MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7d07b5cc7e45c5130af5037c7c4cf8db1ba9c0d48b405c43f8ee93af2d91efb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7d07b5cc7e45c5130af5037c7c4cf8db1ba9c0d48b405c43f8ee93af2d91efb
SHA3-384 hash: d193f80d0c6f142c650affcc4b6fa3135ccc10d3ca99ffd2930ef6a8347044804d7ba65e0c7989bae796667fc5d90275
SHA1 hash: 3723a33ce0ea3aa73d8f8993892c9cbb1d3a70fb
MD5 hash: fcba0d1e76d270cba30c0e942882d896
humanhash: jupiter-river-oregon-paris
File name:weed
Download: download sample
Signature Mirai
Create hunting rule
File size:4'621 bytes
First seen:2025-01-25 13:31:51 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:1xyrDLxvcXgi5qHnzVLgbkLr7OLHXnUB6q68OoDCJqTFv:Gzi5qHnzV8bkL3Oy/TFv
TLSH T1C891229A3DB14F320D91EF96F231C571F56AD08144A08F99A4AF30FCB9BFE48A11055B
Magika shell
Reporter abuse_ch
Tags:Hailbot sh
URLMalware sample (SHA256 hash)SignatureTags
http://185.225.17.58/mips3609f8f3d45d41da70c11fc558eb7e37b6cae17d88c0179a4473d9991dad23cc Miraiddos elf mirai
http://185.225.17.58/mpsl647723492da9410480ea3337ea11c5e39d360305dea6a09eb661cce35b9a8b7e Gafgytddos elf gafgyt mirai
http://185.225.17.58/x86bbbd8da54939b309d5355cb37e5e526d0fd504634fe8e17d5b6a79635a951028 Gafgytddos elf gafgyt mirai
http://185.225.17.58/arm4b4ab364f43de425342f4aca0f4b1986fcc8e88be840a4be9c4bd4fff3ea7ac57 Miraiddos elf mirai
http://185.225.17.58/arm5f641c646b09a47bce17d7c55b7323bb67bf16c151269d125f9615455955ab201 Miraiddos elf mirai
http://185.225.17.58/arm61200075da17d87d7748d66dde17eceb0f75fb2a2a491da622db0cdd3a61077a1 Miraiddos elf mirai
http://185.225.17.58/arm71473bb781c7add63f1a618d9a1a3ae5ab9fc8e58d3c734fd0eea422ff7436b70 Miraibash curl ftp mirai tftp wget
ftp://5.225.17.58:8021/mipsn/an/an/a
ftp://5.225.17.58:8021/mpsln/an/an/a
ftp://5.225.17.58:8021/x86n/an/an/a
ftp://5.225.17.58:8021/arm4n/an/an/a
ftp://5.225.17.58:8021/arm5n/an/an/a
ftp://5.225.17.58:8021/arm7n/an/an/a
ftp://5.225.17.58:8021/arm6n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67951c84bb54c6545300fe1elinux22vpnfull_triage
Tags:
trojan agent hype
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
busybox expand lolbin remote
Link:
https://www.filescan.io/uploads/6794e7d385aac483f387c367/reports/d208838d-fb4e-4929-86b9-beebe415a133/overview
Verdict:
Malicious
Labled as:
Linux.Medusa.C.Generic
Link:
https://www.hybrid-analysis.com/sample/b7d07b5cc7e45c5130af5037c7c4cf8db1ba9c0d48b405c43f8ee93af2d91efb
Result
Verdict:
MALICIOUS
Score:
57%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/b7d07b5cc7e45c5130af5037c7c4cf8db1ba9c0d48b405c43f8ee93af2d91efb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b7d07b5cc7e45c5130af5037c7c4cf8db1ba9c0d48b405c43f8ee93af2d91efb/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-01-25 15:10:33 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w7ihwxgh4rofcmfpka34prgprwy3vhanjc2alrb7r3utv4wzd35q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250125-vrdn9atrbp/
Behaviour
Modifies registry class
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b7d07b5cc7e45c5130af5037c7c4cf8db1ba9c0d48b405c43f8ee93af2d91efb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_sh_hailbot
Create hunting rule
Author:abuse.ch
Description:Detects HailBot shell scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh b7d07b5cc7e45c5130af5037c7c4cf8db1ba9c0d48b405c43f8ee93af2d91efb

(this sample)

Mirai

elf 3609f8f3d45d41da70c11fc558eb7e37b6cae17d88c0179a4473d9991dad23cc

  
URLhaus
https://urlhaus.abuse.ch/url/3413508/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d7fcff07b52bf721b7b4f92ced8924f1
  
Dropping
SHA256 3609f8f3d45d41da70c11fc558eb7e37b6cae17d88c0179a4473d9991dad23cc

Comments