MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d84a822da198bf842bc9ea2bad0a672f00cac57b0575ede7b726a400bb78fcad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	d84a822da198bf842bc9ea2bad0a672f00cac57b0575ede7b726a400bb78fcad
SHA3-384 hash:	bd914bee4e47044e6052dc6c77007d30ee53dfc3308388e19b3099458cf968b80d39cb1a84b0de4b67a5118c73740375
SHA1 hash:	4011be455c2aeff17b4bd2a25880631dbcd326af
MD5 hash:	b951c20602c4a74e0658b68082ac2438
humanhash:	enemy-social-autumn-oregon
File name:	femboy.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'207 bytes
First seen:	2025-11-23 17:26:23 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:z0FkqS3+qSN7C0FkqZx+qZphi0FkqO+q9f0FkqSb7+qSN0FkqSG+qSJ0FkqStr+U:wSsN7XZlp5hsvFAZ64zbRv
TLSH	T1324186C41236667AB8537473B1A74944B4A2F0D636C78E47AEFD34E2C44CD003AEAE72
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://95.182.100.117/systemctl/bin.powerpc	437fe2ea35b2f241e8a6210fbfa41b2e550cbec12948e0d9035e5a4b11b18331	Mirai	elf mirai ua-wget
http://95.182.100.117/systemctl/bin.mips	bd294988b105332f922819984c7a132acdd40d5bef0db066d072567ce40d7ecd	Mirai	elf mirai ua-wget
http://95.182.100.117/systemctl/bin.mipsel	2bd87e9554f51fe80ebf48480ee003c7c3594fe3045256e413d896b86fad8591	Mirai	elf mirai ua-wget
http://95.182.100.117/systemctl/bin.armv4l	3273f921b59c98f024bfe386fd054f20e40e200c16040f09760549b8c1ff6751	Mirai	elf mirai ua-wget
http://95.182.100.117/systemctl/bin.armv5l	3582cb544618c049b8fa9bc5ddf2b9faca22acdb4ea51d92c3abcc91674e0a0f	Mirai	mirai
http://95.182.100.117/systemctl/bin.armv6l	bd3f1730ddab14b7738bcf408872053d788dc727cfee126730f7ffc13040e3d6	Mirai	elf mirai ua-wget
http://95.182.100.117/systemctl/bin.armv7l	560a3e1264aa447a680ac2deb7b8e71e2ec8c45a1e710e4ad3838396d82942a5	Mirai	elf mirai ua-wget
http://95.182.100.117/systemctl/bin.m68k	d901c6f0681979e0e8c0b68460bae492f8cb02c300c9071adc4041f7e9a44dcb	Mirai	mirai
http://95.182.100.117/systemctl/bin.sh4	a41ed253774c35c72278881b53779f9fa14ab5cb06d092b092baa5f77ddc1e60	Mirai	elf mirai ua-wget
http://95.182.100.117/systemctl/bin.i586	59df147cf8b3ba79833010be75d42b5deec66c09fcb2b4540ec5eaa620566cb7	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bash lolbin mirai

Link:

https://www.filescan.io/uploads/692343f3f96b58f0dc80ef8e/reports/3e1a3ba9-a1fc-4137-a2c8-0236978a2e9a/overview

Result

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-12T17:51:00Z UTC

Last seen:

2025-09-12T18:28:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d84a822da198bf842bc9ea2bad0a672f00cac57b0575ede7b726a400bb78fcad/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d309616b-5f06-440a-bfbc-9865a5495e30

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d84a822da198bf842bc9ea2bad0a672f00cac57b0575ede7b726a400bb78fcad

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d84a822da198bf842bc9ea2bad0a672f00cac57b0575ede7b726a400bb78fcad/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-11-22 20:42:00 UTC

File Type:

Text (Shell)

AV detection:

22 of 36 (61.11%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3bfielnbtc7yik6j5iv22cthf4amvrl3av263z5xe2sabo3y7swq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251123-v1g32abj9y/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.