MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c71b8d66ac2f86177e48df856681cfb53528f1613ca1dae67593a705d7e0ad19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c71b8d66ac2f86177e48df856681cfb53528f1613ca1dae67593a705d7e0ad19
SHA3-384 hash:	b34ca11e1ebaeb10b3c7e0643191699603eb07da77ed11e05db3bcb271ced38bde6c6f70dc2e37b9d919622c2dad2d89
SHA1 hash:	b8b633904ec83acf87ed95d021e7cf7c3f1859ad
MD5 hash:	578dc2a186a37626d81019896752c4d9
humanhash:	charlie-washington-connecticut-sink
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'608 bytes
First seen:	2025-01-04 04:06:48 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:GLkuj6oqLy+uQZXlLlxM+uMGYfLt2uMmh8LOuMuCvLC+uMD5lLoRuEuOUuL12uyE:s7ovVAXGtdh+8j55VPogx9jspF+iiv4d
TLSH	T11C31CEC56AE2067A2CD1AD8B726BCC5D310B7E8E29C68F9968DE30F6548DD44B580B13
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.188.254.21/Kloki.mpsl	eb3e694a5a22497585690a3c97acfdf0d6788968538cd0a05dc30fe3599aa79b	Mirai	elf mirai
http://91.188.254.21/Kloki.mips	37e1cf2f265d16edcfec29c618de091d35b61233e8d2eb8a9baa42ae3c08c45e	Mirai	elf mirai
http://91.188.254.21/Kloki.arm4	e9f6e4ca27e0b00e3abb8d2064c14e919b2ca017ebd4f8f014863bbe824bd6eb	Mirai	elf mirai
http://91.188.254.21/Kloki.arm5	e5a11ff5b01497755c01ae790c9758376b8abc6ef805ae142a326089728d5df9	Mirai	elf mirai
http://91.188.254.21/Kloki.arm6	a0a114e9f90a3b28dfb45c574e0dbfee7ecc2eee8802550088c635aff6f5ee98	Mirai	elf mirai
http://91.188.254.21/Kloki.arm7	af697660b27a6a01c5e5c1be4cdfd946a8dd6595d221acc7e5a07cbf68376c50	Mirai	elf mirai
http://91.188.254.21/Kloki.m68k	6e15ca0d44f9755e25d43b727e0f955dc8fc8047db4d0fc8c180a7f1f75a7adb	Mirai	elf mirai
http://91.188.254.21/Kloki.x86	8a1ff3a98c8c7685707bbbe14e3c21f4236687a069984c1d44ea47d40ba8f18f	Mirai	elf mirai
http://91.188.254.21/Kloki.spc	4807c962e66f0142d8cec0d2253e5324ddf69f76c3674466ac5ca172ed03174f	Mirai	elf mirai
http://91.188.254.21/Kloki.ppc	0fcf14ca363a57d61610bfc67af3ddbb87f1635e6d456becb340e4428ca60df2	Mirai	elf mirai
http://91.188.254.21/Kloki.x86_64	b1e9744ae47146393b87783e6d9d560d4396fe50b56961903d4706697d115164	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

129

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6778b4e274a2bd296e2615bblinux22vpnfull_triage

Tags:

virus shell

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug bash busybox evasive expand lolbin remote

Link:

https://www.filescan.io/uploads/6778b3e8ff386d8949076637/reports/b30ac970-ff48-41af-9b1b-773b8d1ba25d/overview

Result

Verdict:

UNKNOWN

Score:

88%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c71b8d66ac2f86177e48df856681cfb53528f1613ca1dae67593a705d7e0ad19

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c71b8d66ac2f86177e48df856681cfb53528f1613ca1dae67593a705d7e0ad19/

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2025-01-04 04:07:04 UTC

File Type:

Text (Shell)

AV detection:

12 of 23 (52.17%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y4ny2zvmf6dbo7si36cwnaopwu2sr4lbhsq5vztvsotqlv7avumq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250104-epmw5ssrfq/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c71b8d66ac2f86177e48df856681cfb53528f1613ca1dae67593a705d7e0ad19

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.