MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcd0b3f9fc69d27bbf74d2beb747ec802bacb321d1312b188c3ac34c67fce7a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	fcd0b3f9fc69d27bbf74d2beb747ec802bacb321d1312b188c3ac34c67fce7a4
SHA3-384 hash:	931f5b1398b59d71eff9e1ab0ada5cde1d3f40c58e156623425a9901da4be7d3883054cbaac8bd7749d33eec4cef627e
SHA1 hash:	94443a0e636a3d06a9b193913d1c5784b9a65d06
MD5 hash:	37fa46d25dab4c9d884676edea103802
humanhash:	harry-eight-single-triple
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'298 bytes
First seen:	2026-06-07 19:06:40 UTC
Last seen:	2026-06-08 18:30:37 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:qMNEmRXErtAVeNIxEgnLEIKj4VJtvvxo5A9xhNpTXDU5t5JK5G5f0At5P+1C:qMNEmRXERAVVEgnLEIu4VJtvvxYA9xh6
TLSH	T14521E0CD11E1B017C5E8DE48B9A1C754E400B6D7A4FF2E0CEFC5682AD8D96487235B56
Magika	batch
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.126/bins/arm	cd8cec8d509f19176a13d5750a458c55dacdb3397d0b141380131ccb13cff8e5	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/arm5	48d574a4c9826603cb60047e4a5c2c58a63f9b260770043bcaa80556883d0020	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/arm6	2532851bbd6a3a3cb9b39e644a015b83fcc11939937e91ae061da6a5c1f3b36f	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/arm7	394d90529db4150272fd16b51b05188528caeee08754d8caef26a0f8d0d56109	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/m68k	4d9dd833ebe47101a9764f8283b7f39391012bf62252300f88628f9b3c51e77f	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/mips	3895f3b7368cb2c0657cb743506fe388bd18263c025d391b99a74052d376c04e	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/mipsel	11e34b5802e385e33a7730d60496a950376bae5bca1dc0e2d1f63d141dea826e	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/ppc	db643607eb610ecabf6867963d5c3cf994002d374bed24cd036c5293d90f04ad	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/sh4	85f81d8713fa7d55806735490f7f5dac78b29f951b74feee25f25a627a36bc5e	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/spc	86dec2a0e49a227a64ba225dba4b2483873f5958f8b857f86e91c1a5affd28c1	Mirai	176-65-139-126 elf mirai ua-wget
http://176.65.139.126/bins/x86_64	7398c35856f5b73d61895f6abe311a36efcc1e80ae20da64a0f6d36843a75291	Mirai	176-65-139-126 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

text

First seen:

2026-06-07T01:05:00Z UTC

Last seen:

2026-06-07T01:11:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fcd0b3f9fc69d27bbf74d2beb747ec802bacb321d1312b188c3ac34c67fce7a4/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/59e3bfec-67af-4024-a459-194a1b473602

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fcd0b3f9fc69d27bbf74d2beb747ec802bacb321d1312b188c3ac34c67fce7a4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fcd0b3f9fc69d27bbf74d2beb747ec802bacb321d1312b188c3ac34c67fce7a4/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/fcd0b3f9fc69d27bbf74d2beb747ec802bacb321d1312b188c3ac34c67fce7a4

Threat name:

Script-Shell.Trojan.Heuristic

Status:

Malicious

First seen:

2026-06-07 05:55:27 UTC

File Type:

Text (Shell)

AV detection:

13 of 36 (36.11%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7tilh6p4nhjhxp3u2k7lor7mqav2zmzb2eyswgemhlbuyz7446sa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260607-xsqrbaas9y/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fcd0b3f9fc69d27bbf74d2beb747ec802bacb321d1312b188c3ac34c67fce7a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh