MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3ea146765328dbf51fa4f5c36094ef1cf8836e3012377c4ee2ccedfc23e6e0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3ea146765328dbf51fa4f5c36094ef1cf8836e3012377c4ee2ccedfc23e6e0d
SHA3-384 hash: 69d6354a08cd95e304507a8da41d00634e68259d3f7204034961ad5b9bcbd386fa6deedeb7da902d0c034bc2760bb3f3
SHA1 hash: 847eeb41c1a7891cd201e2587aead02853515d29
MD5 hash: 8d3b1492e414e8c661e5e9787b73c25f
humanhash: hotel-east-alaska-four
File name:w.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'345 bytes
First seen:2026-01-04 19:02:23 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:cj+ELbMfVEcFLNIZEtaDEVKTXCEHw/EOFELM9METQP3E3etbEKxeEzqgE1MdEk8:yS5/QXGFXpcEevBw28
TLSH T1F52110CF54B4B5795088CF8032A254C570F4CAE1E5604E1B5EC878F785C8A1B7739EDA
Magika batch
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://130.12.180.28/Fantazy/Fantazy.arm45f4ead21261a4872c7bbdc341a3cab2d09a881bc1ca20a78f3cbe3800cd54f0d Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.arm59df7c2bebdee16b4907509ea8cdfc4128a8c2c0fb21156ed8105db2cf8f4ecf2 Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.arm69c6625a0a04aee9ac1fe10d55edc2f0aa77f66593916a10cb8314ad29457edeb Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.arm748b94eff6e2031ce3fd8f0c605917b5a55b26a2d9e1800b9612758189e794631 Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.m68k4b6f0caf42dc42e3f8f4e7adc9a93435cb27d604df131e19503be23fbc955826 Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.mips9997ba3aad89be8f8371620b5b841eaa71da6f32368d84363bab6dd57303929c Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.mpsleeb8b37ab92777cbe5c49834cc044393207e0b745a0e2d0806b7da4e6292000b Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.ppc1f0a93ffbe48da5f9d8188060be1d5ce128fdc1545c2077a22bff830b19302cf Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.sh469a6fc590d0f527d1c6e04a9cf1c84eb52ca88de7867e8e8cf31b0b67d94eb70 Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.spcd1d3129a68b9da3ed82981110c4d48721d47a176134b004e4e34544d1e2b1cd9 Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.x86ad613cf0f480c1c00f15379fc0df01af6d6c14309c9d0e452bd5e71ec6342c0f Miraielf mirai
http://130.12.180.28/Fantazy/Fantazy.x86_645443d764e399f0cd44ef17ea0940db73fc635045faa26f0ce8a4d8b3453b5988 Miraielf mirai

