MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c386fd7ca22fd96ebc8631b14c70e3b1e821406b01beecb9ddbddc4c8ffc3487. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c386fd7ca22fd96ebc8631b14c70e3b1e821406b01beecb9ddbddc4c8ffc3487
SHA3-384 hash:	ae6af30813776e618d043b4f5e4d117f8499bec774597b1549e14be8981c2b40a771074544d52a72af44ed50728878aa
SHA1 hash:	c670bbcf70ba7c1d6168f36a55942f15d7a70e06
MD5 hash:	d7bba858c97531acefd3e5d0b44a76ac
humanhash:	zebra-steak-arizona-december
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'907 bytes
First seen:	2026-06-03 23:38:21 UTC
Last seen:	2026-06-04 21:00:07 UTC
File type:	sh
MIME type:	text/plain
ssdeep	48:qIPmOm2JMI/y/biB87n7uZUSUScvyyyn2n2bwLNfvPoXerRORhM3IIm:M12JMg2biBQ7uZ02bwI
TLSH	T1115101DB0284EB72D65DC64EB7F4B174A10AA0C366DF9E08EE84582D8FD9D4C7296F40
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnaarch64xnxn	41d4cec0c31112c1235c1762e16ee3a838118f655acc1af017ddbaf8c7934c61	Mirai	arm elf mirai ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxni386xnxn	895ac29db2a4c2d5e1c1e0356fe6b6a042191a98e6eca23fc325c3fd1c63cacd	Mirai	elf mirai ua-wget x86
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	n/a	n/a	ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnm68kxnxn	f9fe616c3416d29c383b3fe349b0b3812a83b8957e2659c65f0d04785edaaec2	Mirai	elf m68k mirai ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	n/a	n/a	ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnmipsxnxn	694c480fc9dfc83a4ce25a8a6dfb08e17c3cb217a9eccadff5fc547546c3c87d	Mirai	elf mips mirai ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnor1kxnxn	n/a	n/a	ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	b328c7703c8bcf91268c616a6e709c4bd8df936ddfdb082ce50d742380a02d89	Mirai	elf mirai PowerPC ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnriscv32xnxn	n/a	n/a	ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnriscv64xnxn	e38c8945c30dd1050b6f205fd1b45fa92376fcd290a12ed25c599b8035c742fe	Mirai	elf mirai RISC-V ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnsh2xnxn	n/a	n/a	ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnsh4xnxn	a795b74735f796d2bc926e73b73ddad0b9fa5f147b57b1b996b271af29e936fc	Mirai	elf mirai SuperH ua-wget
http://176.65.139.131/bins/xnxnxnxnxnxnxnxnx86_64xnxn	37c5a878e962a677aea8d5f994e02d327e01e51d6a6366f55ed69d22ec730086	Mirai	elf mirai ua-wget x86

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm evasive

Link:

https://www.filescan.io/uploads/6a20bafc099ef368af1c0543/reports/ed162834-44de-41da-9382-6bbc0755d69c/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-03T20:50:00Z UTC

Last seen:

2026-06-04T00:44:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/c386fd7ca22fd96ebc8631b14c70e3b1e821406b01beecb9ddbddc4c8ffc3487/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/0024ff69-de19-4a35-830f-90608cea1c3f

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c386fd7ca22fd96ebc8631b14c70e3b1e821406b01beecb9ddbddc4c8ffc3487

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c386fd7ca22fd96ebc8631b14c70e3b1e821406b01beecb9ddbddc4c8ffc3487/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/c386fd7ca22fd96ebc8631b14c70e3b1e821406b01beecb9ddbddc4c8ffc3487

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-06-03 23:40:35 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yodp27fcf7mw5pegggyuy4hdwhuccqdlag7ozoo5xxoezd74gsdq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260603-3m1bfsgw8q/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c386fd7ca22fd96ebc8631b14c70e3b1e821406b01beecb9ddbddc4c8ffc3487

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.