MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0f7bd2cfaeada542098fadc71faec134f91c75982ef563fa811a4df5930fd85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	f0f7bd2cfaeada542098fadc71faec134f91c75982ef563fa811a4df5930fd85
SHA3-384 hash:	ae50f1ba26e55a52963d883bfd104550d3699a7f23a9b825fac4eda36eea5ce92c9978e05f13e8c0e182bf655685ab66
SHA1 hash:	635e4d5a39c364dbcc757323a6129564f95f3a17
MD5 hash:	d925a2a9105787333042f1b263297497
humanhash:	arizona-vegan-fillet-stairway
File name:	rva.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'974 bytes
First seen:	2026-08-11 11:56:38 UTC
Last seen:	2026-08-12 08:45:38 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:spYcdpxD3kpW4pZsp7ApTYdphYhypEkpLJGpvYvsplcpBGpyK5pnGn5qpxXp:sDdLkbcGad3+yNS5UifX5
TLSH	T19E5187B50182087F6E42F683A7AB4559B1D6FD86A6C67F0DE7EC3DBC908CD09B0525C2
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://217.60.195.187/rva_bins/rva.x86	22a7e3fb4dc8570ee033185689aa77ebcab3b16f7fbcd63d559443440f6ff87a	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.mips	7f3762d032cc25873728ad0cdafffc90dbf1674c8a39a20f170918908ab37fe0	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.arc	5001dcd7338d1213709e686a35c8636c4b3cc8e8263037be3d82893f89ecb886	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.i468	n/a	n/a	censys elf ua-wget
http://217.60.195.187/rva_bins/rva.i686	n/a	n/a	censys elf ua-wget
http://217.60.195.187/rva_bins/rva.x86_64	n/a	n/a	censys elf ua-wget
http://217.60.195.187/rva_bins/rva.mpsl	e30c68a5d14048c44c94676561a0fa2d15bc2fc205daad34da42ac3ee8c263ca	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.arm	a7fab01edafa0f77a756909101c915d0600f040ffb8a5f34873ad698d6f6a570	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.arm5	b917460b2f8c5ccc99d24bef30b04011618c75ee9563bd3f5fed003ac90be065	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.arm6	cbfa29be93d0514acd8179f75705cdad7d4b4ad86861b5bef99c2384404894b3	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.arm7	cc7bcbeed4c561774c6f2a8f38fcdbe465ac8a6c3670001d8286dd290ed0ece0	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.ppc	245443ad2e43a7c3e6288292aa3701b5cb2481a1141c73f977a94a2cb3956bb8	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.spc	4a2e34ffd5ff1f0d0cdaa2db74b8cec724c4b1a6375cb1f8eebd982d98f1fbe5	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.m68k	9f3849e652bb6daa6418275e733891fdc3c82cda04218d996cb183d4c4023e93	Mirai	censys elf mirai ua-wget
http://217.60.195.187/rva_bins/rva.sh4	6478842eda7a2fa9a6a9c51ea58a6b33b08863b9d499aa2c3d7fe49233667873	Mirai	censys elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader mirai

Link:

https://www.filescan.io/uploads/6a7b0e384d0e928aec88e3e2/reports/5a5131a9-6ef8-42e9-b11f-f432a1e17333/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-07T09:41:00Z UTC

Last seen:

2026-08-11T13:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f0f7bd2cfaeada542098fadc71faec134f91c75982ef563fa811a4df5930fd85/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/792c11de-01cf-4147-bf96-a591fe32ffed

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f0f7bd2cfaeada542098fadc71faec134f91c75982ef563fa811a4df5930fd85

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0f7bd2cfaeada542098fadc71faec134f91c75982ef563fa811a4df5930fd85/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-08-11 11:57:28 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6d332lh25lnfiiey7lohd6xmcnhzdr2zqlxvmp5icgsn6wjq7wcq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260811-n4rcjsdp4z/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f0f7bd2cfaea/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f0f7bd2cfaeada542098fadc71faec134f91c75982ef563fa811a4df5930fd85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh