MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3788033e840a4e3da0b8187b329f7136e6116c3994616aca3e673f9da8ab3ffb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	3788033e840a4e3da0b8187b329f7136e6116c3994616aca3e673f9da8ab3ffb
SHA3-384 hash:	feee14c6da9d39993d633ba69e7fae910847e1c5b78f2e1adedd6b00e1ffc1868038a47e50b901e9869ce1257fa02f59
SHA1 hash:	0c901267bdca783adf4d8aebc2136ebc88614a61
MD5 hash:	4d2a9207479855ae70b055f8a69b2371
humanhash:	magazine-monkey-winter-eighteen
File name:	wget_telnet.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'930 bytes
First seen:	2025-11-24 09:54:29 UTC
Last seen:	2025-11-24 18:40:17 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:pI1tawHGzXt2au7Zk0ZByZhdzuLe7KMYVOOH8ELjuHXwiDE:pgosAAau97BwhgyUWgx
TLSH	T177510AED02402F3A71069A2993D355AADC4A4FD1B29B2758D48A2C17DC1FB0C7BF6D87
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.35.154/powerpc.uhavenobotsxd	2fc813a289298e34f20e9ffadb2a8ba2dad96edcdd988cdf05228e676713b890	Mirai	elf geofenced mirai PowerPC ua-wget USA
http://94.154.35.154/mips.uhavenobotsxd	f44a199d532e67a8f84ffc93aa8ddda9596a00d875be5ea49e5d1f8226d5ed3b	Mirai	elf geofenced mips mirai ua-wget USA
http://94.154.35.154/mipsel.uhavenobotsxd	0d018abf429ec83041512259b9a49a50a43473506496536aaf4848670ca71a73	Mirai	elf geofenced mips mirai ua-wget USA
http://94.154.35.154/arm.uhavenobotsxd	18d0cc7b40a193a55589f14b91d4f3243f32dc354f5265422eae9637f84fa891	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm5.uhavenobotsxd	d060e726d0e3433b3a88e2f132404be1c02664c8705f320c7b2a187ce04d78b3	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm6.uhavenobotsxd	25b423780d37da72f154b884c64c96ec29fe38687744344da924a321b13459e5	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm7.uhavenobotsxd	122100a11ee0c4d3508dd7d091c3ed462e918b9aa0e725fb2a8228ad87c0c785	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/sparc.uhavenobotsxd	n/a	n/a	elf ua-wget
http://94.154.35.154/m68k.uhavenobotsxd	n/a	n/a	elf ua-wget
http://94.154.35.154/sh4.uhavenobotsxd	n/a	n/a	elf ua-wget
http://94.154.35.154/x86_64.uhavenobotsxd	257ae90d3a3a93c93ddfa6a9c7702d35ca382843d8e87ae13e34851bc35a841e	Mirai	elf geofenced mirai ua-wget USA x86
http://94.154.35.154/x86_32.uhavenobotsxd	c1b5e7b4da44dda350efa32458644ac0852534869a11c83da1be61445f6ce050	Mirai	elf geofenced mirai ua-wget USA x86

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive medusa mirai

Link:

https://www.filescan.io/uploads/69242b8ddeea95d50b252b8a/reports/f062a316-3554-44fe-ab0c-1beff91c503c/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-24T10:44:00Z UTC

Last seen:

2025-11-25T23:40:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3788033e840a4e3da0b8187b329f7136e6116c3994616aca3e673f9da8ab3ffb/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/f4f84300-182e-445d-be27-85990ba9badf

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3788033e840a4e3da0b8187b329f7136e6116c3994616aca3e673f9da8ab3ffb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3788033e840a4e3da0b8187b329f7136e6116c3994616aca3e673f9da8ab3ffb/

Threat name:

Linux.Downloader.ShellAgnt

Status:

Malicious

First seen:

2025-11-24 09:55:27 UTC

File Type:

Text (Shell)

AV detection:

21 of 38 (55.26%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g6eagpuebjhd3ifydb5tfh3rg3tbc3bzsrqwvsr6m47z3kflh75q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/251124-lxzn8ssjaz/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Executes dropped EXE

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3788033e840a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3788033e840a4e3da0b8187b329f7136e6116c3994616aca3e673f9da8ab3ffb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.