MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a
SHA3-384 hash:	bf6499f4b7068f903787d259d7ca5538d4a8a0bf7c2fad855f350e38a5477335058d0e1662c73002e7f64bac77bf36d6
SHA1 hash:	2b541548c2a999d3506aa9118f9a1ca5cd149699
MD5 hash:	43c207338f205fa18d4f858a277a52c6
humanhash:	delaware-high-sweet-alpha
File name:	test.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	5'808 bytes
First seen:	2025-12-13 23:55:54 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:2OiijM3L6DV9ArPtUzkB1ByV/Vs8DybrFl562Z:riiVqT0AbrFlH
TLSH	T1E7C1C8E5BBF261B03C645C366479404478A3A8BE51C57EA63CDC39E2C08DE6831A17FB
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://netrip.ddns.net/systemcl/arc	1078f2fef9abdeda64bb97bd4c1e4ba9a6c8ee74a13eb8f29853b27ea5abd844	Mirai	bashlite elf mirai morte opendir stopmalwareservice
http://netrip.ddns.net/systemcl/arm	be58a44667b375703a76ad0c6ddca15d16aee9717d125919f20dce30763cc00e	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm5	58979f8f088f4a7ccb290972f63908b9f2aed2745965edec68713c3cd48288dd	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm6	cda60790407bccd1f7e11f6b1ec2f299a5348392a1abfdfddaeae28e42bd284f	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm7	169aa77dbeeb8bfa7ad7749eec142c66c0612b71cf1d4197bbd1b9a11784e094	Mirai	elf mirai
http://netrip.ddns.net/systemcl/i486	n/a	n/a	elf ua-wget
http://netrip.ddns.net/systemcl/m68k	ee69d2f047fb8bd98d96d1ff4fb41f5dbea8aa91d81b60819542c8de7eb80a62	Mirai	elf mirai
http://netrip.ddns.net/systemcl/mips	b38cac7dcd0b2f68f15499113658d15987de22ba225cea00a14e95a885adec75	Mirai	elf mirai
http://netrip.ddns.net/systemcl/mpsl	6bcd18e09bdddc9823c1ebc6090640ed723eddb8d214958ee99d607da2e6d86b	Mirai	elf mirai
http://netrip.ddns.net/systemcl/ppc	55bdaa3a8a9608985b07865783259092d37736f52066f94df42f2a4c9820b026	Mirai	elf mirai
http://netrip.ddns.net/systemcl/ppc440	n/a	n/a	elf ua-wget
http://netrip.ddns.net/systemcl/sh4	n/a	n/a	n/a
http://netrip.ddns.net/systemcl/spc	n/a	n/a	n/a
http://netrip.ddns.net/systemcl/x86	5b1f2a4aae9074691cb6f36abffe7c155844f670b8fcf1c9106ca60201217bf3	Mirai	elf mirai
http://netrip.ddns.net/systemcl/x86_64	970d48b9edbe3f7877701b695eec9e47f7f64409a951de973b4e40e72e0da785	Mirai	elf mirai
http://netrip.ddns.net/systemcl/x86_32	093a123021a37f13d2af22b359fcbc683d18e2aa5873d897001b4a6a524c45be	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-7.UNOFFICIAL

Sanesecurity.Malware.32160.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/693dfd181eac7b9b76a91df8/reports/0c5c881f-d589-48d4-9220-1dc0df77247e/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-13T21:02:00Z UTC

Last seen:

2025-12-13T21:30:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/1e385c43-95c3-4f4f-9d17-bbb04515dc8f

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a

Threat name:

Linux.Backdoor.Mirai

Status:

Malicious

First seen:

2025-12-13 23:56:07 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wblpeaumu5qw2ofxfpdcxyyk7xyudcr7thda5a4u62dtydv5grna._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251213-3y5ejstqbt/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads process memory

UPX packed file

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Traces itself

Mirai

Mirai family

Malware Config

C2 Extraction:

ahahahahahajs.unproxy.st

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.92

Link:

https://yomi.yoroi.company/submissions/b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.