MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286
SHA3-384 hash:	487f0b05675c9adff5080786d3cc033c5f89c623b2f66afa4f83c4f0764cc94f57e6ec6f8a321c59d6388e3322aa7cec
SHA1 hash:	3373fa8d0d2674c79ca7ab7644234840c403a7a3
MD5 hash:	40b94b5c245f6d8a18d4324e7034e4ef
humanhash:	hydrogen-echo-zebra-stairway
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'881 bytes
First seen:	2026-05-05 15:06:58 UTC
Last seen:	2026-05-05 22:35:43 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:W+pg6g2JMkJuJbiB4VnVuZgkEZkEnE2EhELU/pUnUbwrLptJnunJUf449D6DhM3m:Id2JMsGbiBkVuZ//cvyQUbwZYhM3m
TLSH	T1BA5161AB13084B31D649854EBBFE31B4A50EE19366DBC708FD4408AD4FCAD4C3295E85
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnaarch64xnxn	de860ef37ee47533eec06c5dd9f5939d8368d168bac1ebad58feed22b3d14375	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxni386xnxn	ba2048de6e58963a4c705c2c63da845977f646c844717cde7fc1fb133e792c66	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	12ad2e32965731ed2adc9069070591cff2a42c2f57c130a929d92aff49eff736	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnm68kxnxn	f62cfeb4b3a2d4e5b45ec706288ac2bf6da5218545ed93a567dda145be23f3a6	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	b3791f906405d4fb859e423430e9ea74c9b672180bf2bfef339a0a01d3424eb5	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnmipsxnxn	ff6438403c893c8a35d04dfb5f21c9054ee72de7842ea63145a1c97c5e30e1cf	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnor1kxnxn	849f1ca6e286c4e11d8f7b6188ef209f64e3ed65b6450531b45692ea010269a9	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	7bb8198bb7d23236888579a8a29e33bb67106835dd1f6728a3a1c858469516aa	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnriscv32xnxn	2a2974ccdd715e1fdaacf1e65ee8a54568a306c07c53a67a8f81ba129244fa21	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnriscv64xnxn	6618fa629b66739d438426d18e6898e150845eb0e710c0094d60c0617986fab4	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnsh2xnxn	ba179aaf217f0a9899787eed7387a3f80ea5c717799573382164ebab003abb70	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnsh4xnxn	1a63a2f3f865c058fab9d6a42dbaed7329b1b23282e5f3cd0e4c726c33a7801a	Mirai	elf mirai ua-wget
http://45.83.207.206/bins/xnxnxnxnxnxnxnxnx86_64xnxn	e5be5078e60338325fdfbffe6a209c6c1bcc55004c310f39c8ab90c867e68786	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm evasive mirai

Link:

https://www.filescan.io/uploads/69fa07b27d31ad7bba4e78f3/reports/c361901b-c6f0-4b22-b637-a309aaff82cf/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-05-05T12:11:00Z UTC

Last seen:

2026-05-05T14:49:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.gen

Link:

https://opentip.kaspersky.com/518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/10345fcb-8dd6-4797-ab6d-1bccc48c05d9

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-05-05 15:07:31 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kgfd4pononsgecfn7qka6f6avte5g7eyxh27rnanwwzlfibpmkda._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260505-shj4kaax7z/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.