MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0a47c2b71332cbb3f7d3237a1bdb32c1a4fd29df5801cbfe4998e41596d3a43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c0a47c2b71332cbb3f7d3237a1bdb32c1a4fd29df5801cbfe4998e41596d3a43
SHA3-384 hash:	b522f9577db018d4ecc55cb16826d7cd92439b25a1ff7f61bfecc0ed1eeed819d23625b285e5f77de17a132b0dd6f312
SHA1 hash:	8e9e0c9cb4506f1eb586830bdb7c3bafb5fde15e
MD5 hash:	c7fe38ae597ea8b5329bedb0f5787050
humanhash:	undress-shade-social-zulu
File name:	dvr.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	874 bytes
First seen:	2025-02-16 20:22:02 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:hQHoQL9QnNIqiQuKxjQ8QTQJ6QzQV1oiQaHQgQP:hQHoQL9QniQuSjQ8QTQJ6QzQHQaHQgQP
TLSH	T1BC1130CEB096E086043ADDDE2159DC0A6014ABD874BD5B39FDE54D3740E95123424BAA
Magika	txt
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

104

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30762.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Shell.Downloader.Gen-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b24a7828ab76d43a5b4dedlinux22vpnfull_triage

Tags:

downloader trojan agent

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c0a47c2b71332cbb3f7d3237a1bdb32c1a4fd29df5801cbfe4998e41596d3a43

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c0a47c2b71332cbb3f7d3237a1bdb32c1a4fd29df5801cbfe4998e41596d3a43/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-16 20:22:39 UTC

File Type:

Text (Shell)

AV detection:

14 of 37 (37.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ycshyk3rgmwlwp35gi32dpntfqne7uu56wabzp7etghecwlnhjbq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery

Link:

https://tria.ge/reports/250216-y5x7laxpdp/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/c0a47c2b71332cbb3f7d3237a1bdb32c1a4fd29df5801cbfe4998e41596d3a43