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
busybox mirai
Link:
https://www.filescan.io/uploads/695ab971127d6a14e0cf8e5a/reports/519457f5-a294-40d9-a7e4-45601fa6da54/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-01-04T16:07:00Z UTC
Last seen:
2026-01-04T18:48:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.cl
Link:
https://opentip.kaspersky.com/a3ea146765328dbf51fa4f5c36094ef1cf8836e3012377c4ee2ccedfc23e6e0d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4562b462-5cee-45bf-99a5-6446a3f402ef
Behavior Graph:
Download SVG
%3 guuid=4b9d0992-1600-0000-00d8-fa5a060d0000 pid=3334 /usr/bin/sudo guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339 /tmp/sample.bin guuid=4b9d0992-1600-0000-00d8-fa5a060d0000 pid=3334->guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339 execve guuid=2b5fd493-1600-0000-00d8-fa5a0c0d0000 pid=3340 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=2b5fd493-1600-0000-00d8-fa5a0c0d0000 pid=3340 execve guuid=53f2bd97-1600-0000-00d8-fa5a160d0000 pid=3350 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=53f2bd97-1600-0000-00d8-fa5a160d0000 pid=3350 execve guuid=a0960798-1600-0000-00d8-fa5a180d0000 pid=3352 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=a0960798-1600-0000-00d8-fa5a180d0000 pid=3352 clone guuid=fed49d99-1600-0000-00d8-fa5a1c0d0000 pid=3356 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=fed49d99-1600-0000-00d8-fa5a1c0d0000 pid=3356 execve guuid=e064999d-1600-0000-00d8-fa5a260d0000 pid=3366 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=e064999d-1600-0000-00d8-fa5a260d0000 pid=3366 execve guuid=53c2da9d-1600-0000-00d8-fa5a280d0000 pid=3368 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=53c2da9d-1600-0000-00d8-fa5a280d0000 pid=3368 clone guuid=3ce1649e-1600-0000-00d8-fa5a2c0d0000 pid=3372 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=3ce1649e-1600-0000-00d8-fa5a2c0d0000 pid=3372 execve guuid=6c565aa2-1600-0000-00d8-fa5a380d0000 pid=3384 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=6c565aa2-1600-0000-00d8-fa5a380d0000 pid=3384 execve guuid=009e2da3-1600-0000-00d8-fa5a3b0d0000 pid=3387 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=009e2da3-1600-0000-00d8-fa5a3b0d0000 pid=3387 clone guuid=be6f36a5-1600-0000-00d8-fa5a410d0000 pid=3393 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=be6f36a5-1600-0000-00d8-fa5a410d0000 pid=3393 execve guuid=a7b9c6a9-1600-0000-00d8-fa5a4d0d0000 pid=3405 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=a7b9c6a9-1600-0000-00d8-fa5a4d0d0000 pid=3405 execve guuid=2c9d1daa-1600-0000-00d8-fa5a4f0d0000 pid=3407 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=2c9d1daa-1600-0000-00d8-fa5a4f0d0000 pid=3407 clone guuid=e91e07ab-1600-0000-00d8-fa5a530d0000 pid=3411 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=e91e07ab-1600-0000-00d8-fa5a530d0000 pid=3411 execve guuid=9567c6ae-1600-0000-00d8-fa5a5d0d0000 pid=3421 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=9567c6ae-1600-0000-00d8-fa5a5d0d0000 pid=3421 execve guuid=7cc12eaf-1600-0000-00d8-fa5a5f0d0000 pid=3423 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=7cc12eaf-1600-0000-00d8-fa5a5f0d0000 pid=3423 clone guuid=34b507b0-1600-0000-00d8-fa5a630d0000 pid=3427 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=34b507b0-1600-0000-00d8-fa5a630d0000 pid=3427 execve guuid=f3e089b4-1600-0000-00d8-fa5a6f0d0000 pid=3439 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=f3e089b4-1600-0000-00d8-fa5a6f0d0000 pid=3439 execve guuid=1135d3b4-1600-0000-00d8-fa5a700d0000 pid=3440 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=1135d3b4-1600-0000-00d8-fa5a700d0000 pid=3440 clone guuid=abaedab5-1600-0000-00d8-fa5a750d0000 pid=3445 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=abaedab5-1600-0000-00d8-fa5a750d0000 pid=3445 execve guuid=605065ba-1600-0000-00d8-fa5a7e0d0000 pid=3454 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=605065ba-1600-0000-00d8-fa5a7e0d0000 pid=3454 execve guuid=3a0abdba-1600-0000-00d8-fa5a800d0000 pid=3456 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=3a0abdba-1600-0000-00d8-fa5a800d0000 pid=3456 clone guuid=c56e5bbb-1600-0000-00d8-fa5a830d0000 pid=3459 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=c56e5bbb-1600-0000-00d8-fa5a830d0000 pid=3459 execve guuid=95de22bf-1600-0000-00d8-fa5a8d0d0000 pid=3469 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=95de22bf-1600-0000-00d8-fa5a8d0d0000 pid=3469 execve guuid=76228dbf-1600-0000-00d8-fa5a8f0d0000 pid=3471 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=76228dbf-1600-0000-00d8-fa5a8f0d0000 pid=3471 clone guuid=65683fc1-1600-0000-00d8-fa5a940d0000 pid=3476 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=65683fc1-1600-0000-00d8-fa5a940d0000 pid=3476 execve guuid=02dd03c5-1600-0000-00d8-fa5a9f0d0000 pid=3487 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=02dd03c5-1600-0000-00d8-fa5a9f0d0000 pid=3487 execve guuid=33c79dc5-1600-0000-00d8-fa5aa10d0000 pid=3489 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=33c79dc5-1600-0000-00d8-fa5aa10d0000 pid=3489 clone guuid=06cb89c7-1600-0000-00d8-fa5aa60d0000 pid=3494 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=06cb89c7-1600-0000-00d8-fa5aa60d0000 pid=3494 execve guuid=8b8035cb-1600-0000-00d8-fa5ab10d0000 pid=3505 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=8b8035cb-1600-0000-00d8-fa5ab10d0000 pid=3505 execve guuid=a1116ccb-1600-0000-00d8-fa5ab30d0000 pid=3507 /usr/bin/dash guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=a1116ccb-1600-0000-00d8-fa5ab30d0000 pid=3507 clone guuid=b78f14cc-1600-0000-00d8-fa5ab70d0000 pid=3511 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=b78f14cc-1600-0000-00d8-fa5ab70d0000 pid=3511 execve guuid=1ee9b7cf-1600-0000-00d8-fa5abf0d0000 pid=3519 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=1ee9b7cf-1600-0000-00d8-fa5abf0d0000 pid=3519 execve guuid=5558ffcf-1600-0000-00d8-fa5ac00d0000 pid=3520 /home/sandbox/Fantazy.x86 net guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=5558ffcf-1600-0000-00d8-fa5ac00d0000 pid=3520 execve guuid=653732d0-1600-0000-00d8-fa5ac30d0000 pid=3523 /usr/bin/busybox net send-data write-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=653732d0-1600-0000-00d8-fa5ac30d0000 pid=3523 execve guuid=092519d5-1600-0000-00d8-fa5acb0d0000 pid=3531 /usr/bin/chmod guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=092519d5-1600-0000-00d8-fa5acb0d0000 pid=3531 execve guuid=dbeb6bd5-1600-0000-00d8-fa5acc0d0000 pid=3532 /home/sandbox/Fantazy.x86_64 net guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=dbeb6bd5-1600-0000-00d8-fa5acc0d0000 pid=3532 execve guuid=8b8f9c00-1800-0000-00d8-fa5ab6100000 pid=4278 /usr/bin/rm delete-file guuid=5b259293-1600-0000-00d8-fa5a0b0d0000 pid=3339->guuid=8b8f9c00-1800-0000-00d8-fa5ab6100000 pid=4278 execve b6a64ba0-71d1-5d3d-a9f9-c19471e8250a 130.12.180.28:80 guuid=2b5fd493-1600-0000-00d8-fa5a0c0d0000 pid=3340->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 96B guuid=fed49d99-1600-0000-00d8-fa5a1c0d0000 pid=3356->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 96B guuid=3ce1649e-1600-0000-00d8-fa5a2c0d0000 pid=3372->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 96B guuid=be6f36a5-1600-0000-00d8-fa5a410d0000 pid=3393->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 96B guuid=e91e07ab-1600-0000-00d8-fa5a530d0000 pid=3411->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 96B guuid=34b507b0-1600-0000-00d8-fa5a630d0000 pid=3427->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 96B guuid=abaedab5-1600-0000-00d8-fa5a750d0000 pid=3445->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 96B guuid=c56e5bbb-1600-0000-00d8-fa5a830d0000 pid=3459->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 95B guuid=65683fc1-1600-0000-00d8-fa5a940d0000 pid=3476->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 95B guuid=06cb89c7-1600-0000-00d8-fa5aa60d0000 pid=3494->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 95B guuid=b78f14cc-1600-0000-00d8-fa5ab70d0000 pid=3511->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 95B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=5558ffcf-1600-0000-00d8-fa5ac00d0000 pid=3520->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=b2b225d0-1600-0000-00d8-fa5ac10d0000 pid=3521 /home/sandbox/Fantazy.x86 guuid=5558ffcf-1600-0000-00d8-fa5ac00d0000 pid=3520->guuid=b2b225d0-1600-0000-00d8-fa5ac10d0000 pid=3521 clone guuid=c6d729d0-1600-0000-00d8-fa5ac20d0000 pid=3522 /home/sandbox/Fantazy.x86 net send-data zombie guuid=5558ffcf-1600-0000-00d8-fa5ac00d0000 pid=3520->guuid=c6d729d0-1600-0000-00d8-fa5ac20d0000 pid=3522 clone guuid=c6d729d0-1600-0000-00d8-fa5ac20d0000 pid=3522->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 9bff2e1e-4e84-5ecd-918a-a1cdd4202ef3 130.12.180.28:63645 guuid=c6d729d0-1600-0000-00d8-fa5ac20d0000 pid=3522->9bff2e1e-4e84-5ecd-918a-a1cdd4202ef3 send: 21B guuid=1efc35d0-1600-0000-00d8-fa5ac40d0000 pid=3524 /home/sandbox/Fantazy.x86 guuid=c6d729d0-1600-0000-00d8-fa5ac20d0000 pid=3522->guuid=1efc35d0-1600-0000-00d8-fa5ac40d0000 pid=3524 clone guuid=f0f039d0-1600-0000-00d8-fa5ac50d0000 pid=3525 /home/sandbox/Fantazy.x86 guuid=c6d729d0-1600-0000-00d8-fa5ac20d0000 pid=3522->guuid=f0f039d0-1600-0000-00d8-fa5ac50d0000 pid=3525 clone guuid=7c6a3ed0-1600-0000-00d8-fa5ac60d0000 pid=3526 /home/sandbox/Fantazy.x86 net net-scan send-data guuid=c6d729d0-1600-0000-00d8-fa5ac20d0000 pid=3522->guuid=7c6a3ed0-1600-0000-00d8-fa5ac60d0000 pid=3526 clone guuid=653732d0-1600-0000-00d8-fa5ac30d0000 pid=3523->b6a64ba0-71d1-5d3d-a9f9-c19471e8250a send: 98B guuid=7c6a3ed0-1600-0000-00d8-fa5ac60d0000 pid=3526->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7c6a3ed0-1600-0000-00d8-fa5ac60d0000 pid=3526|send-data send-data to 160 IP addresses review logs to see them all guuid=7c6a3ed0-1600-0000-00d8-fa5ac60d0000 pid=3526->guuid=7c6a3ed0-1600-0000-00d8-fa5ac60d0000 pid=3526|send-data send guuid=dbeb6bd5-1600-0000-00d8-fa5acc0d0000 pid=3532->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 349af0aa-1d52-5b54-ab86-2f426b84e968 0.0.0.0:59025 guuid=dbeb6bd5-1600-0000-00d8-fa5acc0d0000 pid=3532->349af0aa-1d52-5b54-ab86-2f426b84e968 con guuid=e39a8600-1800-0000-00d8-fa5ab3100000 pid=4275 /home/sandbox/Fantazy.x86_64 guuid=dbeb6bd5-1600-0000-00d8-fa5acc0d0000 pid=3532->guuid=e39a8600-1800-0000-00d8-fa5ab3100000 pid=4275 clone guuid=0a948f00-1800-0000-00d8-fa5ab4100000 pid=4276 /home/sandbox/Fantazy.x86_64 net send-data zombie guuid=dbeb6bd5-1600-0000-00d8-fa5acc0d0000 pid=3532->guuid=0a948f00-1800-0000-00d8-fa5ab4100000 pid=4276 clone guuid=0a948f00-1800-0000-00d8-fa5ab4100000 pid=4276->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=0a948f00-1800-0000-00d8-fa5ab4100000 pid=4276->9bff2e1e-4e84-5ecd-918a-a1cdd4202ef3 send: 23B guuid=3fb19a00-1800-0000-00d8-fa5ab5100000 pid=4277 /home/sandbox/Fantazy.x86_64 guuid=0a948f00-1800-0000-00d8-fa5ab4100000 pid=4276->guuid=3fb19a00-1800-0000-00d8-fa5ab5100000 pid=4277 clone guuid=1b50a900-1800-0000-00d8-fa5ab7100000 pid=4279 /home/sandbox/Fantazy.x86_64 zombie guuid=0a948f00-1800-0000-00d8-fa5ab4100000 pid=4276->guuid=1b50a900-1800-0000-00d8-fa5ab7100000 pid=4279 clone guuid=bdf9b200-1800-0000-00d8-fa5ab8100000 pid=4280 /home/sandbox/Fantazy.x86_64 net net-scan send-data zombie guuid=0a948f00-1800-0000-00d8-fa5ab4100000 pid=4276->guuid=bdf9b200-1800-0000-00d8-fa5ab8100000 pid=4280 clone guuid=bdf9b200-1800-0000-00d8-fa5ab8100000 pid=4280->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 76b2adeb-146e-515d-b463-282f5b69968b 43.169.20.176:2323 guuid=bdf9b200-1800-0000-00d8-fa5ab8100000 pid=4280->76b2adeb-146e-515d-b463-282f5b69968b send: 40B 345eadfd-19cd-5b5d-a9aa-2bb3a2087f62 216.201.73.201:2323 guuid=bdf9b200-1800-0000-00d8-fa5ab8100000 pid=4280->345eadfd-19cd-5b5d-a9aa-2bb3a2087f62 send: 40B guuid=bdf9b200-1800-0000-00d8-fa5ab8100000 pid=4280|send-data send-data to 4097 IP addresses review logs to see them all guuid=bdf9b200-1800-0000-00d8-fa5ab8100000 pid=4280->guuid=bdf9b200-1800-0000-00d8-fa5ab8100000 pid=4280|send-data send
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a3ea146765328dbf51fa4f5c36094ef1cf8836e3012377c4ee2ccedfc23e6e0d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3ea146765328dbf51fa4f5c36094ef1cf8836e3012377c4ee2ccedfc23e6e0d/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/a3ea146765328dbf51fa4f5c36094ef1cf8836e3012377c4ee2ccedfc23e6e0d
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-01-04 19:03:14 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=upvbiz3fgkg36up2j5odmcko6hhyqnxdaerxprhofthn7qr6nygq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260106-jdy79adr4y/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh a3ea146765328dbf51fa4f5c36094ef1cf8836e3012377c4ee2ccedfc23e6e0d

(this sample)

Mirai

elf 80d861f704833e98ec956d78c29f5a7a34806b0460552f426444e4c6fbf61c07

  
URLhaus
https://urlhaus.abuse.ch/url/3746071/
  
Delivery method
Distributed via web download
  
Dropping
MD5 3960fe1366f9bbefab396c92013b68c6
  
Dropping
SHA256 80d861f704833e98ec956d78c29f5a7a34806b0460552f426444e4c6fbf61c07

Comments