MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95f716bc6b708400e3d2093c3a65615e482d5ec51e803b2c9e4cbfc075b5ce0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	95f716bc6b708400e3d2093c3a65615e482d5ec51e803b2c9e4cbfc075b5ce0b
SHA3-384 hash:	a2f42aade86a03cdd76b827bd584279847d510c4973ca55ecc6bbca3a69ac6147406d590801864122535f8df31c9cbd4
SHA1 hash:	b178734db4185538fd139e7888dbc48527746685
MD5 hash:	813d439e96f740d596241d27534f7ab2
humanhash:	grey-indigo-lemon-oscar
File name:	mass
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'988 bytes
First seen:	2025-09-12 05:29:41 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:2XISntFcB7MlFrS8bFFdq4N6kFqT1Y15FBATaxoaFUdLElFAP9w7FrGDgbNFMf9/:2XISntFcB7MlFrS8bFFdq4NBFqT1a5F4
TLSH	T1624165D638111953030EFE9CA362C898A04E85DCA78B26D4FAA91EBDDD4C70E7971B4C
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.35.154/powerpc.urbotnetisass	09a18ca51af0504d1de3691d6a5c290d3e2c1a6c98043957b8518267a3bb12ed	Mirai	elf geofenced mirai ua-wget USA
http://94.154.35.154/mips.urbotnetisass	b18659cad3db34b8d2d82ad5786c5696454ce7dd79e4de554f3da84f8f9d2aa0	Mirai	elf geofenced mirai ua-wget USA
http://94.154.35.154/mipsel.urbotnetisass	9b01970e468137eceb8f401e6f20a643826cb19b724a73de07c5d4abee718237	Mirai	elf geofenced mirai ua-wget USA
http://94.154.35.154/arm.urbotnetisass	a28ba2c86793fdc59244babe507f419e4cfa658bd61a5dd178ae090a5e795984	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm5.urbotnetisass	98b0356eb57747abf0f7aa3aac9c5ebee23164227fcbdf7a6e2984647b207334	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm6.urbotnetisass	4080cdfcf00475b9709de913f4fadccb5e43164702fa9c8247cc4927982eb9b0	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/arm7.urbotnetisass	483994d47c07d3cc14da050b1c6db9167bb9eef388a33aad5b3910ece49a830c	Mirai	arm elf geofenced mirai ua-wget USA
http://94.154.35.154/sparc.urbotnetisass	n/a	n/a	elf ua-wget
http://94.154.35.154/m68k.urbotnetisass	f4946b27267c603871ff2a00cfce51e49993eb1528240d4d028030f119bab328	Mirai	elf geofenced mirai ua-wget USA
http://94.154.35.154/sh4.urbotnetisass	89936f49e50a14f7c17b9ed52f01677b1cba93ff5d631fff8675a5eb68c7ceb2	Mirai	elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-12T03:34:00Z UTC

Last seen:

2025-09-12T03:34:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p

Link:

https://opentip.kaspersky.com/95f716bc6b708400e3d2093c3a65615e482d5ec51e803b2c9e4cbfc075b5ce0b/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f8544f4a-0f71-4121-9439-f2e9d33f04fe

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/95f716bc6b708400e3d2093c3a65615e482d5ec51e803b2c9e4cbfc075b5ce0b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95f716bc6b708400e3d2093c3a65615e482d5ec51e803b2c9e4cbfc075b5ce0b/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/95f716bc6b708400e3d2093c3a65615e482d5ec51e803b2c9e4cbfc075b5ce0b

Threat name:

Linux.Trojan.Geninst

Status:

Malicious

First seen:

2025-09-12 05:32:43 UTC

File Type:

Text (Shell)

AV detection:

14 of 23 (60.87%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sx3rnpdloccaby6sbe6duzlblzec2xwfd2adwle6js74a5nvzyfq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250912-hjtpaattbt/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/95f716bc6b708400e3d2093c3a65615e482d5ec51e803b2c9e4cbfc075b5ce0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.