MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c65aabe3268eadb4c3ab7392a2d91e59fa5eab788d9f5aa203efc9f38de32424. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c65aabe3268eadb4c3ab7392a2d91e59fa5eab788d9f5aa203efc9f38de32424
SHA3-384 hash: 84822b09407c57c4067862a9cdc79c496a3d1eee677b829a5396e59df0ffea427652c619df493cf324a51dbe6e55501b
SHA1 hash: da96ed7370c2c0b0aae3cf8960319665eabf8f0d
MD5 hash: 47b99ac3bd3e8fbff0cfc699c06adebd
humanhash: ink-quebec-nitrogen-red
File name:avtech.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:800 bytes
First seen:2025-09-24 16:55:32 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 12:dZoJ2egeKNWKDbnPZM5ZMoOF7+MB05+XLdOkXLdNDNkfXLNvkXLNMDNkfXLWyTk8:E22IbO5zOt+MB0CJZkTNaNmkTq2kq
TLSH T13B0122CE01B1AC3258C10DDF35538D19A9CBC5E91EC68E88608A443BF8CDD18F272FA9
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://194.31.222.17/v/armv4le333d6098ba7af114b4e8b290f0e587592067b8e153798bf4763262d2074ad96 Miraiarm elf geofenced mirai ua-wget USA
http://194.31.222.17/v/armv5l79d810e67c7bd6c6669214c1c4b631829d90726886b4167a232813d8434ef3f7 Miraiarm elf geofenced mirai ua-wget USA
http://194.31.222.17/v/armv7lc3788d92bfc3a08dbcca4476832c46b099bcad182c56cdbccf837eb0edb6cd77 Miraiarm elf geofenced mirai ua-wget USA

