MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2e8ad3035bf734c4ab18d298b44dae38c3841eb5e37532bef4ca89e3bb8c35b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	d2e8ad3035bf734c4ab18d298b44dae38c3841eb5e37532bef4ca89e3bb8c35b
SHA3-384 hash:	494719f4e6f6cef338905f678090fe7718379e862ce0e8422fee76c56c93d06f16b42d3aa5dc07afb5bac2f234fc6f6e
SHA1 hash:	49edb8fdb00950e9771d419a00300e6153d05704
MD5 hash:	dea2f5cdccae2a25db51a14bc9a6c739
humanhash:	batman-oven-avocado-missouri
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'740 bytes
First seen:	2025-12-25 03:18:59 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:nDdLfiTSXdCV1CX8dCoDadObydmUgdQ9WRdCjRdgJtbdeBIdjyjjJdh8jAd4J78J:nD9K7av1gw6gRsaI4QA6Byv
TLSH	T1D731D6DE30114AB229CECE80B6E1F148F4A09AF627F51F74BD96086A6DD7604378D634
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.20:52603/x86_64	afd23239ac37840687f51cdc8cc0e5c1ab0f62bfcc861427a092bd21e07d8dee	Mirai	elf geofenced mirai ua-wget USA x86
http://130.12.180.20:52603/x86	30da945d7e5500938299cb12b475f94e3354dfdcfb5d591128668a3b5d4de483	Mirai	elf geofenced mirai ua-wget USA x86
http://130.12.180.20:52603/m68k	b041660f92a91d789663cf2b84acb7045c27fc2287283b0dd3bcb4cea0ebb9d8	Mirai	elf geofenced m68k mirai ua-wget USA
http://130.12.180.20:52603/mips	d908d2f0b4114165079510ef8fc762c6b6cec60eea6dec514d683f3e67f55680	Gafgyt	elf gafgyt geofenced mips ua-wget USA
http://130.12.180.20:52603/mpsl	e2f49b929531ddce009e62e076af65a97785fe9732012fb13e968ffab3164f43	Mirai	elf geofenced mips mirai ua-wget USA
http://130.12.180.20:52603/ppc	4f581e30be9df11bcab26c70caf17a0161cf2acaf676371ba0aa5aabc7e5d371	Mirai	elf geofenced mirai PowerPC ua-wget USA
http://130.12.180.20:52603/spc	0ddb8750a2234f53bebd468ede3922e59d69845d47c81967709bb9ed729a2717	Mirai	elf geofenced mirai sparc ua-wget USA
http://130.12.180.20:52603/sh4	7916e2f6e47d71fcc0a48bf85d4bce2a61623035bc91eda55f036f1f6482a956	Mirai	elf geofenced mirai SuperH ua-wget USA
http://130.12.180.20:52603/i486	n/a	n/a	elf ua-wget
http://130.12.180.20:52603/arm4	42719d96f3b14272254cbd68c4ea3e02900a517a501f8a94440cf162689e6b0a	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20:52603/arm5	fc542ad670c36e48b6bf573678e5e81fe884d231807256ecd06fa88801cb8eaa	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20:52603/arm6	f4c538b4c55ad7f1dcc1dc160b373386aa0b11de48528ac5338ea58913e42900	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20:52603/arm7	f20dd3de2b928c15faff2a8b7233b3918a3922f53f61ce7e02a7e0f1b691be1a	Mirai	arm elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.BV.Downloader-AEH.24475745.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/694cad37e126b9ff4390a321/reports/d4830db8-8aa2-4d63-8d0a-f967b708e5ee/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dce32526-7591-4cc0-97cd-5bddeee81882

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d2e8ad3035bf734c4ab18d298b44dae38c3841eb5e37532bef4ca89e3bb8c35b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d2e8ad3035bf734c4ab18d298b44dae38c3841eb5e37532bef4ca89e3bb8c35b/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/d2e8ad3035bf734c4ab18d298b44dae38c3841eb5e37532bef4ca89e3bb8c35b

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2luk2mbvx5zuysvrruuywrg24ogdqqplly3vgk7pjsuj4o5yynnq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/251225-dvhzpsxrak/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d2e8ad3035bf734c4ab18d298b44dae38c3841eb5e37532bef4ca89e3bb8c35b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh