MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd002ab03fd47df784199dc51228f31613ab5c65116d5d113bbd7e62220b67bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	cd002ab03fd47df784199dc51228f31613ab5c65116d5d113bbd7e62220b67bf
SHA3-384 hash:	8e9196a540ef42655dc5c5e5a16932ffc4ee6787073d174b28e9b2c5153b3af7fb4ebb5be9de68c472b17ca0d9ff45e8
SHA1 hash:	332a4bb340b4e28616d0a035023270acb4fd9195
MD5 hash:	04fdebdb3e3606117667774ce2efc79e
humanhash:	early-bravo-pluto-johnny
File name:	bee
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'144 bytes
First seen:	2025-02-04 17:11:35 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:2X+yzXokQKXHqUjXDzeKXLXDXYqcXDst9EXD6NIxqKCXDeVKEXX8z1X5WEwFee:2X+yzXokQKXHvjX/tXLXzEXY/EXl4Xqv
TLSH	T18421CDDA3D307A060009DD1DB173B099F831C9CB279B4BD66E9C953F94CCE1AF125A94
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.188.83.11/nshkmips	6f9c48597c27dcf08b71f0e6a3c6eba3e4263add4eb4b5763d7dd9845e530e3a	Mirai	elf mirai
http://103.188.83.11/nshkmpsl	b8f51776ef09caccdb7019655cbc5d11bbd57d836cacefd4f6b5d7b5cd4b71eb	Mirai	elf mirai
http://103.188.83.11/nshkx86	ecdc4e4f8b45a75c350beff554b3fe8b7d361f1c8240bcdc4bdcc74962045fa6	Mirai	elf mirai
http://103.188.83.11/nshkarm	28ea86454ba4e666d78ca708cef5af2dcd0171e073fd018d58a51c309c0c04dc	Mirai	elf mirai
http://103.188.83.11/nshkarm4	28ea86454ba4e666d78ca708cef5af2dcd0171e073fd018d58a51c309c0c04dc	Mirai	elf
http://103.188.83.11/nshkarm5	7b4e8ec9eef3f4155ce39445987721ffa282b66f32c1a7880364881cb89e5843	Mirai	elf mirai
http://103.188.83.11/nshkarm6	30e679b1d009d04c4bdd24e422ff05394a2bf9e57339409dba56442d5b2a7395	Mirai	elf mirai
http://103.188.83.11/nshkarm7	96e8f86ff694aeead8b89870db584c43cd1acec8089882586d281b331874018d	Mirai	elf mirai
http://103.188.83.11/nshksh4	87d305402b68f6aa908debb5ef3fe43b5537f8627e2ee750b2ca62cd71e78ee9	Gafgyt	elf gafgyt
http://103.188.83.11/nshkppc	0170ceaac5745441f255b036cb05e4f6563d85c78bb8afacd517478d788322e9	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a24ba151193558eb195ffblinux22vpnfull_triage

Tags:

phishing backdoor agent overt

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/67a24a6e2df544bdc6e4ebb6/reports/0b3fb623-c978-45b3-854d-98a94d47bba6/overview

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/cd002ab03fd47df784199dc51228f31613ab5c65116d5d113bbd7e62220b67bf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd002ab03fd47df784199dc51228f31613ab5c65116d5d113bbd7e62220b67bf/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-02-04 17:14:10 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zuacvmb72r67pbaztxcrekhtcyj2wxdfcfwv2ej3xv7geiqlm67q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250204-vr2q3svqar/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cd002ab03fd47df784199dc51228f31613ab5c65116d5d113bbd7e62220b67bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.