MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 838bc817322c36f5c5cf3bc4bc457f6de4424a4a8a2284dd654798f927cb689f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	838bc817322c36f5c5cf3bc4bc457f6de4424a4a8a2284dd654798f927cb689f
SHA3-384 hash:	5cbfd51981510f4edfa05c5287f0d66bbd0dfd104853467ebd2f3277c63831806a44a87b7adcfa5153dca5482f1a14b4
SHA1 hash:	adb2945c974ca5ca5ddf7a78f18db0054412ecf5
MD5 hash:	b248e8ab42cd4089319762f062bfae98
humanhash:	artist-california-grey-hamper
File name:	tplink.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'747 bytes
First seen:	2026-02-16 09:59:12 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:iorCo5IoXsoTBTO9GEoTIT9zloTIT9zloSJosnojQLoatoJYo7woNzNaopsp/oTH:fr/5JXFTBTO9GdTIT9zaTIT9zaSWsoj/
TLSH	T1F77142F656A10B322D629DF7F7A950277042908990C7BF05EAE978F925EDD0C3048B5F
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	juroots
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.144.64.166:81/epshteyn_x86_64	354b42ba644a621b2d7c63da4fc4b62b93bcfed1962a761826e5a4d6d02db84a	Mirai	mirai
http://45.144.64.166:81/epshteyn_i486	8c252a0623638c441aa90a97e7df42a95281028630c578b24dade116955b72f0	Mirai	mirai
http://45.144.64.166:81/epshteyn_aarch64	fa74adf19d58fd9dc812cdbbf22a1951de69ab9dbe21aec87389d507ad1f3146	Mirai	mirai
http://45.144.64.166:81/epshteyn_mips	8281588e04600cbf3cece7261b73873618d8bb2fc451d81fd4bb34ad4f9e639d	Mirai	mirai
http://45.144.64.166:81/epshteyn_mpsl	d5a387b1fa9e3b03ae0a055aebb844e73c8e1ed1728ba775bb74d918a015c5ef	Mirai	mirai
http://45.144.64.166:81/epshteyn_mips32	232d1fbbbc8d0807bfc4c3d236468687adbc92635be4969508d78e029561a10e	Mirai	mirai
http://45.144.64.166:81/epshteyn_arc	9a372e6e294b69861d246f5f316047e8fa27e2e970ebb6de1004b105dd9ecfb6	Mirai	mirai
http://45.144.64.166:81/epshteyn_arm4	800a02b006e274ae455ae5f231cfcacfc69cdab5a99870c9adeed76c2fa298b5	Mirai	mirai
http://45.144.64.166:81/epshteyn_arm5	9ee3f6e4412df6a836e74081fcc01b5046d5bf3d07f7a97ca108867429730c82	Mirai	mirai
http://45.144.64.166:81/epshteyn_arm6	cb5c01163888125d43f063b02c1a19cdf0a7aecfe8b175f8fbefde50db11232c	Mirai	mirai
http://45.144.64.166:81/epshteyn_arm7	918ca73a9ad98ae6b7d9129e22d4e8eae6841d54abadc76925af111aacfe6d00	Mirai	mirai
http://45.144.64.166:81/epshteyn_ppc	07f0056010295dd01ef7292975d3738fdaaa4cf66e909a48fa3eff96aee53d1b	Mirai	mirai
http://45.144.64.166:81/epshteyn_ppc440	fe44ed151419ee10d36cbd20f0a7b6fae542b03ecae99ec215279ea39f0c049f	Mirai	mirai
http://45.144.64.166:81/epshteyn_spc	876e0e1290b19d3f26a7fcd4ee7c36239902009de02135e6cfbfca8269d95d2f	Mirai	mirai
http://45.144.64.166:81/epshteyn_m68k	3ecda2a7a6d13bafea629c41b5b8a35d8e129d873db178d17e1c69adc48a7540	Mirai	mirai
http://45.144.64.166:81/epshteyn_sh4	b7588bde89df4af3e0e90f7fa0e4ae44e6fd4b9efcd515d6f76f1cd5ae70dfb6	Mirai	mirai
http://45.144.64.166:81/epshteyn_riscv32	0eb96a804a6097bc1827094043f6388d05f0b1920ad558de7024aa0941967402	Mirai	mirai
http://45.144.64.166:81/epshteyn_riscv64	e648ddd49dcb88cc435bfa0bcdf643d39ccc27c21f901cbd472dd831f4ed317a	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3c96b4ce-4066-455e-8ef4-3f0a24578657

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/838bc817322c36f5c5cf3bc4bc457f6de4424a4a8a2284dd654798f927cb689f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/838bc817322c36f5c5cf3bc4bc457f6de4424a4a8a2284dd654798f927cb689f/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/838bc817322c36f5c5cf3bc4bc457f6de4424a4a8a2284dd654798f927cb689f

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-02-16 10:00:37 UTC

File Type:

Text (Shell)

AV detection:

20 of 35 (57.14%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qof4qfzsfq3plrophpclyrl7nxseesskririjxlfi6mpsj6lncpq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/260216-l1kpgsbv2b/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/838bc817322c36f5c5cf3bc4bc457f6de4424a4a8a2284dd654798f927cb689f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh