MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39bb91671ae26554e7f1649f7aa8e990db27013304ef136d1e2f524d03c07e4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	39bb91671ae26554e7f1649f7aa8e990db27013304ef136d1e2f524d03c07e4c
SHA3-384 hash:	ffe62fa2b538a667f2bc5b718118f5e8f3f019f90d0146815f28b2f4af0ac40a8a7075e7d99205b5d75f6cfbd29276e4
SHA1 hash:	a4c1220cf272a76893855276a7abcd7935ee91c9
MD5 hash:	380b42581d6386e4d5209061994cfcca
humanhash:	rugby-fish-hawaii-three
File name:	sex.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	493 bytes
First seen:	2026-04-01 15:03:38 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:YkdMvSHvtkdMvx5HvlZwkdMvhNI1HvBkdMvq6HvjJwkdMpH9wkdMAHy:+gvJPvlwhNIZvdtvdy9ty
TLSH	T1E6F05BCD8C41F343C59F9ADD3021C614F007D5D4A9451F0BE74C4972A74A950E40775E
Magika	txt
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://178.16.52.148/rebirth.arm	159c73d8e746064ba1187265ac47ac3bdd35642275c68a10d8fe45722652d336	Mirai	elf mirai ua-wget
http://178.16.52.148/rebirth.arm5	d767060b7b8f808367f3f0eb2f5fdf59143c057a09f0fb8e5d9ca8414d061158	Mirai	elf mirai ua-wget
http://178.16.52.148/rebirth.arm6	3d83173d1a4cd927066a324926b4f5001f2e98825c480de180b6f9eb492cacfe	Mirai	elf mirai ua-wget
http://178.16.52.148/rebirth.arm7	8b92f02ece73bd262a89f19d9f583dabb824b0fb683f2797614274341d149ed7	Mirai	arm elf mirai ua-wget
http://178.16.52.148/rebirth.mips	3db7969c50574330d864c08ed6409055dd2153ff8763e8a47e11f8dca9d432e8	Mirai	elf mips mirai ua-wget
http://178.16.52.148/rebirth.mipsel	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

File Type:

text

First seen:

2026-04-01T12:33:00Z UTC

Last seen:

2026-04-01T17:51:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/39bb91671ae26554e7f1649f7aa8e990db27013304ef136d1e2f524d03c07e4c/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2870ea8e-bb86-4dae-992f-a4548f76a0e9

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/39bb91671ae26554e7f1649f7aa8e990db27013304ef136d1e2f524d03c07e4c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/39bb91671ae26554e7f1649f7aa8e990db27013304ef136d1e2f524d03c07e4c/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/39bb91671ae26554e7f1649f7aa8e990db27013304ef136d1e2f524d03c07e4c

Threat name:

Document-HTML.Trojan.Heuristic

Status:

Malicious

First seen:

2026-04-01 15:02:40 UTC

File Type:

Text (Shell)

AV detection:

9 of 36 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hg5zczy24jsvjz7rmspxvkhjsdnsoajtatxrg3i6f5je2a6apzga._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260401-sfnzqsgx5x/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/39bb91671ae26554e7f1649f7aa8e990db27013304ef136d1e2f524d03c07e4c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh