MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0f828c946b98ac14b8ee7f12d85c82d7773f5671b39df45f025f54127986d58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0f828c946b98ac14b8ee7f12d85c82d7773f5671b39df45f025f54127986d58
SHA3-384 hash: 1127b8e52fd639701720f3e0fa0ccbe10d0be85c673023afb0a8c738af90cca87c366b023da7fb4685c368983cd1ad5b
SHA1 hash: 6d97e27d696e62a72458f456cd3572c173daf2a8
MD5 hash: c24137535d17c8be48f5f74a45634ab0
humanhash: high-north-cup-venus
File name:lmao
Download: download sample
Signature Mirai
Create hunting rule
File size:906 bytes
First seen:2025-01-02 12:41:28 UTC
Last seen:2025-01-15 01:53:26 UTC
File type: sh
MIME type:text/plain
ssdeep 12:ESnJAFK/XS0abmRXSmi3QAjSrXUSrmK5XS9NIl52LGjSO0LKzKWSy+tVZ8SIS+7:EeJX2bgXsljhUm+QNI7hQKz/+tYDV
TLSH T158114FCEA3111E07050EEE4EB2A7C6A96055D5CF2B874FF67E9C043EC4DC9187025A68
Magika txt
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://103.188.82.218/mips3609f8f3d45d41da70c11fc558eb7e37b6cae17d88c0179a4473d9991dad23cc Miraiddos elf HailBot mirai
http://103.188.82.218/mpsl647723492da9410480ea3337ea11c5e39d360305dea6a09eb661cce35b9a8b7e Gafgytddos elf gafgyt HailBot mirai
http://103.188.82.218/x86bbbd8da54939b309d5355cb37e5e526d0fd504634fe8e17d5b6a79635a951028 Gafgytddos elf gafgyt mirai
http://103.188.82.218/armb4ab364f43de425342f4aca0f4b1986fcc8e88be840a4be9c4bd4fff3ea7ac57 Miraielf HailBot mirai ua-wget
http://103.188.82.218/arm5f641c646b09a47bce17d7c55b7323bb67bf16c151269d125f9615455955ab201 Miraiddos elf HailBot mirai
http://103.188.82.218/arm61200075da17d87d7748d66dde17eceb0f75fb2a2a491da622db0cdd3a61077a1 Miraiddos elf HailBot mirai
http://103.188.82.218/arm71473bb781c7add63f1a618d9a1a3ae5ab9fc8e58d3c734fd0eea422ff7436b70 Miraiddos elf HailBot mirai
http://103.188.82.218/sh4c34e1ab4eb2920835607e62307be32b42d9de09aa0b04ce7199e378801fede24 hailBotelf mirai ua-wget
http://103.188.82.218/ppcfa14447ee4ed6660aa798e1ab3993dd47782d0fb07858514fc5fee99d770226a Miraielf HailBot mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
113
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67768bfc74a2bd296e2521e7linux22vpnfull_triage
Tags:
gafgyt mirai
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug expand lolbin remote
Link:
https://www.filescan.io/uploads/6776899d3d1131f9b91cac3f/reports/3e1cf3ce-16a3-4fff-a8f6-180f8f04f639/overview
Verdict:
Malicious
Labled as:
Linux.Medusa.D.Generic
Link:
https://www.hybrid-analysis.com/sample/f0f828c946b98ac14b8ee7f12d85c82d7773f5671b39df45f025f54127986d58
Result
Verdict:
MALICIOUS
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/f0f828c946b98ac14b8ee7f12d85c82d7773f5671b39df45f025f54127986d58
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0f828c946b98ac14b8ee7f12d85c82d7773f5671b39df45f025f54127986d58/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2025-01-02 12:52:09 UTC
File Type:
Text (Shell)
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6d4crskgxgfmcs4o47ys3boifv3xh5lhdm456rpqex2ucj4ynvma._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250102-p3284asmft/
Behaviour
Modifies registry class
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f0f828c946b98ac14b8ee7f12d85c82d7773f5671b39df45f025f54127986d58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts
Rule name:golang_david_CSC846
Create hunting rule
Author:David
Description:CSC-846 Golang
Rule name:XWorm_3_0_3_1_Detection
Create hunting rule
Author:Archevod
Description:Detects XWorm versions 3.0 and 3.1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh f0f828c946b98ac14b8ee7f12d85c82d7773f5671b39df45f025f54127986d58

(this sample)

Mirai

elf 0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf

  
URLhaus
https://urlhaus.abuse.ch/url/3386372/
  
Delivery method
Distributed via web download
  
Dropping
MD5 0d6189f4e61001f513d4e09331cbac30
  
Dropping
SHA256 0ef56902fe4ff6364b5f464dd189f8d0663220946d7c2e2f3f09c5fab45669cf

Comments