MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d3ec1b691d143a32c148acd17a70a68bbf7955da58bd7cf860abe727b642145. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	0d3ec1b691d143a32c148acd17a70a68bbf7955da58bd7cf860abe727b642145
SHA3-384 hash:	22b41060aed545e48a89d35fa54f365529a04d604064c8c35133e3e80f1b5dc2b180116c755a3e4bbb762628a5c25417
SHA1 hash:	960cdbc7d058eeb21faf6c742fb44614932b698a
MD5 hash:	4196877ad167d19ec69c981182afa3f8
humanhash:	two-pasta-potato-eight
File name:	run.sh
Download:	download sample
File size:	4'731 bytes
First seen:	2026-10-09 23:39:46 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:rl383vTiXLxd62AV35olPgj7yW6dn546Q3d1STBWLYTg/3iVXjIFFT4FTxaflcJb:rl383vTiXLxd62AV35olPgj7yW6dn54a
TLSH	T135A1D48A6170D73DA46FDDBCBAE70A40588945E235B13F395EB008933C89970B389F5E
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.aarch64be	763a5313b5ce7a7adbc9b3f3e32e7ac1a81274437cb1100a1f06c708e57826ac	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	48dfe414f0a7c65142e363655ea7144eb74c9d23b246904b21e4685031c2c6e8	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	8e309f91353197022b436a770fff7421b76552fc7eb052685413f08e17db49f6	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	a2c234532b5d6f314b3ec4cf29eff0ea6f39d3ce23940e97c339a562c1e570d4	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	59f255347969aa82d875e878ee41604dcc7475a63c73dba58cf8ff2569669116	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	ca14dc48ccad7c092d942e290e4519c861eb6145a1fbd89ed81b3c15e2da0f83	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	28f8e370da1c68269b2ee15985216d9cc0dded716687833bac18379b235c43a3	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	8ae5df9b6e67b60c19a55793d8ba1b614c6fa4d42e75582697a6db2d3eda150b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	c238e2f72a3940662daa22b1b5c81c4b42eba1b78a75a764a7ebb4f67ec40bd7	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	28c8a375115f283377aab40b697d6019d3360c5e913f0d159b1ee8f5af9003ec	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	bf1654fc2e9fd294ab2243fd088a0f933d66f7a8db2cd4542ee94ba48c1a4816	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	d6f5cfc4c369d784a0cd75a520d6e719954c6aef4f9a3720150390fa0fcb3345	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	650cccc991d70a021d8b5efecce182378657fa7385cf0ec487cc6056662babb5	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e500mc	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e5500	b69f10b45ec15cbbf5d6c585d147e1e3948e0e4dac091db488a07133164d1755	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e6500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.m68k-68xxx	n/a	n/a	elf m68k opendir ua-wget
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	d2dad3befbc3598b574187cfca2ca7cd2f8bb55bbd682d4190767b98d03cb1ea	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32r5el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32r6el	8b89aecfc6aaa0be8c7dd842e9bc7feed8af05f2eed6021dada1ff8b536f1e8e	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	e6c403005b6b5573b35c5f37918e3297183ba5de0266b4fb878036be67ea4092	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64el-n32	fcb4ad801db84d6a9428ea7b56503fdd26f1ded8f195f1a08daaca5fd77fa272	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64-n32	8f3e2a9f8331265e999b06f20508cbdfb26b474e870bd3f5add584867a34e9b5	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64r6el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	62900587da4553f9f3c84a31bf2fbac85c286731836a83e7c213cb614ccc152b	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	626e8187d504a416705b551c52f91856c71d98eab341c5820acf555e0bb23f1d	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.power8	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.power8le	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.powerpc	1c707bbdf2937e5c5e64e6a6bc03349ddd4b2ed7f870de7b8bf7e8989e09fa78	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.ppc440fp	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	4f2c77768598082bb7574eef1d558826b4016106cadb07962b8144162d7ce956	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.riscv64	1129446cb94148988acd6efd5ba70a7077ef3e2c9db62230a61c44da92345810	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.s390x	74b8b95d4153009990ca3645f317ce76399f1892d38f79340920449a396bffcc	Mirai	elf mirai opendir s390x ua-wget
http://130.12.182.77/main.sh4	c81efd1b47f6c372d670d6f0ebde6b3dcba715c0f4bf172a7662ba4240f41944	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sh4aeb	n/a	n/a	elf opendir SuperH ua-wget
http://130.12.182.77/main.sh4musl	dc0e5c6523846e53f5b0d1660732b6d0ed6b58a5e5456fc7879ba5cee2a7213a	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sparc	7e9fa00a2d3224c15c3d15a8aea4590d5e257d63cd51b0f92ab1eb85af19db04	Mirai	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.sparc64	0d8e03947e473f1fa1f0cde6efbe74fb4d0df8658352b4fdeef4c29cd3fa5aaf	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.sparcv8	eb93f2969d04852a87df1a90408460ed08eb193338dac1c8d22b9649f2ef316b	Gafgyt	elf gafgyt opendir sparc ua-wget
http://130.12.182.77/main.x86-64	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86_64	ad6095e0cd1aac8e57137bff757e195fb617b9332fcc47d9be11c52ff42c42b4	Mirai	elf gafgyt mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-i7	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-v2	237f12f5a34ae1c7e21aa2c2e539d6f75c272b6596909a7c47a06a75b722ca4b	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v3	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v4	e4ac5e615f12c406041329408b7d501d4ae476a1232c054b1365bc4c34983967	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-core2	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-i686	997a4146f9916f2f8491e6ad1c9b7c1746912a023ae0e2aeb446ef6983b174e1	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.xtensa	0eaee2cebbeca2f7f2c0cdee58d0f7d039c53576148604f7da30e05b05a13ea2	Mirai	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ac97b65c7b121d141e9a080/reports/902d8298-0dfc-45a9-9d9b-9df4f1106bc3/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-10-09T21:32:00Z UTC

Last seen:

2026-10-11T12:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0d3ec1b691d143a32c148acd17a70a68bbf7955da58bd7cf860abe727b642145/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ada93f12-e53f-46d1-9724-b074a7b34ac4

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0d3ec1b691d143a32c148acd17a70a68bbf7955da58bd7cf860abe727b642145

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0d3ec1b691d143a32c148acd17a70a68bbf7955da58bd7cf860abe727b642145/

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-10-09 23:40:27 UTC

File Type:

Text (Batch)

AV detection:

11 of 38 (28.95%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bu7mdnur2fb2glaurlgrpjyknc57pfk5uwf5pt4gbk7he63eefcq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261009-3n1zdawtdv/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh