MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91edac44800a3cebae17f730387fbff80d81ba22f5cea696fbbf437b8717dfc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	91edac44800a3cebae17f730387fbff80d81ba22f5cea696fbbf437b8717dfc0
SHA3-384 hash:	a342f6dddd990510183fe0044c5d983f38623cef94ba90fe2f6b0d1970a5880d82dd0e9721de61ccae9965717f056ee0
SHA1 hash:	d87aa16d58aabb3f480ddc45658030f4f63485ff
MD5 hash:	89bc339c7299fc9374a40742a4fc20e7
humanhash:	sixteen-low-carbon-whiskey
File name:	telnet.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'834 bytes
First seen:	2026-08-08 17:02:02 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Dkft0dtVNaKM6zODOmF8foMK1pk1YtVbcVb1LBDN0RN0KvtnEe77tLBSChwlz48X:gfCpF0DzFYK/kuaN2R2Mtxtx+
TLSH	T1CF3173DE12B3A25AC184CE42B3F942C4A675F5C43290EA72F9C29C39F179EC13455A37
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.207.196.86/iran.x86_64	fb44541efeb566a4dadf7d84ecc48be839112c7b0bf596e65d026b35845a3432	Mirai	ua-wget
http://45.207.196.86/iran.aarch64	00f518e1d68985bb3477a7db43b1cd87b19e8ab0f28656f9476d3c1ec767b5ea	Mirai	mirai ua-wget
http://45.207.196.86/iran.m68k	3c5992d4f4b96c3a9e67796545e992e9a58a091d9b288441dea39cb78d4ad098	Mirai	ua-wget
http://45.207.196.86/iran.mips	c74b026a46d2c1f745e00d0a0c238a4fa6dc73edc7b6e296eb82ec0bdc81c108	Mirai	ua-wget
http://45.207.196.86/iran.mipsel	5e16374c9bef3f91624f7bd79a6699b81e8631cc830bbd185bd9fa8778685aff	Mirai	ua-wget
http://45.207.196.86/iran.powerpc	5ef8c87877de0c8ec908b788bd9ca21645dc1f3c04bfea21dfe2d8484ca7285d	Mirai	ua-wget
http://45.207.196.86/iran.sparc	c360784addafcc7f7e89087a92e1f634464d69ad797103c637b0caad3b636db0	Mirai	mirai ua-wget
http://45.207.196.86/iran.sh4	835b4bb30ff13a783cac401f0e8093ba552b623859714e2b617e51fb7bc4c159	Mirai	ua-wget
http://45.207.196.86/iran.arc	0e42a5f6ceb75b8798d8f89e1b4b0c1f3df854a91bda74deaefaf6772994184b	Mirai	mirai ua-wget
http://45.207.196.86/iran.i486	4b11d46b6cc930459cd24852a0dc32ff4b17478fe57447063eade46caa81ffb7	Mirai	ua-wget
http://45.207.196.86/iran.armv4l	0736aea70023fe0789f7bb4c057ce06b425368b1e9ceeb27f1f0447a12fe4c25	Mirai	ua-wget
http://45.207.196.86/iran.armv5l	03a9492180fa6f30ba7274483a91ed24643ddaa85897b413848f1c06f3d3b071	Mirai	mirai ua-wget
http://45.207.196.86/iran.armv6l	e94f5de7cc52706fcb7b67af1bfca1fa9351e4f30e0aeb0465d88530d29b2bb7	Mirai	ua-wget
http://45.207.196.86/iran.armv7l	ae31548b7714caf4555ab79fea6a6b4764a0ae5bc1baf73b69fd762ff0999b11	Mirai	ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-24T18:34:00Z UTC

Last seen:

2026-07-24T19:12:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/91edac44800a3cebae17f730387fbff80d81ba22f5cea696fbbf437b8717dfc0/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/0740f8bc-f020-4ecd-8130-56fab956c068

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/91edac44800a3cebae17f730387fbff80d81ba22f5cea696fbbf437b8717dfc0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/91edac44800a3cebae17f730387fbff80d81ba22f5cea696fbbf437b8717dfc0/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-08-08 17:01:27 UTC

File Type:

Text (Shell)

AV detection:

13 of 36 (36.11%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=shw2yreabi6oxlqx64ydq7577agydorc6xhknfx3x5bxxbyx37aa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/260808-vkctdavwfv/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Modifies init.d

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Malware family:

Gafgyt

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/91edac44800a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/91edac44800a3cebae17f730387fbff80d81ba22f5cea696fbbf437b8717dfc0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh