MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3320e53b957e9583c55683cea6996f86b52bc31d7600a49d3ce2b7df76ae45e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	3320e53b957e9583c55683cea6996f86b52bc31d7600a49d3ce2b7df76ae45e4
SHA3-384 hash:	2e66945cbd2c0f0e3da6fd1056bdc1f741b97415b4343aa1a92f246946e9f46a7c9ced042968a8458fc4a59a097525b5
SHA1 hash:	19e061d43f0073237191b73be3a3a0eff812b241
MD5 hash:	4029320a76a86663ade8d721870cbcec
humanhash:	december-arizona-avocado-south
File name:	tplink.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	4'882 bytes
First seen:	2026-08-09 13:16:23 UTC
Last seen:	2026-08-09 20:38:52 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:Xl/8HvLiPLxF6eAN3xodPYjLy+6Fnh4iQ/dtSbBmLoTQ//iVXrINFL4Nxuxfdc5D:Xl/8HvLiPLxF6eAN3xodPYjLy+6Fnh4w
TLSH	T1D5A1BF8A2478D63CA47FD9AC79E54B40988D45E232B23F399EB028535CC9970B349F5E
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.aarch64be	n/a	n/a	arm elf opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	8e309f91353197022b436a770fff7421b76552fc7eb052685413f08e17db49f6	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	59f255347969aa82d875e878ee41604dcc7475a63c73dba58cf8ff2569669116	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	146ae2b9523e9bdadb477b51e6e66b5e7f643f20c9706f0a3572446ddc3ba849	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	8ae5df9b6e67b60c19a55793d8ba1b614c6fa4d42e75582697a6db2d3eda150b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	28c8a375115f283377aab40b697d6019d3360c5e913f0d159b1ee8f5af9003ec	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	28c3620bf420d2fe4fd54ab0b34c06eea18f61da419be2d482b85c4cf30d7321	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	bb0ae3b1ad361529bd2b8a6b5523cadebae95c82fa0ea8cb9206963ef597f40b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e500mc	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e5500	aa17ea69626b98e2b911e39b4c3fdd2963f8c40d8f58f69d0a70509b89f6e7e6	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e6500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	eeafc43bb1ff4f056d0e5e8c40b6b0561889c430a27ada2e87b5f8b57df9c1ab	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.m68k-68xxx	n/a	n/a	elf m68k opendir ua-wget
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	a743806caf6bc8b7bd42ac45890b5259af91068ab0f1062e717c00a9a5d3c7d4	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	fd8712d7e332f6e2974131788a2b23ddce1e11fb5cde91e5edb6801a68857e22	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32r5el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32r6el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	62385232479b24892b542b2123c0514f7899814f0ee1a6e5c7b692f8fb96618d	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64r6el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	4b9e703299491e1ef17eb53dbb7a9949e02e081c319c6fa6c5e2b8ed84f28eae	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	9cb871a274b7163c58dbf2ad5663e4c5c8b807f6ce887db3959f8e620ce2185b	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.power8	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.power8le	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.powerpc	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.ppc440fp	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	59a463d1610d03625f803d11ba91b9380e636f1830e103039681ad18edb7b1ca	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.riscv64	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.s390x	7a174f653381d7c791070a68d87249f1bad916d201664b31b440297230c6b726	Mirai	elf mirai opendir s390x ua-wget
http://130.12.182.77/main.sh4	2464b4ef4d95ed605329fb87dde5ef20230926c0571dd47bd427af045c01c0f0	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sh4aeb	302819a3568a56fcbbfce3649328c18e900267dcc11c2fdf1c61d0318eb831c6	Mirai	elf opendir SuperH ua-wget
http://130.12.182.77/main.sh4musl	n/a	n/a	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sparc	n/a	n/a	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.sparc64	8c54f60dcda7e913f32acc07568b2b761e7d4e8cbeec229b9d2777066b426e14	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.sparcv8	0273d3705b043809cb63e3f09f2b776a2a5d66e5b0afc85baaa2ee455a718b67	Gafgyt	elf gafgyt opendir sparc ua-wget
http://130.12.182.77/main.x86-64	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86_64	1417470886b23fe79a76d8015a6ef15ed4b8507507f6332598035ce66b40278e	Mirai	elf gafgyt mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-i7	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-v2	9ab5ac47c2042d48c073cecf3e3781167e2863c1c4840d4be6c0e81036ad80f8	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v3	9caad13ae137c6e82ae28866abf3d2a8f0f1ae5f6ce8b185a3a454b9b3f10ced	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v4	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-core2	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-i686	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.xtensa	n/a	n/a	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/6a787de86226b5674cb44dd4/reports/8dcded26-bd63-45d5-98f3-b79d6ae416b2/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-08-09T08:52:00Z UTC

Last seen:

2026-08-10T21:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3320e53b957e9583c55683cea6996f86b52bc31d7600a49d3ce2b7df76ae45e4/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5747407b-4de3-4cba-92a6-e0da8409111e

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3320e53b957e9583c55683cea6996f86b52bc31d7600a49d3ce2b7df76ae45e4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3320e53b957e9583c55683cea6996f86b52bc31d7600a49d3ce2b7df76ae45e4/

Threat name:

Script-Shell.Trojan.Heuristic

Status:

Malicious

First seen:

2026-08-09 13:17:34 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gmqoko4vp2kyhrkwqphknglpq22sxqy5oyakjhj44k3565voixsa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260809-qjk15sfm3z/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3320e53b957e9583c55683cea6996f86b52bc31d7600a49d3ce2b7df76ae45e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh