MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dffaed1dc45fa25bf7d329cf56ed0bc2413bfc98c794bdcdd55744e6109f7003. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	dffaed1dc45fa25bf7d329cf56ed0bc2413bfc98c794bdcdd55744e6109f7003
SHA3-384 hash:	1d5fe1a3b36e6848eef97ec089fca18a9a784a078a6f2c408ab7c2b3af8bf60ac872573a108cd6e3b97b948d1db52993
SHA1 hash:	c8f71fc0a75fa43ea6f7126880853c37eef8098c
MD5 hash:	6fa241132aec164fe013b0be00ee882b
humanhash:	quiet-pizza-eleven-tennis
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'162 bytes
First seen:	2025-06-26 04:09:16 UTC
Last seen:	2025-06-26 21:00:57 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:/DbfRDjJrDDDCF8DNfDNKDhDNbDNBXDN7DNJMDQGDOXD3DtDLDZtc4ZDhDmZnRD+:zXJUDNHtJx64mZIF1UsjGs
TLSH	T18341E8CD9ED18B13CB8CCE85F161C2967C694D86A6A7CE989C9B1CA4486D908303B797
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://106.248.251.189:22970/x86_64	a72ee92a97daf5ef9cc221ec5863be80e1ba89bfe8d037ef9da3e51aa7457b7e	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/aarch64	c3606a38dc492dd447c7a12e6a56c12e93c6d8c3e31fb0a4cbeb1e7b8f662ddf	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/m68k	c72013b046b2d2c5c3b96347bd3174c8a7f1e64fd72efdcbdc91c0717f2bfcf1	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/mips	2a09f99f8bdeb093b0553f1d9b946894e7603c0a2237630cd0c5594e034a69dd	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/mipsel	e7a168b0adc04d60d076edc9efe2be06d7790f1c37c9b0f313c0e6fecafaf726	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/powerpc	7133391d2afb2ba104c3f7b6e3420ca341a52531b3ee62e64ea1a1c732f8c55d	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/sparc	7418939311768be639b3ab2fd50c84816649c14d338e3b7e29af0c4c9f8b2b44	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/sh4	8f76a5f963b9991f350d8c0f4c714253bd07a797a3476c7b6dc097a57c181641	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/arc	0a4e9303a9f9b28bd61cec449a01c5a7f9e373255983cc89a18cdf625220dff6	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/csky	0a17e204ab1a716b0d03020e98d1d92fb0315da992d526543b2ad39d843a782c	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/i486	afbedf07e67976de1305ad7cac2cab0db1eab33ad9a790c7158cd82b44bbe3c0	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/armv4l	3e47a2b97201434bc4607a33db6b88a0cde0f3ded5b8fe01781476c69ffee02e	Mirai	elf gafgyt mirai ua-wget
http://106.248.251.189:22970/armv5l	f8941692367f79d0861d7dbad6d29727d666b319367becc960d4c286b878242a	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/armv6l	bcd3426c205ea35b61022c37dc72ef8261c65c1914ae90d4b66a20e2c9dde76a	Mirai	elf mirai ua-wget
http://106.248.251.189:22970/armv7l	57780dd8711b15c05334df427dffd2072e6612b1e21bbb72e06e351b1fd62f1a	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.DownLoader.683.7276.18241.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685cc801b06783b9ebd7dad1linux22vpnfull_triage

Tags:

agent virus shell

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/6ff78a5d-b090-4fe4-b7d7-bf984f66c0fc

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dffaed1dc45fa25bf7d329cf56ed0bc2413bfc98c794bdcdd55744e6109f7003

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dffaed1dc45fa25bf7d329cf56ed0bc2413bfc98c794bdcdd55744e6109f7003/

Threat name:

Document-HTML.Trojan.Multiverze

Status:

Malicious

First seen:

2025-06-24 23:47:37 UTC

File Type:

Text (Shell)

AV detection:

17 of 37 (45.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=375o2hoel6rfx56tfhhvn3ilyjatx7eyy6kl3tovk5comee7oabq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/250626-eq4ahsar6x/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Enumerates running processes

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Modifies Watchdog functionality

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dffaed1dc45fa25bf7d329cf56ed0bc2413bfc98c794bdcdd55744e6109f7003

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.