MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da80863061dc0e02682bb76dcb69b6012e205d7c55252ec228416cdc813bc81e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	da80863061dc0e02682bb76dcb69b6012e205d7c55252ec228416cdc813bc81e
SHA3-384 hash:	d110013ad1864dfff56c19bc3cad20fa1bc9e836dd7c3b9dfc69946cc0cf8bfd15d60b178a0ab92ff91ea8b0118859ee
SHA1 hash:	b8ed5b388335b09e84a33969c44edab5b9c81ec8
MD5 hash:	9e478dd363dd7cbb36f0cfa236be88aa
humanhash:	high-mirror-princess-quebec
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	734 bytes
First seen:	2025-03-01 17:42:11 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:+fQInFFFBzWKmfPIbFFFBzWKmfAFFFBzWKmfAFFFBzWKmfe5FFFBzWKmfJ1tFFFV:qBFFFBKKSPCFFFBKKSAFFFBKKSAFFFB4
TLSH	T13D01E5870842EAB090A9C6567B32F9181006BC9F3CDABFFCFAA7458CD494E0C7100E82
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.144.239/tarm	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf
http://176.65.144.239/tarm5	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf
http://176.65.144.239/tarm7	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf
http://176.65.144.239/tmips	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf
http://176.65.144.239/tmpsl	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf
http://176.65.144.239/tsh4	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c347b2a08f47cf14a3bd9alinux22vpnfull_triage

Tags:

trojan agent hype

Result

Verdict:

UNKNOWN

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/da80863061dc0e02682bb76dcb69b6012e205d7c55252ec228416cdc813bc81e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/da80863061dc0e02682bb76dcb69b6012e205d7c55252ec228416cdc813bc81e/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2025-03-01 17:42:23 UTC

File Type:

Text (Shell)

AV detection:

5 of 38 (13.16%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3kaimmdb3qhae2blw5w4w2nwaexcaxl4kuss5qriifwnzaj3zapa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250301-v964hsxse1/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/da80863061dc0e02682bb76dcb69b6012e205d7c55252ec228416cdc813bc81e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.