MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 caf8a8dbb980bf9f0047043baa6d60790fc6248a90cc8800cb2eca5bc1df4441. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	caf8a8dbb980bf9f0047043baa6d60790fc6248a90cc8800cb2eca5bc1df4441
SHA3-384 hash:	5ae3b554c7b53a0282cb637b026ff162da0ddb6a5046db67f0e60f111306b246985b69b98616c0271372f96023003164
SHA1 hash:	fb725c734c82283c8e621e2ea6101990d32ee972
MD5 hash:	8dd8e50abe0b74faa7319bfce7421541
humanhash:	hamper-oranges-princess-kansas
File name:	xcurl.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'928 bytes
First seen:	2025-08-07 06:59:45 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:VPWyasMUkqpWlA9A5Btaxq3c+5LijOP6o55LbYkQyvyjw:VNBsaxCWjOP6oLnYmn
TLSH	T13251B7A941292C5FF7149E5BB3BACD1C12365FB9106BCF89DF803529DC4DA20A0E3622
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.209.150.187/odin.arm	9a36946cbdf2682af5b0227ee93b120c3c0543f260076bb2094638a71b68e294	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.arm5n	d89b9aa7f0ac337077c5614d1d8321d1a0dff5280560bde0a8339c0dba0abd5d	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.arm7	bdde0035d6b37dce2fff359848916a559640206659024577d4fa61608b4931bc	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.m68k	a11b9aef373169010a4822273a8a16fb4deb9e386166e4b94aa791f34a25f39e	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.mips	a25ff39e978fa88f79d10bcd25a86bc48d196af8e2046be47a886ce4dd6a6650	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.mpsl	96f1e58ca140b8babe3873412dc17b203d2b87df2e70886625c249d3db092789	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.ppc	e7834d6e7af525e9200c4f98255f6a3db500d86e1a1d254610c1f5d47a90575b	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.sh4	b185e773d0014ff89e12a4ba6075282488a1b130af190e3d8c064d618c11cf7e	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.spc	3ccec93311c41cc3a813b5762e249706c4cc3fd2c04894585300e05221268a01	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/odin.x86	aa14c7945115ba63c093f4ca508af7a9b20198c432a70b68cab2f52bad4121c7	Mirai	elf geofenced mirai ua-wget USA
http://213.209.150.187/bizy.arm5	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.arm6	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.arm7	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.arm8	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mips	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mpsl	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mipss	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mpsls	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.riscv	e2fbe4a0085cfa107069c0a614ecae10e3b1b04f1ecfee287f2d5abdc2b79a13	Mirai	elf mirai ua-wget
http://213.209.150.187/bizy.x86	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.x64	n/a	n/a	elf ua-wget
http://213.209.150.187/bizy.mips64	2fa27985ef9b46d3584dcff9ec777b1fdd62ea98a7660490cc3ebb5fc5b79172	Mirai	elf mirai ua-wget
http://213.209.150.187/bizy.mpsl64	8b35595ec94e07930eaf57ce734a1d48ab90db9ee97073bedda788574786eeda	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/bccde8a2-b301-4266-988f-804166326e81

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/caf8a8dbb980bf9f0047043baa6d60790fc6248a90cc8800cb2eca5bc1df4441

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/caf8a8dbb980bf9f0047043baa6d60790fc6248a90cc8800cb2eca5bc1df4441/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/caf8a8dbb980bf9f0047043baa6d60790fc6248a90cc8800cb2eca5bc1df4441

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2025-08-07 07:02:48 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zl4krw5zqc7z6achaq52u3lapeh4mjeksdgiqaglf3ffxqo7iraq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250807-ht553a1r13/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Mirai

Mirai family

Malware Config

C2 Extraction:

104d.hldns.ru

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/caf8a8dbb980/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/caf8a8dbb980bf9f0047043baa6d60790fc6248a90cc8800cb2eca5bc1df4441

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.