MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 527be178002d858b9ae1f6a50ab52d45f9cc88a46b4c187fb497ef996bfd55a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 4 File information Comments

SHA256 hash:	527be178002d858b9ae1f6a50ab52d45f9cc88a46b4c187fb497ef996bfd55a0
SHA3-384 hash:	bd9f1b9fd7093c08923482a3cd403cdf8f4f7afd33e06e916f22a5814879aef07f0d69ab73fcf47cfccf60ce6f3e1f33
SHA1 hash:	863291b2c822855da68b9c1d0d34fd4d4842821d
MD5 hash:	49f9a74962bf0ab9ccbaea5978ed6423
humanhash:	moon-zulu-happy-early
File name:	telnet.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'453 bytes
First seen:	2026-10-02 18:39:51 UTC
Last seen:	2026-10-03 00:26:58 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:UpmeTpminpm6NI7qpmSKkprJxpnxJpip8MpNTtTptFpGmz2:Up7TpPnpkqp5lpTpnxJpip/pN9pDpGmy
TLSH	T1B13191CB61A25576ACA8ED67727B8544B190E58F50CE6F4A6CCC38F884CEE44F0507D3
Magika	batch
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.135/arm	2efd63cc32630d6a630dac0ca70afd9ff65a87826153678b0c89841a88308fc5	Mirai	elf mirai ua-wget
http://176.65.139.135/arm5	8938b1cb68b3189c93f0db674b3c0b40cf35169733b1e1d23aaa37714bcdfaf1	Mirai	elf mirai ua-wget
http://176.65.139.135/arm6	6561897bb373f25b7002a595c69a45292f2abc9e61141ca90fc39ecf8c0979ac	Mirai	elf mirai ua-wget
http://176.65.139.135/arm7	609316b027434e338a24c2a2499bb1903c1cdcf3424f13d9d33e00257d805f26	Mirai	elf mirai ua-wget
http://176.65.139.135/mips	b2b090f8e71800288cf2dfa6bde8e61c043cd34937600458b83e20939d2b1098	Mirai	elf mirai ua-wget
http://176.65.139.135/mpsl	98b43dca907880c96d2e5ec3e4c3d0cd2c13e441cd99de9523278ed4530d980c	Mirai	elf mirai ua-wget
http://176.65.139.135/x86_64	889643499f34373689fc109d7e09f764848e71082ec8d7de499b27c2c3892f4a	Mirai	elf mirai ua-wget
http://176.65.139.135/ppc	4a203def15c9d4b30d4602ed9db960d0407a6ba04114a64091b9658c5cd011f2	Mirai	elf mirai ua-wget
http://176.65.139.135/sh4	67cfc503966fd56d77c58cc8a689b94c6d9ba32e262646630cc55fc82037c06e	Mirai	elf mirai ua-wget
http://176.65.139.135/spc	93af664ca7cdd9682c89d3999802e0cdc763898a66cf5e013b58b5f4a8eccc4e	Mirai	elf mirai ua-wget
http://176.65.139.135/m68k	5c18a42bd5004985bedc476beef3c1f1ed02b09aff7b18dab323d6b19de4466f	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-02T16:41:00Z UTC

Last seen:

2026-10-03T18:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/527be178002d858b9ae1f6a50ab52d45f9cc88a46b4c187fb497ef996bfd55a0/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/cd433e0b-b2f5-4266-a58e-321084ebd6ec

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/527be178002d858b9ae1f6a50ab52d45f9cc88a46b4c187fb497ef996bfd55a0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/527be178002d858b9ae1f6a50ab52d45f9cc88a46b4c187fb497ef996bfd55a0/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-10-02 18:38:13 UTC

File Type:

Text (Shell)

AV detection:

21 of 38 (55.26%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kj56c6aafwcyxgxb62sqvnjnix44zcfenngbq75us7xzs275kwqa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261002-xbemqavglb/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/527be178002d858b9ae1f6a50ab52d45f9cc88a46b4c187fb497ef996bfd55a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	LIN_Downloader_Unknown_WgetChmodExecute Create hunting rule
Author:	Marjoriefort
Description:	Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:	misses_archive / grappe 5.182.210.174

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh