MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f130821f1b8499cdcb6a3cd0cfcb826751c1c247e8b903873b3ac2c8b490f9d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	f130821f1b8499cdcb6a3cd0cfcb826751c1c247e8b903873b3ac2c8b490f9d6
SHA3-384 hash:	f8cc1e345d5f23982a9c2b22ad8fff69f394997ac87ac1c7bb42ab07c43e1cdd5f3343906fd71786c31b627ae4c8a88f
SHA1 hash:	8593ec76b02554cb193a2fd3a02b1148da462bdb
MD5 hash:	2a76929fcddc5fd387a410a9c333a3c2
humanhash:	nebraska-paris-saturn-ack
File name:	e
Download:	download sample
Signature	Mirai Create hunting rule
File size:	777 bytes
First seen:	2026-10-07 16:44:32 UTC
Last seen:	2026-10-08 02:49:45 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:c1Zf8q76X8Zf8qjpEbZf8qCrtZf8qI1nZf8qulT:c1p8q76X8p8qjSbp8qCrtp8qI1np8qsT
TLSH	T1B60171C501811DD2D4ECA09570AEE52C645059F217C65B4C99BF38E6CC0D8F5F02AE96
Magika	txt
Reporter	BlinkzSec
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.36/eclipse.mips	574b611a85a59d8bae55c1ff3dd2652e87929822bd68a6f42e272379d141d777	Mirai	176-65-139-36 elf mirai ua-wget
http://176.65.139.36/eclipse.mipsel	8210a2ece70747f8ffd4de03ce4288893f3ecd34e14fd5598efc8657ffebe98f	Mirai	176-65-139-36 elf mirai ua-wget
http://176.65.139.36/eclipse.armv5l	644fa7ab326d731734f7a87dace1d9cc10b09467f4e66aff6db4adde07e1393a	Mirai	176-65-139-36 elf mirai ua-wget
http://176.65.139.36/eclipse.armv7l	3c0ce274aea0d1a8ccb9e352fc281ef502e6078e4a6df7cf305b3c6e3b2e553b	Mirai	32-bit arm elf mirai
http://176.65.139.36/eclipse.x86_64	ca8686e0a699624e8df0d558af680a5ddbda7522b19258e7d200c9062cc68d97	Mirai	automated cowrie honeypot mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-34.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/6ac67799e23985e3f7b788e4/reports/5d8b84a2-e58c-492b-b769-1a085632bb32/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-10-05T21:24:00Z UTC

Last seen:

2026-10-08T08:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f130821f1b8499cdcb6a3cd0cfcb826751c1c247e8b903873b3ac2c8b490f9d6/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e93e153f-cad6-438e-8b17-968c5e2972d2

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f130821f1b8499cdcb6a3cd0cfcb826751c1c247e8b903873b3ac2c8b490f9d6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f130821f1b8499cdcb6a3cd0cfcb826751c1c247e8b903873b3ac2c8b490f9d6/

Threat name:

Script-Shell.Trojan.Heuristic

Status:

Malicious

First seen:

2026-10-07 16:44:40 UTC

File Type:

Text (Shell)

AV detection:

5 of 23 (21.74%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6eyiehy3qsm43s3khtim7s4cm5i4dqsh5c4qhbz3hlbmrneq7hla._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261007-van4naby2v/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f130821f1b8499cdcb6a3cd0cfcb826751c1c247e8b903873b3ac2c8b490f9d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh