MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40bec1ee86a5ba5ed620bbe546b09d072481d71356ba2025974c08a0e3f3fb0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	40bec1ee86a5ba5ed620bbe546b09d072481d71356ba2025974c08a0e3f3fb0c
SHA3-384 hash:	a87c56990185e02f1aa69db148203c33c6d584412f3e8c82902507183493c4f37b1cae53dd13d5e6636e9a97be0edb61
SHA1 hash:	29b562532baab837db97a2f1db7fce55866927a6
MD5 hash:	6127b5deaa894bb3ee1ff144fa36c945
humanhash:	black-shade-mexico-mountain
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'737 bytes
First seen:	2025-12-26 17:18:28 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:nDdffi3SXdu1qO8dmsDadyHydTWTEgdkBWRdmnRdE9tbdb2bpIdSyySyjJd98HAr:nDpznarF2Eg460R02Ik8Aa5Gv
TLSH	T15731F3CE20315BB229CD9E80B2E0914AF4C0FAD666F19F74FD9628664DD7604379C638
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.20:59989/x86_64	afd23239ac37840687f51cdc8cc0e5c1ab0f62bfcc861427a092bd21e07d8dee	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/x86	30da945d7e5500938299cb12b475f94e3354dfdcfb5d591128668a3b5d4de483	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/m68k	b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/mips	d908d2f0b4114165079510ef8fc762c6b6cec60eea6dec514d683f3e67f55680	Gafgyt	elf gafgyt geofenced ua-wget USA
http://130.12.180.20:59989/mpsl	e2f49b929531ddce009e62e076af65a97785fe9732012fb13e968ffab3164f43	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/ppc	4f581e30be9df11bcab26c70caf17a0161cf2acaf676371ba0aa5aabc7e5d371	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/spc	0ddb8750a2234f53bebd468ede3922e59d69845d47c81967709bb9ed729a2717	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/sh4	n/a	n/a	n/a
http://130.12.180.20:59989/i486	n/a	n/a	n/a
http://130.12.180.20:59989/arm4	42719d96f3b14272254cbd68c4ea3e02900a517a501f8a94440cf162689e6b0a	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/arm5	fc542ad670c36e48b6bf573678e5e81fe884d231807256ecd06fa88801cb8eaa	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/arm6	f4c538b4c55ad7f1dcc1dc160b373386aa0b11de48528ac5338ea58913e42900	Mirai	elf geofenced mirai ua-wget USA
http://130.12.180.20:59989/arm7	f20dd3de2b928c15faff2a8b7233b3918a3922f53f61ce7e02a7e0f1b691be1a	Mirai	elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/694ec393e126b9ff43926e29/reports/126c0c7b-efd8-4390-8686-ff5620b00b60/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b55adf85-233f-4e1a-901b-0c0247c28b16

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/40bec1ee86a5ba5ed620bbe546b09d072481d71356ba2025974c08a0e3f3fb0c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/40bec1ee86a5ba5ed620bbe546b09d072481d71356ba2025974c08a0e3f3fb0c/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/40bec1ee86a5ba5ed620bbe546b09d072481d71356ba2025974c08a0e3f3fb0c

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ic7md3uguw5f5vraxpsunme5a4sidvytk25cajmxjqekby7t7mga._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251226-vvxxastpap/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh