MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5ad3cfe1a5b9409cb54a59a5466ada8c7306ea0262829af35f1206d8530c67e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	c5ad3cfe1a5b9409cb54a59a5466ada8c7306ea0262829af35f1206d8530c67e
SHA3-384 hash:	9382a242a2b9a8aefa21202348f26035e1c2da73f6eb1198729efb7f0ccae2517d85db2cb9d1e5134004e766c7f44c0e
SHA1 hash:	80a946d6eb73dc0f5cece8d0868541487bbf6103
MD5 hash:	b7c9e65f0360b4a9315bc8708b3a43d4
humanhash:	lamp-nebraska-pluto-mars
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'881 bytes
First seen:	2026-03-31 11:06:05 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:g12JMMubiBExuZvE6EnE2EhEKOYbwxwJUf/whM3S:g12JMMubiBExuZvvcvyIYbw9whM3S
TLSH	T1735150DA01906771DB06C64D77F032F4524AE2835EDF8F45F9D8182C9EC9D8C3A99A80
Magika	txt
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnaarch64xnxn	f93c7d148e76bb7a029130af5bfeeed16c4f7c0eed1d85d3b8d2410dba64a659	Mirai	arm elf mirai opendir ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxni386xnxn	eaacedbbba3a6ac2b258e34561de392eabc990f0759a504d02e3b19e4a4c9623	Mirai	elf mirai opendir ua-wget x86
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	a6cf97062cd502f81661c00b39403b5bd6abefae526aa681ea8a016e3bb02554	Mirai	elf mirai opendir ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnm68kxnxn	d897821b96feca88ac6380e1b0711ac5b2aeb1d9855de7bd7dd7c0d15437bec4	Mirai	elf m68k mirai opendir ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	9c53a3f18389aad2cbaf55d552c776bfdf8c383c3c9e01af03f1e723cb3b1d11	Mirai	elf mirai opendir ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnmipsxnxn	a011da91831c93332a0ca9049c36a52e8a15bc19d69b48a1c4ae663e7d1bd52a	Mirai	elf mips mirai opendir ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnor1kxnxn	d433ee39b09f728862268b5794adc2eda2f0b01b7ec81fff6a5d17370adafcb3	Mirai	elf mirai opendir ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	173e45840734e04d5f4db67166ff15d00ff638b374d8f67177de690321273f6e	Mirai	elf mirai opendir PowerPC ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnriscv32xnxn	a3f96aaf0ed4a834d463244e3c3131bd13e7366a2f5bac5303547d46b6912547	Mirai	elf mirai opendir RISC-V ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnriscv64xnxn	7ea944b1daa39ff521bc62cbf2a7b1aaab9a586e49e28d50331bc95d4c3fb2e3	Mirai	elf mirai opendir RISC-V ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnsh2xnxn	74806f3ee8e62782fa25026c63473ef2b8f029c359d2a27e450b2c298a1a85aa	Mirai	elf mirai opendir SuperH ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnsh4xnxn	b632d1b8c1e520bfac47d8bf846df39e23d6deb688ff6e674db6f285d61d9f40	Mirai	elf mirai opendir SuperH ua-wget
http://83.168.69.118/bins/xnxnxnxnxnxnxnxnx86_64xnxn	01e63c589a87fc53b9eee7d8005a0df91108c985188f85781b5801d2d11d03bb	Mirai	elf mirai opendir ua-wget x86

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/adbe164d-4e22-4e89-85cc-0749bf6f3a87

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c5ad3cfe1a5b9409cb54a59a5466ada8c7306ea0262829af35f1206d8530c67e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c5ad3cfe1a5b9409cb54a59a5466ada8c7306ea0262829af35f1206d8530c67e/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/c5ad3cfe1a5b9409cb54a59a5466ada8c7306ea0262829af35f1206d8530c67e

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-03-31 11:05:59 UTC

File Type:

Text (Shell)

AV detection:

4 of 36 (11.11%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ywwtz7q2lokats2uuwnfizvnvddta3vaeyuctlzv6eqg3bjqyz7a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260331-m7janshw7j/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c5ad3cfe1a5b9409cb54a59a5466ada8c7306ea0262829af35f1206d8530c67e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.