MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e578a9081b7063f8a5ae94db560cd5e913d65167b1378675fd0f411ef45d8b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	4e578a9081b7063f8a5ae94db560cd5e913d65167b1378675fd0f411ef45d8b6
SHA3-384 hash:	183d2036a8c3e664526196e13eec8afd16e027670b7c8c2e7f1518d8b275b8171bb67c64de0065729dfbcfc6dec3ca58
SHA1 hash:	f763384657ad974489f01f9f9da841bd60ee7101
MD5 hash:	f239881887a5be8baabd10750b35cdf7
humanhash:	aspen-delta-oscar-pennsylvania
File name:	Ow.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	925 bytes
First seen:	2026-04-05 00:03:27 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:oVpVFnV4NIhVdV/VtVOkVFVtDc4TV1DVq:oVpVFnVrVdV/VtVOkVFVtA4TV9Vq
TLSH	T17B1188EF40A69BF048179D3EF62ED8C4F122C78A511B5F06BDCC14BD98E8D10F902A94
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://216.245.140.191/arm	f0b2f26bbf14fcd1db5358c87fcc01ad71b1b850a26c7cf402c03c93a7f8e036	Mirai	arm elf mirai opendir ua-wget
http://216.245.140.191/arm5	c8afd5582198ec3fb6d718310e52b08e2b8d3b0a5d8b76995d691928fcd9dc88	Mirai	arm elf mirai opendir ua-wget
http://216.245.140.191/arm6	a1390964c26ac99dd99796b07064db70382ef3434a38af653c5e833c97ed5efd	Mirai	arm elf mirai opendir ua-wget
http://216.245.140.191/arm7	1d6ca1a4324d442a28dbcf4675eab8cc10be7da7bde6d96e11b6207dc28e4a70	Mirai	arm elf mirai opendir ua-wget
http://216.245.140.191/m68k	ddf3dae37de2cd3094926863f8c5b762303ae08a23da20964f2f6b7f154008a2	Mirai	elf m68k mirai opendir ua-wget
http://216.245.140.191/mips	10f46fec5656fa4294c079b9627faf3b8ad922359f760d941fe168fbb8c5b245	Mirai	elf mips mirai opendir ua-wget
http://216.245.140.191/mpsl	985a10e895c71465387e6b59a6c6dc3e1650e124408b83640cabddf287f75939	Mirai	elf mips mirai opendir ua-wget
http://216.245.140.191/ppc	f826ddb251e79bda62288913e9da072ed66742f43e367baf57ed0b6499eca626	Mirai	elf mirai opendir PowerPC ua-wget
http://216.245.140.191/sh4	0f641d5c2c241a051b1ca43ffa946ad7617255549238cc4103d1c2b344a4e6de	Gafgyt	elf gafgyt opendir SuperH ua-wget
http://216.245.140.191/spc	n/a	n/a	elf opendir sparc ua-wget
http://216.245.140.191/x86	336c13f5f83a2dc65a58a4566850fbe6ad874267e9307b62260d318e05aaad21	Mirai	elf mirai opendir ua-wget x86

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

medusa mirai

Link:

https://www.filescan.io/uploads/69d1a6ffe2df9aa488c69e79/reports/c5f7e55d-03d1-47c6-9710-709a8afe8317/overview

Result

Gathering data

Verdict:

Malicious

File Type:

text

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/4e578a9081b7063f8a5ae94db560cd5e913d65167b1378675fd0f411ef45d8b6/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ae9fe733-38ec-45af-ac0c-2916e727413f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4e578a9081b7063f8a5ae94db560cd5e913d65167b1378675fd0f411ef45d8b6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e578a9081b7063f8a5ae94db560cd5e913d65167b1378675fd0f411ef45d8b6/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/4e578a9081b7063f8a5ae94db560cd5e913d65167b1378675fd0f411ef45d8b6

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-04-05 00:04:41 UTC

File Type:

Text (Shell)

AV detection:

16 of 36 (44.44%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jzlyveebw4dd7cs25fg3kygnl2it2ziwpmjxqz272d2bd32f3c3a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260405-acp4hsez8n/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4e578a9081b7063f8a5ae94db560cd5e913d65167b1378675fd0f411ef45d8b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh