MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b41eb4fa4b1270f8b9f6a723d57f144f24f3f677e49cd340552aa6a4a457b251. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	b41eb4fa4b1270f8b9f6a723d57f144f24f3f677e49cd340552aa6a4a457b251
SHA3-384 hash:	e620b6608814d5c95a5b38564cce0410f82257b5e55a3e9190ec07b379e56f3089672aaff9fc75b9080716c2722a8cf5
SHA1 hash:	89b7a1fb9a4ce7184efd0fd91cb8aac5f944ecb1
MD5 hash:	2473c2a561acd57410f462f603dccfa0
humanhash:	double-edward-rugby-july
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'881 bytes
First seen:	2026-02-08 14:53:23 UTC
Last seen:	2026-02-08 20:10:51 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:oF2JM8mbiBsxuZnEKEnE2EhEy+YbwJoJUfvAhM3a:oF2JM8mbiBsxuZnncvyAYbw9AhM3a
TLSH	T14A510E9B01089B319F0FCB9D77F431B95306B1E396DBC644E944099E5FC698C26CDE51
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnaarch64xnxn	4034d3c1d40097edcfda1c7f97ff057dc11b8dc2f25a16e53bc2122cb6af07ae	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxni386xnxn	411aec2600ebb8e2dff75750ea2c6ddba1e61188a9dd140de45fcf27fa9cc4aa	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	c2a52b8b04f72b7c281232d32dcbc3756ad7f4a9d28bd2d42a394a4e628ddb3d	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnm68kxnxn	516cc2dacae1a1d55ad57744aefc133d0b10b83033740c824fa827bc197735d7	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	314acaf706a13f709d8064d418248e10d9bf72416a64041389fd6ee6db39b748	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnmipsxnxn	03ce826ffbd8436e6cdb27e25a9c8483d677e608fa111b1d36a0379f1f3299da	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnor1kxnxn	5284f88167faa897e66e1535c8a75962b6a89e767bad3b554f6b383093eeb029	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	a3be89eae3abf909aadaa3d7021c77d491ed6425cc665725651be53131ba4ffc	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnriscv32xnxn	037def81f4d4987a0c5fa5b5f10c8a7771111b3ca75d49cf2cc8daf7945c516b	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnriscv64xnxn	a7d2bbd8da4d8aa35b1e760b6f27289705840a0bf8507df2be3997445e0362e9	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnsh2xnxn	caaccc18a6befc7484853a9b74bc3529f50bd3cc37ce78071128fc92f4a15b9d	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnsh4xnxn	329cec30ee710011f22b50e4c719d4bc0938ebdf5472eb166fff7d0bc1295728	Mirai	elf mirai ua-wget
http://91.92.241.232/bins/xnxnxnxnxnxnxnxnx86_64xnxn	2f475bc50b4cf52ad87921d41b4171768b78e7dc76297a58683815aa5c747661	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/6988a396981ff1d38a4d34fe/reports/779ebb8c-6fc1-4fd3-b054-8b43a9da4ab2/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-02-08T11:59:00Z UTC

Last seen:

2026-02-09T17:16:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/b41eb4fa4b1270f8b9f6a723d57f144f24f3f677e49cd340552aa6a4a457b251/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/49a7bf44-2686-46f8-aaca-2aeb20edc50b

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b41eb4fa4b1270f8b9f6a723d57f144f24f3f677e49cd340552aa6a4a457b251

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b41eb4fa4b1270f8b9f6a723d57f144f24f3f677e49cd340552aa6a4a457b251/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/b41eb4fa4b1270f8b9f6a723d57f144f24f3f677e49cd340552aa6a4a457b251

Threat name:

Script.Downloader.Heuristic

Status:

Malicious

First seen:

2026-02-08 14:54:18 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wqplj6slcjypropwu4r5k7yuj4sph5tx4songqcvfktkjjcxwjiq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260208-r9y65afx7e/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b41eb4fa4b1270f8b9f6a723d57f144f24f3f677e49cd340552aa6a4a457b251

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.