MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef320e36facfe3273cd3aa07db50598404eed9d017c236e95270cdf11c8dbe44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	ef320e36facfe3273cd3aa07db50598404eed9d017c236e95270cdf11c8dbe44
SHA3-384 hash:	10742f5ceee3ed505fe957c9552024915eccab8b26f0c858b1b20c4d01d61e7c918e4925cd1473e22bc33a236bf3dfac
SHA1 hash:	55869af225a75c106bff97e228695938c21d1d86
MD5 hash:	6a61aec680ac6ee616225e618e98ef4c
humanhash:	berlin-berlin-utah-lake
File name:	poop.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'305 bytes
First seen:	2025-02-21 07:07:22 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:hJkyYwv5HfSeLt85PArWmzJg8GRqrwmf5VmvXU:HKwvJoPA62
TLSH	T145217C8AF72054928C00DDC873BD8A2B6CD6C5819CCA4F5D8ACF642FF9747297922646
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://107.189.31.150/armbotnigletjsw	8613ef116c48e784e48c55cf4abd1d87453cd6422f39f59871b67ebeb555626f	Mirai	bash curl mirai wget
http://107.189.31.150/arm5botnigletjsw	9a1eeb999b4757b83f9b441c18a20a7b9b1cf5875b0d99a5133a079929cd5beb	Mirai	bash curl mirai wget
http://107.189.31.150/arm6botnigletjsw	5298b1c73efe3bcc4f9d547c143b7b57f2884566e578e037acaf378e7ef4fd7b	Mirai	bash curl mirai wget
http://107.189.31.150/arm7botnigletjsw	bdddda9e4058d7ca4e2e932edf791d6894b9f6236ebffcc896f15bb425b178e2	Mirai	bash curl mirai wget
http://107.189.31.150/mk68kbotnigletjsw	bdddda9e4058d7ca4e2e932edf791d6894b9f6236ebffcc896f15bb425b178e2	Mirai	bash curl wget
http://107.189.31.150/mipsbotnigletjsw	4a1c3d8ba98e3b83dea611d66e2ca7921371dca54a7249a701d875c3d47c8b5c	Mirai	bash curl mirai wget
http://107.189.31.150/mpslbotnigletjsw	3b979aed0cdc9ceae9e45e7c9bff782251591ecdffba3de446a5754cc0211280	Mirai	bash curl mirai wget
http://107.189.31.150/ppcbotnigletjsw	a94ded8de2a29e7deb7d05ce853fb2b555c2a9e51940d8d9d2dc4508705e64e3	Mirai	bash curl mirai wget
http://107.189.31.150/sh4botnigletjsw	7197cf921b53f836a852f25ab9deab0167f3daabf536f21270578b07635f6e1c	Mirai	bash curl mirai wget
http://107.189.31.150/x86botnigletjsw	da8b2fb3f75a7b288a2df61230a803afcfed9d0d9098fabb928f01944d019232	Mirai	bash curl mirai wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b8272628ab76d43a5c3682linux22vpnfull_triage

Tags:

ransomware shellcode backdoor

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin mirai remote

Link:

https://www.filescan.io/uploads/67b8265b5b81efb9a6967ac8/reports/28e98d00-a943-4aec-8b4e-b460837e754a/overview

Result

Verdict:

UNKNOWN

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/ef320e36facfe3273cd3aa07db50598404eed9d017c236e95270cdf11c8dbe44

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ef320e36facfe3273cd3aa07db50598404eed9d017c236e95270cdf11c8dbe44/

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2025-02-21 07:08:11 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=54za4nx2z7rsopgtvid5wuczqqco5woqc7bdn2ksodg7chenxzca._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250221-hx9yeswngl/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ef320e36facfe3273cd3aa07db50598404eed9d017c236e95270cdf11c8dbe44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.