MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8b75bd9e451c226a0d8b39abe63df8d31146143cde1456ba026a129241a5ffc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	e8b75bd9e451c226a0d8b39abe63df8d31146143cde1456ba026a129241a5ffc
SHA3-384 hash:	da030c544b2846f02455470eb8e02e6b70971d7d96afd426bc71b78db4078482cf8703e61d7c01e97d7f0476dcccdd49
SHA1 hash:	a5e31775e5faa1d5b5b990efe5b2622ddd01e1e6
MD5 hash:	4601c5138d92e20ef3e058eac77a176b
humanhash:	mirror-thirteen-angel-moon
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'881 bytes
First seen:	2026-04-30 02:07:02 UTC
Last seen:	2026-04-30 11:59:03 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:A12JMEWbiBkNuZvEeEnE2EhEe68bw1YJUfPwhM3e:A12JMEWbiBkNuZvvcvy48bwpwhM3e
TLSH	T1655194DF2300DB31960E9A4EFBF0B6B4660AB4C65ADF8E0CE980085C0EDED4C3695E50
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnaarch64xnxn	c5b83964c342cca78446791fad6d693698e5a2b8f2c24b53c2c1d2221ada15b3	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxni386xnxn	cc1c4b2fc00f127206103fe391dd73bd7a8939b098d5c7eb20505d21b23e819c	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	bcbed7bfa4b6bd7c39edfb6890bc217c795210196d6d71abbc49a7357040e932	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnm68kxnxn	c2ea5668cccb34e61ccdb3110f31fe017f6281470f00c88c4ddee76721a25969	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	9c555b341a4fa66b361dd74fa77a120f46ae27d52a8c7128b21cfd371b2eace5	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnmipsxnxn	aa471f443a6fcc97bdf7f4f053d4f01b8e7780a1e575611fb096ef0112ee324b	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnor1kxnxn	c9b0847f2f30bb47b7bdbe1ab66eb0c342f0ce31a0bda361088fe874de4a26f6	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	224a5c22ef8ccddf925b16f1604a4db959173a0b7492cb7c0f34938b02a03c62	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnriscv32xnxn	93aebf8b0fd05f039fa5e38c02382f7a538fbbb72ec023316aaaf72927870e6a	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnriscv64xnxn	69033c25ab2f978443f25ca06c7259c6270f176409e35b9d635c1baa9444b9f8	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnsh2xnxn	fa9ecfcbe373ae474a71d23cff556077a0d601f0c54ae609562f3cc8e549dbd4	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnsh4xnxn	9d9671995b6153ee5d1ca494fbd6f69c1383d6f3a7e345c9c3df65e48cd6cc87	Mirai	103-83-87-122 elf mirai ua-wget
http://103.83.87.122/bins/xnxnxnxnxnxnxnxnx86_64xnxn	a25858eb58d90477c9c900ab9c8c272e4c01b7f3e7c44bd78bb7a91364ed18c2	Mirai	103-83-87-122 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

text

First seen:

2026-04-29T23:22:00Z UTC

Last seen:

2026-04-29T23:34:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/e8b75bd9e451c226a0d8b39abe63df8d31146143cde1456ba026a129241a5ffc/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/7d5431f4-6f8d-49fb-98e3-567a8e74ee50

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e8b75bd9e451c226a0d8b39abe63df8d31146143cde1456ba026a129241a5ffc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e8b75bd9e451c226a0d8b39abe63df8d31146143cde1456ba026a129241a5ffc/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/e8b75bd9e451c226a0d8b39abe63df8d31146143cde1456ba026a129241a5ffc

Threat name:

Script.Trojan.Multiverze

Status:

Malicious

First seen:

2026-04-30 02:10:49 UTC

File Type:

Text (Shell)

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5c3vxwpekhbcnigywonl4y67ruyriykdzxquk25ae2qssja2l76a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260430-ckec4aat5s/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e8b75bd9e451c226a0d8b39abe63df8d31146143cde1456ba026a129241a5ffc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.