MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8fe258c2c99ec1e464faa5266095ade07481ad62313fd04f46ad0a495c69c87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	d8fe258c2c99ec1e464faa5266095ade07481ad62313fd04f46ad0a495c69c87
SHA3-384 hash:	ce512a4cb8530bab316f41ff442117eb0e37ef9b91adbc91cffec831138fa715620cda19c62caaaf3a1d29069026f989
SHA1 hash:	ccb965285b638f107b364ead06a2e1dc9609a80e
MD5 hash:	c0b6591fa1273147f4582d42e3f20591
humanhash:	six-bravo-florida-ohio
File name:	dvr.sh
Download:	download sample
File size:	4'833 bytes
First seen:	2026-08-28 16:05:27 UTC
Last seen:	2026-08-29 07:02:33 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:UupQVxK9PUX6ktXMrHaXMum3SXmdKFPEUNCXjWg2tge1ER6SMmPbaomQ0JBmCNIc:UupQVxK9PUX6ktXMrHaXMum2mdKpEUNN
TLSH	T141A19E8E5170D23DA46FDDACB6F70B00584585E231B13F295EA808A3BCC9A707369F5E
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	5888576581a5a4fc78218ea90e78ad420a2ef3ef22cf103e231ffe43a58d63a7	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.aarch64be	n/a	n/a	arm elf opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	8e309f91353197022b436a770fff7421b76552fc7eb052685413f08e17db49f6	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	59f255347969aa82d875e878ee41604dcc7475a63c73dba58cf8ff2569669116	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	85bc819c97ee41dac47ebea4b6077f599546616d5d83d63e162c75ed623e6ce6	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	3c566055bc538d964a8c3d11996676abca6a61923081af6d7e6b831e478c3334	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	8ae5df9b6e67b60c19a55793d8ba1b614c6fa4d42e75582697a6db2d3eda150b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	28c8a375115f283377aab40b697d6019d3360c5e913f0d159b1ee8f5af9003ec	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	623b23217a476585d062fb99f73a9ec565e203b91e9b7ec53cb6e4f979faa196	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e500mc	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e5500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e6500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	09f9b48c4d38a6f9b587c3467927717b1ad0dbc6c077213ba6426c8cedc17bdd	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.m68k-68xxx	n/a	n/a	elf m68k opendir ua-wget
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	45fde3defd8f0f109a8582e38e055ac4320b403c68bbaa726f9f1b96970051e6	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32r5el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32r6el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64el-n32	caa58a4d69af408999c315eff45b8226314f51abdc9398deab82c2e330759831	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64r6el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	bb50036b84ddd68366df361cbf2ccccb5d5919beebcce75e6107160dae49a80b	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.power8	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.power8le	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.powerpc	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.ppc440fp	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.riscv64	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.s390x	227b75deeadc8224a4ce6e1d7dfea4f03e3c6d6a9a0610d9ba3fe027d15804de	Mirai	elf mirai opendir s390x ua-wget
http://130.12.182.77/main.sh4	e4451d8970323bd258f4e55ea1118a63928479661ad8f11c8a6a0e9b2330bf46	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sh4aeb	n/a	n/a	elf opendir SuperH ua-wget
http://130.12.182.77/main.sh4musl	n/a	n/a	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sparc	n/a	n/a	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.sparc64	n/a	n/a	elf opendir ua-wget
http://130.12.182.77/main.sparcv8	67f0b5b79bd72d991813a80efadeb70c136e0e33531615385f71b34c9c5fa6a0	Gafgyt	elf gafgyt opendir sparc ua-wget
http://130.12.182.77/main.x86-64	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86_64	2109694b6e3871bbd670bc4bf0651cf586862849489c6bc644a14f2764fc7f4b	Mirai	elf gafgyt mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-i7	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-v2	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v3	n/a	n/a	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v4	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-core2	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-i686	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.xtensa	n/a	n/a	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader mirai

Link:

https://www.filescan.io/uploads/6a91b1faf7f0d768148a1ef1/reports/932ceb0b-e77c-47e4-a30d-a53a738f72e5/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-08-28T15:09:00Z UTC

Last seen:

2026-08-30T01:39:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d8fe258c2c99ec1e464faa5266095ade07481ad62313fd04f46ad0a495c69c87/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ff2d9c2e-3f25-41c0-ae80-0253968afda5

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d8fe258c2c99ec1e464faa5266095ade07481ad62313fd04f46ad0a495c69c87

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d8fe258c2c99ec1e464faa5266095ade07481ad62313fd04f46ad0a495c69c87/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-08-28 16:06:21 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3d7cldbmthwb4rspvjjgmck23yduqgwwemj72bhunlikjfogtsdq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260828-tj73fszgnc/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d8fe258c2c99ec1e464faa5266095ade07481ad62313fd04f46ad0a495c69c87

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh