MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e40d671c6b92e4dda4c444d6e650e1dfa6d2f2bd7e0bdebb10e27b3a224c7de3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	e40d671c6b92e4dda4c444d6e650e1dfa6d2f2bd7e0bdebb10e27b3a224c7de3
SHA3-384 hash:	4224d6aafdc08f73025cca298489f9e23bca4a647fc74e4d00400e19a4ac560a46bfc63cb53dff281393a6e786555b0d
SHA1 hash:	d8745257ac308475d2411d5ac0b86eef32f09114
MD5 hash:	778cea7f253606adafe8e2c4e8666b59
humanhash:	gee-lion-comet-fifteen
File name:	toto.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'882 bytes
First seen:	2025-07-19 17:41:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:W1dydZ1dAd71dYudY3dw1dFdB1deMdexs1deRdeUf1dvcvdvg01dvBdvpP1dvqd8:Wr2Zrk7rv9rbBre4exsre/eUfrvcVvgw
TLSH	T13C51958408D381B66CB5CF33F6AA8268B59E90C779C19EB644FD7CF1444DE04689A9D3
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://196.251.66.32/HBTs/top1miku.arc	a6ead5ecc5a093af2dd8f9cd7b44db97a3077e888ed6fed6598a68ecad756df0	Mirai	elf mirai
http://196.251.66.32/HBTs/top1miku.i586	ebac11af23f5d447139124bffa1c56429adf2132ea21eba3aed21ecad2423720	Mirai	elf mirai ua-wget x86
http://196.251.66.32/HBTs/top1miku.x86_64	d98f7aaa9e2aa30f86d5f7c88bc2e895bee6adeebc6d87a904bd28e6f9e01810	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.i686	386ed38648148fb805047a802ac6c25485bee146667b0a7f0940b388630a0285	Mirai	elf mirai
http://196.251.66.32/HBTs/top1miku.mips	a77e7186ad2e7b858f23a9f1d3d5d6365481fcf8bf212a6d49b50ba9f9ae046f	Gafgyt	elf gafgyt mirai ua-wget
http://196.251.66.32/HBTs/top1miku.mipsel	2278610b46274d256bef90a582804de656311472aedbb00c1e61a7ce801468f9	Gafgyt	elf gafgyt mips ua-wget
http://196.251.66.32/HBTs/top1miku.armv4l	61074be715c8549eedb1ff4e8f61f3b2ba72918f588b81f33cf285ce1cee3034	Mirai	arm elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.armv5l	cff95b9961ac1757bcba78d775bf142fb4c9134327f823d63a6f26704be7805e	Mirai	arm elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.armv6l	2b4fed8258475b2cb9a33688c0755df646c6473ddac66e7f2d27998f367778e6	Mirai	arm elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.armv7l	4764a1efb1dda2cc50f294de2884f1a67b68acbcf6d3fdb168c26ae59b599028	Mirai	arm elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.powerpc	beaa0f74467ee44b441389fb674657e93bdb4080452567fb4f7874de7a3b783a	Gafgyt	elf gafgyt PowerPC ua-wget
http://196.251.66.32/HBTs/top1miku.sparc	n/a	n/a	elf
http://196.251.66.32/HBTs/top1miku.m68k	eb6913d816c810b0846bc7bf8dd6a19152cf078b0e4ddac040eda89ae0de8ac1	Mirai	elf mirai ua-wget
http://196.251.66.32/HBTs/top1miku.sh4	b3f1e7014dfba66c06190cfa803ea2dc947f59a0b6f437f3ec6f9263b34cb4a0	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3c4db3c4-e20f-48cb-8c13-5453d302b175

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e40d671c6b92e4dda4c444d6e650e1dfa6d2f2bd7e0bdebb10e27b3a224c7de3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e40d671c6b92e4dda4c444d6e650e1dfa6d2f2bd7e0bdebb10e27b3a224c7de3/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-07-19 17:42:26 UTC

File Type:

Text (Shell)

AV detection:

15 of 22 (68.18%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4qgwohdlslsn3jgeitlomuhb36tnf4v5pyf55oyq4j5tuismpxrq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250719-v97p2sfn6t/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e40d671c6b92e4dda4c444d6e650e1dfa6d2f2bd7e0bdebb10e27b3a224c7de3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.