MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 914522b59aaa66b6dea702bb084cf8b130868a07f2ced84e40e48b41586d8af6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 914522b59aaa66b6dea702bb084cf8b130868a07f2ced84e40e48b41586d8af6
SHA3-384 hash: 1f14c85cfbb0226645491e5964b419f9b4662df4654a9125cc080ec34483928c10c8997954c0d3ff61d195ad605e0f19
SHA1 hash: e035f739ff360a1e3242407942c808bce600b813
MD5 hash: 60bba2d250301f1ee43e16412d9fc173
humanhash: oklahoma-sodium-monkey-coffee
File name:tplink.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'170 bytes
First seen:2025-06-20 08:59:03 UTC
Last seen:2025-06-20 17:40:10 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:FyayOyCytMyGTjy+yV4yyyrQtyayiyBiRhyXeyH:FyayOyCyKyay+yKyyyCyayiyqhyXeyH
TLSH T1404142CA24A719706DA8DDA775BA840870E0B9C671CA3F259CDD3DF544CDF093180B87
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.96.131.92/mipsa42c4d58ed1e56eec68d559bcb17a65f079d4a64e41248c8c62e85d38eecec5d Miraielf mirai ua-wget
http://176.96.131.92/mipsel29092ff60d3c10e486bf39919ac545a968c32cbba8dcd8bad4b823a13a535c14 Miraielf mirai ua-wget
http://176.96.131.92/sh4bbc50de11f561797de5ffda50e882073fff54add68f89b408b143df2183f84ef Miraielf mirai ua-wget
http://176.96.131.92/x86_64fd04838d3192096a4996446e53cb1a2b83969116db3903d88c3f2df4a60f8cdd Miraielf mirai ua-wget
http://176.96.131.92/arm6n/an/an/a
http://176.96.131.92/i6869c647eb049c31c689bd89181f6c8a043deca07d2f2b39a8480ce8e9f2d20efdb Miraielf mirai ua-wget
http://176.96.131.92/powerpce0e66d83469487cd3fcab72ea1db5a48d51ccd3ec94233201b594de44c4a8328 Miraielf mirai ua-wget
http://176.96.131.92/x86e4b312250b02502668017e7452d2376e7e548ebcaacb5f79830f6e5e5c5b116c Miraielf mirai ua-wget
http://176.96.131.92/m68keaebb4d7d87945e2c5bc6d7c1bdfcb59d889c5022e04d70235490d4ae4a959f4 Miraielf mirai ua-wget
http://176.96.131.92/spcn/an/an/a
http://176.96.131.92/arm82ae6c673060bb1b8c81851e7ed1e24568bb5ec8070a5d705a3957b268780e7d Miraielf mirai ua-wget
http://176.96.131.92/arm5be6cc0f4fb1f9434817e6e9195bb8e5a12da1ff5753a4077dec5f80b8c88c3a5 Miraielf mirai ua-wget
http://176.96.131.92/ppc4fpn/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
67
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685522f6bb25757a6a1b1635linux22vpnfull_triage
Tags:
agent hype sage
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/520fb1d8-8fd1-40bf-aec9-825b2ff7a73b
Behavior Graph:
Download SVG
%3 guuid=b3fcd4fd-1900-0000-9fea-75aa8e0a0000 pid=2702 /usr/bin/sudo guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707 /tmp/sample.bin guuid=b3fcd4fd-1900-0000-9fea-75aa8e0a0000 pid=2702->guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707 execve guuid=e1b2f7ff-1900-0000-9fea-75aa960a0000 pid=2710 /usr/bin/wget net send-data write-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=e1b2f7ff-1900-0000-9fea-75aa960a0000 pid=2710 execve guuid=80f9370f-1a00-0000-9fea-75aab90a0000 pid=2745 /usr/bin/chmod guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=80f9370f-1a00-0000-9fea-75aab90a0000 pid=2745 execve guuid=5ecc960f-1a00-0000-9fea-75aabb0a0000 pid=2747 /usr/bin/bash guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=5ecc960f-1a00-0000-9fea-75aabb0a0000 pid=2747 clone guuid=a4e93b10-1a00-0000-9fea-75aabe0a0000 pid=2750 /usr/bin/rm delete-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=a4e93b10-1a00-0000-9fea-75aabe0a0000 pid=2750 execve guuid=3bfe8e10-1a00-0000-9fea-75aac10a0000 pid=2753 /usr/bin/wget net send-data write-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=3bfe8e10-1a00-0000-9fea-75aac10a0000 pid=2753 execve guuid=a8c0c320-1a00-0000-9fea-75aad70a0000 pid=2775 /usr/bin/chmod guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=a8c0c320-1a00-0000-9fea-75aad70a0000 pid=2775 execve guuid=77a21f21-1a00-0000-9fea-75aad80a0000 pid=2776 /usr/bin/bash guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=77a21f21-1a00-0000-9fea-75aad80a0000 pid=2776 clone guuid=f0642c22-1a00-0000-9fea-75aadc0a0000 pid=2780 /usr/bin/rm delete-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=f0642c22-1a00-0000-9fea-75aadc0a0000 pid=2780 execve guuid=cbc0dc22-1a00-0000-9fea-75aae00a0000 pid=2784 /usr/bin/wget net send-data write-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=cbc0dc22-1a00-0000-9fea-75aae00a0000 pid=2784 execve guuid=bb66652f-1a00-0000-9fea-75aaf40a0000 pid=2804 /usr/bin/chmod guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=bb66652f-1a00-0000-9fea-75aaf40a0000 pid=2804 execve guuid=781eb92f-1a00-0000-9fea-75aaf60a0000 pid=2806 /usr/bin/bash guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=781eb92f-1a00-0000-9fea-75aaf60a0000 pid=2806 clone guuid=d0b38030-1a00-0000-9fea-75aaf80a0000 pid=2808 /usr/bin/rm delete-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=d0b38030-1a00-0000-9fea-75aaf80a0000 pid=2808 execve guuid=941f1c31-1a00-0000-9fea-75aaf90a0000 pid=2809 /usr/bin/wget net send-data write-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=941f1c31-1a00-0000-9fea-75aaf90a0000 pid=2809 execve guuid=82b35d3f-1a00-0000-9fea-75aa100b0000 pid=2832 /usr/bin/chmod guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=82b35d3f-1a00-0000-9fea-75aa100b0000 pid=2832 execve guuid=8d3dba3f-1a00-0000-9fea-75aa110b0000 pid=2833 /tmp/x86_64 net guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=8d3dba3f-1a00-0000-9fea-75aa110b0000 pid=2833 execve guuid=d318da3f-1a00-0000-9fea-75aa140b0000 pid=2836 /usr/bin/rm delete-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=d318da3f-1a00-0000-9fea-75aa140b0000 pid=2836 execve guuid=fc464b40-1a00-0000-9fea-75aa180b0000 pid=2840 /usr/bin/wget net send-data guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=fc464b40-1a00-0000-9fea-75aa180b0000 pid=2840 execve guuid=77e27447-1a00-0000-9fea-75aa290b0000 pid=2857 /usr/bin/chmod guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=77e27447-1a00-0000-9fea-75aa290b0000 pid=2857 execve guuid=d721ed47-1a00-0000-9fea-75aa2b0b0000 pid=2859 /usr/bin/bash guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=d721ed47-1a00-0000-9fea-75aa2b0b0000 pid=2859 clone guuid=f28f1248-1a00-0000-9fea-75aa2c0b0000 pid=2860 /usr/bin/rm guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=f28f1248-1a00-0000-9fea-75aa2c0b0000 pid=2860 execve guuid=0575e948-1a00-0000-9fea-75aa2d0b0000 pid=2861 /usr/bin/wget net send-data write-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=0575e948-1a00-0000-9fea-75aa2d0b0000 pid=2861 execve guuid=50b96556-1a00-0000-9fea-75aa4a0b0000 pid=2890 /usr/bin/chmod guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=50b96556-1a00-0000-9fea-75aa4a0b0000 pid=2890 execve guuid=0bffb556-1a00-0000-9fea-75aa4c0b0000 pid=2892 /tmp/i686 net guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=0bffb556-1a00-0000-9fea-75aa4c0b0000 pid=2892 execve guuid=915ad956-1a00-0000-9fea-75aa4f0b0000 pid=2895 /usr/bin/rm delete-file guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=915ad956-1a00-0000-9fea-75aa4f0b0000 pid=2895 execve guuid=457a2257-1a00-0000-9fea-75aa530b0000 pid=2899 /usr/bin/wget net send-data guuid=f8d379ff-1900-0000-9fea-75aa930a0000 pid=2707->guuid=457a2257-1a00-0000-9fea-75aa530b0000 pid=2899 execve eda3e667-8c41-5104-a4bd-982a31e34038 176.96.131.92:80 guuid=e1b2f7ff-1900-0000-9fea-75aa960a0000 pid=2710->eda3e667-8c41-5104-a4bd-982a31e34038 send: 132B guuid=3bfe8e10-1a00-0000-9fea-75aac10a0000 pid=2753->eda3e667-8c41-5104-a4bd-982a31e34038 send: 134B guuid=cbc0dc22-1a00-0000-9fea-75aae00a0000 pid=2784->eda3e667-8c41-5104-a4bd-982a31e34038 send: 131B guuid=941f1c31-1a00-0000-9fea-75aaf90a0000 pid=2809->eda3e667-8c41-5104-a4bd-982a31e34038 send: 134B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=8d3dba3f-1a00-0000-9fea-75aa110b0000 pid=2833->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=13cfd03f-1a00-0000-9fea-75aa130b0000 pid=2835 /tmp/x86_64 zombie guuid=8d3dba3f-1a00-0000-9fea-75aa110b0000 pid=2833->guuid=13cfd03f-1a00-0000-9fea-75aa130b0000 pid=2835 clone guuid=d663e03f-1a00-0000-9fea-75aa150b0000 pid=2837 /tmp/x86_64 net send-data zombie guuid=13cfd03f-1a00-0000-9fea-75aa130b0000 pid=2835->guuid=d663e03f-1a00-0000-9fea-75aa150b0000 pid=2837 clone b0f38c32-b061-562f-b20a-5c682bf2ef50 176.96.131.92:5683 guuid=d663e03f-1a00-0000-9fea-75aa150b0000 pid=2837->b0f38c32-b061-562f-b20a-5c682bf2ef50 send: 78B guuid=d1b2e93f-1a00-0000-9fea-75aa160b0000 pid=2838 /usr/bin/dash guuid=d663e03f-1a00-0000-9fea-75aa150b0000 pid=2837->guuid=d1b2e93f-1a00-0000-9fea-75aa160b0000 pid=2838 execve guuid=11bfd640-1a00-0000-9fea-75aa1a0b0000 pid=2842 /usr/bin/dash guuid=d663e03f-1a00-0000-9fea-75aa150b0000 pid=2837->guuid=11bfd640-1a00-0000-9fea-75aa1a0b0000 pid=2842 execve guuid=769e1a40-1a00-0000-9fea-75aa170b0000 pid=2839 /usr/bin/mkdir guuid=d1b2e93f-1a00-0000-9fea-75aa160b0000 pid=2838->guuid=769e1a40-1a00-0000-9fea-75aa170b0000 pid=2839 execve guuid=fc464b40-1a00-0000-9fea-75aa180b0000 pid=2840->eda3e667-8c41-5104-a4bd-982a31e34038 send: 132B guuid=3f6e0141-1a00-0000-9fea-75aa1b0b0000 pid=2843 /usr/bin/mv guuid=11bfd640-1a00-0000-9fea-75aa1a0b0000 pid=2842->guuid=3f6e0141-1a00-0000-9fea-75aa1b0b0000 pid=2843 execve guuid=0575e948-1a00-0000-9fea-75aa2d0b0000 pid=2861->eda3e667-8c41-5104-a4bd-982a31e34038 send: 132B guuid=0bffb556-1a00-0000-9fea-75aa4c0b0000 pid=2892->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c171d056-1a00-0000-9fea-75aa4d0b0000 pid=2893 /tmp/i686 guuid=0bffb556-1a00-0000-9fea-75aa4c0b0000 pid=2892->guuid=c171d056-1a00-0000-9fea-75aa4d0b0000 pid=2893 clone guuid=6783d656-1a00-0000-9fea-75aa4e0b0000 pid=2894 /tmp/i686 net send-data zombie guuid=c171d056-1a00-0000-9fea-75aa4d0b0000 pid=2893->guuid=6783d656-1a00-0000-9fea-75aa4e0b0000 pid=2894 clone guuid=6783d656-1a00-0000-9fea-75aa4e0b0000 pid=2894->b0f38c32-b061-562f-b20a-5c682bf2ef50 send: 78B guuid=2cb6ee56-1a00-0000-9fea-75aa500b0000 pid=2896 /usr/bin/dash guuid=6783d656-1a00-0000-9fea-75aa4e0b0000 pid=2894->guuid=2cb6ee56-1a00-0000-9fea-75aa500b0000 pid=2896 execve guuid=09de9c57-1a00-0000-9fea-75aa560b0000 pid=2902 /usr/bin/dash guuid=6783d656-1a00-0000-9fea-75aa4e0b0000 pid=2894->guuid=09de9c57-1a00-0000-9fea-75aa560b0000 pid=2902 execve guuid=a7271757-1a00-0000-9fea-75aa520b0000 pid=2898 /usr/bin/mkdir guuid=2cb6ee56-1a00-0000-9fea-75aa500b0000 pid=2896->guuid=a7271757-1a00-0000-9fea-75aa520b0000 pid=2898 execve guuid=457a2257-1a00-0000-9fea-75aa530b0000 pid=2899->eda3e667-8c41-5104-a4bd-982a31e34038 send: 135B guuid=3884c457-1a00-0000-9fea-75aa570b0000 pid=2903 /usr/bin/mv guuid=09de9c57-1a00-0000-9fea-75aa560b0000 pid=2902->guuid=3884c457-1a00-0000-9fea-75aa570b0000 pid=2903 execve
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/914522b59aaa66b6dea702bb084cf8b130868a07f2ced84e40e48b41586d8af6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/914522b59aaa66b6dea702bb084cf8b130868a07f2ced84e40e48b41586d8af6/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/914522b59aaa66b6dea702bb084cf8b130868a07f2ced84e40e48b41586d8af6
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-06-20 08:33:01 UTC
File Type:
Text (Shell)
AV detection:
16 of 24 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sfcsfnm2vjtlnxvhak5qqthyweyincqh6lhnqtsa4sfucwdnrl3a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/250620-kxxzzacn5w/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.12
Link:
https://yomi.yoroi.company/submissions/914522b59aaa66b6dea702bb084cf8b130868a07f2ced84e40e48b41586d8af6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts
Rule name:UNK_install_script
Create hunting rule
Author:evilcel3ri
Description:Detects a suspicious behaviour in an bash installation script

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 914522b59aaa66b6dea702bb084cf8b130868a07f2ced84e40e48b41586d8af6

(this sample)

Mirai

elf 9911c7f6f84c520afed6f93a132de7d7e5c12cafb15b2891d9669dd1d118ce21

  
URLhaus
https://urlhaus.abuse.ch/url/3568532/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d9118c3fc30ca1e3ed1b842a97eae05b
  
Dropping
SHA256 9911c7f6f84c520afed6f93a132de7d7e5c12cafb15b2891d9669dd1d118ce21

Comments