MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4c5bd41b0d5f3c5050de5f45223d9e641ef39a7c7bdf9cfbb02030291a65036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	a4c5bd41b0d5f3c5050de5f45223d9e641ef39a7c7bdf9cfbb02030291a65036
SHA3-384 hash:	18586aa34910ce4b65ac169e621faff743926a9c280f722f110e46518dbb9d27deb4634f66eaf2e686298227ac1f3657
SHA1 hash:	c795ff33f0a942cb5a2733a5d362913e8fb0769b
MD5 hash:	eae0a2c80d73ff7bd7fe4b2b9f2699de
humanhash:	solar-grey-london-utah
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'117 bytes
First seen:	2026-07-20 19:09:37 UTC
Last seen:	2026-07-27 01:55:24 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:HGk6k5keNIakzKiHkwkLkIk4jkVkZkuk2:mk6k5kOkzjHkwkLkIk4jkVkZkuk2
TLSH	T16C21E3C50024499DDD02AE48F77BD8C0EA5A8296FE82BF0BADD9456AD45CD34F4DCAC0
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://64.89.163.215/bins/putita.arm	d7095a429463d5b5934f6820d35f575300f635a7819bdf43a74ec9cff84e66fa	Mirai	arm elf mirai opendir ua-wget
http://64.89.163.215/bins/putita.arm5	c67577c4771d12285ea8fdca4dc7700f75861f8f74f82f8126c49e86a4b40044	Mirai	arm elf mirai opendir ua-wget
http://64.89.163.215/bins/putita.arm6	01f7dfdd5ab6006cc3d4dcfbcc65e6a145ca34336f21559588c6dbc5c2121d1f	Mirai	arm elf mirai opendir ua-wget
http://64.89.163.215/bins/putita.arm7	451e62772cb780fa8cd93a36f5041c349d62dfb83e6c9879c082050b55a5b444	Mirai	arm elf mirai opendir ua-wget
http://64.89.163.215/bins/putita.m68k	b6819af7882a880ab0119b79fa068177570e53cf205653e4091bdfafc7ccf8b8	Mirai	elf m68k mirai opendir ua-wget
http://64.89.163.215/bins/putita.mips	3415243d11351b8d298fb5bb31e0143208e2de5163f4d0f7baa24bfae61c02e0	Mirai	elf mips mirai opendir ua-wget
http://64.89.163.215/bins/putita.mipsrouter	1e2fe76c69ec4f78d0e63fba2f08b919936f5d82c1dddbacd74b82d6a33f01e9	Mirai	elf mirai ua-wget
http://64.89.163.215/bins/putita.mpsl	021427534dbf7d135a102de94627a2809ea47ed6dd9753116999aa50989771c9	Mirai	elf mips mirai opendir ua-wget
http://64.89.163.215/bins/putita.ppc	9b441caa70276b8de1b6d3eaba0e72c27b31630e927b9dc1519429c083cce766	Mirai	elf mirai opendir PowerPC ua-wget
http://64.89.163.215/bins/putita.sh4	n/a	n/a	elf ua-wget
http://64.89.163.215/bins/putita.x86	94df870d187244e4c64ff80f4ae3d703642bb6cfd384b312e8729bfaf4fd4c97	Mirai	elf mirai opendir ua-wget x86
http://64.89.163.215/bins/putita.x86_64	70ad15526da0fcfe0b038908dc05976b69410fe3716c662db15e45fc7b9a8139	Mirai	elf mirai opendir ua-wget x86

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-34.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expand lolbin

Link:

https://www.filescan.io/uploads/6a5e72e23a6e366c9d353d17/reports/040b8d29-138a-43f9-bc5a-01ce259034f9/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-20T13:31:00Z UTC

Last seen:

2026-07-22T04:11:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a4c5bd41b0d5f3c5050de5f45223d9e641ef39a7c7bdf9cfbb02030291a65036/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/79075c5b-394a-4cb1-aa51-34c20c5a385d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a4c5bd41b0d5f3c5050de5f45223d9e641ef39a7c7bdf9cfbb02030291a65036

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a4c5bd41b0d5f3c5050de5f45223d9e641ef39a7c7bdf9cfbb02030291a65036/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-07-20 19:10:50 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=utc32qnq2xz4kbin4x2fei6z4za66onhy667tt53aibqfengka3a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/260720-xvpa9ses3z/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Modifies Bash startup script

UPX packed file

Creates/modifies Cron job

Creates/modifies environment variables

Modifies init.d

Modifies rc script

Modifies systemd

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/a4c5bd41b0d5f3c5050de5f45223d9e641ef39a7c7bdf9cfbb02030291a65036

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh