MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd444aa4fa9dc7af7ce7a78849ee7b9a2a153c287bbcfb024169292f6ddbe040. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd444aa4fa9dc7af7ce7a78849ee7b9a2a153c287bbcfb024169292f6ddbe040
SHA3-384 hash: 71eae11c9b962f9586fdc71b8fc12945674151179be2d509397678e6d6428b670bcd8f8bf7c51cafc9f415fe37ee5e02
SHA1 hash: 5a1b7682862c6f52ff944c54319ab9350b2f313d
MD5 hash: b419a9fbbcf3a9dedc7184d03bc784ec
humanhash: item-west-beryllium-east
File name:coke.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:413 bytes
First seen:2026-08-11 14:03:03 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 6:B9Ii1rK5AKMLABP5f5AKMLABNsK5AKMLABXVV5AKMLABKf5AKMLAs:kir8LK8P5BLK8S8LK8XRLK8KBLKh
TLSH T15BE01285134AAE316816BA8AB30309A47501919B68B71FA22E496C249559604B429E4E
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://93.114.194.171/d/armc1bc5c236ac09f9bb74d2b2df4dac145da1afd6edaf9405cf7bce133ddd0459c Miraicensys elf mirai ua-wget
http://93.114.194.171/d/arm56690d52796a3b194421dcadef0f57c71a12983c5435cf234bd2014600e4fea28 Miraicensys elf mirai ua-wget
http://93.114.194.171/d/arm7881d5a6b504c1b56324114757c4cf27cfd41c43ed49804eca0f1c5500bafedce Miraicensys elf mirai ua-wget
http://93.114.194.171/d/mips0cbf6f10c9a39d628bb5c0a3810f25d2f58b37a4351045ab200c62154d03734e Gafgytcensys elf gafgyt ua-wget
http://93.114.194.171/d/mipsel8522dd99e4ea41eb22ebd4e2867d0a993e5c93ae2b3e55aad799808d9e01ca34 Miraicensys elf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7b2bccb54e1c7afc218086/reports/4ded5e62-8d19-473d-b2e4-3ba0c3a1be7d/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-08-11T12:54:00Z UTC
Last seen:
2026-08-12T01:41:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/cd444aa4fa9dc7af7ce7a78849ee7b9a2a153c287bbcfb024169292f6ddbe040/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1c5d5e76-fd16-43b3-b50e-8f23bc45d2f0
Behavior Graph:
Download SVG
%3 guuid=177d8ce0-1a00-0000-56c2-525782090000 pid=2434 /usr/bin/sudo guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439 /tmp/sample.bin guuid=177d8ce0-1a00-0000-56c2-525782090000 pid=2434->guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439 execve guuid=48bf78e4-1a00-0000-56c2-525788090000 pid=2440 /usr/bin/dash guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=48bf78e4-1a00-0000-56c2-525788090000 pid=2440 clone guuid=52d18de4-1a00-0000-56c2-525789090000 pid=2441 /usr/bin/wget net send-data write-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=52d18de4-1a00-0000-56c2-525789090000 pid=2441 execve guuid=cd2798f8-1a00-0000-56c2-5257b6090000 pid=2486 /usr/bin/chmod guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=cd2798f8-1a00-0000-56c2-5257b6090000 pid=2486 execve guuid=701201f9-1a00-0000-56c2-5257b9090000 pid=2489 /usr/bin/dash guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=701201f9-1a00-0000-56c2-5257b9090000 pid=2489 clone guuid=102deff9-1a00-0000-56c2-5257bc090000 pid=2492 /usr/bin/rm delete-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=102deff9-1a00-0000-56c2-5257bc090000 pid=2492 execve guuid=85c77dfa-1a00-0000-56c2-5257be090000 pid=2494 /usr/bin/wget net send-data write-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=85c77dfa-1a00-0000-56c2-5257be090000 pid=2494 execve guuid=41c96e1d-1b00-0000-56c2-52571b0a0000 pid=2587 /usr/bin/chmod guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=41c96e1d-1b00-0000-56c2-52571b0a0000 pid=2587 execve guuid=761cb71d-1b00-0000-56c2-52571c0a0000 pid=2588 /usr/bin/dash guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=761cb71d-1b00-0000-56c2-52571c0a0000 pid=2588 clone guuid=d3154c1e-1b00-0000-56c2-52571f0a0000 pid=2591 /usr/bin/rm delete-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=d3154c1e-1b00-0000-56c2-52571f0a0000 pid=2591 execve guuid=0dca911e-1b00-0000-56c2-5257200a0000 