MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d
SHA3-384 hash: 4a179a584a66497ccbae52965c4101162169812cda055604f5a758bf48c456dc875a133fdc443daabdd373e71393784e
SHA1 hash: d7317c63d7cb99ed36d3c0f36a935048a29a844b
MD5 hash: 57775f162f28e4727c36503b038d48be
humanhash: white-zulu-uniform-snake
File name:cat.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'343 bytes
First seen:2026-04-07 17:22:29 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:opqRgpQ0QagpbHgpUHxgpexgpUOUYgpadaSgplVgpco0gpqOqNIjZgpWeygpJnJp:opqKpQ0Q3pbApyqpeqpUOU9pgeplOpcn
TLSH T1DF210ED90152A283C67BDD1C7A75C9446222E0C3A5CB2E3EDCD418ADCCCA76AB215BC9
Magika csv
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.52/bins/x86_64b7dd079942df5544c88b861ccf831ac7222c332643cfcd3947d23917c58d3c7c Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/px86b7dd079942df5544c88b861ccf831ac7222c332643cfcd3947d23917c58d3c7c Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/pspc52576a56e466972d8abbe2e2b76ff6391065544068717b2a8bcf8567bb271c83 Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/psh458a02139c0d0511c5c84ebd4e7cd7316868e992796a7ea636bca4ed948b4de3d Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/pppc38560878d6da281011c9e628f4c9cbf07075ea4da4b14d1bc35849f1eeee6aaf Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/pmpslf56bd9b536daddf32e277cb6dceaa901c060a3729ac15b017d356df0b89a3c68 Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/pmipsbb1d71acda0f065e6bace361dec4d89bbc3338f8a2c780a614c94c99019724bc Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/pm68k0c393756c8713871b94d0cda58331cb449662b5325f2a612d86de514706e69b2 Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/parm7740045574b5ad8967ada3f569ac1211c1900e9821cef7b4566bb8b7b0223a0e5 Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/parm6ad2cfd8b661654b7518a991c8caca2b2f3455c3cac6794b2da55ffc0d89baaf4 Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/parm5eec75b78d511756863d55565fb269906e50705a61bc6f00e9c8fbca3d07e6fb1 Mirai176-65-139-52 elf mirai ua-wget
http://176.65.139.52/bins/parmdb54a6b0df51bdc18e43dfc91b8600625415592ddf88d54c2455f1c3934c2f5c Mirai176-65-139-52 elf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
medusa mirai similar-threat
Link:
https://www.filescan.io/uploads/69d53d5600ad3636940e0965/reports/5bc7259a-8876-4435-ab57-335a4aac1802/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-04-07T07:11:00Z UTC
Last seen:
2026-04-09T01:40:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d
Threat name:
Linux.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-04-07 14:22:55 UTC
File Type:
Text (Shell)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qsxhwr4jbh7jyoqoxm2avofviom4s6hluhxfao3hszolukyiyi6q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260407-vxtbwsat4q/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d

(this sample)

Mirai

elf 9164db5a23b56ef88c946b4cc3ef0d59540e1dd6303769c6a4587ce2be782e1c

Mirai

elf b7dd079942df5544c88b861ccf831ac7222c332643cfcd3947d23917c58d3c7c

  
URLhaus
https://urlhaus.abuse.ch/url/3813538/
  
Delivery method
Distributed via web download
  
Dropping
MD5 5edac00af76b4413f445e9f0c668c3d3
  
Dropping
SHA256 b7dd079942df5544c88b861ccf831ac7222c332643cfcd3947d23917c58d3c7c

Comments