MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcd921bb44cdb057335e0433791538c23c7dc9d63960c341f5d317052d4a075d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	dcd921bb44cdb057335e0433791538c23c7dc9d63960c341f5d317052d4a075d
SHA3-384 hash:	f04ba73282ab4648e53653b5c7d8e5caec3b33e38fe3d96589eb3415e8e9d17eef35c69baa22f87a29ed9ed097d603a8
SHA1 hash:	28e4cb01f195133308b304573f1d00bcaf47246a
MD5 hash:	87d595e313adda86934c98bd7e60d53a
humanhash:	washington-social-maryland-arkansas
File name:	k
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'515 bytes
First seen:	2026-08-29 06:09:36 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p5j50rD5qNIlz5XkKDg5g5b35Hw/d85j5vycwZ5Hw/d85YhVbR:p5EgNIleKDgy1Vw/d8RMVw/d8AR
TLSH	T19231DCDA79615D80C0469AAD713E9C56D330C1DB5ABF5BC59CDC1D6EC0A8EECB024618
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.220.3.140/ri/la.bot.arm	f85299205e1596ab621b06343f49a58606ae480ea3a7460d9db11de62fdc97bc	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm5	8ecb1ac8be0165ab2d27abf995719a59154f5516f9408271475f52b68c640c7b	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm6	1a644b96e353f644bd85ee3c195635f749c93130f99afe544a5b624b2d987db9	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm7	1a644b96e353f644bd85ee3c195635f749c93130f99afe544a5b624b2d987db9	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.mips	e1419805e587355ca7d9d0be4faeebc4fa0e683600a62e282af58f0b88e2ba27	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.mipsel	c000f4ff8aaa12a0bc5216b658d447405a4fb3ac67d5d7dafea45751e910e8bf	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.powerpc	addec310024be796b4e327aa586b0bcad080a09cdd4c654ee70d6d0896eff568	Mirai	elf mirai
http://31.220.3.140/ri/la.bot.m68k	0b63ad7fbb676f27359d28c2c9ab4465e6e81d3765e3931541fe3b97f39e6ecd	Mirai	elf
http://31.220.3.140/ri/la.bot.x86_64	589b4a0dda2510fba387e41677898bb4d596f8676944fb24b3130f5434d0c04c	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.sparc	1995363af372df9ae64a2b641234ee8870b908702bb7b15c8dec92b52da6d0ee	Mirai	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d87f0d08-5193-4a61-866d-62c3438c254c

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dcd921bb44cdb057335e0433791538c23c7dc9d63960c341f5d317052d4a075d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dcd921bb44cdb057335e0433791538c23c7dc9d63960c341f5d317052d4a075d/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-08-29 06:03:07 UTC

File Type:

Text (Shell)

AV detection:

20 of 36 (55.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3tmsdo2ezwyfom26aqzxsfjyyi6h3sowhfqmgqpv2mlqklkka5oq._file

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260829-gw6nyagk9v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Unexpected DNS network traffic destination

Contacts a large (37650) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/dcd921bb44cdb057335e0433791538c23c7dc9d63960c341f5d317052d4a075d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh