MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7df459800fa43d17acbc1a8f78d32dcb753e8279c9c351b0793bfaeb18d5ade. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	b7df459800fa43d17acbc1a8f78d32dcb753e8279c9c351b0793bfaeb18d5ade
SHA3-384 hash:	72c78be6de961bd08d7bc71fcd7605fe89adc33f5f6f45fae0a1b7ba80673ee0b98fc6151025ae54b4797747c66db1e9
SHA1 hash:	ed546bbe5a73b2641363845ebd095ae909d34cf3
MD5 hash:	980eedc8be2a094748f13e4269503b12
humanhash:	texas-four-angel-eleven
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'197 bytes
First seen:	2025-06-25 19:10:50 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:tDbfRDjJrDDDCF8DNfDNKDhDNbDNBXDN7DNJMDQGDOXD3DtDLDZtc4ZDhDmZnRD+:dXJUDNHtJx64mZIF1UsjGs
TLSH	T1234119CD5ED18B13CBCCCE85F160C2967C694D86A6A3CF989C9B1CA4486D808303B797
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://106.248.251.189:22970/x86_64	a72ee92a97daf5ef9cc221ec5863be80e1ba89bfe8d037ef9da3e51aa7457b7e	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/aarch64	c3606a38dc492dd447c7a12e6a56c12e93c6d8c3e31fb0a4cbeb1e7b8f662ddf	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/m68k	c72013b046b2d2c5c3b96347bd3174c8a7f1e64fd72efdcbdc91c0717f2bfcf1	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/mips	2a09f99f8bdeb093b0553f1d9b946894e7603c0a2237630cd0c5594e034a69dd	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/mipsel	e7a168b0adc04d60d076edc9efe2be06d7790f1c37c9b0f313c0e6fecafaf726	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/powerpc	7133391d2afb2ba104c3f7b6e3420ca341a52531b3ee62e64ea1a1c732f8c55d	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/sparc	7418939311768be639b3ab2fd50c84816649c14d338e3b7e29af0c4c9f8b2b44	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/sh4	8f76a5f963b9991f350d8c0f4c714253bd07a797a3476c7b6dc097a57c181641	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/arc	0a4e9303a9f9b28bd61cec449a01c5a7f9e373255983cc89a18cdf625220dff6	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/csky	0a17e204ab1a716b0d03020e98d1d92fb0315da992d526543b2ad39d843a782c	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/i486	afbedf07e67976de1305ad7cac2cab0db1eab33ad9a790c7158cd82b44bbe3c0	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/armv4l	3e47a2b97201434bc4607a33db6b88a0cde0f3ded5b8fe01781476c69ffee02e	Mirai	elf gafgyt mirai ua-wget
http://106.248.251.189:22970/armv5l	f8941692367f79d0861d7dbad6d29727d666b319367becc960d4c286b878242a	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/armv6l	bcd3426c205ea35b61022c37dc72ef8261c65c1914ae90d4b66a20e2c9dde76a	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/armv7l	57780dd8711b15c05334df427dffd2072e6612b1e21bbb72e06e351b1fd62f1a	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BV.Downloader-AEH.19901.5410.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685c4aab32ed47a3a8d72610linux22vpnfull_triage

Tags:

mirai agent virus html

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/d4b2972d-11ce-4225-a251-e1b22dca5cf4

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b7df459800fa43d17acbc1a8f78d32dcb753e8279c9c351b0793bfaeb18d5ade

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b7df459800fa43d17acbc1a8f78d32dcb753e8279c9c351b0793bfaeb18d5ade/

Threat name:

Document-HTML.Trojan.Vigorf

Status:

Malicious

First seen:

2025-06-25 19:17:39 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w7pulgaa7jb5c6wlyguppdjs3s3vh2bhtsodkgyhso725mmnllpa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/250625-xzcs2avjw9/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b7df459800fa43d17acbc1a8f78d32dcb753e8279c9c351b0793bfaeb18d5ade

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.