MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcd340e7466ec0198ad202bff359e50478caead3b7ac00995bc54ecb2bfda280. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	bcd340e7466ec0198ad202bff359e50478caead3b7ac00995bc54ecb2bfda280
SHA3-384 hash:	d37612d90b206a306228b875303347be04c7a9267397ac3730c56bbdc8b3262f638b218fae92e7e6b7392bf5970881a4
SHA1 hash:	6357c24961c4fb1513d1a494f70e7d6195b6b0da
MD5 hash:	f2273c183e5ed9b55ba356cd492e1040
humanhash:	echo-pennsylvania-arkansas-violet
File name:	test.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'281 bytes
First seen:	2025-11-23 10:10:30 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:s8uI8DlDz7L8kPaJ8fzV86QIU86w6W8WzWZp8N18pSM8Y1s82Or85zP:sY8LceVArPWcYDMPs6rAP
TLSH	T1EA412EDD77B270B16C61AD32657A4404B0A1E4D5A2C0AE967CCC3AF2C0CDE5472B1BAF
Magika	csv
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://netrip.ddns.net/systemcl/arm	3e98eef752fb14582bfd0f70e00ae5f1b2e7ccb06b32597053c6ad8f0e591dae	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm5	15c555f6d2014a41eb89f2779f43d1fc11677f501a3219cd3aa72bd0619a2849	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm6	dfd02ed59c95575642af97a5a34c18ec7be4a61872e339720bba3286d6dbc80d	Mirai	elf mirai
http://netrip.ddns.net/systemcl/arm7	76f40915e3bbfcd021903f45af774295d1781c327addbcabb3b5bd35da28ecb6	Mirai	elf mirai
http://netrip.ddns.net/systemcl/m68k	452a0c93f439b4eeb230d8a3b2b01934b286283bdcc509cc56f09734f1b667ed	Mirai	elf mirai
http://netrip.ddns.net/systemcl/mips	a5357cb8f6566613be9393a2def399b617ef91c2bc5ead8b8c1ff0f50d3f8dd5	Mirai	elf mirai
http://netrip.ddns.net/systemcl/mpsl	a8e6f02362f973adda0cf4dcbc1c5c3809ee7477a7967287893457b8c5eb02b1	Mirai	elf mirai
http://netrip.ddns.net/systemcl/ppc	c3f7cf4b69be7bcc3f70465622a093198c73174902d8dd8dfde516f161ba4569	Mirai	elf mirai
http://netrip.ddns.net/systemcl/sh4	n/a	n/a	n/a
http://netrip.ddns.net/systemcl/spc	n/a	n/a	n/a
http://netrip.ddns.net/systemcl/x86	6f83f9621bd8b0e62a71359b184969f147b0046328455d84a8f20aa1a7ad0fae	Mirai	elf mirai
http://netrip.ddns.net/systemcl/x86_64	6f83f9621bd8b0e62a71359b184969f147b0046328455d84a8f20aa1a7ad0fae	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Sanesecurity.Malware.32160.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive medusa mirai

Link:

https://www.filescan.io/uploads/6922e554eecb08e4aa45aada/reports/8760ce42-d4b9-4f62-acc4-d0c0b4beb455/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-21T09:07:00Z UTC

Last seen:

2025-11-23T10:29:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bcd340e7466ec0198ad202bff359e50478caead3b7ac00995bc54ecb2bfda280/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8d67be24-5390-4e89-835a-a4f71753cf29

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bcd340e7466ec0198ad202bff359e50478caead3b7ac00995bc54ecb2bfda280

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bcd340e7466ec0198ad202bff359e50478caead3b7ac00995bc54ecb2bfda280/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-11-11 10:38:21 UTC

File Type:

Text (Shell)

AV detection:

8 of 36 (22.22%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xtjubz2gn3abtcwsak77gwpfar4mv2wtw6wabgk3yvhmwk75ukaa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251123-mszzwatrc1/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bcd340e7466ec0198ad202bff359e50478caead3b7ac00995bc54ecb2bfda280

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.