MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4178cf0bd11cd9977008647ebb6bb12a7ad34c384faab31da66c8dfbf64f72a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	4178cf0bd11cd9977008647ebb6bb12a7ad34c384faab31da66c8dfbf64f72a4
SHA3-384 hash:	1125450eb4b79a7a6ef852cb71e9f05e05eb6c64d2ae591bf5d280b76b6a485a7527a403596b29a55c1462b9bcdda1e6
SHA1 hash:	c25bc797914ae48de8b9359b6bfa6ac74cef5e12
MD5 hash:	9eb89fdb0346355072616e1f94c9e362
humanhash:	low-cold-music-stairway
File name:	p
Download:	download sample
Signature	Mirai Create hunting rule
File size:	831 bytes
First seen:	2026-07-30 20:21:31 UTC
Last seen:	2026-07-31 03:56:15 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:kXCKysE2hi0ziQvZoha5C8WW8GjF47luS7:e9Qp+Msc8WWDF47AS7
TLSH	T19801C2D6E3109900405ED85E66E766A0B431C3C7254B0F78BF9D443EAB98A14F06BFA8
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://129.121.110.105/4hR	c70b4b289425d42a082b20f0f8cef59126f2bff80720811c21f33ee66da644f5	Mirai	mirai ua-wget
http://129.121.110.105/V9G	a2ff2bef4f109e5d196188ffb859124614962f084a256e570341acdf4725aff4	Mirai	mirai ua-wget
http://129.121.110.105/aaaE	cc524db8d2727d261725930fcf991850d45b927ae16688a6057cdb7cf2cb4f9d	Mirai	mirai ua-wget
http://129.121.110.105/mmo	62294b09e63f2af34692c8ea734b56fb1f61f7d65a5437559f240a74feb6d7fc	Mirai	mirai ua-wget
http://129.121.110.105/CZk	0b4db3337ac7c2b9ac24875b67054eeac57241d0f26284c8246dd18de18c3f08	Mirai	mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a6bb287e61c506334b90b49/reports/f8ff2c36-525c-43ab-8373-357a0ad48efc/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-30T18:16:00Z UTC

Last seen:

2026-07-31T01:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4178cf0bd11cd9977008647ebb6bb12a7ad34c384faab31da66c8dfbf64f72a4/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/bae72f7c-bc91-4188-93f9-6cb46b79dc41

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4178cf0bd11cd9977008647ebb6bb12a7ad34c384faab31da66c8dfbf64f72a4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4178cf0bd11cd9977008647ebb6bb12a7ad34c384faab31da66c8dfbf64f72a4/

Threat name:

Win32.Trojan.Malgent

Status:

Malicious

First seen:

2026-07-30 20:22:45 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=if4m6c6rdtmzo4aimr7lw25rfj5ngtbyj6vlghngnsg7x5spoksa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260730-y5tt6sfb56/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Creates/modifies Cron job

Enumerates running processes

Modifies rc script

Modifies systemd

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/4178cf0bd11cd9977008647ebb6bb12a7ad34c384faab31da66c8dfbf64f72a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.