MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d595dbe970f66c0de241d4b5f6f455a5c647e3801ac0daf1f1ec69931ad5ed31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d595dbe970f66c0de241d4b5f6f455a5c647e3801ac0daf1f1ec69931ad5ed31
SHA3-384 hash: df6733fda0aabe3da8ab036eecce86f91fd9aae10e43714c2f3f38ee2caa169635b1d2beb04b2576249e3b19f3ea525c
SHA1 hash: cd557a8f797920843af600bbea320596e583af42
MD5 hash: c9fecb8c4fd0a502239f30f77ccb583a
humanhash: muppet-december-beer-white
File name:sora.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'913 bytes
First seen:2025-11-26 13:52:40 UTC
Last seen:2025-11-27 00:42:39 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vD/yRDwaRD4iWRDjZoRD+2RDhuRDkORDu4RDDKRDq4e:voPQgFyvnMY
TLSH T174414185B3024E31AFEE9E5B72B4C844B084F5BA7EC0DE15D5EEB4AE888CF087451657
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://151.242.30.13/bins/sora.x866940062fd167ca015934ef768324347a77588eece5478240bf3aff138d74b612 Miraielf mirai ua-wget
http://151.242.30.13/bins/sora.mips1c5a8cb3e8195b00974e3e6aa19e0fff094a18508d737870bbc061d191646ada Miraielf mirai ua-wget
http://151.242.30.13/bins/sora.mpslc4a9179ca4545210b8fa1e6834c0e78c168a99b06d2679b5d6ee149da148e8d8 Miraielf mirai ua-wget
http://151.242.30.13/bins/sora.arm4n/an/aelf ua-wget
http://151.242.30.13/bins/sora.arm529fe13609d5bbf51ccebd6d2bc120f8c8327f568c45664b401d63135ec59a795 Miraielf mirai ua-wget
http://151.242.30.13/bins/sora.arm626e511f063bf1fae47601c19cf1b24e646e2d02c3467bf79e1fdf243b3f473eb Miraielf mirai ua-wget
http://151.242.30.13/bins/sora.arm7d67bde84ca7c52f18bf902175e6b7a430a69068f784da2bf0eee040e5670e927 Miraielf mirai ua-wget
http://151.242.30.13/bins/sora.ppcf5826ffe1f7f66e44ae05e1753fc4272875b9c1f5f9b9c20f2f3360405c8c2a5 Miraielf mirai ua-wget
http://151.242.30.13/bins/sora.m68k9997f69184ce44014adab83dc4be283f5a82394d97756088f287bca69b40437d Miraielf mirai ua-wget
http://151.242.30.13/bins/sora.sh4759e187d2bf078cb1b4db174db08e02a970f091df86156c2269654ec5526906e Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
medusa mirai
Link:
https://www.filescan.io/uploads/6927064bf5b8bc6001530d4a/reports/411c6e51-1b2e-487d-a92d-2c6226110e3a/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-26T09:11:00Z UTC
Last seen:
2025-11-27T14:18:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.c HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p
Link:
https://opentip.kaspersky.com/d595dbe970f66c0de241d4b5f6f455a5c647e3801ac0daf1f1ec69931ad5ed31/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d595dbe970f66c0de241d4b5f6f455a5c647e3801ac0daf1f1ec69931ad5ed31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d595dbe970f66c0de241d4b5f6f455a5c647e3801ac0daf1f1ec69931ad5ed31/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/d595dbe970f66c0de241d4b5f6f455a5c647e3801ac0daf1f1ec69931ad5ed31
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2025-11-26 13:42:58 UTC
File Type:
Text (Shell)
AV detection:
17 of 24 (70.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2wk5x2lq6zwa3ysb2s27n5cvuxdepy4adlanv4pr5ruzggwv5uyq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:sora antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/251126-q63jpszqcz/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
UPX packed file
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (371928) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d595dbe970f66c0de241d4b5f6f455a5c647e3801ac0daf1f1ec69931ad5ed31

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh d595dbe970f66c0de241d4b5f6f455a5c647e3801ac0daf1f1ec69931ad5ed31

(this sample)

Mirai

elf 6940062fd167ca015934ef768324347a77588eece5478240bf3aff138d74b612

  
URLhaus
https://urlhaus.abuse.ch/url/3717172/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d6168f2d7f32d2468ed5e769aecc6296
  
Dropping
SHA256 6940062fd167ca015934ef768324347a77588eece5478240bf3aff138d74b612

Comments