MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bac919a3bbc3d4861e773b6a2f622927e444bc5930c5f7d0051bfa4ed7d65633. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	bac919a3bbc3d4861e773b6a2f622927e444bc5930c5f7d0051bfa4ed7d65633
SHA3-384 hash:	41c383cf7f9dba3439573062bba2dbd0c7cd7b4e065696dd910f629c79260773d1c4f17fdaa095642d4ea18173ea19a3
SHA1 hash:	2f9d82c69ed3f354cffb8337ed0fa886b14ee9dd
MD5 hash:	7f0e5f422dec2a152787e38f22851cd2
humanhash:	twenty-lithium-nebraska-solar
File name:	telnet.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'834 bytes
First seen:	2026-08-06 20:07:25 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Okfc0dt3NaKt6uODOmj9frTK1uk1YsVbNVb1LBeN04N0KvtqVe77zLBJC6wl7LXX:jfxXFGDzjJKAkrPM242MtjzTk
TLSH	T13F31058D22B17EB1CA4DCF05B0E542D4A247DDC4A2970AF2F4C21E6369D9F80BD55A36
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.180/iran.x86_64	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.aarch64	3765c1701c91925ae8265173e0fcf7e56938fb2994f920515aa0dc40eaa44cbe	Mirai	94-154-43-180 DEU elf geofenced mirai
http://94.154.43.180/iran.m68k	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.mips	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.mipsel	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.powerpc	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.sparc	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.sh4	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.arc	89bc05195c285fd2a451a2698795eaf4246758a8a399ec5440c1f58aeae9d641	Mirai	94-154-43-180 DEU elf geofenced mirai
http://94.154.43.180/iran.i486	d3fa2dc23f90c19b36828887b0f70b1e1477a3e5229d7ca8b4ef38c6d609f90d	Mirai	94-154-43-180 DEU elf geofenced mirai
http://94.154.43.180/iran.armv4l	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.armv5l	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.armv6l	n/a	n/a	elf ua-wget
http://94.154.43.180/iran.armv7l	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-06T17:25:00Z UTC

Last seen:

2026-08-07T12:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bac919a3bbc3d4861e773b6a2f622927e444bc5930c5f7d0051bfa4ed7d65633/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a2b0a48d-a868-4955-8a25-9da8a28383fb

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bac919a3bbc3d4861e773b6a2f622927e444bc5930c5f7d0051bfa4ed7d65633

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bac919a3bbc3d4861e773b6a2f622927e444bc5930c5f7d0051bfa4ed7d65633/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-08-06 20:06:56 UTC

File Type:

Text (Shell)

AV detection:

10 of 36 (27.78%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xlerti53ypkimhtxhnvc6yrje7sejpczgdc7puafdp5e5v6wkyzq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/260806-ywptvshr6s/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Enumerates running processes

Modifies init.d

File and Directory Permissions Modification

Executes dropped EXE

Malware family:

Gafgyt

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bac919a3bbc3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/bac919a3bbc3d4861e773b6a2f622927e444bc5930c5f7d0051bfa4ed7d65633

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh