MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d513e92a5b874779ffa41df508f054038b520cf05d179427d2fd84bda5d695d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	d513e92a5b874779ffa41df508f054038b520cf05d179427d2fd84bda5d695d5
SHA3-384 hash:	72ce881f6bc6f8db1b149a9b80501db2cf3a83177dc251c4485fa1dad85ea1cf25c561f0e6ed36d616eb7827c3483cca
SHA1 hash:	47e57ed0dd82319a364e81aa447f6e4e39600b2a
MD5 hash:	6450aa02ff0d90d41d589bb5ed8f0e41
humanhash:	uniform-burger-tennis-charlie
File name:	1.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'179 bytes
First seen:	2025-10-03 04:11:58 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:141LvR2M5pIiKMCmCQ3gSH4JU/fSWO6NX3Fe+:pRQ3gSwa
TLSH	T1D341E5F6A38BCA03D27D87CA3EA50006B010C36BB49F8735DCE9FAC90494E9C7255A85
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://157.20.32.209/bins/morte.arc	4704e07f48738bd7b4cd44cec97a7c5526a4419fa665fd425ba217425916024a	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arm	f6d0afe358d658d05afad447734fee5a590e953c6c0f98cbd217a867521f8754	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arm5	17bb63761f5c8c1601c331cf193c55c09d4619053f9572b3648ef69e49fd1a89	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arm6	b3cd17f0afa885b377f8b04679e75f7f0827189f0b3f025a3814d156b4db1c38	Mirai	mirai opendir
http://157.20.32.209/bins/morte.arm7	09d4f358af13014b924279b5b4318a7da185db5a95b1175fac33a87e93f00b35	Mirai	mirai opendir
http://157.20.32.209/bins/morte.i686	a1617a2f4c04b81e7d8fa32fd63a09ed977cd7607b24b76055b36fdea3112c89	Mirai	mirai opendir
http://157.20.32.209/bins/morte.m68k	cdab74aed8c37c66f1370e839cd48ae264c4bda7f1aae193b516e1c9a52a93ea	Mirai	mirai opendir
http://157.20.32.209/bins/morte.mips	1cb41b9c1a9e8123336054934a6ade938b976b5dbb87e852c742ef3f1fa9cdbb	Mirai	mirai opendir
http://157.20.32.209/bins/morte.mpsl	9f142d179fbde485e13d3364d65180ee6d62449aff02e35d87447ca0f9417210	Mirai	mirai opendir
http://157.20.32.209/bins/morte.ppc	1dc7e464cdaabeaa49a759a198d6a69d7cfc69014337f7fe1881dc9f3efdb8dd	Mirai	mirai opendir
http://157.20.32.209/bins/morte.sh4	bb8425e14a2cc5ce0d44da49e2b28d19e081b6352f48c376c7b0f9b0c92e3054	Mirai	mirai opendir
http://157.20.32.209/bins/morte.spc	e43b10988feae69a629b29ad0826d88d485372dabbed9421f2e1094147da7c01	Mirai	mirai opendir
http://157.20.32.209/bins/morte.x86	20eec1f49d7ab9223b5d47b6f464aed12e418942570966eae401968088463f1a	Mirai	mirai opendir
http://157.20.32.209/bins/morte.x86_64	16ba16bf6f0d4de4341bf38820777755012f008554f5e482b88cd4a85e97eb8b	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/68df4d8f674d5fd6aa147be8/reports/d10544c0-9fb4-45dc-920e-f2b9404d1314/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-03T01:22:00Z UTC

Last seen:

2025-10-04T13:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d513e92a5b874779ffa41df508f054038b520cf05d179427d2fd84bda5d695d5/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/afae0e6f-3875-4378-a9e5-53a559a4a895

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d513e92a5b874779ffa41df508f054038b520cf05d179427d2fd84bda5d695d5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d513e92a5b874779ffa41df508f054038b520cf05d179427d2fd84bda5d695d5/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/d513e92a5b874779ffa41df508f054038b520cf05d179427d2fd84bda5d695d5

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2025-10-03 04:15:55 UTC

File Type:

Text (Shell)

AV detection:

12 of 36 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2uj6sks3q5dxt75edx2qr4cuaofvedhqlulzij6s7wcl3jowsxkq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery execution linux persistence

Link:

https://tria.ge/reports/251003-etpljaw1fx/

Behaviour

Command and Scripting Interpreter: Unix Shell

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Enumerates running processes

Modifies init.d

Modifies rc script

File and Directory Permissions Modification

Executes dropped EXE

Mirai

Mirai family

Malware Config

C2 Extraction:

157.20.32.209

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d513e92a5b87/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/d513e92a5b874779ffa41df508f054038b520cf05d179427d2fd84bda5d695d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.