MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7bbde2e2ce335f37a96076431e67874069d457eb7b1bb6e840b234c0ba707c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	d7bbde2e2ce335f37a96076431e67874069d457eb7b1bb6e840b234c0ba707c9
SHA3-384 hash:	625d2694a27aee347231ecf0e703b7e44d6971973b17d346fd5d041e022f309ae7bbf3df899b6cc848e075344060d725
SHA1 hash:	cc785593fdd4e152d51222fdaedfad19e4df080b
MD5 hash:	0437d8cc77e8aec25007e7c70ad97f60
humanhash:	muppet-glucose-kitten-mango
File name:	l
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'505 bytes
First seen:	2024-12-28 20:10:56 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:GLF+2gnvEDLkUe5nuLy+IUBLlxM+GRLt2mKLOh8LC+PLoR+OSL12gZDLmRPQ3LHm:sF+hnvEf2tExJAHZtNIs+TH/7ZftbG
TLSH	T14D31C1C592B159B56EE1AC4B726FCC0D318B79CE1CC99F8968CC30F6A68ED50B844B13
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.222.191.146/x86_64	a98c75b7612614ed742dc20e8606ccfbf3e9e420db04a51de199febf79df432a	Mirai	elf gafgyt mirai
http://83.222.191.146/mpsl	2334f9ff33a1a40363409037d38200e7ab05d17e45b0c34d2fa9fdfba0981184	Mirai	elf mirai
http://83.222.191.146/mips	1a277c37236c7f81798518774b8a503060f075c2f5f80d8891737f099568b0cd	Mirai	elf gafgyt mirai
http://83.222.191.146/arm4	1a742066ad19b17d888000e4afc3ae71232c46846604f2ef9385d92a45c7908e	Mirai	elf gafgyt mirai
http://83.222.191.146/arm5	eec96d97e6867412ad5b49487ec4d11996c2e76dda69f6802e90d417956a173b	Mirai	elf gafgyt mirai
http://83.222.191.146/arm6	10168506319b8be5589155349a7fea42791d64bd90ab610747d473a056e4ec3d	Mirai	elf mirai
http://83.222.191.146/arm7	ddaa4a6fbb91a9fe3eeb6971840e677e2f131cb10d3bb423cfe563560f04ebdd	Mirai	elf gafgyt mirai
http://83.222.191.146/m68k	3a353240939bc7ca326e9ed1c640f99517b5c1779a660b053fcf3266881c7852	Mirai	elf mirai
http://83.222.191.146/x86	06858102f6c443b53241baa576c4ecfce5c61bd729379fea88a40323227ee34a	Mirai	elf mirai
http://83.222.191.146/spc	8cc0e7a4a92d334f4df94cf382385ea5f59866b5e32097f0ac96b3f3c15b2b27	Mirai	elf mirai
http://83.222.191.146/ppc	e2286c2fc91b4bd4780c7f35ab12af96397b0701dc051739684bf0c3b7c67360	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677105801bb06b88847932edlinux22vpnfull_triage

Tags:

phishing trojan virus shell

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug busybox evasive expand lolbin remote

Link:

https://www.filescan.io/uploads/67705b5ba561e5a2873b5330/reports/6f970cd4-2e54-4c15-8a2c-1f76bd1b127f/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/d7bbde2e2ce335f37a96076431e67874069d457eb7b1bb6e840b234c0ba707c9

Result

Verdict:

UNKNOWN

Score:

66%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/d7bbde2e2ce335f37a96076431e67874069d457eb7b1bb6e840b234c0ba707c9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d7bbde2e2ce335f37a96076431e67874069d457eb7b1bb6e840b234c0ba707c9/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2024-12-28 20:48:58 UTC

File Type:

Text (Shell)

AV detection:

15 of 23 (65.22%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=26554lrm4m27g6uwa5sddztyoqdj2rl6w6y3w3uebmruyc5ha7eq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d7bbde2e2ce335f37a96076431e67874069d457eb7b1bb6e840b234c0ba707c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.