MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db35ab5a5e12afdfbf855cb2caa2f39775a9f015cd624e2c7f26ff5a163b45d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	db35ab5a5e12afdfbf855cb2caa2f39775a9f015cd624e2c7f26ff5a163b45d3
SHA3-384 hash:	28fed1d3815eda52d2fcca874edc4f767a3bdb570a5db1e4ba3fcfbde746500e2456b4c69c49846f217720f303accce8
SHA1 hash:	9c22711d7fc0b2409ad75ec3bbc2baffc0a200d6
MD5 hash:	91149750c7f13da6326b03f535d0ed2d
humanhash:	cat-table-white-five
File name:	test.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'232 bytes
First seen:	2026-06-01 11:13:21 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:2d3p3ibd/sdLkLY+aLdtdiJdGYBdLYKGdSxSZduCuxd0WdA+dhwdX4dAvk:2dJibmSaLCPBlGEgZchV4igk
TLSH	T16C412EC9327162723C9FDD3263BB4614B0E0B4D261C8DE1698CC38E5D48DE856A9EE76
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec
Tags:	mirai

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://160.30.18.123/systemcl/arc	c7b9ccb9b1cb94f53237d16c6b20348fbb26a260d4f78b1aa2085fe127e88a56	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/arm	c3ba3af87d1e38db43ef5613a383b42799494c992cb52ad55d70f3e2b10bb6f8	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/arm5	771e26ffa4f9f53449615d6efa310fa469cad503c0dcf6bcc3d243eed641eb95	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/arm6	5ec333647d4946c22672778debde2c126e1acdd932d3c6665e19cbb7f549014c	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/arm7	82c4db2c55bca8b4a99ce22b0c340f2c03fd146df69bb642f65092bd4f544d8e	Mirai	elf mirai
http://160.30.18.123/systemcl/m68k	dfd542f72cad80cd5536ec3ce826c569a64f0c5ae2f5451f6dc4a4fda9746de8	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/mips	f6c19972c7868d2aba77121f00237c9094eb6a32c7bcab31bcb6e17617bee280	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/mpsl	1da8cb5ae6ce618ec8d790e052802f5ccd880f0c84ce5ba9364df366640fe485	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/ppc	df5a544637ca04758ce210cff2943aec8406cca4fa31efe9cf8820b212836974	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/sh4	10947b6c23490f8f76fea478a4a8b7df2cbd7e7c291e48eb88a66b681c5cdb90	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/spc	2fac85485bf728e8a209f5a65836aef5597a9da055b11b11913278c6d9629e02	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/x86	7a6e634a6e1d59ea5fd15d843cd70b6c69fe263f61d25c46e3e5b46c5e1b0d00	Mirai	160-30-18-123 elf mirai ua-wget
http://160.30.18.123/systemcl/x86_64	aac7ddb06290ea067759714f70fa52c1a514e9a40576f50babca6e2c7dedcb83	Mirai	160-30-18-123 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Sanesecurity.Malware.32160.LX.BOT.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-05-30T09:18:00Z UTC

Last seen:

2026-05-30T11:40:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.cl HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/db35ab5a5e12afdfbf855cb2caa2f39775a9f015cd624e2c7f26ff5a163b45d3/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d962971f-a9b2-449d-8fc9-88051c62bf83

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/db35ab5a5e12afdfbf855cb2caa2f39775a9f015cd624e2c7f26ff5a163b45d3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db35ab5a5e12afdfbf855cb2caa2f39775a9f015cd624e2c7f26ff5a163b45d3/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-05-30 12:09:50 UTC

File Type:

Text (Shell)

AV detection:

17 of 36 (47.22%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3m22wws6ckx57p4flszmvixts522t4avzvre4ld7e37vufr3ixjq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet credential_access defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260601-nbs1nsby6k/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads process memory

UPX packed file

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Traces itself

Family: Mirai

Malware Config

C2 Extraction:

idknotherefucku.followz.st

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh