MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44
SHA3-384 hash:	867a2e53a683434fef67721cad319aa6238f977c413f9f17e086510158297ebe89f8488e9f90847348574dbbb401b9b6
SHA1 hash:	74cf6bf634399f402ec1f2f0eeddd7a139971559
MD5 hash:	388cfc6db7c74f1054d307a8919c5cf1
humanhash:	johnny-berlin-double-india
File name:	telnet.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'834 bytes
First seen:	2026-09-07 17:50:17 UTC
Last seen:	2026-09-07 18:20:41 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:akfg0dt3NaKB6mODOmrVfzvK1mk1YEVbJVb1LB2N0gN0KvtSxe777LBxC+wlzTvX:vfl3FeDzr9K4kvjk2g2MtD7D0
TLSH	T11931F48932B07E71C59EEF05B0E5C2D4A247F5C4B6930BF2E4C21CA168D9F88B855B36
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.221/iran.x86_64	de1de068b151fa14fdf94ba39d0503f0ee10a05fe0f9146c43928a96db25e084	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.aarch64	e102ee5bbf9282a4c5f5b38c5554668eefc67a9782004631d1aa837e18dfe159	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.m68k	b77142d8fa79f421c402fae649e041589c6e3584e69def5789b704af6b522535	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.mips	dea6d274c1c7c34d160bd12c87a27ef5c5edb1f4934c4557bb54f1857c7be360	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.mipsel	abc54ab37e423461c6a67b7d65f342451e42fbd93e4ba83fd571c3236cfcfc25	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.powerpc	7b46bce6515f1189593f7fbd7edb24ce2e152e0fbb6b57808515db882b331060	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.sparc	60bd242f448228391063d6a1521233087ba3602f5521f526a784d6325ffe8377	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.sh4	b610ed02b56e1634c71f36076e61e7bf69aca774e745df6c698d5d9f470d48b8	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.arc	b5099a274a6192b76e132488df1a051b2e6ccb68fc916901ddf73ef9d0f01fe2	Mirai	cowrie honeypot mirai
http://94.154.43.221/iran.i486	7bc4b2aef74456cca1499e1c6e3ce28827aa3c2d6e4a1f18cad547ad47e0b8ff	Mirai	94-154-43-221 elf mirai ua-wget
http://94.154.43.221/iran.armv4l	f692af11faa6ec2919d9269d28c7a962ee970f6199e92ad85676255bd5f8b91c	Mirai	94-154-43-221 elf mirai ua-wget
http://94.154.43.221/iran.armv5l	51ac3c75c8583cffc3f61777a7af6e4b068dcf7698ab89c89a57f15fab59bf18	Mirai	94-154-43-221 elf mirai ua-wget
http://94.154.43.221/iran.armv6l	e29c40498d1e2b650e65855ab7051475e4aa6bc54e9b0d8352dda798c5aba339	Mirai	94-154-43-221 elf mirai ua-wget
http://94.154.43.221/iran.armv7l	699848a33a1808fe612ce4e2e1f1bb292546509b3939c56b6842e315ad02d731	Mirai	94-154-43-221 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-07T15:48:00Z UTC

Last seen:

2026-09-08T14:54:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7d002de9-2ced-43ae-b161-e430cbb4910d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-09-07 17:49:46 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kgajexziyjf5mn6eoql4cvbhg2vdtcph4f2nrbmjptooraf43jca._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/260907-werwsazyfw/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Enumerates running processes

Modifies init.d

File and Directory Permissions Modification

Executes dropped EXE

Malware family:

BASHLITE

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5180925f28c2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh