MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0f5b14f4fd2edd83f1a074e26854cefe590cb8afc8af40c75cd44edcbfcb593. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	b0f5b14f4fd2edd83f1a074e26854cefe590cb8afc8af40c75cd44edcbfcb593
SHA3-384 hash:	faf08df0b5a4d71932aa8b086e5138f5ea53605c9f3e1f84d1e4419724c5b02fde9ab4892d6ff17da8f1bd67fcbccdf3
SHA1 hash:	ae5d65c9a5ae9a17067f72be5c6607337784a79c
MD5 hash:	d8fb910778b3982101416da23cb4a722
humanhash:	beer-juliet-robert-ack
File name:	poc.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'047 bytes
First seen:	2025-05-11 20:32:55 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:wp/R5/RCLp/Rm/RRrp/R7/RYRp/Rs/Rz7p/W/Rp/KO/Krp/z/UD5p/o/K2p/k/xd:wFR1RCLFRURRrFRbRYRFR+Rz7FkRFL+i
TLSH	T14641048522925772ACE9DA573175CC0C7061B99B66F92F06D8CC64E4C0DDD48B263FF2
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.141.210/navo.arm	c3c2ed4c2a13f3244b9ad4f21816703bb5bddb7aa8505888c838c2a7eece9dbe	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.arm5	fa7577577f7cee474d3276a04db1543b3bdb1bba1ca7a05262f67588360ee077	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.arm6	cdd280215ecf04e93af5a7bb70005d71bf860a52bff3e691135d585eff09bcc5	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.arm7	d338e32bb255f02484b9a24117a0cc0fbc151eed3bb690a83b14f015dd757811	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.mips	d06165b8132be657be9e85cc65cc5f2d701656d9ed3f0250defc4d0746c7927b	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.mpsl	741ba2d53d54dc42195da1268d8680ab395f74d79bb90710910d9d597fc7b152	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.x86	bdb702657db4a6fb1616b42e6a2cd457a76e48e866edeea479be35711b518447	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.ppc	db3d12a2e4ebbffe25f4088c934f8d51feb3b50c435086bbe80459edf5d8e2c7	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.sh4	c89055af96171ca11e02cda5da78991bc1d496ce0f15df3d9709fc52e7cebd20	Mirai	elf mirai ua-wget
http://176.65.141.210/navo.m68k	17d4ee1b8bac608dc2e6333a73a145509392fc65f2700c327405033a6f352bdf	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

161

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68210b72e16384d6a7039aa7linux22vpnfull_triage

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bash evasive lolbin mirai remote

Link:

https://www.filescan.io/uploads/682109810b64e174c421ef38/reports/bccfc7db-4ef8-4932-8908-ea7b6b3f5620/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b0f5b14f4fd2edd83f1a074e26854cefe590cb8afc8af40c75cd44edcbfcb593

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b0f5b14f4fd2edd83f1a074e26854cefe590cb8afc8af40c75cd44edcbfcb593/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-05-11 20:33:13 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wd23ct2p2lw5qpy2a5hcnbkm57szbs4k7sfpiddvzvco3s74wwjq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250511-zbyfyagr5t/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b0f5b14f4fd2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b0f5b14f4fd2edd83f1a074e26854cefe590cb8afc8af40c75cd44edcbfcb593

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.