MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a
SHA3-384 hash:	bf6499f4b7068f903787d259d7ca5538d4a8a0bf7c2fad855f350e38a5477335058d0e1662c73002e7f64bac77bf36d6
SHA1 hash:	2b541548c2a999d3506aa9118f9a1ca5cd149699
MD5 hash:	43c207338f205fa18d4f858a277a52c6
humanhash:	delaware-high-sweet-alpha
File name:	test.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	5'808 bytes
First seen:	2025-12-13 23:55:54 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:2OiijM3L6DV9ArPtUzkB1ByV/Vs8DybrFl562Z:riiVqT0AbrFlH
TLSH	T1E7C1C8E5BBF261B03C645C366479404478A3A8BE51C57EA63CDC39E2C08DE6831A17FB
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://netrip.ddns.net/systemcl/arc	fb73d8b20485136882c270df6fc64b7499dd9af4c1361bb8893f6ff827e8926d	Mirai	bashlite elf mirai morte opendir stopmalwareservice
http://netrip.ddns.net/systemcl/arm	0ebf87b4e6f9225a6062947618de49be2a4cdb146e9b68c07056d2fa0c91f16b	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm5	dfd8a925739e4df860e83995e0625d562ec32ab5f7b338b204a30939b2019f3e	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm6	ad083a1f9186ffc38fbd148fe515812a7ccc82f410ac74ed6ac7fbd88f135ac3	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm7	fa67b277479419302ccc82d5862c7c47723de5185f5798c3f21befbc0e26af9f	Mirai	elf mirai
http://netrip.ddns.net/systemcl/i486	n/a	n/a	elf ua-wget
http://netrip.ddns.net/systemcl/m68k	3c4697891ad492001f880868fe557f2b1b4627ec60a2058e6ffa57bd5934243c	Mirai	elf mirai
http://netrip.ddns.net/systemcl/mips	a4d03d28364c3c527fb20f3cf9984f78abaef31182f25e106cf7bffb2094cdef	Mirai	elf mirai
http://netrip.ddns.net/systemcl/mpsl	e5fa9517ae35e916913e60115a385e0173239103f707688804b299ddf5c3ec36	Mirai	elf mirai
http://netrip.ddns.net/systemcl/ppc	9e74dc5377747bdd06bd70cbcb4325e0218a8dd31f66dcccfa41069b7a11ca00	Mirai	elf mirai
http://netrip.ddns.net/systemcl/ppc440	n/a	n/a	elf ua-wget
http://netrip.ddns.net/systemcl/sh4	n/a	n/a	n/a
http://netrip.ddns.net/systemcl/spc	n/a	n/a	n/a
http://netrip.ddns.net/systemcl/x86	b1eca05ac8f0dca29557632c95eab45b6cdedd3a594cc28c6d94ce8f7ef37bba	Mirai	elf mirai
http://netrip.ddns.net/systemcl/x86_64	27968814839edb77bd46fe35bb64115b75985e9069a045b86f1dd73ade0d2de6	Mirai	elf mirai
http://netrip.ddns.net/systemcl/x86_32	60246e66a15265caf6b8d57f52e17f1f58f33498944d18dede0b91b8d4ebd087	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-7.UNOFFICIAL

Sanesecurity.Malware.32160.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/693dfd181eac7b9b76a91df8/reports/0c5c881f-d589-48d4-9220-1dc0df77247e/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-13T21:02:00Z UTC

Last seen:

2025-12-13T21:30:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/1e385c43-95c3-4f4f-9d17-bbb04515dc8f

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-12-13 23:56:07 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wblpeaumu5qw2ofxfpdcxyyk7xyudcr7thda5a4u62dtydv5grna._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251213-3y5ejstqbt/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads process memory

UPX packed file

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Traces itself

Mirai

Mirai family

Malware Config

C2 Extraction:

ahahahahahajs.unproxy.st

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.92

Link:

https://yomi.yoroi.company/submissions/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.