f3d409d2e
SHA1 hash:	96f61fba53fab583c3740fe5110412e3c792691e
MD5 hash:	83d2f78700c4f15459b42308e8130c1d
humanhash:	indigo-four-maryland-east
File name:	GuruITDDoS3.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'107 bytes
First seen:	2025-02-25 18:32:52 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vI5+X3I8Y3IV1+3I123Iug3Ix23IY03I8i3If23Iga3ID23IHG3I2x:vZX3a3x393I3n3W3u3x36373z3h
TLSH	T178510585322D4174BEA645926D7B012FBA84C065A4CF2D0197DC68E2EBADD8FFD43DC2
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://107.189.31.150/GuruITDDoS/RpcSecurity.x86	cc0d2187e8a958986bfe86d30ae30fc3c1fa418e5c8b6ed948adc85174e09c8c	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.mips	cc0d2187e8a958986bfe86d30ae30fc3c1fa418e5c8b6ed948adc85174e09c8c	Mirai	bash curl elf wget
http://107.189.31.150/GuruITDDoS/RpcSecurity.mpsl	98f9724f7811a80d2488626b84dc7dd7a9368422249dc68fa5bfa8a54864d6b0	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.arm	0e020f7814a832c3bc5e1d413285fd5a3d5ab089d2b9d3b616c885893d4ce648	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.arm5	3ce56b7dfbbbca091a12381a7299fa7d34d6d80c6e2dc83e4d6f7e1b3b377da5	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.arm6	1b5aa74abb1a7b06835f1391c20cd911c2c41aa9e766e5bf29e3275ada8bef5e	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.arm7	75980b2ddfc50e722ae8a1fcb01c19b599195af2dcc06f6b0649cd74023af0ed	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.ppc	fd7ab428e75259a190bae7e96006eff573baeb56592bdfede526c096e661ca8d	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.m68k	b571066bd8bc4c85e1aee978687ce55c4199378ef8ca8715c4668e448aa2be36	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.sh4	2b0e08eb77ad61ab0c9b81595b046713194715ebe19f3b7519c5aba54e10e01e	Mirai	elf mirai
http://107.189.31.150/GuruITDDoS/RpcSecurity.spc	2b0e08eb77ad61ab0c9b81595b046713194715ebe19f3b7519c5aba54e10e01e	Mirai	bash curl elf wget
http://107.189.31.150/GuruITDDoS/RpcSecurity.arc	2b0e08eb77ad61ab0c9b81595b046713194715ebe19f3b7519c5aba54e10e01e	Mirai	bash curl elf wget
http://107.189.31.150/GuruITDDoS/RpcSecurity.x86_64	2b0e08eb77ad61ab0c9b81595b046713194715ebe19f3b7519c5aba54e10e01e	Mirai	bash curl elf wget

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67be0d2ba0fd713c335cc019linux22vpnfull_triage

Tags:

downloader shellcode agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/67be0ce760f4b4f0724c59f2/reports/4e3eee9f-30a2-4fe0-944d-d85fb6061e8d/overview

Result

Verdict:

MALICIOUS

Score:

15%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/ae9bc27d53679248d34adfc5e9e601c1f2fe23b7968fa6a29324a8dfbaa3a746

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ae9bc27d53679248d34adfc5e9e601c1f2fe23b7968fa6a29324a8dfbaa3a746/

Threat name:

Win32.Trojan.Mirai

Status:

Malicious

First seen:

2025-02-25 18:33:11 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v2n4e7ktm6jeru2k37c6tzqbyhzp4i5xs2h2niutesun7ovdu5da._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:demons antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250225-w68cva1jx6/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Mirai

Mirai family

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ae9bc27d5367/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/ae9bc27d53679248d34adfc5e9e601c1f2fe23b7968fa6a29324a8dfbaa3a746

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.