MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e89af3e8129665aa440a1ebf26b6cf0815040d5416b468ca75cbfbd20b149f6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	e89af3e8129665aa440a1ebf26b6cf0815040d5416b468ca75cbfbd20b149f6a
SHA3-384 hash:	24ee886100f894904236d2366f74d77cc69dd0099badf3b891cb61cefaacbae9e6be6e9e201f51737b76d5f00e7bf433
SHA1 hash:	f8d6d57785128686ac347629d1b55627b8aeb6d9
MD5 hash:	e62dff991f276bcbcaa8a0d752b80f6a
humanhash:	carpet-red-fix-louisiana
File name:	bin
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'023 bytes
First seen:	2025-01-12 19:56:09 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vYMVOSYf/fnhaIOSYoNpouJWoOSY4Z5OSYt1OSYaNpay9OSYTVOSY9xOSYY/jOSf:vbRwHn9RDNCw9Rp5RYR9Sy9RiR+RTRKe
TLSH	T1AC41658693A106312DE3DD5771E4C964F1A664DBBCE0AF5194DE3CEDD88FF042480A93
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.59.248.92/bins/Cinquento.x86	fcafdc9a736da58957c22b2c0904ba678a5001a090598dd100bfac591ae4408a	Mirai	elf mirai opendir
http://5.59.248.92/bins/Cinquento.mips	515cf0523472e7bbe5b422c3511545a3597bb9a9d4c0d4dd4447f2a7501a79d5	Mirai	elf mirai opendir
http://5.59.248.92/bins/Cinquento.mpsl	1b827695fedd23e8418cb6f368abcab51f89dde3e7715730af2f88f10c515e3f	Mirai	elf mirai opendir
http://5.59.248.92/bins/Cinquento.arm4	n/a	n/a	n/a
http://5.59.248.92/bins/Cinquento.arm5	cb2706d62de598be16fd338017cd9996848cbc78f0aee981aa00bb0fd8a1680e	Mirai	elf mirai opendir
http://5.59.248.92/bins/Cinquento.arm6	00f98e30d0bb1fbed6bce1d83709a1105611755baa8e94a0eac2cf930ac58018	Mirai	elf mirai opendir
http://5.59.248.92/bins/Cinquento.arm7	6ed67622b1164dbdb53f767002dfae9a65d68760da1cf25631c4f4c7fa64174a	Mirai	elf mirai opendir
http://5.59.248.92/bins/Cinquento.ppc	a6cc850dd77bc277c14c2106d2fa4f41822097d9f7fef86327f9ecca5f74c196	Mirai	elf mirai opendir
http://5.59.248.92/bins/Cinquento.m68k	174fdab071a3759753c98d4f2f554623ca5bfe165e888e7658dfffaff3358901	Mirai	elf mirai opendir
http://5.59.248.92/bins/Cinquento.sh4	366def995e8c81dd60c8ea538f00788d97080b79d9ca3c663dba728459913503	Mirai	elf mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

132

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67841e912c8240e189bc29d0linux22vpnfull_triage

Tags:

trojandownloader overt agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/67841e8f9ae0ee7e9dea5ac2/reports/dfae7daa-c4f5-4e20-807c-c0493dd47e04/overview

Result

Verdict:

MALICIOUS

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e89af3e8129665aa440a1ebf26b6cf0815040d5416b468ca75cbfbd20b149f6a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e89af3e8129665aa440a1ebf26b6cf0815040d5416b468ca75cbfbd20b149f6a/

Threat name:

Win32.Trojan.Mirai

Status:

Malicious

First seen:

2025-01-12 06:12:24 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5cnph2asszs2urakd27snnwpbakqidkuc22grstvzp55ecyut5va._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:sora antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250112-yn8l1awrgv/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (461720) amount of remote hosts

Creates a large amount of network flows

Mirai

Mirai family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e89af3e8129665aa440a1ebf26b6cf0815040d5416b468ca75cbfbd20b149f6a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.