MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca14508537e55c5ebdb643c837807219c98d535e06b7734fa9da73e5660a9c65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	ca14508537e55c5ebdb643c837807219c98d535e06b7734fa9da73e5660a9c65
SHA3-384 hash:	c7fc7c59d9f220da9320ebe51623310663db3bf88a7e84ec96ec2f8cd7f93bcad2f22ac186b0b46368f7b36d02dce48b
SHA1 hash:	56946b3d862c0cc59263e0e56fd5968e3b9e8ddf
MD5 hash:	53e74a033ffb1f18cbdee119345bd5a9
humanhash:	tennessee-helium-shade-kentucky
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'840 bytes
First seen:	2025-04-06 08:17:32 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:UpD+7t7PpD+XhpD+mk9pD+iEpD+fHJpD+2YpD+/JpD++ApD+RjpD+wapD+7P9pDR:U5+7t7P5+Xh5+mI5+iE5+/J5+2Y5+/Jf
TLSH	T17031558A52A69F346D76EF23746BD5207482A18198D96F42D8DCB6E291DEF10B040B93
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.144.232/hiddenbin/boatnet.x86	2fe3a266bca6857ed49b9806c22de43e2b777845a05a14f2f71dcc7baf0489f9	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.spc	9af1e86f080d506ed2724b99126088c8701cb9e531a05e52f7921f359b5253a8	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.sh4	49936ea5385356c81ce0ee83af1daefe94299237535478755dc081aa435f5358	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.ppc	1def12e2655f63be3d84172001b2a354fcf2e75bb526d6074cccd354571f5e94	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.mpsl	0a385ff56080540ab31b80eed9baffddf8c1f2c45a5de163267db4d1c0f49269	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.mips	ecc794a86dcc51b1f74d8b1eb9e7e0158381faadaf4cb4ee8febd4ba17fd2516	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.m68k	be29f4d93d3e068fc6b8b3d42d745bf7f269c090a5dbb1a6e65414da484a3790	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.arm7	9a1bf6864b775e72f94e6ee81ea30fcefd54dd631f20dd7998200196fa25226a	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.arm6	4acfe226a8de01231bec0aace38cfaaed7437d1440eefe98941279315850605d	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.arm5	547e4850b5d3c979af6caabcfb10d226cc596b00b73833d79857ba5bd23f9b5b	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.arm4	n/a	n/a	n/a
http://176.65.144.232/hiddenbin/boatnet.arm	7ed4b2a380c896c7dd770246fc76b1005878553d684568577fd217a6305ebc14	Mirai	elf mirai
http://176.65.144.232/hiddenbin/boatnet.arc	1cc3f8c0d6cfd9205fa90f0026d8a8f7e272bf86a431cb55d8471cf431d570a9	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f238e1a695a0cd1fab585dlinux22vpnfull_triage

Tags:

downloader trojan agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67f238c540adfb5162ba07c1/reports/7b43d0fe-bfd9-4f06-8498-876f87454ba0/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ca14508537e55c5ebdb643c837807219c98d535e06b7734fa9da73e5660a9c65

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca14508537e55c5ebdb643c837807219c98d535e06b7734fa9da73e5660a9c65/

Threat name:

Linux.Trojan.Alevaul

Status:

Malicious

First seen:

2025-04-06 08:18:14 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zikfbbjx4vof5pnwipedpadsdhey2u26a23xgt5j3jz6kzqktrsq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250406-j7clcaxkv2/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ca14508537e55c5ebdb643c837807219c98d535e06b7734fa9da73e5660a9c65

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.