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32150.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox
Link:
https://www.filescan.io/uploads/68d4233f74e5a28989916833/reports/7ae2e89d-d1e1-4161-9d6c-85f52d9eb1a5/overview
Verdict:
Malicious
File Type:
ps1
First seen:
2025-09-24T15:07:00Z UTC
Last seen:
2025-09-24T15:07:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p
Link:
https://opentip.kaspersky.com/c65aabe3268eadb4c3ab7392a2d91e59fa5eab788d9f5aa203efc9f38de32424/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b42460e2-2025-4fd7-a369-c865dd8b814a
Behavior Graph:
Download SVG
%3 guuid=7cf56828-1a00-0000-6e58-a6da510b0000 pid=2897 /usr/bin/sudo guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903 /tmp/sample.bin guuid=7cf56828-1a00-0000-6e58-a6da510b0000 pid=2897->guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903 execve guuid=c10fe02a-1a00-0000-6e58-a6da580b0000 pid=2904 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=c10fe02a-1a00-0000-6e58-a6da580b0000 pid=2904 clone guuid=ca2edf2b-1a00-0000-6e58-a6da610b0000 pid=2913 /usr/bin/rm delete-file guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=ca2edf2b-1a00-0000-6e58-a6da610b0000 pid=2913 execve guuid=61371b2c-1a00-0000-6e58-a6da620b0000 pid=2914 /usr/bin/rm delete-file guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=61371b2c-1a00-0000-6e58-a6da620b0000 pid=2914 execve guuid=137e652c-1a00-0000-6e58-a6da630b0000 pid=2915 /usr/bin/rm delete-file guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=137e652c-1a00-0000-6e58-a6da630b0000 pid=2915 execve guuid=3186b92c-1a00-0000-6e58-a6da640b0000 pid=2916 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=3186b92c-1a00-0000-6e58-a6da640b0000 pid=2916 clone guuid=c881932d-1a00-0000-6e58-a6da660b0000 pid=2918 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=c881932d-1a00-0000-6e58-a6da660b0000 pid=2918 clone guuid=5aeddd2d-1a00-0000-6e58-a6da690b0000 pid=2921 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=5aeddd2d-1a00-0000-6e58-a6da690b0000 pid=2921 clone guuid=af688039-1a00-0000-6e58-a6da7b0b0000 pid=2939 /usr/bin/chmod guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=af688039-1a00-0000-6e58-a6da7b0b0000 pid=2939 execve guuid=5bd42c3a-1a00-0000-6e58-a6da7d0b0000 pid=2941 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=5bd42c3a-1a00-0000-6e58-a6da7d0b0000 pid=2941 clone guuid=06952f3c-1a00-0000-6e58-a6da820b0000 pid=2946 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=06952f3c-1a00-0000-6e58-a6da820b0000 pid=2946 clone guuid=040ed146-1a00-0000-6e58-a6da970b0000 pid=2967 /usr/bin/chmod guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=040ed146-1a00-0000-6e58-a6da970b0000 pid=2967 execve guuid=ba051c47-1a00-0000-6e58-a6da980b0000 pid=2968 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=ba051c47-1a00-0000-6e58-a6da980b0000 pid=2968 clone guuid=0437c547-1a00-0000-6e58-a6da9b0b0000 pid=2971 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=0437c547-1a00-0000-6e58-a6da9b0b0000 pid=2971 clone guuid=0837dd52-1a00-0000-6e58-a6dab40b0000 pid=2996 /usr/bin/chmod guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=0837dd52-1a00-0000-6e58-a6dab40b0000 pid=2996 execve guuid=665f3253-1a00-0000-6e58-a6dab50b0000 pid=2997 /usr/bin/dash guuid=2b1d922a-1a00-0000-6e58-a6da570b0000 pid=2903->guuid=665f3253-1a00-0000-6e58-a6dab50b0000 pid=2997 clone guuid=13eef72a-1a00-0000-6e58-a6da5a0b0000 pid=2906 /usr/bin/cat guuid=c10fe02a-1a00-0000-6e58-a6da580b0000 pid=2904->guuid=13eef72a-1a00-0000-6e58-a6da5a0b0000 pid=2906 execve guuid=fce4fd2a-1a00-0000-6e58-a6da5b0b0000 pid=2907 /usr/bin/grep guuid=c10fe02a-1a00-0000-6e58-a6da580b0000 pid=2904->guuid=fce4fd2a-1a00-0000-6e58-a6da5b0b0000 pid=2907 execve guuid=0574082b-1a00-0000-6e58-a6da5c0b0000 pid=2908 /usr/bin/grep guuid=c10fe02a-1a00-0000-6e58-a6da580b0000 pid=2904->guuid=0574082b-1a00-0000-6e58-a6da5c0b0000 pid=2908 execve guuid=0d8f122b-1a00-0000-6e58-a6da5d0b0000 pid=2909 /usr/bin/grep guuid=c10fe02a-1a00-0000-6e58-a6da580b0000 pid=2904->guuid=0d8f122b-1a00-0000-6e58-a6da5d0b0000 pid=2909 execve guuid=ca3d282b-1a00-0000-6e58-a6da5e0b0000 pid=2910 /usr/bin/cut guuid=c10fe02a-1a00-0000-6e58-a6da580b0000 pid=2904->guuid=ca3d282b-1a00-0000-6e58-a6da5e0b0000 pid=2910 execve guuid=8969c82c-1a00-0000-6e58-a6da650b0000 pid=2917 /usr/bin/cp write-file guuid=3186b92c-1a00-0000-6e58-a6da640b0000 pid=2916->guuid=8969c82c-1a00-0000-6e58-a6da650b0000 pid=2917 execve guuid=8e6f9c2d-1a00-0000-6e58-a6da670b0000 pid=2919 /usr/bin/chmod guuid=c881932d-1a00-0000-6e58-a6da660b0000 pid=2918->guuid=8e6f9c2d-1a00-0000-6e58-a6da670b0000 pid=2919 execve guuid=9bd7e52d-1a00-0000-6e58-a6da6a0b0000 pid=2922 /usr/bin/wget net send-data write-file guuid=5aeddd2d-1a00-0000-6e58-a6da690b0000 pid=2921->guuid=9bd7e52d-1a00-0000-6e58-a6da6a0b0000 pid=2922 execve 287749b9-1937-53b1-8818-44b73ae22708 194.31.222.17:80 guuid=9bd7e52d-1a00-0000-6e58-a6da6a0b0000 pid=2922->287749b9-1937-53b1-8818-44b73ae22708 send: 136B guuid=84403d3c-1a00-0000-6e58-a6da830b0000 pid=2947 /usr/bin/wget net send-data write-file guuid=06952f3c-1a00-0000-6e58-a6da820b0000 pid=2946->guuid=84403d3c-1a00-0000-6e58-a6da830b0000 pid=2947 execve guuid=84403d3c-1a00-0000-6e58-a6da830b0000 pid=2947->287749b9-1937-53b1-8818-44b73ae22708 send: 136B guuid=fc19d047-1a00-0000-6e58-a6da9c0b0000 pid=2972 /usr/bin/wget net send-data write-file guuid=0437c547-1a00-0000-6e58-a6da9b0b0000 pid=2971->guuid=fc19d047-1a00-0000-6e58-a6da9c0b0000 pid=2972 execve guuid=fc19d047-1a00-0000-6e58-a6da9c0b0000 pid=2972->287749b9-1937-53b1-8818-44b73ae22708 send: 136B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c65aabe3268eadb4c3ab7392a2d91e59fa5eab788d9f5aa203efc9f38de32424
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c65aabe3268eadb4c3ab7392a2d91e59fa5eab788d9f5aa203efc9f38de32424/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/c65aabe3268eadb4c3ab7392a2d91e59fa5eab788d9f5aa203efc9f38de32424
Threat name:
Script-Shell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-09-23 07:15:54 UTC
File Type:
Text (Shell)
AV detection:
8 of 24 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yznkxyzgr2w3jq5loojkfwi6lh5f5k3yrwpvviqd57e7hdpdeqsa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250924-vf2xpsxkv7/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c65aabe3268eadb4c3ab7392a2d91e59fa5eab788d9f5aa203efc9f38de32424

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh c65aabe3268eadb4c3ab7392a2d91e59fa5eab788d9f5aa203efc9f38de32424

(this sample)

Mirai

elf e333d6098ba7af114b4e8b290f0e587592067b8e153798bf4763262d2074ad96

  
URLhaus
https://urlhaus.abuse.ch/url/3631155/
  
Delivery method
Distributed via web download
  
Dropping
MD5 f79e16a572b31fd90195274c2a38baf7
  
Dropping
SHA256 e333d6098ba7af114b4e8b290f0e587592067b8e153798bf4763262d2074ad96
  
URLhaus
https://urlhaus.abuse.ch/url/3631165/

Comments