MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd25e25dbc38453f74abada88a21877d1d757afcbbf58fc315dd83a2129c8574. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	fd25e25dbc38453f74abada88a21877d1d757afcbbf58fc315dd83a2129c8574
SHA3-384 hash:	03c37e22ab298e5b2d75f1aed0bd87bba26a8ca388f433311953041a396b83e70d33d616856d03a9aa22b2a4c3cbe434
SHA1 hash:	e83515abf8c9d6c4d3dadea9b036beea7982f14d
MD5 hash:	1b285f732139c3d1c73aa93be91db7a8
humanhash:	network-minnesota-vermont-music
File name:	tot
Download:	download sample
Signature	Mirai Create hunting rule
File size:	870 bytes
First seen:	2026-11-12 00:06:06 UTC
Last seen:	2026-11-12 06:57:04 UTC
File type:	sh
MIME type:	text/plain
ssdeep	6:oO9hd3F8sRz9hd3o9Rz9hd3TTzRz9hd3vpsRz9hdnXhzRz9hdabTRz9hd9vRz9hT:oOHbHibHhpHtmHfNHspHXpHMHAHJHRth
TLSH	T1F41113DE021526D894C6EBBE3291821CB55CDBCD24FA8668F9C70A3800F80CE3036B0B
Magika	batch
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.90.163.37/jklarm	n/a	n/a	arm elf
http://45.90.163.37/jklarm5	841c7c2330c378645dc8031ae6228924269b788e578ddbe94815b1bb06872737	Mirai	arm elf mirai
http://45.90.163.37/jklarm6	e2287022dd66fd805bb6845d9dc1a63181aa587e87dac6c5358670815e124aa5	Mirai	arm elf
http://45.90.163.37/jklarm7	caac7e9d53a806f42d82c1a5d466e7ab5b1e248d04c45d4c1caadde72b1dcd18	Mirai	arm elf
http://45.90.163.37/jklm68k	3787ec84ac609e0655c675a0d9af5870252e7d4834677e9ba2e539e903c66fd0	Mirai	elf m68k
http://45.90.163.37/jklmips	4c0ab25df33fd65eb6d0cd2eb9cc39184ece05cf91b655a84882fce6746e36c9	Mirai	elf mips
http://45.90.163.37/jklmpsl	5587121f00ddbc3df2f8871e4ffccb20696592e5a8c85b653c225fb034045bb7	Mirai	elf mipsel mirai
http://45.90.163.37/jklppc	0111db892e1b719ae12ed4cd847117670164d6ab636dec6eeb5e23d5d55d7986	Mirai	elf PowerPC
http://45.90.163.37/jklsh4	ed9bd016ec38519dd07769755edd2ec5601c19694a94e089b2edd1190b6df91f	Mirai	elf SuperH
http://45.90.163.37/jklspc	3e1ab3f6f8906754ae60aa9fc71382cb565d15f9ec4068389bb499ae9da39e39	Mirai	elf sparc
http://45.90.163.37/jklx86	5d3ec5ede0ac473a4631846bafe4a8af8a23b7071e2afd2efb75fb495ca29baf	Mirai	elf x86

Intelligence

File Origin

# of uploads :

404

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c3b0f21b-1703-4cd2-8994-e4087253c6ff

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fd25e25dbc38453f74abada88a21877d1d757afcbbf58fc315dd83a2129c8574

Gathering data

Threat name:

Document-HTML.Hacktool.Heuristic

Status:

Malicious

First seen:

2026-11-08 11:34:09 UTC

File Type:

Text (Shell)

AV detection:

7 of 36 (19.44%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7us6exn4hbct65flvwuiuimhpuoxk6x4xp2y7qyv3wb2eeu4qv2a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261112-htn7jsdf52/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Malware Family:

bash

Malicious:

True

Tags:

shell

Link:

https://intel.virussign.com/intelligence/file/fd25e25dbc38453f74abada88a21877d1d757afcbbf58fc315dd83a2129c8574

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fd25e25dbc38453f74abada88a21877d1d757afcbbf58fc315dd83a2129c8574

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Downloader_Unknown_WgetChmodExecute Create hunting rule
Author:	Marjoriefort
Description:	Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:	misses_archive / grappe 5.182.210.174