MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b17eeecbaf37d56aaa2ea01f57a214cca6a42ccd8efc3c7cc8033418ce06b97f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	b17eeecbaf37d56aaa2ea01f57a214cca6a42ccd8efc3c7cc8033418ce06b97f
SHA3-384 hash:	daff6410c6f288a4ffa508d4371fb03055c79ec22ae2d7c6530bdb8f772e669c90e400b14166d0926bba49c9256ba259
SHA1 hash:	7de674fe81868f0d90e83adf4dd0adae988a48e3
MD5 hash:	c87c29edca1a82e09b16604a8b157d7d
humanhash:	sodium-black-speaker-utah
File name:	dvr.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'392 bytes
First seen:	2025-12-21 09:31:59 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v0ks1ks7IjksQks7ksQkspksFBLksaksbksOkscfksTksHksZksR:v1sCsvs5sAs5sOsMsLsgsXszs4sEs+sR
TLSH	T18D61848A1115E7392E67C72273B745D972E0E1EAA1C39E4760C878F3A44CD4364A1EDB
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.92.243.68/Fantazy/Fantazy.x86	165e9ae4a6cb930e7560a3e88063642a1e5c356cbd6be7d6545ab1d50f7c1a0b	Mirai	elf geofenced mirai ua-wget USA x86
http://91.92.243.68/Fantazy/Fantazy.mips	0f6b0327fb3d814eab9fb2a7674195a381936da4e4c4dcad7f42553d37dc0b28	Mirai	elf geofenced mips mirai ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.mpsl	f43e3602afc7424afe5aa04e34f5a6603a220696cf9954afc849bd16d17fe54a	Mirai	elf geofenced mips mirai ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.arm	n/a	n/a	elf ua-wget
http://91.92.243.68/Fantazy/Fantazy.arm5	ecc57dad5f28e2f8b0cb3182917d3e985894130c8ad4f640f28dad25a3dd8ccb	Mirai	arm elf geofenced mirai ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.arm6	9b51caf8e94f32dab03ffef1c66022182ce2876bd1ce474721f52c3f336e03fc	Mirai	arm elf geofenced mirai ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.arm7	d0e69826172390416075ecef3feb17d339b41888896f3868f3d206da1a26bf85	Mirai	arm elf geofenced mirai ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.ppc	dc9650fb46972e8461b462ed2e2c9ce6e90157c15743f63f1e977459a7b5bad9	Mirai	elf geofenced mirai PowerPC ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.m68k	de368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1	Mirai	elf geofenced m68k mirai ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.sh4	9e794fdbae88d594f54e5b2c4d568e2d552e14063cb66963b21f78504a248434	Mirai	elf geofenced mirai SuperH ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.spc	aab2354eb4373b0b6ac3b4ffbd9fcace62ec787b473f231f55976594757cbdf5	Mirai	elf geofenced mirai sparc ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.arc	f77b502820be9ed053e789187999efaa986ea391fa4124e765c59f821b32fa7c	Mirai	arc elf geofenced mirai ua-wget USA
http://91.92.243.68/Fantazy/Fantazy.x86_64	8e40e40a596baaa7a901898832a4508f9b0f7ca527ce42fabd80ce01cf8452de	Mirai	elf geofenced mirai ua-wget USA x86
http://91.92.243.68/Fantazy/Fantazy.i686	98ad2cadc594e95381fb98f514b2fcd6d64f6c69e45567438e279cb19d295d8b	Mirai	elf geofenced mirai ua-wget USA x86
http://91.92.243.68/Fantazy/Fantazy.i486	1f2ef3d8b5617798a2edf449e1da32ebe50de3a9f5d72d092a790ffe97c4d983	Mirai	elf geofenced mirai ua-wget USA x86
http://91.92.243.68/Fantazy/Fantazy.i586	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-21T07:14:00Z UTC

Last seen:

2025-12-22T17:07:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/b17eeecbaf37d56aaa2ea01f57a214cca6a42ccd8efc3c7cc8033418ce06b97f/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b03469b6-e838-485f-9e3a-3d85516ecf88

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b17eeecbaf37d56aaa2ea01f57a214cca6a42ccd8efc3c7cc8033418ce06b97f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b17eeecbaf37d56aaa2ea01f57a214cca6a42ccd8efc3c7cc8033418ce06b97f/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/b17eeecbaf37d56aaa2ea01f57a214cca6a42ccd8efc3c7cc8033418ce06b97f

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-12-21 09:33:26 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wf7o5s5pg7kwvkrouapvpiquzstkilgnr36dy7giam2brtqgxf7q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/251221-lhzexstjer/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

Creates a large amount of network flows

Enumerates active TCP sockets

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (12510) amount of remote hosts

Mirai

Mirai family

Malware Config

C2 Extraction:

katana.chernobyl.network

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b17eeecbaf37/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.59

Link:

https://yomi.yoroi.company/submissions/b17eeecbaf37d56aaa2ea01f57a214cca6a42ccd8efc3c7cc8033418ce06b97f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh