MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a31041a3d49bad7ffcbc1e49d5e0275e75f3fde7fc43093385aa7d6d9b9ad2b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	a31041a3d49bad7ffcbc1e49d5e0275e75f3fde7fc43093385aa7d6d9b9ad2b6
SHA3-384 hash:	f44d1a533d9444e8a07a6da1e049845958886db4a2f1789add775ec78ecf19d14ee14c7a0e56f0daebeb8cdbc951be8f
SHA1 hash:	33718d3fe56778d5b0c420f71e23497e45c147e3
MD5 hash:	295be3065de51f84ccfb4d5336d7e596
humanhash:	social-hawaii-bluebird-harry
File name:	tplink.sh
Download:	download sample
File size:	4'893 bytes
First seen:	2026-08-14 13:51:53 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:7l/8HvLiPLxF6eAN3xodPYjLy+6Fnh4iQ/dtSbBmLoTQ//iVXrINFL4Nxuxfdc5z:7l/8HvLiPLxF6eAN3xodPYjLy+6Fnh4a
TLSH	T18AA1BF8A2478D63CA47FDDAC79E54B40988D45E232B23F399EB028535CC9970B349F5E
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.aarch64be	n/a	n/a	arm elf opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	0a1b5a7d511f78d0fc5edd2631a3e35db7d78a97ffc500c583e67fbbe66c260c	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	eef49d9756bc6d5ce108b4b09aed69cb5f8ec007a5c0a86f6fbe69cf271ee93f	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	f9ea5d7b3ced95262b48c49b353d3ed5c10d08480163fba0f3cb4f7b0f6cc226	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	6a8f55a91c79430e15bd17485c43af13ab7dee58d1a5b7e385fab307c798126c	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	7d853349156efba35f1655d52df5b2c5915173b42fdb88bf832bda464a2934ac	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	fc384d8532b3862c2523e44e93263a0defa3e5bf49b5e7e2884a1ee6724248d1	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	5ca81bc8c1e8cc36af45b3f747c07a8b36338361b4c21ebe988e0521720c5f4d	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	60266ec469a63f90a21ccf98c259ed88677e4ad8e48640ec27e4420f8ae1892a	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	e380989e2a71a20fdc2b80c01fcb81fe28ec2779ac2295c4aee3b39e4d3881df	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	adce532926d00a809db14b6db7aa6c5cd3c9371995cc3aee79d1a778ed7a64d0	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	fe5bff34f38963f7a7e22522a1a0e33327cff599acd655702f7d69469cc89281	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e500mc	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e5500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e6500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	c9bb5dd52976d4c6abc0f1a8f53afab4b7ec029eccf25d48d558ff8b0edb62cf	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.m68k-68xxx	n/a	n/a	elf m68k opendir ua-wget
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	04e7d3cf8d5664c0151f2f922ec152ab42886fc6f663f14dc85570f1cec93753	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32	3a2ec3347d6a7f386ae4def173d07daed20bc7811499bccface54374744fc3ec	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	8679859c1707872ba54a49505e5964cfcb9d42f13819f11ce1f628822cfbb858	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32r5el	0e8208254ee176da983b6615c0c3efbdf89557c9ed15a73248ad16ebe26031d9	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips32r6el	b9061158996ce05f27b87707628796d9427eb5de42a7d2154270fca548b2337e	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	11c08fb55565c70a54f0720c2b1d4888163612ebf4aed0e56d1606d4b84e7e63	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64-n32	0ad006150fa4bfe952b2143bea489b60a09cb4cd0dabdcfc2a8acd0f2671d2a4	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64r6el-n32	14dcc6ed713bb7ead2184cc12f1b06e265dcf32a58ed3c3421b479ab991f1c28	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	b234556f56745222a967d87b0f01e40bc26cd4725d4f8e1d9863c8e597d374d6	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.power8	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.power8le	c37cae9648fe0ebb08a6f4c5cda9e7f375c2684ba7aad228c09778d605d75e61	Mirai	elf opendir PowerPC ua-wget
http://130.12.182.77/main.powerpc	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.ppc440fp	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.riscv64	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.s390x	caca12988c34c299833d55bf8e22adcb174279148b652f59054cc1a8b9189eae	Mirai	elf opendir s390x ua-wget
http://130.12.182.77/main.sh4	28c2c8599a12114d2703e87a629cb8a715db1284e936c8476cb3eb592d971b15	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sh4aeb	n/a	n/a	elf opendir SuperH ua-wget
http://130.12.182.77/main.sh4musl	f277b63275019f51d42f69e648a5b6eb3de315c856e02534deafb20f1967729d	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sparc	fe539abf7cf207b935ad2fe45f50c42cbfb4efcfd2595f75693aa14de3664da3	Mirai	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.sparc64	n/a	n/a	elf opendir ua-wget
http://130.12.182.77/main.sparcv8	3f30012e525ee678f637dc77099b1fc032a5f329231a0d5752d32ae763b03609	Gafgyt	elf gafgyt opendir sparc ua-wget
http://130.12.182.77/main.x86-64	b92f17d42699a6ae6c6de1688d0b36e9afbbcf57b9b345863689a3e3a304b843	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86_64	03258ad2f234093b751d1d1b849a3a4abe29c53a8b10a7bb525e87c213f96459	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-i7	064a7f570a8da895e7fd1de974d08f8dc77228a18ba52df65b623ad7afe34880	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-v2	8b07d8c3a9ed2f7ae71bd05f7aa7a6fbe3da06d461ff74d1505f6017c32d744d	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v3	0987875be2e6b27f374e76be2e514b2a9b3198388b98d4265749904f1fea8509	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v4	fd5a35a6134bd712197503a605e2b8056522a1f5e915f760baff9864a4beb0b2	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-core2	7a1cef957bd0f2a0df8c1cbe80b015d421dfeef290fde891aa676af49b8aa4f8	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-i686	f76c8cb9ddbb3695dca4a58bd2c1f77ae6d57e85dab694f84f4fcb4a9b68629b	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.xtensa	c2da2156d52cbcaea559f38f7ff5adc005436f471c0febd2ea49fc2e309658e9	Mirai	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/6a7f1d9da2cb727a73a930a8/reports/aba3765a-358d-4455-912d-24e652fa43c2/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-08-14T11:16:00Z UTC

Last seen:

2026-08-16T00:41:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a31041a3d49bad7ffcbc1e49d5e0275e75f3fde7fc43093385aa7d6d9b9ad2b6/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4d8c2acf-de70-4486-88b2-3786d314387f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a31041a3d49bad7ffcbc1e49d5e0275e75f3fde7fc43093385aa7d6d9b9ad2b6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a31041a3d49bad7ffcbc1e49d5e0275e75f3fde7fc43093385aa7d6d9b9ad2b6/

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-08-14 13:52:42 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=umiedi6utowx77f4dze5lybhlz27h7ph7rbqsm4fvj6w3g422k3a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260814-q6m41sv1et/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a31041a3d49bad7ffcbc1e49d5e0275e75f3fde7fc43093385aa7d6d9b9ad2b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh