MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310
SHA3-384 hash:	2a84929adec6597cc85997b2a4d5c44920e92dfeb028f3432f628947d8f16fec4a121033f8f6318e9e002078455a263a
SHA1 hash:	f49ffff5fb814f429ba125edd454a46fbe6edb26
MD5 hash:	d0d949733bcf4751d48ccbf5870b9827
humanhash:	emma-skylark-princess-eleven
File name:	sifFBrHc.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	4'007 bytes
First seen:	2026-03-17 22:45:51 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:/WnYUVc9+zk+EtyEWhiORGYaTnOWiF/y+Z3h0Czhka6JZzytuMWsG/u8:/CYU+Mg+//hiORGjTni32mPiy4MWse1
TLSH	T1F48169CEE0B0A73029CDDE1272F75948B160A98764C63F14ADCC34F01A9FE89395AB56
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://178.16.54.73/Wl1od1VJR3WquMjE	29f20243292cc7287ac1e24a4bd2c7976ac94fbcd1669be8a39502c6c329a3d6	Mirai	elf m68k mirai ua-wget
http://178.16.54.73/KweOhS08huYPY94Qpd9bz	e663a4312de309f96b41c5fc13cbc672e3fc901231549354d529410a46c5953b	Mirai	elf mirai ua-wget x86
http://178.16.54.73/B3XOHsUWebhjBm	b6a05e2244a46eca59671bad97f27846eaaca8beb3d915dae39140969612650c	Mirai	arm elf mirai ua-wget
http://178.16.54.73/RsFtwTTsYv34xStYDnjN63iD	0ad659a251eb5ddbbd0d7892425386d4ebc70b7bd1ada8cb2fe7a83f9206f44e	Mirai	elf mips mirai ua-wget
http://178.16.54.73/IeEGYOrPIHEg8WmroKfsCF	8c87f8e1095c827cc036fe352fe22e285ac8e6d3602bf7cd12db3311b67d319f	Mirai	elf mirai PowerPC ua-wget
http://178.16.54.73/CJ5YYyumIO0jZ	3920d8143477ec76be6bb791c96d88e7d65cd928a9a96907990eff0cb56c5aaf	Mirai	elf mirai SuperH ua-wget
http://178.16.54.73/EIy6BAYzYWv0jhNo6oSuvG2Q	7c576c16ba57b38bb0b51613059f6ee9afad77ec7b4c1d15f8a1203da6989d48	Mirai	elf mirai ua-wget x86
http://178.16.54.73/q98WAmCazAkPXc3wGh3DFHO	2f2fbb527f9a086e9cf23bd80c3ce7f74f673de58b4258b14d2ccac6134c0196	Mirai	elf mirai ua-wget x86
http://178.16.54.73/pIP5soqMaST8B1IQK51Pn	aa01d67acbcbddda7acd553b700e9aa5172d716266e68fc245bcf28f66eb56d1	Mirai	arm elf mirai ua-wget
http://178.16.54.73/BKDqqlGsf5dk0IrwZVgB	d1ca90b03cc79e7b4627518021a2d3b304e8a0a157494b797964a4dfc3eb2e23	Mirai	arm elf mirai ua-wget
http://178.16.54.73/EGeWczeqnEXTMUhzwSnhcgz	3444490e3044cb9f9c8eebade13d23de7530dc848e8cbeec2ed98c8210af12d4	Mirai	arm elf mirai ua-wget
http://178.16.54.73/jHlAwTINQWl0vqvfmfPTPWYM	8c2f0301b28eaab1e35d1620fd6c5179f51956641e6791b5e5f877fd7ed184fc	Mirai	elf mips mirai ua-wget
http://178.16.54.73/fKlK05Fc24ZNucvNh2mhBC	7cebd4c3451c365ecd8ae3cec19d34dd32b27a0fa50bd03e7347f0bc4b053fd8	Mirai	elf mirai PowerPC ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive medusa mirai

Link:

https://www.filescan.io/uploads/69b9d9b94ec2f522cc4d0f54/reports/4b11bc57-ba08-4e69-aabe-b70a30d814e6/overview

Verdict:

Malicious

File Type:

unix shell

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/f8464c07-7503-4a3c-bb55-4eeebb4a9bea

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2026-03-17 22:46:22 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3exfpdahdgtkv7pnee3mxwe6ic6cpppbjwofp4qahnjtbdklwmia._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260317-2p3zpags3x/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Creates/modifies Cron job

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Malware family:

Xorbot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d92e578c0719/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.