MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1ebdefbfcf0967d811431319b33fc17ca5c59a130d53ee67d5f2669ecd335d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	d1ebdefbfcf0967d811431319b33fc17ca5c59a130d53ee67d5f2669ecd335d1
SHA3-384 hash:	dac39f23d625298e083b2b35ce23d19c28379fb1548161a96a3aa9a660c2bd4266f666fdc72bed7875dd8da156783801
SHA1 hash:	c2c47801e47d44551e99aa6b4fb4dc30587ab380
MD5 hash:	61a03cb9795128199b202d32e706c209
humanhash:	wisconsin-summer-georgia-queen
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'213 bytes
First seen:	2025-12-20 16:56:56 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:4QrKfQ18gvfQtNI2SQexKd4QwQnD6QdW/9dlQdRJR8RzSRRYQSa5aSF6SgQAGnP2:4UKfivfmNIvlKd4De6pOY3vdX4qpjn
TLSH	T18D2180FD077169014C848F48A42BC4CB811DADF9B58FDA0AE4BB1C7E8194B2730E6E39
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://141.98.10.91/bins/sumrak.arm	a8e657d363b5dc97a9e887e8686306ea0acc346c0b4b1eaf97e23cf2504a028b	Mirai	mirai opendir
http://141.98.10.91/bins/sumrak.arm5	fe42c0e128ed02574179e239ec54ac6b3979c77912af2c287c79cf7cdad837d9	Mirai	mirai opendir
http://141.98.10.91/bins/sumrak.arm6	c7c544bd12f4e96efe9522e2b1eec9e1aaca2963f1af9d6d825a77e23055ca4d	Mirai	mirai opendir
http://141.98.10.91/bins/sumrak.arm7	0eaf8243e73a2f2de8164be8c565e3fb343a382ed4e850290d043621b87d6671	Mirai	mirai opendir
http://141.98.10.91/bins/sumrak.sh4	66c60404acaf2b67f97fc3cd57d8436641d88574c388ae6403729eb83ffeaaca	Mirai	mirai opendir
http://141.98.10.91/bins/sumrak.arc	n/a	n/a	elf ua-wget
http://141.98.10.91/bins/sumrak.mips	020b5d89315667708d7d91af70bbc3bdbbf9a2abc19282644def144a7c54d538	Mirai	mirai opendir
http://141.98.10.91/bins/sumrak.mipsel	n/a	n/a	elf ua-wget
http://141.98.10.91/bins/sumrak.sparc	n/a	n/a	elf ua-wget
http://141.98.10.91/bins/sumrak.x86_64	5d763d962556094f1524a6e3202365c6d7611c4988772e5f26f136cd19becdc2	Mirai	mirai opendir
http://141.98.10.91/bins/sumrak.i686	8f18c738a20bf65a34ab2c701c018eefe824bb2ff912a2b3907804de87af7f6c	Mirai	mirai opendir
http://141.98.10.91/bins/sumrak.i586	0b265a89f89abed68d47200ed1f27f4f1d68af668103176085e362fa8979f1e9	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive mirai

Link:

https://www.filescan.io/uploads/6946d5745ceddcfa3ff6371a/reports/1c63b096-bc1a-40ef-ab89-c5ae63b36b45/overview

Verdict:

Malicious

File Type:

text

First seen:

2025-12-20T15:30:00Z UTC

Last seen:

2025-12-21T02:00:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d1ebdefbfcf0967d811431319b33fc17ca5c59a130d53ee67d5f2669ecd335d1/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/9c2ed813-0de7-4058-968d-51c8de603119

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d1ebdefbfcf0967d811431319b33fc17ca5c59a130d53ee67d5f2669ecd335d1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d1ebdefbfcf0967d811431319b33fc17ca5c59a130d53ee67d5f2669ecd335d1/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2025-12-20 16:58:24 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2hv556746clh3aiugeyzwm74c7ffywnbgdkt5zt5l4tgt3gtgxiq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251223-nwlr4awlg1/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d1ebdefbfcf0967d811431319b33fc17ca5c59a130d53ee67d5f2669ecd335d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh