MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2232a4a01f3805c54622553fedd4471c062821c939e78fab52033c8a66f0bf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	f2232a4a01f3805c54622553fedd4471c062821c939e78fab52033c8a66f0bf5
SHA3-384 hash:	63d3973f3e871110553d3af7b9a9365973bc2b48ec77c04b1219271b77e4725228bf32e006c8e430499a127ec8150e39
SHA1 hash:	ed15e49ef669149ef00093525e5e06b66a4f01e3
MD5 hash:	1ab959ee47010bd5a8cba9e7b4cd6c0b
humanhash:	november-green-princess-happy
File name:	bee
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'164 bytes
First seen:	2025-02-27 10:57:46 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:2X+pXokWMKXHijXDze3LXDXY0+cXDst3sEXD6NIxqKLXDeVKEcX8g1X5WEwFVe:2X+pXokdKXHijX/2LXzhDXYGEXlRXqVy
TLSH	T15021E0EA39313A060009DE2DB173B199F875C9CB2B974BD66E9C913F84CCB16F019994
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.188.83.11/nshkmips	6f9c48597c27dcf08b71f0e6a3c6eba3e4263add4eb4b5763d7dd9845e530e3a	Mirai	elf mirai
http://103.188.83.11/nshkmpsl	b8f51776ef09caccdb7019655cbc5d11bbd57d836cacefd4f6b5d7b5cd4b71eb	Mirai	elf mirai
http://103.188.83.11/nshkx86	ecdc4e4f8b45a75c350beff554b3fe8b7d361f1c8240bcdc4bdcc74962045fa6	Mirai	elf mirai
http://103.188.83.11/nshkarm	28ea86454ba4e666d78ca708cef5af2dcd0171e073fd018d58a51c309c0c04dc	Mirai	elf mirai
http://103.188.83.11/nshkarm4	28ea86454ba4e666d78ca708cef5af2dcd0171e073fd018d58a51c309c0c04dc	Mirai	elf
http://103.188.83.11/nshkarm5	7b4e8ec9eef3f4155ce39445987721ffa282b66f32c1a7880364881cb89e5843	Mirai	elf mirai
http://103.188.83.11/nshkarm6	30e679b1d009d04c4bdd24e422ff05394a2bf9e57339409dba56442d5b2a7395	Mirai	elf mirai
http://103.188.83.11/nshkarm7	96e8f86ff694aeead8b89870db584c43cd1acec8089882586d281b331874018d	Mirai	elf mirai
http://103.188.83.11/nshksh4	87d305402b68f6aa908debb5ef3fe43b5537f8627e2ee750b2ca62cd71e78ee9	Gafgyt	elf gafgyt
http://103.188.83.11/nshkppc	0170ceaac5745441f255b036cb05e4f6563d85c78bb8afacd517478d788322e9	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c045d04e50050b2e6ec0f9linux22vpnfull_triage

Tags:

phishing backdoor agent overt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive lolbin remote

Link:

https://www.filescan.io/uploads/67c04543f8726576332b5aa8/reports/95306123-1dc6-485e-aa53-0bdb41a1d9cf/overview

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/f2232a4a01f3805c54622553fedd4471c062821c939e78fab52033c8a66f0bf5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f2232a4a01f3805c54622553fedd4471c062821c939e78fab52033c8a66f0bf5/

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2025-02-27 11:00:16 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6irsusqb6oafyvdcevj75xkeohagfaq4sophr6vveaz4rjtpbp2q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250227-m335aawks9/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f2232a4a01f3805c54622553fedd4471c062821c939e78fab52033c8a66f0bf5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.