MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e96a52706073a156c709be722ec9db2c627b808191207951b72e90ffae96f6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	4e96a52706073a156c709be722ec9db2c627b808191207951b72e90ffae96f6e
SHA3-384 hash:	fe598d0e2322af73ebe41f8f0bea4ee2ffc4490e53c727f93a481e50dc17dd0636d5a022989743455cab1e9ccbeac6a2
SHA1 hash:	987dd1cb8ffee0d655856bb13967c435e757df80
MD5 hash:	80918ff6067ef444052c396c2c3ff512
humanhash:	lactose-maine-six-nitrogen
File name:	massload.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'627 bytes
First seen:	2025-07-18 10:16:16 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:/rsfrycy3dArEyExsrPNoPN0srobrNHrJyJYx6r7PrfPrwHwAPrzvrSFSirOo:/rsfrl/rEyExsrPyP6srobrNHrJyJYxY
TLSH	T1955185C40E9387B21C79CE37E9AB42487E55D89378C56E6794FC3CEA604DE0821A1E73
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://161.97.77.188/HBTs/top1miku.x86	64aa14e4bba9920161c083819452da01e173458619866025b454e29117f427c3	Mirai	elf mirai opendir ua-wget x86
http://161.97.77.188/HBTs/top1miku.x86_64	5c03e74290ffbc6332f3d357d54853000ea53f19ee0fa3fb36d466989c48826f	Mirai	elf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.mips	6dba5a43486ad2c883f236754e25806a860f5063fcf73e225f4f86c1c1741ead	Mirai	elf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.mpsl	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arm	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arm5	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arm6	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arm7	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.ppc	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.m68k	af5ef5773b4f244557be125fa269d59bfa897f6ad5ddbbd600a224a7fe38fdb8	Mirai	elf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.sh4	200f50c4e8e10d7cd12823b2ff9dcc4fd4643094ee0cb1bbd321a636af1acdc4	Mirai	elf mirai opendir ua-wget
http://161.97.77.188/HBTs/top1miku.spc	n/a	n/a	ua-wget
http://161.97.77.188/HBTs/top1miku.arc	380cdfff39fab66e0d2f0e3217f0e2573374ebbde28f6a96343e2cb72c0ca944	Mirai	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/bd612bbe-9620-4f9a-aafa-bc9b17060c54

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4e96a52706073a156c709be722ec9db2c627b808191207951b72e90ffae96f6e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e96a52706073a156c709be722ec9db2c627b808191207951b72e90ffae96f6e/

Verdict:

Malicious

Threat:

Linux.Downloader.Medusa

Link:

https://tip.neiki.dev/file/4e96a52706073a156c709be722ec9db2c627b808191207951b72e90ffae96f6e

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-07-18 10:16:29 UTC

File Type:

Text (Shell)

AV detection:

22 of 38 (57.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j2lkkjyga45bk3dqtptsf3e5wldcpoaidejapfi3oluq76xjn5xa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250718-ma6dyaxrx4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4e96a52706073a156c709be722ec9db2c627b808191207951b72e90ffae96f6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.