MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43cd5aef8482df97e7ac0e97f0c5a7dbfa920c1dd04dac95050c5d34bcd2a1a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	43cd5aef8482df97e7ac0e97f0c5a7dbfa920c1dd04dac95050c5d34bcd2a1a3
SHA3-384 hash:	2156c444d94d6718fd0b88be5f33666bbf3c2bfc053ff24052ed1384bf213090f7649b3222d772a408d861b908cb8e10
SHA1 hash:	94a67e7755afab2e4729992c167eb4e7da523970
MD5 hash:	0559dbb590a9274b947ef9e439eeb976
humanhash:	lake-nine-texas-aspen
File name:	0x83911d24Fx.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'570 bytes
First seen:	2026-10-27 04:52:34 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vu8DuYCYNu+H1TtLuvMLuZkLuOrJuZdZsGsud8uoEUuhQu6Bui5uBR:vu8DuYCYNu0HuULuZkLuOVuzcud8uoE9
TLSH	T10351B9EA802146303DA19962B5FD1C0530B6A5B958D59E1C7CED34F8BDCCE3A168DACB
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.56.209.34/SpaceDown/bin.x86	471e1afe6e2be740309e2ce1190144101e159a1ac216bd5c0e65d3e63a52ee78	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.mips	54c85247522f881cfe8a6e315c25084f24bce3b53cae9b6d2484ec08fee5820a	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.mpsl	e885f75eefb196da653fa414d8863488e4240f202de9b6fbe389084750fba1da	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.arm	03516d8dede856730d1e5ecc2cd1263d771e578ec7e7d409d2b306b932a466c8	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.arm5	ba3a04de34b99f360b75b93d2870d4e0950fe961a3c5799720cf168baac3f856	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.arm6	188ea937b475b527afabf4bcb7f099e47c770b95c859904989aaac99590d29a8	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.arm7	63fc28b4298fccea34df7368288aa0cc26a96d19523943e1dbc6f695d954fcda	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.ppc	f2c1d6be518ca06daa518832a339bcc393b210939d79b7b13ed54538931d6b35	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.m68k	33c9c490d5e77a906e8801678643c934d321bfb2df42418b54dd227908db3ffe	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.sh4	e77e4cbfa5632e2ca0c1e5bd71a928e454947cd06afe3ca8a6d7fc115814a992	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.spc	ecb540c5bbb30a92e9ff101ef4a80ea96fe38d58b3d7b349a21c5cf1fac7f135	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.arc	b5a0f9de23f9deaa70992ab6acfb7e8cbbd13f6377d12a20982d6c4c596e82b0	Mirai	31-56-209-34 elf mirai ua-wget
http://31.56.209.34/SpaceDown/bin.x86_64	b0651300b80666950b1af992d5ac3b7a1d77f776b7d56cca49d567af113ab2c6	Mirai	31-56-209-34 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-27T03:23:00Z UTC

Last seen:

2026-10-27T22:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/43cd5aef8482df97e7ac0e97f0c5a7dbfa920c1dd04dac95050c5d34bcd2a1a3/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/fddffdee-7dc3-4472-b080-c6641a2083ac

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/43cd5aef8482df97e7ac0e97f0c5a7dbfa920c1dd04dac95050c5d34bcd2a1a3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/43cd5aef8482df97e7ac0e97f0c5a7dbfa920c1dd04dac95050c5d34bcd2a1a3/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-10-27 04:52:19 UTC

File Type:

Text (Shell)

AV detection:

23 of 36 (63.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ipgvv34eqlpzpz5mb2l7brnh3p5jeda52bg2zfifbrotjpgsugrq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/261027-fh5n2saw6v/

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/43cd5aef8482/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh