MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d586e9eb58b9962474ac2e2b5648f8c30b823ce73e1847e5d737048773cd2846. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	d586e9eb58b9962474ac2e2b5648f8c30b823ce73e1847e5d737048773cd2846
SHA3-384 hash:	4eb45d11ade201fcc6a4fd4975d81c1b339b1d361483a131232870104109ba6862df57bfcf7b0750f5468d4a6c8f0c94
SHA1 hash:	1d7b53e3fa98d6b53af1bbfbdb57c2be498ba2ca
MD5 hash:	e2d9b861d442c25b78374e64bf05f20a
humanhash:	alanine-wisconsin-summer-princess
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'881 bytes
First seen:	2026-02-23 10:28:04 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:6tA9O92JMY6C6biBcWLWuZUZEdZEnE2EhEvh4tzLzbwPYQawsCsJUfcX04O4hM3G:b82JMPxbiBHyuZmmcvyfnbwWnhM3G
TLSH	T14351849F13008F31A74C85AD7BF0B1385546A4935BEB8B18EE90885E0EC6E4C37CDE60
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnaarch64xnxn	9d411d2ea4975d448f9419074bb7ed4af7230e9d71cd21c364b469fd0feb6e6f	Mirai	elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxni386xnxn	3c185216f32db7ef974b6b99d03f099078af2c8326a9d4dd0ee1091e06224981	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	e179a564c84da82ae6cd343ee5bccc15c6433382579d5386af2152f760136bc0	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnm68kxnxn	8b81cc5589d6c6a76c60e46653585e2e492bce3f62ea1415557b0d5b3fadffe6	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	e6d7a59c35a1c0e7f936c824c27244d99bebe813fc0ec281789357db06c28ff3	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnmipsxnxn	5dc95fd46ac55877620392211ceaf25f7bc92c123c98399ec22f1de9ac6d63cf	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnor1kxnxn	cd45ce1719122ae5a86c4f2b07183fb03350e22c861d503ec892b4b5fe151919	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	4ce0cf81db980e021161730effe02c3418e687a83ccb2377638eb9ac4327ad17	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnriscv32xnxn	53bc38db1b98c45d55757e8e48623d1d6c9583cb90ca39d1374f5f9f8a7e44a3	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnriscv64xnxn	fe5cdfe9b7f80f6b45eac6cab85006bfe5c1ffdc4f9ebbcad7a5a494d062e548	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnsh2xnxn	c0a5a83009d82ae7f51649266605ba241c961b3e96149045db88bab52b9dd9d6	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnsh4xnxn	cd886cd30ecf8bd0d19f21895a016b4bb920bad6cb4c2bf82c903d96349a5420	Mirai	censys elf mirai ua-wget
http://130.12.180.64/bins/xnxnxnxnxnxnxnxnx86_64xnxn	6a0602e45dce1d0be1ee3d3c8458c7b6356e2ea17c0e0390d7349181fd707aee	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Gathering data

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/d586e9eb58b9962474ac2e2b5648f8c30b823ce73e1847e5d737048773cd2846/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/ba03f99c-c984-4323-8567-f84f04b67956

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d586e9eb58b9962474ac2e2b5648f8c30b823ce73e1847e5d737048773cd2846

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d586e9eb58b9962474ac2e2b5648f8c30b823ce73e1847e5d737048773cd2846/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/d586e9eb58b9962474ac2e2b5648f8c30b823ce73e1847e5d737048773cd2846

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-02-23 10:29:22 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2wdot22yxglci5fmfyvvmshyymfyephhhymepzoxg4cio46nfbda._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260223-mhydasdx9g/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d586e9eb58b9962474ac2e2b5648f8c30b823ce73e1847e5d737048773cd2846

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.