MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b
SHA3-384 hash: e934421c2b61809e8b342407e85e404e605f3e588e244a7a222e324e6771e5da25891f1678e30f24bc20c6dcd1058e17
SHA1 hash: 40d2efb5cff5f2f52589e7f29efe4d960cde821b
MD5 hash: 86a016ac011d31fa881923e5ec1cc51d
humanhash: twelve-vegan-echo-hawaii
File name:smc2
Download: download sample
Signature Mirai
Create hunting rule
File size:308 bytes
First seen:2025-12-21 15:13:24 UTC
Last seen:2025-12-22 08:24:45 UTC
File type: sh
MIME type:text/plain
ssdeep 6:LMFdV2jzbgMFdVeaLaNgp4CgMFdVcFGNIvF+69gMFdVcfiAK6isr:odMjzLdMaLaNgpvdVNIE6xdGLK6R
TLSH T144E04DEF0022CF13820C1C0830A2F833A031C6C023A0CA0BAFD9803B80C9A20B32CE61
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://130.12.180.64/splarm495b770ac94c945f1e442209fa34e7dd7449469150aace82003e4c76bdccdd4a9 Miraielf mirai ua-wget
http://130.12.180.64/splarm599126f681aa44a7d9b99678bdc492133341e2de0ca22c50b014a1e43b8ae2d91 Miraielf mirai ua-wget
http://130.12.180.64/splarm6fa62bcbb4cff0013ab416aaa10c8fe9b2c3beb731db15f27eafba9f81d761343 Miraielf mirai ua-wget
http://130.12.180.64/splarm77cc0c7d015dfef9d1917318d0ec9b7cb9d1bb80d8b2b0bff615814bc2a0726eb Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
mirai
Link:
https://www.filescan.io/uploads/6948129384afa5547b5b6e63/reports/f31686f8-f1a4-46b6-94f1-6591d9b93ee1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b
Verdict:
Malicious
File Type:
text
First seen:
2025-12-21T12:39:00Z UTC
Last seen:
2025-12-23T05:09:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2b8ddc21-04ec-4498-b798-7f8836665c78
Behavior Graph:
Download SVG
%3 guuid=cae4c722-1c00-0000-60f7-f224810a0000 pid=2689 /usr/bin/sudo guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698 /tmp/sample.bin guuid=cae4c722-1c00-0000-60f7-f224810a0000 pid=2689->guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698 execve guuid=2f6e1e25-1c00-0000-60f7-f2248b0a0000 pid=2699 /usr/bin/wget net send-data guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=2f6e1e25-1c00-0000-60f7-f2248b0a0000 pid=2699 execve guuid=fa59cb27-1c00-0000-60f7-f224960a0000 pid=2710 /usr/bin/chmod guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=fa59cb27-1c00-0000-60f7-f224960a0000 pid=2710 execve guuid=25600328-1c00-0000-60f7-f224980a0000 pid=2712 /usr/bin/dash guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=25600328-1c00-0000-60f7-f224980a0000 pid=2712 clone guuid=45490928-1c00-0000-60f7-f224990a0000 pid=2713 /usr/bin/wget net send-data write-file guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=45490928-1c00-0000-60f7-f224990a0000 pid=2713 execve guuid=8693f72b-1c00-0000-60f7-f224a80a0000 pid=2728 /usr/bin/chmod guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=8693f72b-1c00-0000-60f7-f224a80a0000 pid=2728 execve guuid=9981652c-1c00-0000-60f7-f224aa0a0000 pid=2730 /usr/bin/dash guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=9981652c-1c00-0000-60f7-f224aa0a0000 pid=2730 clone guuid=cd0f822d-1c00-0000-60f7-f224b00a0000 pid=2736 /usr/bin/wget net send-data write-file guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=cd0f822d-1c00-0000-60f7-f224b00a0000 pid=2736 execve guuid=b85c9b31-1c00-0000-60f7-f224bc0a0000 pid=2748 /usr/bin/chmod guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=b85c9b31-1c00-0000-60f7-f224bc0a0000 pid=2748 execve guuid=4ef5cf31-1c00-0000-60f7-f224be0a0000 pid=2750 /usr/bin/dash guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=4ef5cf31-1c00-0000-60f7-f224be0a0000 pid=2750 clone guuid=a27c5732-1c00-0000-60f7-f224c10a0000 pid=2753 /usr/bin/wget net send-data write-file guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=a27c5732-1c00-0000-60f7-f224c10a0000 pid=2753 execve guuid=b4aebc36-1c00-0000-60f7-f224cf0a0000 pid=2767 /usr/bin/chmod guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=b4aebc36-1c00-0000-60f7-f224cf0a0000 pid=2767 execve guuid=192ff836-1c00-0000-60f7-f224d00a0000 pid=2768 /usr/bin/dash guuid=f264e524-1c00-0000-60f7-f2248a0a0000 pid=2698->guuid=192ff836-1c00-0000-60f7-f224d00a0000 pid=2768 clone f22fee75-ab34-540d-95fe-696883c6f4ad 130.12.180.64:80 guuid=2f6e1e25-1c00-0000-60f7-f2248b0a0000 pid=2699->f22fee75-ab34-540d-95fe-696883c6f4ad send: 135B guuid=45490928-1c00-0000-60f7-f224990a0000 pid=2713->f22fee75-ab34-540d-95fe-696883c6f4ad send: 135B guuid=cd0f822d-1c00-0000-60f7-f224b00a0000 pid=2736->f22fee75-ab34-540d-95fe-696883c6f4ad send: 135B guuid=a27c5732-1c00-0000-60f7-f224c10a0000 pid=2753->f22fee75-ab34-540d-95fe-696883c6f4ad send: 135B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b
Threat name:
Document-HTML.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-21 15:30:33 UTC
File Type:
Text (Shell)
AV detection:
9 of 24 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4jf42j6owmupj2hvdmoi3vpvlvex6e6zrbf2jivbqoeqs6iux4vq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251223-lmeajssjby/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh e24bcd27ceb328f4e8f51b1c8dd5f55d497f13d9884ba4a2a18389097914bf2b

(this sample)

Mirai

elf 0b8b4be3fec08aaec58830ce72504f9b393eab3a8190dcd14a7886aef07e28a9

  
URLhaus
https://urlhaus.abuse.ch/url/3739277/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3739319/
  
URLhaus
https://urlhaus.abuse.ch/url/3739351/
  
Dropping
MD5 207c0822ec6241e0b7ea55e7513824bb
  
Dropping
SHA256 0b8b4be3fec08aaec58830ce72504f9b393eab3a8190dcd14a7886aef07e28a9

Comments