MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29
SHA3-384 hash: 55b674836fb519148da89a0ef818a02afe84ed148fd09cc9eb544abfc4fdb949208b132681f4eeec96f9c5760cb973b5
SHA1 hash: 579c98954426e3e1851f6d61a3b4fd26f6c70cc9
MD5 hash: 861b46e31c9bb2f6b1354f00af2ee2ec
humanhash: uranus-nineteen-carolina-apart
File name:splash.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'435 bytes
First seen:2026-03-18 02:29:03 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:wuYWYLfLSbNISCUKN9SQ5xMN9wUyAG7ciP8aDmFkr+3A:wu7YLfL0CUq9SQ5xMN9w571P8aDmWr+A
TLSH T164416099E17304FC6D988A49396F77107284948128FB6F4F68CCBFF940CEF00E612666
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://203.161.47.138/oop/dontcrynow.arm46dcd95e5b1f0b36a45e0a16a8513e082d23efa6d695f4702ea7e1ad79236c17 Miraiarm elf mirai ua-wget
http://203.161.47.138/oop/dontcrynow.arm5ae5865c6f0d7e4839d9843f6871a4b756bde4346f70ea358988a3c49132d0919 Miraiarm elf mirai ua-wget
http://203.161.47.138/oop/dontcrynow.arm66d8794dc4b50aba8363b10a7eabb395f101bb3557c333da1fed5fe7838a36bc6 Miraiarm elf mirai ua-wget
http://203.161.47.138/oop/dontcrynow.arm75374977ec8c1c386863c96881a310ee350811ae057849c69f35dca1da69acbc3 Miraiarm elf mirai ua-wget
http://203.161.47.138/oop/dontcrynow.m68kcea61191aa2b73cb5c87619d6f829b91002db7acbf4ec9a1bf6fa8dfbb770a73 Miraielf m68k mirai ua-wget
http://203.161.47.138/oop/dontcrynow.mipsf30856c95d68ab3b4361101905746525a36dfb62dd3b564de0a1d92581d756d1 Miraielf mips mirai ua-wget
http://203.161.47.138/oop/dontcrynow.mpsl5ef3c087cd5d02544be1c631c61b18a1bb4efd32b106023fb0dda00668b91424 Miraielf mips mirai ua-wget
http://203.161.47.138/oop/dontcrynow.ppce0e170fb4ccbd24e44591435189b36f3301095e5511a5bcf4655087848e8d69c Miraielf mirai PowerPC ua-wget
http://203.161.47.138/oop/dontcrynow.sh4abf52a11e992dd93925a268fd70ad77423bfcddfa4e579a9e668fd0f07e138d8 Miraielf mirai SuperH ua-wget
http://203.161.47.138/oop/dontcrynow.spc48881849ad56486002fa0999bbcd05d15cda932189e129f0f711f43b4a300ed5 Miraielf mirai sparc ua-wget
http://203.161.47.138/oop/dontcrynow.x86395dd5b4d45768d2799c94d03ef34a06360029080a8d956d89cde5ad0892204d Miraielf mirai ua-wget x86

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
medusa mirai
Link:
https://www.filescan.io/uploads/69ba0dfd2000fc76c3e7a26a/reports/d545a0ce-bee5-4ccc-8de2-15d3ba72b87b/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p
Link:
https://opentip.kaspersky.com/13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4f5dbdd8-2005-4434-a563-f459fb1d8768
Behavior Graph:
Download SVG
%3
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-03-18 02:29:25 UTC
File Type:
Text (Shell)
AV detection:
17 of 24 (70.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cotmvmujbprujajrhffjm7wmpnbigj7cizpew5tug2ij6b7ytuuq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260318-cyqchsf15m/
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/13a6cab2890b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29

(this sample)

Mirai

elf 27278538affd35ba966fd23c1f380fd55d36b33a6741d0f03655dae0ef92d689

Mirai

elf 46dcd95e5b1f0b36a45e0a16a8513e082d23efa6d695f4702ea7e1ad79236c17

  
URLhaus
https://urlhaus.abuse.ch/url/3798266/
  
Delivery method
Distributed via web download
  
Dropping
MD5 dbc15f84b3f2300c9788f58aa2e79ee8
  
Dropping
SHA256 46dcd95e5b1f0b36a45e0a16a8513e082d23efa6d695f4702ea7e1ad79236c17

Comments