pid=2592 /usr/bin/wget net send-data write-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=0dca911e-1b00-0000-56c2-5257200a0000 pid=2592 execve guuid=2e078330-1b00-0000-56c2-52573e0a0000 pid=2622 /usr/bin/chmod guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=2e078330-1b00-0000-56c2-52573e0a0000 pid=2622 execve guuid=e8bb1231-1b00-0000-56c2-5257410a0000 pid=2625 /usr/bin/dash guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=e8bb1231-1b00-0000-56c2-5257410a0000 pid=2625 clone guuid=5c07e531-1b00-0000-56c2-5257450a0000 pid=2629 /usr/bin/rm delete-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=5c07e531-1b00-0000-56c2-5257450a0000 pid=2629 execve guuid=efed4c32-1b00-0000-56c2-5257470a0000 pid=2631 /usr/bin/wget net send-data write-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=efed4c32-1b00-0000-56c2-5257470a0000 pid=2631 execve guuid=1eec734a-1b00-0000-56c2-5257630a0000 pid=2659 /usr/bin/chmod guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=1eec734a-1b00-0000-56c2-5257630a0000 pid=2659 execve guuid=c0b3e24a-1b00-0000-56c2-5257640a0000 pid=2660 /usr/bin/dash guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=c0b3e24a-1b00-0000-56c2-5257640a0000 pid=2660 clone guuid=5c31a14b-1b00-0000-56c2-5257680a0000 pid=2664 /usr/bin/rm delete-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=5c31a14b-1b00-0000-56c2-5257680a0000 pid=2664 execve guuid=bc21e84b-1b00-0000-56c2-5257690a0000 pid=2665 /usr/bin/wget net send-data write-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=bc21e84b-1b00-0000-56c2-5257690a0000 pid=2665 execve guuid=018d345e-1b00-0000-56c2-5257880a0000 pid=2696 /usr/bin/chmod guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=018d345e-1b00-0000-56c2-5257880a0000 pid=2696 execve guuid=e1a5775e-1b00-0000-56c2-5257890a0000 pid=2697 /usr/bin/dash guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=e1a5775e-1b00-0000-56c2-5257890a0000 pid=2697 clone guuid=3ae6fb5e-1b00-0000-56c2-52578d0a0000 pid=2701 /usr/bin/rm delete-file guuid=f59824e4-1a00-0000-56c2-525787090000 pid=2439->guuid=3ae6fb5e-1b00-0000-56c2-52578d0a0000 pid=2701 execve 6ad14c85-30c1-5a31-ae85-904cde1e1c75 93.114.194.171:80 guuid=52d18de4-1a00-0000-56c2-525789090000 pid=2441->6ad14c85-30c1-5a31-ae85-904cde1e1c75 send: 134B guuid=85c77dfa-1a00-0000-56c2-5257be090000 pid=2494->6ad14c85-30c1-5a31-ae85-904cde1e1c75 send: 135B guuid=0dca911e-1b00-0000-56c2-5257200a0000 pid=2592->6ad14c85-30c1-5a31-ae85-904cde1e1c75 send: 135B guuid=efed4c32-1b00-0000-56c2-5257470a0000 pid=2631->6ad14c85-30c1-5a31-ae85-904cde1e1c75 send: 135B guuid=bc21e84b-1b00-0000-56c2-5257690a0000 pid=2665->6ad14c85-30c1-5a31-ae85-904cde1e1c75 send: 137B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cd444aa4fa9dc7af7ce7a78849ee7b9a2a153c287bbcfb024169292f6ddbe040
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd444aa4fa9dc7af7ce7a78849ee7b9a2a153c287bbcfb024169292f6ddbe040/
Threat name:
Document-HTML.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-11 14:05:48 UTC
File Type:
Text (Shell)
AV detection:
7 of 24 (29.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvcevjh2txd267hhu6eet3t3tivbkpbipo6pwasbneus63o34baa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260811-rcyjbs1xby/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cd444aa4fa9dc7af7ce7a78849ee7b9a2a153c287bbcfb024169292f6ddbe040

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh cd444aa4fa9dc7af7ce7a78849ee7b9a2a153c287bbcfb024169292f6ddbe040

(this sample)

Mirai

elf c1bc5c236ac09f9bb74d2b2df4dac145da1afd6edaf9405cf7bce133ddd0459c

  
URLhaus
https://urlhaus.abuse.ch/url/3902090/
  
Delivery method
Distributed via web download
  
Dropping
MD5 e85ac8621444529b9c563ade6cb7fe06
  
Dropping
SHA256 c1bc5c236ac09f9bb74d2b2df4dac145da1afd6edaf9405cf7bce133ddd0459c

Comments