MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aece834da00023aa3b832d18f8c952871c11cf6e752c469519228fd081252966. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	aece834da00023aa3b832d18f8c952871c11cf6e752c469519228fd081252966
SHA3-384 hash:	37ff3d909fe4da9596ffc1967a5a267e974ab5fbff2b936c357a71b02b9f997204b2467845bd98a027096663069feec1
SHA1 hash:	2f66ce76c3264030c1f477358fc45535d43d036f
MD5 hash:	79a310d30f441a1c65379987235a8cac
humanhash:	may-jersey-chicken-mobile
File name:	l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'074 bytes
First seen:	2025-03-20 11:18:09 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:WhYlri4ZgiiWjimri4iPiMNI7uiFqK2iKtYJKioul:wUiPiiWjiui4iPixuiUdiFJKioG
TLSH	T14A1106FF94591D020458EE8FFA2A84D97037DEBA1117DF84BE8E303D9B989287420B18
Magika	txt
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.209.150.48/mips	f63d863954c84b42cfed487db4101b7f6e15df431ae08c2e331679f50795c66b	Mirai	censys elf mirai
http://213.209.150.48/mpsl	a15bf9dd4d0aad9778ab4380feb71ca2cf314765a78f8dbb5275f1343a9f5b8e	Mirai	censys elf mirai
http://213.209.150.48/arm	33ffeb7f9d5e17ad498d9ca9843e31844d7421e04917b3a9a1475c53c177c05b	Mirai	censys elf mirai
http://213.209.150.48/arm5	c2d51bc86e52742a4d5bfc9541667690c516aaf1d7a4f971f4eee77d79c89076	Mirai	censys elf mirai
http://213.209.150.48/arm6	3a23ff501ce58ec816fa09f77f8b8e9b79934199688f6f8aaf2d8e32caad1435	Mirai	censys elf mirai
http://213.209.150.48/arm7	091b84349ab71754a9f74f93525a054a64b98f17799013df02f2dfb42ce918da	Mirai	censys elf mirai
http://213.209.150.48/sh4	3dc6298bbf1922c1d5c6d34f9a45fa0ce297c5438ec63fdfdcd562b1732ac6ac	Mirai	censys elf mirai
http://213.209.150.48/ppc	41d7eb8d26f4db1c4efaa16ee1c230d3f4760a4c5a4c334c037d4efb1c5fc6a3	Mirai	censys elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67dc01ec115e7b48b48f1943linux22vpnfull_triage

Tags:

medusa mirai agent virus

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

expand lolbin remote

Link:

https://www.filescan.io/uploads/67dbf9adb93e688233f068cc/reports/04b0ca96-69fe-4118-bb59-1c289ed0afd8/overview

Verdict:

Malicious

Labled as:

Linux.Medusa.D.Generic

Link:

https://www.hybrid-analysis.com/sample/aece834da00023aa3b832d18f8c952871c11cf6e752c469519228fd081252966

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/aece834da00023aa3b832d18f8c952871c11cf6e752c469519228fd081252966

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aece834da00023aa3b832d18f8c952871c11cf6e752c469519228fd081252966/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2025-03-20 11:22:02 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v3higtnaaar2uo4dfumprsksq4obdt3oouwenfizekh5bajfffta._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250320-n21s7swls5/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/aece834da00023aa3b832d18f8c952871c11cf6e752c469519228fd081252966

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.