MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc715a7ebcb71d9020169f9bd23d12f3dfeb0aa311785cb93d5725f1b2bfe5b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	fc715a7ebcb71d9020169f9bd23d12f3dfeb0aa311785cb93d5725f1b2bfe5b8
SHA3-384 hash:	30b5702cc6c84d739846f3efa75bc80355991aed8cffaf8a4f67caaed8a5df259b61b475c6008f1d42611c3711652d28
SHA1 hash:	766f17cecce6714470395503fa3e82a79252976f
MD5 hash:	f4cc8bc4b8bfc160030972b403311036
humanhash:	dakota-eighteen-bakerloo-video
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	690 bytes
First seen:	2025-10-18 10:01:25 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:LMF/ckhMq9Ktk+MF/ckhEyoKtdQMF/ckhE7oKtiRzFXAMF/ckhEpoKtaJAMF/ckI:otFVQc3BBBnTbNmSXfP9DAYin
TLSH	T1810144CD60641981C12BFDC63319DD8AE047E9E75B47CFB2A87918DBE05E4243013784
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.253.86.21/bot.i686	533000a78d42bee90839ed417fb216bf9dbb6afdbb5e285efe3bda5a24d8e0a5	Mirai	elf mirai ua-wget
http://5.253.86.21/bot.armv4l	34c7bfb6808bb3b027bb6c7551cfc92e02f1748d314fe65883a01c6738c8aaea	Mirai	elf mirai ua-wget
http://5.253.86.21/bot.armv5l	n/a	n/a	elf ua-wget
http://5.253.86.21/bot.armv7l	eaf3447663d95584650861c8c2afa0cceff6df64e0215b27ebbfa777a0c65ec7	Mirai	elf mirai ua-wget
http://5.253.86.21/bot.mipsel	e827115ddaece0476a81cd528961283e570eaa9339fb58b483c02630889064a0	Mirai	elf mirai ua-wget
http://5.253.86.21/bot.mips	b399eaf6238be55d5967d150d8ddce452ca38d9d283b5ed0a4693fecd86a8819	Mirai	elf mirai ua-wget
http://5.253.86.21/bot.i586	c4381c1d7a61c78e12a7b903d1f5ab531c7605a814022e90f3020d0a3c3d8a15	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

File Type:

text

First seen:

2025-10-18T08:13:00Z UTC

Last seen:

2025-10-19T06:24:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fc715a7ebcb71d9020169f9bd23d12f3dfeb0aa311785cb93d5725f1b2bfe5b8/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/f67884de-7ec7-4068-b74e-38ddc5aa7d5b

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fc715a7ebcb71d9020169f9bd23d12f3dfeb0aa311785cb93d5725f1b2bfe5b8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc715a7ebcb71d9020169f9bd23d12f3dfeb0aa311785cb93d5725f1b2bfe5b8/

Threat name:

Linux.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-10-18 10:02:43 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ryvu7v4w4ozaiawt6n5epis6pp6wcvdcf4fzoj5k4s7dmv74w4a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251018-l2mv8szjam/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fc715a7ebcb71d9020169f9bd23d12f3dfeb0aa311785cb93d5725f1b2bfe5b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.