MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 959f6557999d6008ef5dd2ff0faf5810a88072fe35202bd993e392f9519a42e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	959f6557999d6008ef5dd2ff0faf5810a88072fe35202bd993e392f9519a42e1
SHA3-384 hash:	b624cc348b892d94839216c4cd02b76fbe0a7f790c9ed58abcc39f5d23712c77ce3c71ebe7e611c43115fec4ace43357
SHA1 hash:	a4fa29432f4e67aa672abac9bdbb796e7d55d7ff
MD5 hash:	c2427b0e38724319fd1e5d89ed0a88ea
humanhash:	glucose-lemon-fifteen-kitten
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'584 bytes
First seen:	2025-12-24 23:11:51 UTC
Last seen:	2025-12-25 14:31:35 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:nDd/fiXSXdO1Y8dGMDadSnyd6ggdEhWRdGHRdkdtbdZJiZJ1IdPyPjJdd8nAdMJe:nD1iTa3NgA6IRM1Y1Iw4AWt6v
TLSH	T1313180CE30218EB229CD9E85B2F1E548F480DAE666F50FB4BDD608674DD7604379C638
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.20/x86_64	afd23239ac37840687f51cdc8cc0e5c1ab0f62bfcc861427a092bd21e07d8dee	Mirai	elf geofenced mirai ua-wget USA x86
http://130.12.180.20/x86	30da945d7e5500938299cb12b475f94e3354dfdcfb5d591128668a3b5d4de483	Mirai	elf geofenced mirai ua-wget USA x86
http://130.12.180.20/m68k	b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8	Mirai	elf geofenced m68k mirai ua-wget USA
http://130.12.180.20/mips	d908d2f0b4114165079510ef8fc762c6b6cec60eea6dec514d683f3e67f55680	Gafgyt	elf gafgyt geofenced mips ua-wget USA
http://130.12.180.20/mpsl	e2f49b929531ddce009e62e076af65a97785fe9732012fb13e968ffab3164f43	Mirai	elf geofenced mips mirai ua-wget USA
http://130.12.180.20/ppc	4f581e30be9df11bcab26c70caf17a0161cf2acaf676371ba0aa5aabc7e5d371	Mirai	elf geofenced mirai PowerPC ua-wget USA
http://130.12.180.20/spc	0ddb8750a2234f53bebd468ede3922e59d69845d47c81967709bb9ed729a2717	Mirai	elf geofenced mirai sparc ua-wget USA
http://130.12.180.20/sh4	7916e2f6e47d71fcc0a48bf85d4bce2a61623035bc91eda55f036f1f6482a956	Mirai	elf geofenced mirai SuperH ua-wget USA
http://130.12.180.20/i486	n/a	n/a	elf ua-wget
http://130.12.180.20/arm4	42719d96f3b14272254cbd68c4ea3e02900a517a501f8a94440cf162689e6b0a	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20/arm5	fc542ad670c36e48b6bf573678e5e81fe884d231807256ecd06fa88801cb8eaa	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20/arm6	f4c538b4c55ad7f1dcc1dc160b373386aa0b11de48528ac5338ea58913e42900	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20/arm7	f20dd3de2b928c15faff2a8b7233b3918a3922f53f61ce7e02a7e0f1b691be1a	Mirai	arm elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Gathering data

Verdict:

Malicious

File Type:

unix shell

Detections:

HEUR:Trojan-Downloader.Shell.Agent.cx HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/959f6557999d6008ef5dd2ff0faf5810a88072fe35202bd993e392f9519a42e1/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b7bcec66-aa37-4ad0-85d0-942891d6099c

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/959f6557999d6008ef5dd2ff0faf5810a88072fe35202bd993e392f9519a42e1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/959f6557999d6008ef5dd2ff0faf5810a88072fe35202bd993e392f9519a42e1/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/959f6557999d6008ef5dd2ff0faf5810a88072fe35202bd993e392f9519a42e1

Threat name:

Script-Shell.Trojan.Geninst

Status:

Malicious

First seen:

2025-12-24 23:12:23 UTC

File Type:

Text (Shell)

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=swpwkv4ztvqar3252l7q7l2yccuia4x6guqcxwmt4ojpsum2ilqq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251224-2656daas6h/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/959f6557999d6008ef5dd2ff0faf5810a88072fe35202bd993e392f9519a42e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh