MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 353b73e82a611a10d98329d968bc525061050415ef11039fc5dffe81a7ae8662. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	353b73e82a611a10d98329d968bc525061050415ef11039fc5dffe81a7ae8662
SHA3-384 hash:	e62f70a02b10febd4435daed2d37c3b4f64b5f6a27bbae606b2d6e1acbf5b36c98b8f1eaa90478bd4037c9de3883ddc1
SHA1 hash:	93fd0de510b0bdcb6e329f2d69f6214cb7cec5ac
MD5 hash:	3ce8a714552d621ba5bb10edcb838078
humanhash:	steak-london-blossom-mexico
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'873 bytes
First seen:	2026-02-15 01:03:42 UTC
Last seen:	2026-02-15 13:12:59 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:s62UG7nqsg1l7w5/XaYu8GnCQio78xfqiaPO47:ic12BI
TLSH	T1D43115CE60F4A143C5DCCE1070F5CFC8631A959261DA2A3AEDC12E67C4C9DE47429B3A
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.18/iran.x86_64	c28bb0854c6adbcaef89386033cff8b26227b328673eaf0e346a4b1cd4c25865	Mirai	elf geofenced mirai ua-wget USA x86
http://176.65.139.18/iran.aarch64	n/a	n/a	elf ua-wget
http://176.65.139.18/iran.m68k	eed004cbe7d4dc52ad2ff89a822316b22dc9093c02bf9db390611091d5076c69	Mirai	elf geofenced m68k mirai ua-wget USA
http://176.65.139.18/iran.mips	8e1df42a50ea94b3a55b4bd1543de6d1dea1d19c17d97f5ce7c8e6026919601a	Mirai	elf geofenced mips mirai ua-wget USA
http://176.65.139.18/iran.mipsel	n/a	n/a	elf geofenced mips ua-wget USA
http://176.65.139.18/iran.powerpc	fa557bdb178dfa41e368db8ed91cc1443e6d97625e2fb68e59a4783db8eced9f	Mirai	elf geofenced mirai PowerPC ua-wget USA
http://176.65.139.18/iran.sparc	11fe6fba059c7656ebcceddab119c1be0cc728fb9d7df710405b5f8b174fd9de	Mirai	elf geofenced mirai sparc ua-wget USA
http://176.65.139.18/iran.sh4	d1eba5b833cc175e9dac22403d79ff7330e58a4be2a150e1f3f884b75d618cf4	Mirai	elf geofenced mirai SuperH ua-wget USA
http://176.65.139.18/iran.arc	e072470520b6ef0b5556d9f883878b6f59c5a02aa7dbd07ae739e9a2389b5dab	Mirai	arc elf geofenced mirai ua-wget USA
http://176.65.139.18/iran.i486	7c83211d24fdb1b813f17067a44ef5880194c042d2547d61febeea8a9531e845	Mirai	elf geofenced mirai ua-wget USA x86
http://176.65.139.18/iran.armv4l	b62bfd01bac40dec3cb308f63a7c439581c958d7dcc1652d6b1f35191c36a8ae	Mirai	arm elf geofenced mirai ua-wget USA
http://176.65.139.18/iran.armv5l	3255625ffa643ae2580b27195e9e070baecc53addccaa2e125a4eaaeb440e167	Mirai	arm elf geofenced mirai ua-wget USA
http://176.65.139.18/iran.armv6l	93625ab1a520f851f71b7704e5dec6113cbaf2e4be081cebc19c2914a6916ba9	Mirai	arm elf geofenced mirai ua-wget USA
http://176.65.139.18/iran.armv7l	4eeeb2ebc9d6cb31eb72b1cf428698bf77e182bba6e1fb0ae9f293998f1f78a0	Mirai	arm elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/69911b92930564ff3ca17654/reports/a6983b4b-65e8-4ff1-a273-680be2f93ebc/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-02-11T12:56:00Z UTC

Last seen:

2026-02-11T17:05:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/353b73e82a611a10d98329d968bc525061050415ef11039fc5dffe81a7ae8662/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d483c162-7733-4f32-98fe-96786fed30a0

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/353b73e82a611a10d98329d968bc525061050415ef11039fc5dffe81a7ae8662

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/353b73e82a611a10d98329d968bc525061050415ef11039fc5dffe81a7ae8662/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/353b73e82a611a10d98329d968bc525061050415ef11039fc5dffe81a7ae8662

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2026-02-12 03:40:23 UTC

AV detection:

14 of 38 (36.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gu5xh2bkmenbbwmdfhmwrpcskbqqkbav54iqhh6f377idj5oqzra._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260215-be3m3afy5a/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

UPX packed file

Enumerates running processes

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.75

Link:

https://yomi.yoroi.company/submissions/353b73e82a611a10d98329d968bc525061050415ef11039fc5dffe81a7ae8662

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh