MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e1ef6487f79bbc7fb5ad95556cecdea031380b84a4235416ad6f35de38cbbfc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	4e1ef6487f79bbc7fb5ad95556cecdea031380b84a4235416ad6f35de38cbbfc
SHA3-384 hash:	32d1d91d3d1a61b7a6997df94c241d5bd47f83d0302c50461aa712de96dce22892335ed1534d72dec048e10d4fcee17d
SHA1 hash:	a22984e5d1877bcac3538821c0152f5efc4f5e59
MD5 hash:	e3cef328dc18a0f940dc459dbeef9b5d
humanhash:	mountain-montana-glucose-edward
File name:	dvr.sh
Download:	download sample
File size:	4'677 bytes
First seen:	2026-09-21 16:30:30 UTC
Last seen:	2026-09-22 13:30:27 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:6e3PXe9GSAcYl4KpzgBdap06CJFSXmrzGMMvEoTaVUWy1Q+/ee1AL6CMWg6yJC6x:6e3PXe9GSAcYl4KpzgBdap06CJsmrzG5
TLSH	T1DFA1AF9E1070973DA86EDD6C35F60B005D4985E236B13F395EB808739CCAA707369E6E
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.e300c3	650cccc991d70a021d8b5efecce182378657fa7385cf0ec487cc6056662babb5	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e500mc	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e5500	b69f10b45ec15cbbf5d6c585d147e1e3948e0e4dac091db488a07133164d1755	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e6500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.m68k-68xxx	n/a	n/a	elf m68k opendir ua-wget
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	d2dad3befbc3598b574187cfca2ca7cd2f8bb55bbd682d4190767b98d03cb1ea	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32r5el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32r6el	8b89aecfc6aaa0be8c7dd842e9bc7feed8af05f2eed6021dada1ff8b536f1e8e	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	e6c403005b6b5573b35c5f37918e3297183ba5de0266b4fb878036be67ea4092	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64el-n32	fcb4ad801db84d6a9428ea7b56503fdd26f1ded8f195f1a08daaca5fd77fa272	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64-n32	8f3e2a9f8331265e999b06f20508cbdfb26b474e870bd3f5add584867a34e9b5	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64r6el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	62900587da4553f9f3c84a31bf2fbac85c286731836a83e7c213cb614ccc152b	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	626e8187d504a416705b551c52f91856c71d98eab341c5820acf555e0bb23f1d	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.power8	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.power8le	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.powerpc	1c707bbdf2937e5c5e64e6a6bc03349ddd4b2ed7f870de7b8bf7e8989e09fa78	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.ppc440fp	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	4f2c77768598082bb7574eef1d558826b4016106cadb07962b8144162d7ce956	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.riscv64	1129446cb94148988acd6efd5ba70a7077ef3e2c9db62230a61c44da92345810	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.s390x	74b8b95d4153009990ca3645f317ce76399f1892d38f79340920449a396bffcc	Mirai	elf mirai opendir s390x ua-wget
http://130.12.182.77/main.sh4	c81efd1b47f6c372d670d6f0ebde6b3dcba715c0f4bf172a7662ba4240f41944	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sh4aeb	n/a	n/a	elf opendir SuperH ua-wget
http://130.12.182.77/main.sh4musl	dc0e5c6523846e53f5b0d1660732b6d0ed6b58a5e5456fc7879ba5cee2a7213a	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sparc	7e9fa00a2d3224c15c3d15a8aea4590d5e257d63cd51b0f92ab1eb85af19db04	Mirai	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.sparc64	0d8e03947e473f1fa1f0cde6efbe74fb4d0df8658352b4fdeef4c29cd3fa5aaf	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.sparcv8	eb93f2969d04852a87df1a90408460ed08eb193338dac1c8d22b9649f2ef316b	Gafgyt	elf gafgyt opendir sparc ua-wget
http://130.12.182.77/main.x86-64	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86_64	ad6095e0cd1aac8e57137bff757e195fb617b9332fcc47d9be11c52ff42c42b4	Mirai	elf gafgyt mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-i7	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-v2	237f12f5a34ae1c7e21aa2c2e539d6f75c272b6596909a7c47a06a75b722ca4b	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v3	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v4	e4ac5e615f12c406041329408b7d501d4ae476a1232c054b1365bc4c34983967	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-core2	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-i686	997a4146f9916f2f8491e6ad1c9b7c1746912a023ae0e2aeb446ef6983b174e1	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.xtensa	0eaee2cebbeca2f7f2c0cdee58d0f7d039c53576148604f7da30e05b05a13ea2	Mirai	elf mirai opendir ua-wget
http://130.12.182.77:8080/main.aarch64	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.aarch64be	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.archs38	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv7l	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armebv7	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv4l	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv4eb	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv4tl	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv5l	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv5-eabi	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv6l	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv6-eabihf	n/a	n/a	elf ua-wget
http://130.12.182.77:8080/main.armv7-eabihf	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

URLhaus.3920752.UNOFFICIAL

URLhaus.3920753.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ab15bd461d70623b5fed515/reports/01452a91-745a-4c87-bd47-a18dd4adee46/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-09-21T18:51:00Z UTC

Last seen:

2026-09-21T19:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4e1ef6487f79bbc7fb5ad95556cecdea031380b84a4235416ad6f35de38cbbfc/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b4dd99cc-d116-4d29-b733-22e0b99c7ecc

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4e1ef6487f79bbc7fb5ad95556cecdea031380b84a4235416ad6f35de38cbbfc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e1ef6487f79bbc7fb5ad95556cecdea031380b84a4235416ad6f35de38cbbfc/

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-09-21 16:31:38 UTC

File Type:

Text (Shell)

AV detection:

12 of 38 (31.58%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jyppmsd7pg54p6223fkvntwn5ibrhafyjjbdkqlk23zv3y4mxp6a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260921-t1gxladd49/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4e1ef6487f79bbc7fb5ad95556cecdea031380b84a4235416ad6f35de38cbbfc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh