MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a1349dfc0edd9acaaef62d11e4a3cde0ab4bc97db9cc8f993fa83f9de188f13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	4a1349dfc0edd9acaaef62d11e4a3cde0ab4bc97db9cc8f993fa83f9de188f13
SHA3-384 hash:	5c50eb79224ff478315753256704cdad893dc86910f0345c46dff6ef7e3f82c1946583757bd34e4610da5ae95135bb57
SHA1 hash:	2690a245e7f4aea3063a30391074cf79b9044e25
MD5 hash:	c83577dd9b0e0f1add73fa8c3c71fcb1
humanhash:	nebraska-equal-twenty-floor
File name:	4a1349dfc0edd9acaaef62d11e4a3cde0ab4bc97db9cc8f993fa83f9de188f13
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'072 bytes
First seen:	2026-10-22 21:56:26 UTC
Last seen:	2026-10-23 07:16:41 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:kXfWaXi5fWaXjWaXEWaXf9WaXAWaXRWaXXAWaXsWaXBWaXfJdWs:kXfWaXihWaXjWaXEWaX1WaXAWaXRWaXV
TLSH	T14611546D01C6BC82C89CD53D7291C11CF08147CA25BF5AE46E99127D65F06EEB131F0A
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	sh wraith

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.40/splarm	0ebcd1947aba571454cb13ab97c23870b95a573f3f57f646ce19b03b5d193968	Mirai	cowrie honeypot mirai
http://176.65.139.40/splarm5	86e9d9cb8543c334f68ea59d6dff8284cec3e6d20391f3b236d373103f6730b7	Mirai	cowrie honeypot mirai
http://176.65.139.40/splarm6	759048c27735a2b308d10cc6eadede7d7a80f34a65a3ee26b3e6d21f4c6434a2	Mirai	cowrie honeypot mirai
http://176.65.139.40/splarm7	42f9f668109e0e63bfbd83f803f9ea405bfe7490e553e9939f69bef3cbcd17b0	Mirai	cowrie honeypot mirai
http://176.65.139.40/splm68k	22b808d16593aeb44ec643f5f1612c88674abe47f124fec377584bd81509ae35	Mirai	ua-wget
http://176.65.139.40/splmips	9c3a54b945ffcf1ab5827d0142e60fd38d789ebcaf9ea65e43d7c749c5b67464	Mirai	mirai ua-wget
http://176.65.139.40/splmpsl	7142054701b0766a37dedb7907bb8b46d3017d699c669a8c2a340df9cb8c1852	Mirai	ua-wget
http://176.65.139.40/splppc	0ae443812b68a5c137afaedcec6a1afed8864baacc48e96846a13e3db07074f8	Mirai	mirai ua-wget
http://176.65.139.40/splsh4	c3703c10bbb878aac87e6c20a0000e1dbd5dbc3587343309a16e5699b0729fb2	Mirai	ua-wget
http://176.65.139.40/splspc	609e40bf48d6923cd5f0ee510739c731746643459212a5019902a9923de52771	Mirai	ua-wget
http://176.65.139.40/splx86	dc5ece812e4e0f7aa6e8203c25bb0c149f13130cc5da0092f2d27944e30a4438	Mirai	ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ada86ba091d22f8b2d33b8b/reports/851eb63b-797c-4a22-89eb-b5cbfe72540d/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c23e8c68-436c-4e74-af5e-06819d0c5b23

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4a1349dfc0edd9acaaef62d11e4a3cde0ab4bc97db9cc8f993fa83f9de188f13

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4a1349dfc0edd9acaaef62d11e4a3cde0ab4bc97db9cc8f993fa83f9de188f13/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-10-22 21:57:16 UTC

File Type:

Text (Shell)

AV detection:

16 of 36 (44.44%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jijutx6a5xm2zkxpmlir4sr43yfljpex3oomr6mt7kb7txqyr4jq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/261022-1tz8xsfy5y/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4a1349dfc0edd9acaaef62d11e4a3cde0ab4bc97db9cc8f993fa83f9de188f13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Downloader_Unknown_WgetChmodExecute Create hunting rule
Author:	Marjoriefort
Description:	Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:	misses_archive / grappe 5.182.210.174