MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc4b2fc2c4f96830fa3e4338fa0b58040b4e6e697e60c11af1d217f0fb51487d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	bc4b2fc2c4f96830fa3e4338fa0b58040b4e6e697e60c11af1d217f0fb51487d
SHA3-384 hash:	925132d8eb740d9695fefc48c13c30e11e5e256dfbf4830c80709080b941ba0051ae749d95df589e2c2fe635fcd479e5
SHA1 hash:	7dd98558c55d45f495498032ed3088593ec3f4d1
MD5 hash:	0b78fffee86866143a42267f8e781615
humanhash:	magazine-batman-may-hawaii
File name:	sshd
Download:	download sample
Signature	Mirai Create hunting rule
File size:	754 bytes
First seen:	2026-08-25 02:03:16 UTC
Last seen:	2026-08-25 14:17:52 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:KMNe/RDvOfUy86e98vKmhFwe98t1/wzPnNie95yIN54pie9sNI0opMe9AhBa:8JKfUy8H8vKQ8tRwbnN/UQOp/sNI0oXl
TLSH	T1520180BA00312907981EDD8FB5D3076848819BFC146A1E7C3A5FA279A8DC640F839A4D
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://104.168.4.206/chrome	02ce9b736cd71658c564d56dd15db84a73e81cfe4a22612c183c0c692adf6677	Mirai	elf mirai ua-wget x86
http://104.168.4.206/dipndots	9bd9a2960671363086cf10264d214ae4323442801f4751a8935182c27c3bc0a0	Mirai	elf mips mirai ua-wget
http://104.168.4.206/dips	39d4c7826381317409185d32e2929e2e27f507904d03cc6e047911b35dda55f9	Mirai	elf mips mirai ua-wget
http://104.168.4.206/giggappc	cdea50a8603a7d54419707b25179a0b3bbbde51466c7c6399908c2bd4e4800d5	Mirai	elf mirai PowerPC ua-wget
http://104.168.4.206/kkk.arm4	ab8041ced5468e8f3b180e215ab8d5118ad49a60a7a432a3a67de38d744ad360	Mirai	arm elf mirai ua-wget
http://104.168.4.206/kkk.arm5	adf557bf4dca96c7623b0b3207b7091c076c3652d446d10153d5cf52a6e8b132	Mirai	arm elf mirai ua-wget
http://104.168.4.206/kkk.arm6	52b776209bece44b89e723c2405c0177a4978bb32598f7bf65359bee58d8f3ed	Mirai	arm elf mirai ua-wget
http://104.168.4.206/kkk.arm7	5e27d784da20ccc41f59a67296d2a2ea3fb9a2fa095b2b44b54863a502ed9626	Mirai	arm elf mirai ua-wget

Intelligence

File Origin

# of uploads :

160

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a8d3682f876b82cb889b71b/reports/cff799de-7ce0-4eba-a6e9-53a1fe5dc81b/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-08-25T00:37:00Z UTC

Last seen:

2026-08-26T18:27:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bc4b2fc2c4f96830fa3e4338fa0b58040b4e6e697e60c11af1d217f0fb51487d/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c91572bc-161d-4b2a-9d28-7b9ca8c77c09

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bc4b2fc2c4f96830fa3e4338fa0b58040b4e6e697e60c11af1d217f0fb51487d

Gathering data

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2026-08-25 04:14:36 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xrfs7qwe7fudb6r6im4puc2yaqfu43tjpzqmcgxr2il7b62rjb6q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260825-g97hdstwfs/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bc4b2fc2c4f96830fa3e4338fa0b58040b4e6e697e60c11af1d217f0fb51487d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh