MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7134ec664ca003c740337cf7b2fbba1162430d86ca1d7a2b5c14fe0463d261b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	f7134ec664ca003c740337cf7b2fbba1162430d86ca1d7a2b5c14fe0463d261b
SHA3-384 hash:	1d11d430e7048d20150d2d8701e253f4984aa8c0d474deb89d83adf44535a65f107584406c9a1fa9b8c7206c20588f1c
SHA1 hash:	0a4b99ff3930526088c24193efed1e5e16cfb53d
MD5 hash:	d1e74643b12d56c0b0d9d00467bb6773
humanhash:	zebra-september-illinois-nitrogen
File name:	handshakebins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'177 bytes
First seen:	2026-08-26 05:38:38 UTC
Last seen:	2026-08-26 11:37:34 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:Gn0FtqyS0FtqJZ0Ftqbv0Ftq13Ggv0Ftqu00FtqEY0Ftq7LbzVR0Ftqui0Ftq0zA:15SKpWGrNf5y/s1X0
TLSH	T1DD2190C760975CB02EE1F46B72A9890074D6EACF41D6AF566EDC3CE551CED08B411A83
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.232.114.14/MIPS	0658e79b91e732723b540ee7040eb0289c497f781d750e42b25dfcf10d233f50	Mirai	mirai
http://213.232.114.14/MIPSEL	3ae5e3dc113e4f92cfae8d293b7362c5cc64fe447afe7cf8dcd4ff072d3c520f	Mirai	mirai
http://213.232.114.14/SH4	38534279305c05fc31115da438390708295fc646f41926c3f3a5fab428757551	Mirai	gafgyt
http://213.232.114.14/X86_64	5a21c34ff54ab1a92246b9cfba815ed187fe636b9350d41e26c5e4aa8f4bf891	Mirai	botnet ddos elf iot KHserver mirai
http://213.232.114.14/ARMV6L	90c9423bf169aa2938c1ed0860112800c88021f09d41fb1c09118c4246783782	Mirai	mirai
http://213.232.114.14/I686	65333b96309698779dd6b78fab972e9754bbef701f19d70e899353421d2be738	Mirai	mirai
http://213.232.114.14/I586	9edda7968efeba7182ed030a578f5d44b02aaeb343199ca0a21b753a0ff68420	Mirai	mirai
http://213.232.114.14/M68K	57a070ddc160dc89eac5cf243d319db9cf1e2bc4ac4b629619abf83f84b9ef5f	Mirai	mirai
http://213.232.114.14/ARMV4L	b297dc8f54f612f92c26735ab50e1360057df3909556d85e6439e695aa646148	Mirai	botnet ddos elf iot KHserver mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a8e7c0822835b14c7627f34/reports/615efe77-9a35-40d5-a780-8d24dc037856/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-08-26T02:11:00Z UTC

Last seen:

2026-08-26T02:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f7134ec664ca003c740337cf7b2fbba1162430d86ca1d7a2b5c14fe0463d261b/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/30924f66-971e-460f-84d3-52758bed8b32

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f7134ec664ca003c740337cf7b2fbba1162430d86ca1d7a2b5c14fe0463d261b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f7134ec664ca003c740337cf7b2fbba1162430d86ca1d7a2b5c14fe0463d261b/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-08-25 14:26:06 UTC

File Type:

Text (Shell)

AV detection:

20 of 36 (55.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=64ju5rteziady5adg7hxwl53uelcimgynsq5pivvyfh6arr5eynq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260826-gcdh2sy1dw/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f7134ec664ca003c740337cf7b2fbba1162430d86ca1d7a2b5c14fe0463d261b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.