MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e348e6eedd91830929cbd21fc28602d8284557ccb41982f80831ae8781dcc10e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	e348e6eedd91830929cbd21fc28602d8284557ccb41982f80831ae8781dcc10e
SHA3-384 hash:	701a085fff05d544aad500dec74c2ec7d7379bc60c9665691504319b1ba0a1f0c50ce47f39d05188a378574c26b97283
SHA1 hash:	af53233fc1c8e8955608acf179b06a9d65dda69e
MD5 hash:	38cb3a672e3ac1cea50981788230c6b8
humanhash:	ink-pluto-carolina-mango
File name:	nigger.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	254 bytes
First seen:	2026-06-11 02:18:26 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	3:TKH4Z8bXjWygFWKIvJjWa3zOdBhYJXn8cIFuBNRFbXjWygFWKIvJjKDOdAlYXJXr:zKb6XhYlnZlFb6Dglnzug3dN
TLSH	T167D05EC764215660CE8E9A2977A006CC708A4ADD11C74BD9ECBA0A3C64AC6442144B45
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://152.236.7.10/eat/some/godisdead.2	8f875dec87348140eee51bb102165d01e90163c9c4c76ba796874b36dfe1108f	Mirai	elf mirai ua-wget
http://152.236.7.10/eat/some/godisdead.3	f2ffd8c6bd84f2af333fde081c598a9770676fd36b7cdd644d077724d9a5ac1d	Mirai	elf mips mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.HEUR.Trojan-Downloader.Shell.Agent.a.32581.30790.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a2a1afabf16337e43c0f7be/reports/d5584cc7-b829-4496-9405-b5cf33c4b1bb/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-10T23:24:00Z UTC

Last seen:

2026-06-12T18:38:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.cv

Link:

https://opentip.kaspersky.com/e348e6eedd91830929cbd21fc28602d8284557ccb41982f80831ae8781dcc10e/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1baf157a-c60a-4a1f-8eed-8162d1b2541f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e348e6eedd91830929cbd21fc28602d8284557ccb41982f80831ae8781dcc10e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e348e6eedd91830929cbd21fc28602d8284557ccb41982f80831ae8781dcc10e/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/e348e6eedd91830929cbd21fc28602d8284557ccb41982f80831ae8781dcc10e

Threat name:

Script.Trojan.Malgent

Status:

Malicious

First seen:

2026-06-11 02:19:31 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4neon3w5sgbqskol2ip4fbqc3auekv6mwqmyf6aiggxipao4yeha._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/260611-crkhpaas2q/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e348e6eedd91830929cbd21fc28602d8284557ccb41982f80831ae8781dcc10e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh