MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3b7f99f3d24b21c119e5fdb4114e2fcc9c044569ad8bb2b030bce09152a9d51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	d3b7f99f3d24b21c119e5fdb4114e2fcc9c044569ad8bb2b030bce09152a9d51
SHA3-384 hash:	ea2d5cd7371b4c230681ec6b4960fdadd83ffca869dfc26a0c4ef0dfeb877ae7a898ff49e9ae96052a19593ebfe20fa8
SHA1 hash:	90ade09c30fdd313130b98adca60cff2a5125385
MD5 hash:	d290112aba2f6331119463f5b5f575cc
humanhash:	quebec-equal-sixteen-eighteen
File name:	tplink.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	4'893 bytes
First seen:	2026-08-10 06:26:27 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:jl/8HvLiPLxF6eAN3xodPYjLy+6Fnh4iQ/dtSbBmLoTQ//iVXrINFL4Nxuxfdc5D:jl/8HvLiPLxF6eAN3xodPYjLy+6Fnh4w
TLSH	T127A1BF8A2478D63CA47FD9AC79E54B40988D45E232B23F399EB028535CC9970B349F5E
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	3976eda2ae8a095f3868ad94d8b28e8bf3019298a73097a3a124a6f56b687b80	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.aarch64be	n/a	n/a	arm elf opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	c0d258fe8e23efd8b255d0e832dc8a2265c94b43b3ec994c4ca25b7ad3d2d59d	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	40a9190f3f5a0f86f97065f09d071b5622517729b6b81442afdc408ae8ec9330	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	470a44a079d8194bd10e4c19bd63cc38688b2fce21ddfdd6657e1e6caf7401a0	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	e0cc4f8ec0d1de74aa8cb49987e58c351e3be2a45b974896ec15124150bd5d00	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e500mc	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e5500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e6500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.m68k-68xxx	n/a	n/a	elf m68k opendir ua-wget
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32r5el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32r6el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64r6el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.power8	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.power8le	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.powerpc	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.ppc440fp	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.riscv64	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.s390x	n/a	n/a	elf opendir s390x ua-wget
http://130.12.182.77/main.sh4	n/a	n/a	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sh4aeb	n/a	n/a	elf opendir SuperH ua-wget
http://130.12.182.77/main.sh4musl	n/a	n/a	elf opendir SuperH ua-wget
http://130.12.182.77/main.sparc	n/a	n/a	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.sparc64	n/a	n/a	elf opendir ua-wget
http://130.12.182.77/main.sparcv8	n/a	n/a	elf gafgyt opendir sparc ua-wget
http://130.12.182.77/main.x86-64	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86_64	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-i7	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v2	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v3	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v4	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-core2	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-i686	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.xtensa	n/a	n/a	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/6a796f22a7fbc0309f8ff8f1/reports/d3338a65-0146-4c89-9588-26ae1cc4470c/overview

Verdict:

Malicious

File Type:

Csv

First seen:

2026-08-09T23:47:00Z UTC

Last seen:

2026-08-09T23:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d3b7f99f3d24b21c119e5fdb4114e2fcc9c044569ad8bb2b030bce09152a9d51/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d7f313ea-ca5e-4b2f-bc01-f8e5492246db

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d3b7f99f3d24b21c119e5fdb4114e2fcc9c044569ad8bb2b030bce09152a9d51

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d3b7f99f3d24b21c119e5fdb4114e2fcc9c044569ad8bb2b030bce09152a9d51/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2o37thz5eszbyem6l7nucfhc7te4arcwtlmlwkydbphasfjktviq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260810-g7mefaxxcs/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh