MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed9ab5389ecf4f970757456e71ef6fd6975feae74734188fc204e51d7e5647b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	ed9ab5389ecf4f970757456e71ef6fd6975feae74734188fc204e51d7e5647b1
SHA3-384 hash:	3b9634e9623e6afa44dfb728540ff946d8b181e70d3e355e5668b1293069d5db916819fc64690e80136e1545dc2a31bd
SHA1 hash:	ac94d588c133f6f3530c5a24666eec33de909df3
MD5 hash:	df1c254074f2976de2b1c0e41b39b390
humanhash:	kitten-helium-carolina-timing
File name:	nigga.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	726 bytes
First seen:	2026-01-09 06:50:35 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:FFlvM8AVtutFlc8AbyEFli8AbzstFl+bNx8AiPnFl+3A8AO835DFl+Px8AgP9tF+:LVbGtuz5arsgpZNO/7K5Rg290ewKwas7
TLSH	T18D015EDD2E227067426BCC1FB672CB30D6C8A28077491B39BF4C18B182E0909785FF55
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://87.121.112.123/fentchrome	d6b9d307b9fe39153807d093a009f78dccaf5faa6a4bf8e6685317d7311011cf	Mirai	elf mirai ua-wget
http://87.121.112.123/fentdips	6b92d51e1c1aa64b3f8d305572d83727360a772717fbd9f0aa0de9b9b2d65a52	Mirai	32-bit elf mips mirai
http://87.121.112.123/fentdots	28916f5fa6a8f13abc46e96a61e4aca97d7b9ffe06be61e53df9d090b173efcf	Mirai	elf mirai ua-wget
http://87.121.112.123/fentarm4	ca1ece23333563c54e03267de8a6470d3da657fb6d96eee31ea2684262bb0ea5	Mirai	elf mirai ua-wget
http://87.121.112.123/fentarm5	3b930dde5a40a405988bb34af341c57d3e82502919d03c786e5bcc0295b22f27	Mirai	elf mirai ua-wget
http://87.121.112.123/fentarm6	e6c411cd4a0064544cc51c6b3c70e121b4fbddd1672cf1586f7af387bd187f1f	Mirai	elf mirai ua-wget
http://87.121.112.123/fentarm7	f7a258f11856f5bc0b563e481d11cdc906fd489af3753bbd49e21f7480199504	Mirai	elf mirai ua-wget
http://87.121.112.123/fentppc	41ac9f3ac4232c877aff9d318cb0a92c643c9e3d40cb31ec963656024da86f4e	Mirai	elf mirai ua-wget
http://87.121.112.123/fentsh4	e83710712a6ce2a96befc4d38fd315099c2a70fd325cc3d513e68a4f98ac10e0	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6960a54c30368802bb7d28d2/reports/825f2f8f-b13c-40d5-a96f-cee9b4a90601/overview

Result

Gathering data

Verdict:

Unknown

File Type:

text

Link:

https://opentip.kaspersky.com/ed9ab5389ecf4f970757456e71ef6fd6975feae74734188fc204e51d7e5647b1/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/422e7dff-e500-46df-915d-c0cf623aec05

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ed9ab5389ecf4f970757456e71ef6fd6975feae74734188fc204e51d7e5647b1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ed9ab5389ecf4f970757456e71ef6fd6975feae74734188fc204e51d7e5647b1/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/ed9ab5389ecf4f970757456e71ef6fd6975feae74734188fc204e51d7e5647b1

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5wnlkoe6z5hzob2xivxhd33p22lv72xhi42brd6catsr27swi6yq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260109-hmdr8sby6a/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ed9ab5389ecf4f970757456e71ef6fd6975feae74734188fc204e51d7e5647b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh