MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf616e7fda0e763256003d780eacb6fa063c4448f6018fd6bd939cc819c28114. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cf616e7fda0e763256003d780eacb6fa063c4448f6018fd6bd939cc819c28114
SHA3-384 hash:	14ef41636fdde0c1c9637a9a20a60345aa9ef2c562b362fc66f630912b5bd1c181cf8b420827ed58d30a4a690814b01a
SHA1 hash:	c73600e7b943df5e0581a8191d88d4deac326507
MD5 hash:	c2127f347bc6c052c69ad07ea3307355
humanhash:	dakota-yellow-neptune-don
File name:	bash
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'022 bytes
First seen:	2025-08-04 05:44:22 UTC
Last seen:	2025-08-04 07:26:53 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:U5iliX258l8NIiVY5D4a5VsKiLi50FGh5FUx5SlSD15LTL/ELFOzza5qUICfdg5r:UiWDIA4cSkYJlv/WFGzaXfdgu2n/
TLSH	T1E241FEDA80595B323372B8B73A9352CB10F085C7CA1FD7E8DCBB8479A888504B6275CC
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

28

Origin country :

DE

Vendor Threat Intelligence

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/e5b1f81b-cc11-4909-932b-2b25644e45ec

Nucleon Malprob Benign

Score:

12%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/cf616e7fda0e763256003d780eacb6fa063c4448f6018fd6bd939cc819c28114

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf616e7fda0e763256003d780eacb6fa063c4448f6018fd6bd939cc819c28114/

ReversingLabs TitaniumCloud Script-Shell.Trojan.Multiverze

Threat name:

Script-Shell.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-04 05:45:32 UTC

File Type:

Text (Shell)

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z5qw4762bz3devqahv4a5lfw7iddyrci6yay7vv5soomqgocqeka._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:owari antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250804-gwr6jsen8v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Unexpected DNS network traffic destination

Creates a large amount of network flows

Mirai

Mirai family

Malware Config

C2 Extraction:

newageofkifirempire.camdvr.org

VMRay Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cf616e7fda0e/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/cf616e7fda0e763256003d780eacb6fa063c4448f6018fd6bd939cc819c28114