MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01715e4a2c3fbadc116a47da778c9fb2d583f24a93ed3c07203dd6936f219a4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	01715e4a2c3fbadc116a47da778c9fb2d583f24a93ed3c07203dd6936f219a4c
SHA3-384 hash:	ca26b18a78186d35597fd3cbd38b7d35acb823347e01ccf1800c8f232cb561b0388d6d5cade65ab0c16eea57d76c1587
SHA1 hash:	dc83319902a93eabff11bde12cbb8d11f9444215
MD5 hash:	3464636dd2c1e9081e33eccbfea76b59
humanhash:	bakerloo-december-papa-saturn
File name:	tot
Download:	download sample
Signature	Mirai Create hunting rule
File size:	939 bytes
First seen:	2026-10-22 15:57:04 UTC
Last seen:	2026-10-23 10:10:42 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:E60V4Ti0V4ThCV4T/V4Tf2V4TsCV4TXCV4TTV4TnV4TiV4TRWVh:E60VKNVKwVK/VKuVKjVKSVKTVKnVKiVP
TLSH	T11211429C01747475C488D9197792C51CF84087CA28BB1EA8ACE22738C8F6ACE7435F1E
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.40/jklarm	2f052afbdbe8e7c75152865006dab713d06d0595bca172acd4127c2cf9850aa1	Mirai	elf mirai
http://176.65.139.40/jklarm5	2b74690e4039eb8d0955525da289efa19db068b34ba37a310e8049232b373756	Mirai	automated cowrie honeypot mirai
http://176.65.139.40/jklarm6	5410f94398ac7fc716285e2e5dc959e193707e9e3892bf8483b4e4b68e5c0a5a	Mirai	automated cowrie honeypot mirai
http://176.65.139.40/jklarm7	fd7d3abff959a5790edc95eba30479e19c6242d3b32abc95a95fd12a55e989dc	Mirai	elf mirai
http://176.65.139.40/jklm68k	9e6be07d6fb7ed87dd4b55ea892d823719cf5d102324e6bbfacb15861ec1ded6	Mirai	elf mirai ua-wget
http://176.65.139.40/jklmips	7df9ad411f034395500a16dfe33d100ea2ab34c9ca0520e101b0b298db3918fc	Mirai	elf mirai ua-wget
http://176.65.139.40/jklmpsl	353e0bac2ad9ad2c57365688c47666edf1f9424853e7e4f47ef9f8278d62e1ee	Mirai	elf mirai ua-wget
http://176.65.139.40/jklppc	51283ea23f0e9ab8d8eff3cd7f06e5e357c0abc5cfac80289b9b7d94587faa7e	Mirai	elf mirai ua-wget
http://176.65.139.40/jklsh4	30ddb929abcea6e444fea8a74824302df2c66ddb48b99a3ba58f5a9aa967e6d4	Mirai	elf mirai ua-wget
http://176.65.139.40/jklspc	bb8aa148998808a63fa6db511dd144d4942831a4975d12ca8c7f50abbe36a9d8	Mirai	elf mirai ua-wget
http://176.65.139.40/jklx86	d0312239fdb46ff37e658af54855ff867b1a158e70b04a444c37d236fc68cb55	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ada325ba12bac6705781c9c/reports/16e010a1-af00-4807-bf62-9d79ee0c0d1d/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-22T13:23:00Z UTC

Last seen:

2026-10-24T13:15:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/01715e4a2c3fbadc116a47da778c9fb2d583f24a93ed3c07203dd6936f219a4c/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f4d7dc3d-b6fa-4159-8b87-ea7050e6eede

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/01715e4a2c3fbadc116a47da778c9fb2d583f24a93ed3c07203dd6936f219a4c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01715e4a2c3fbadc116a47da778c9fb2d583f24a93ed3c07203dd6936f219a4c/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-22 15:57:18 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=afyv4srmh65nyelki7nhpde7wlkyh4skspwtybzahxljg3zbtjga._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/261022-td2ngs11fw/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/01715e4a2c3fbadc116a47da778c9fb2d583f24a93ed3c07203dd6936f219a4c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Downloader_Unknown_WgetChmodExecute Create hunting rule
Author:	Marjoriefort
Description:	Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:	misses_archive / grappe 5.182.210.174