MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ccd4945da4ede5299542ae4138a10ec6f360e091b82b044b41625d26bafb3a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	1ccd4945da4ede5299542ae4138a10ec6f360e091b82b044b41625d26bafb3a6
SHA3-384 hash:	d6fd2e691fc495a8e90747167b0c0a822dd995e890389ad4c2d62e5d62dbe2972c60e6319c1ded741a924ba888ee3679
SHA1 hash:	99b86b29507686e411efde833a466927524b7c5a
MD5 hash:	64ca0bb2817865d12f7cdecfe722e674
humanhash:	sierra-iowa-diet-mars
File name:	tplink.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'704 bytes
First seen:	2026-08-06 13:13:22 UTC
Last seen:	2026-08-06 13:53:46 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:7CDU1aT8GWAxqcF6EFGOe9GGGVUBSA65Xr8DYXO8GmIHbQjfZbMPf9JSXLcTYleN:7CDU1aAyxpF6EFGOe9GGGVUBSAyr84Oz
TLSH	T1D551648E14A0563DA4BFDC9C76F74600E84887E175B23B289EB41C639CC7A34B369E5D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	8e309f91353197022b436a770fff7421b76552fc7eb052685413f08e17db49f6	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	59f255347969aa82d875e878ee41604dcc7475a63c73dba58cf8ff2569669116	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	146ae2b9523e9bdadb477b51e6e66b5e7f643f20c9706f0a3572446ddc3ba849	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	8ae5df9b6e67b60c19a55793d8ba1b614c6fa4d42e75582697a6db2d3eda150b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	28c8a375115f283377aab40b697d6019d3360c5e913f0d159b1ee8f5af9003ec	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	28c3620bf420d2fe4fd54ab0b34c06eea18f61da419be2d482b85c4cf30d7321	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	bb0ae3b1ad361529bd2b8a6b5523cadebae95c82fa0ea8cb9206963ef597f40b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.i486	eeafc43bb1ff4f056d0e5e8c40b6b0561889c430a27ada2e87b5f8b57df9c1ab	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	a743806caf6bc8b7bd42ac45890b5259af91068ab0f1062e717c00a9a5d3c7d4	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32el	fd8712d7e332f6e2974131788a2b23ddce1e11fb5cde91e5edb6801a68857e22	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64	62385232479b24892b542b2123c0514f7899814f0ee1a6e5c7b692f8fb96618d	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mipsel	4b9e703299491e1ef17eb53dbb7a9949e02e081c319c6fa6c5e2b8ed84f28eae	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	9cb871a274b7163c58dbf2ad5663e4c5c8b807f6ce887db3959f8e620ce2185b	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.powerpc	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	59a463d1610d03625f803d11ba91b9380e636f1830e103039681ad18edb7b1ca	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.sh4	2464b4ef4d95ed605329fb87dde5ef20230926c0571dd47bd427af045c01c0f0	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.riscv64	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.sparc	n/a	n/a	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.x86_64	1417470886b23fe79a76d8015a6ef15ed4b8507507f6332598035ce66b40278e	Mirai	elf gafgyt mirai opendir ua-wget x86
http://130.12.182.77/main.xtensa	n/a	n/a	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a74887826411371370d2477/reports/e186c001-1c10-4c26-ad01-8086be5e3027/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-06T10:34:00Z UTC

Last seen:

2026-08-06T18:54:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1ccd4945da4ede5299542ae4138a10ec6f360e091b82b044b41625d26bafb3a6/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/73576c79-f0ca-4306-8b2c-ef6e4bab1b9b

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1ccd4945da4ede5299542ae4138a10ec6f360e091b82b044b41625d26bafb3a6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ccd4945da4ede5299542ae4138a10ec6f360e091b82b044b41625d26bafb3a6/

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2026-08-06 13:16:37 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dtgusro2j3pffgkuflsbhcqq5rxtmdqjdoblarfucys5e25pwota._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260806-qgl6eswwds/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh