MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be5aab087b3c0eb65e7ab261f9ae161f5fb3225e54c21b86ee01eff85bec4c2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	be5aab087b3c0eb65e7ab261f9ae161f5fb3225e54c21b86ee01eff85bec4c2d
SHA3-384 hash:	e4e75a49466628b32355dab9b77219281386df61c883370344a39d3d8e9fbafe7d8cc44680cd7d6283636e5600d53cad
SHA1 hash:	e3bb95b61ea8692b5a02c356e93e015486aba371
MD5 hash:	c77c357df5d86ddd393048fa35238dea
humanhash:	red-oven-nine-cup
File name:	tplink.sh
Download:	download sample
File size:	4'949 bytes
First seen:	2026-08-19 14:09:55 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:XGZodxCVXMfyUFPETvSPce2/SX+liRuLsdSnLGYmlwe10pSqkmXrKY+IEh52yNI0:XGZodxCVXMfyUFPETvSPce2O+liRuLsr
TLSH	T12BA1BF8E1474923C647FDD9C75F647009C4985E232B23F299EA828639CC9A707369F5D
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.aarch64be	n/a	n/a	arm elf opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	c3badb6ed503a4eb4919ca3f31ac5994cd57ed00ce265c18d220591dcf8ac2d1	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	03da7753629b6a38154a6ce0aca873c8595f79eeebfb708392b04a82686f2d52	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	6a8f55a91c79430e15bd17485c43af13ab7dee58d1a5b7e385fab307c798126c	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	7d853349156efba35f1655d52df5b2c5915173b42fdb88bf832bda464a2934ac	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	51078868669b55b7d4c935e3681a18b311808f6d24c6ee0bcc419aab4821d22c	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	5ca81bc8c1e8cc36af45b3f747c07a8b36338361b4c21ebe988e0521720c5f4d	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	60266ec469a63f90a21ccf98c259ed88677e4ad8e48640ec27e4420f8ae1892a	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	adce532926d00a809db14b6db7aa6c5cd3c9371995cc3aee79d1a778ed7a64d0	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e500mc	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e5500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e6500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.m68k-68xxx	n/a	n/a	elf m68k opendir ua-wget
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	04e7d3cf8d5664c0151f2f922ec152ab42886fc6f663f14dc85570f1cec93753	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32r5el	0e8208254ee176da983b6615c0c3efbdf89557c9ed15a73248ad16ebe26031d9	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips32r6el	b9061158996ce05f27b87707628796d9427eb5de42a7d2154270fca548b2337e	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	11c08fb55565c70a54f0720c2b1d4888163612ebf4aed0e56d1606d4b84e7e63	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64r6el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	b234556f56745222a967d87b0f01e40bc26cd4725d4f8e1d9863c8e597d374d6	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.power8	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.power8le	c37cae9648fe0ebb08a6f4c5cda9e7f375c2684ba7aad228c09778d605d75e61	Mirai	elf opendir PowerPC ua-wget
http://130.12.182.77/main.powerpc	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.ppc440fp	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.riscv64	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.s390x	n/a	n/a	elf opendir s390x ua-wget
http://130.12.182.77/main.sh4	00f4de17fd11b13e368d949abddb931a88782921c0fad2e0244c1ddf0205e20c	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sh4aeb	n/a	n/a	elf opendir SuperH ua-wget
http://130.12.182.77/main.sh4musl	n/a	n/a	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sparc	n/a	n/a	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.sparc64	n/a	n/a	elf opendir ua-wget
http://130.12.182.77/main.sparcv8	385d6144d31abd85280150978d7e0c6545b4565c845580bced4726391c9444ac	Gafgyt	elf gafgyt opendir sparc ua-wget
http://130.12.182.77/main.x86-64	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86_64	03258ad2f234093b751d1d1b849a3a4abe29c53a8b10a7bb525e87c213f96459	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-i7	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-v2	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v3	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v4	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-core2	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-i686	f76c8cb9ddbb3695dca4a58bd2c1f77ae6d57e85dab694f84f4fcb4a9b68629b	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.xtensa	c2da2156d52cbcaea559f38f7ff5adc005436f471c0febd2ea49fc2e309658e9	Mirai	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader mirai

Link:

https://www.filescan.io/uploads/6a85b95e3316d8e4d7034286/reports/ae58fb8c-9dc8-47fe-9f4c-274949fdb258/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4f76136e-c16c-40cb-bcae-3b7a25e3f651

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/be5aab087b3c0eb65e7ab261f9ae161f5fb3225e54c21b86ee01eff85bec4c2d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be5aab087b3c0eb65e7ab261f9ae161f5fb3225e54c21b86ee01eff85bec4c2d/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xznkwcd3hqhlmxt2wjq7tlqwd5p3gis6ktbbxbxoahx7qw7mjqwq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260819-rg151scl4y/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh