MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 538637349b68660afe5b7169ee6195be8c1163e8502b27bebd3fa3fb6791f3df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	538637349b68660afe5b7169ee6195be8c1163e8502b27bebd3fa3fb6791f3df
SHA3-384 hash:	f849f2378cebeeed07208b24af1eb6ab88f56a266f6d36f7b78a8a2c62aeadeb6d808953ecff8ebdfe8d9c529f7e17b1
SHA1 hash:	e69a4e325353f9c1764bc7e26d317155de535dd8
MD5 hash:	262592064ecf716f95edf6284d30a1cd
humanhash:	floor-bluebird-white-ack
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'855 bytes
First seen:	2025-12-21 19:47:46 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:6wUwHwCOwC2JMYwbCwbbiBcwnLwnuZUwuEdwuEnE2EhEvwuwRtw6Lw6bwPwlwnwn:xI2JM/1biBv8uZuucvyptbworhM3m
TLSH	T18D51819F11008F31A64E898EB7F03134764AA4D35BEB8A54EE90085E0EC6E5C37C9E50
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnaarch64xnxn	6737ccd8d7dc5945638e935dd11e9aa635b39af9b125b1f62e197b04e9dda3d1	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxni386xnxn	a89f7f5f58288a91a02bdd8c4224fcd917d77ea5149771fd67433aa4deb6a49f	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	57bbaccebcaf065128022f68e01a91bdc58097e35ec9eac390e50f4ce219fed5	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnm68kxnxn	fa14ecf837984c9b9259d1d9fcf84553c4a728d597bee8d623e1738cc178422a	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	5e68511dfe9da9a6d1e081d058b7dc3bd1ddb189bfdd748c629aae43caf335bd	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnmipsxnxn	509a2b093c0328576a3da7ad1bd5bb880c42526167519b95f0fd371bc68552e8	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnor1kxnxn	9726543059a9ce755f9ad2edd8a28acefbf31a09d8420468aa5fa445c8f595c2	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	ba3287ed9914220cf4fcf4dd493c67292c4d1095d9ead5359bc3f38666335b1e	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnriscv32xnxn	6d6c9579ca57b1d3d5a3961be5ef90e7e145f071263042b23afa461e99e3713a	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnriscv64xnxn	0b8d2a649987fca23d0e1965b42a2c7ed29040c40c990fb8861d4c728aa28103	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnsh2xnxn	624719a933aee7d9dbe2c8a899569d268e6ff13ba5172b6d535921660d6f8b6b	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnsh4xnxn	888ed48db5837610a78077720a2ac0ec8ab0777d3b42e07182332ddb21eb8d91	Mirai	elf mirai ua-wget
http://130.12.180.2/bins/xnxnxnxnxnxnxnxnx86_64xnxn	f5b8a7db2093e66948c70002ca7de6cfa8da762c068bd7dfab4e3fdd51143da5	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm evasive mirai

Link:

https://www.filescan.io/uploads/69484efde126b9ff438afdf7/reports/4c9b1a9a-35e8-45c3-a7c3-d393f4e752f3/overview

Verdict:

Malicious

File Type:

text

First seen:

2025-12-21T17:43:00Z UTC

Last seen:

2025-12-21T17:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/538637349b68660afe5b7169ee6195be8c1163e8502b27bebd3fa3fb6791f3df/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/3559562d-5f32-4530-acfd-c70e8e48293a

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/538637349b68660afe5b7169ee6195be8c1163e8502b27bebd3fa3fb6791f3df

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/538637349b68660afe5b7169ee6195be8c1163e8502b27bebd3fa3fb6791f3df/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2025-12-21 19:48:20 UTC

File Type:

Text (Shell)

AV detection:

9 of 38 (23.68%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=koddone3nbtav7s3ofu64ymvx2gbcy7ikavsppv5h6r7wz4r6ppq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251223-lpgtfssla1/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/538637349b68660afe5b7169ee6195be8c1163e8502b27bebd3fa3fb6791f3df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.