MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1810bc3f8788f60b2bd9f914549eff3f3d2a4aa10cdcef4b3e706f539f9720fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	1810bc3f8788f60b2bd9f914549eff3f3d2a4aa10cdcef4b3e706f539f9720fd
SHA3-384 hash:	29ec53eca8b49d99081fe08a356069dd77fccdb5da74f867c4f6e405fa5f8c4f76e63c304f338d9b213bf20531a5f1c0
SHA1 hash:	51c7bf315de49bb29d456e717ca7276a68844b6a
MD5 hash:	8ba031b9e065595b49eadf0a8229b873
humanhash:	lima-beryllium-mexico-oregon
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'855 bytes
First seen:	2026-01-20 19:14:12 UTC
Last seen:	2026-01-20 21:39:06 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:F02JMPhbiBPkuZOE5EnE2EhEaDFbwY/JUfs/hM3G:F02JMPhbiBPkuZOOcvytFbwU/hM3G
TLSH	T1B05145EB4184C731D60D95CF77F531749207A0939AEB8AC4E9A4087D4ED7D6C72C6E41
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnaarch64xnxn	33f8afafd710c2de9318bf6882ebb6a664f0894ce25a5dec82831cc26875a58c	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxni386xnxn	72547d7604f1dd6417769475936381050663630cea38e8c162e3f67df3dec578	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	b079288b3f751c12f3ea67a3fce181df12ad4ef202f5a727993e754f8b65a521	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnm68kxnxn	58632eea19be197fcce1b385a4f0361d2ab023f04ad492e890efc902acc7bd00	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	2fb778d2db18a259201a96631955fd9592ef4407b4fcf2edfad5b5225d9fad6b	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnmipsxnxn	450bde69b244e2fbc35103211729ee781308aa52114d6de0c73a7c8f800288ba	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnor1kxnxn	e51b5fb1f033cb82a834f7837831d8df0887619ac3fd62a7f605e0030fefaa11	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	e7799b231f65133e31f509c08bc798d110e25d15ac7c2337fcb3b5ce627ee9b5	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnriscv32xnxn	9bb41cc7940f79f5eae3f6c8bd815d4c48d74257eedad2c74e028b3d1f41562b	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnriscv64xnxn	2b0e7aad92bc408589ee5d41434f6f4a77105e5025020c6086863221898b33df	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnsh2xnxn	774428434fe32fa67615097c5dd219afe952b0a2abc985614767081dcfa85223	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnsh4xnxn	c833365a24aa8251f3b29617944e2bdda85abc47d4d3472c316db7bca9ad71d1	Mirai	censys elf mirai ua-wget
http://198.96.88.70/bins/xnxnxnxnxnxnxnxnx86_64xnxn	08438c4268502c0697131b474b327dc8f0f4853bce7c1907f82eedc97e60623a	Mirai	censys elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/7b08e688-876e-429d-97df-efd7cd82cbb3

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1810bc3f8788f60b2bd9f914549eff3f3d2a4aa10cdcef4b3e706f539f9720fd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1810bc3f8788f60b2bd9f914549eff3f3d2a4aa10cdcef4b3e706f539f9720fd/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/1810bc3f8788f60b2bd9f914549eff3f3d2a4aa10cdcef4b3e706f539f9720fd

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-01-20 19:16:53 UTC

File Type:

Text (Shell)

AV detection:

4 of 36 (11.11%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dailyp4hrd3awk6z7ekfjhx7h46susvbbtoo6sz6obxvhh4xed6q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260120-xx45hagx2a/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1810bc3f8788f60b2bd9f914549eff3f3d2a4aa10cdcef4b3e706f539f9720fd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.