MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20ea8978c8c543e4d1b3947bb533277e3e1318eed2bc9570a1e4bf3daeb03123. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	20ea8978c8c543e4d1b3947bb533277e3e1318eed2bc9570a1e4bf3daeb03123
SHA3-384 hash:	49a37b9ebe6354c688c39347ae4755832ae0cfb4b4669b34654a84eaa1c57f5ae6867a023b4e0d16f4bf0ce8aece065f
SHA1 hash:	22edb5065c94c76c7d700c9eeed3a08880f68f2f
MD5 hash:	82ddea893b4db33263f14e17a686b75b
humanhash:	monkey-gee-friend-snake
File name:	tplink.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'148 bytes
First seen:	2026-05-31 02:28:28 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:QvQhBh9M0oy1ZdLqMbiiVKGLxZmLPxbinVKTLy:QvQhnoIRiaiFiV5
TLSH	T14321D48C3DE93A6A4D38CDCCF2A2AE05D11AE6CF33960A24E7C6363A5C981203D15F55
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://92.42.100.131/tplink/mips	7b4e23fac930e2c4c3ec03c15adee5a1ed7bf69022c28916f6738f2bc76afe26	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/mpsl	e62822e77456614d85c60eb0d0eb80f100511dbb2969013f443a79dd60c04128	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/arm	060d4594102e3e0e305a532b72e4479f3c3a9da126deece2d780d8fe8a788699	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/arm5	e9ff395fae2a972f98bd9ade7ccb3e2c040b74f816a7a9dedf0b84763aa07e09	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/arm7	0e6f2e466d1ada0a620232e4c707412931b7b3b63c2f6130530cf06b09a77dc5	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/x86	9d199918397bdc50141845165f2ae2525ad47c8e96e07c1d9d39e63eda3fd89c	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a1b9d03099ef368af107424/reports/b2bc70e0-957d-48eb-8945-dcc26baaa05b/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-05-30T23:44:00Z UTC

Last seen:

2026-06-01T03:24:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/20ea8978c8c543e4d1b3947bb533277e3e1318eed2bc9570a1e4bf3daeb03123/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/b3ba2d5e-3391-4495-97f3-7b11a99bb79a

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/20ea8978c8c543e4d1b3947bb533277e3e1318eed2bc9570a1e4bf3daeb03123

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/20ea8978c8c543e4d1b3947bb533277e3e1318eed2bc9570a1e4bf3daeb03123/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-05-31 03:21:35 UTC

AV detection:

15 of 38 (39.47%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=edvis6giyvb6juntsr53kmzhpy7bggho2k6jk4fb4s7t3lvqgerq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260531-cyrkksgy2v/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/20ea8978c8c543e4d1b3947bb533277e3e1318eed2bc9570a1e4bf3daeb03123

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh