MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe98fedbcff5972438347ac96dcc0e024447c61e25bbd2549aabd86c4d760bc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	fe98fedbcff5972438347ac96dcc0e024447c61e25bbd2549aabd86c4d760bc6
SHA3-384 hash:	a9c4b30a4997f9133d841e8eb8e85b7f3e5c026e89e2fb8891bbbb16192c3f1460d10fd182ec536bb67cee4d1e4a4aec
SHA1 hash:	dfee15b480c65c74158771e0e1ae05eec3a064d8
MD5 hash:	066d6cae80ec97c9c1ca5aa4b967a4e6
humanhash:	skylark-batman-seventeen-kitten
File name:	nz.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'729 bytes
First seen:	2026-07-31 13:51:26 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ItGPtsGd6dIhOEG1Y3GY/AGKDPsG2sGzTRzTGF7JGCoCGAGmKLGJRJNINksGwara:inDEx3UaWYTdTGFlv8LnJWrmVTBVXF
TLSH	T16851F6D6100143352E92DD23FABA4C2830AA659A60DBDF1965DAB8F44CCCD0D3D68ECB
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.56.209.153/nz/nz.x86	1741729211a767777d024691477bc83333d59e0f9f222571600487bdd4f9b011	Mirai	elf mirai opendir ua-wget x86
http://31.56.209.153/nz/nz.mips	7d56228e11bcf1feafa30c07418322cbd223b2d95b8092fc34e7e3a346f19361	Mirai	elf mips mirai opendir ua-wget
http://31.56.209.153/nz/nz.arc	8a4636e894d4d7a9ac0880a1210d70e0cf2c05e14924bcfbf39cffcef27c1e41	Mirai	arc elf mirai opendir ua-wget
http://31.56.209.153/nz/nz.i468	n/a	n/a	elf ua-wget
http://31.56.209.153/nz/nz.i686	5602e10a96a21fecb33b7e97615c5c02e6ed62f7107689892a51ea4300fc102b	Mirai	elf mirai opendir ua-wget x86
http://31.56.209.153/nz/nz.x86_64	b277ac8ece6cb1a417fbad35fac655fc28036b7529bfbaa34bc36b293388a67c	Mirai	elf mirai opendir ua-wget x86
http://31.56.209.153/nz/nz.mpsl	c2bd860e1f7b4a612d4dde28ab5e92f9f6120b5f8451f44cf186410061273579	Mirai	elf mips mirai opendir ua-wget
http://31.56.209.153/nz/nz.arm	b9fa1dc749428b51ef1855db00fdcff798c4ec865f1ed823b6f5e0eed49363c7	Mirai	arm elf mirai opendir ua-wget
http://31.56.209.153/nz/nz.arm5	a8ff9266caf4a5c7871f67e6dd1efdec84998ebc5a18970273350407b7a02dbf	Mirai	arm elf mirai opendir ua-wget
http://31.56.209.153/nz/nz.arm6	68e383c37e939f4867cfe9a68ef58b636c0f722ca6e5aeb0ff6e46f3b5c0fcd6	Mirai	arm elf mirai opendir ua-wget
http://31.56.209.153/nz/nz.arm7	ecd6239cfb44faf5588d7d520f25d8f52c3f8e531bd3aa02af757a5463beee5c	Mirai	arm elf mirai opendir ua-wget
http://31.56.209.153/nz/nz.ppc	25dfee5653da397003abc1261c970e69545a73867bd6028772160ee09e30d1b2	Mirai	elf mirai opendir PowerPC ua-wget
http://31.56.209.153/nz/nz.spc	0a75f316cdc7e7cd61881368081f801ee7b63a98174de6cea80f9da85cddc945	Mirai	elf mirai opendir sparc ua-wget
http://31.56.209.153/nz/nz.m68k	fc9bd6c223ac22eb42514c55fc138e534d03c24ea41baa598cea4dc54a24e541	Mirai	elf m68k mirai opendir ua-wget
http://31.56.209.153/nz/nz.sh4	4d91f77e3e4a056b4c2f494ac6bade22d6ed083f757a75735698c2a08a5c37fe	Mirai	elf mirai opendir SuperH ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/6a6ca8a33b0f7b4b76ff474c/reports/8850acd1-d746-42bb-83f1-04dbdeb9e64d/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6759524f-1e2a-49d4-abb6-981ea948123a

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fe98fedbcff5972438347ac96dcc0e024447c61e25bbd2549aabd86c4d760bc6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fe98fedbcff5972438347ac96dcc0e024447c61e25bbd2549aabd86c4d760bc6/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-07-31 13:52:39 UTC

File Type:

Text (Shell)

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=72mp5w6p6wlsiobuplew3taoajceprq6ew55eve2vpmgytlwbpda._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260731-q6nesavxh1/

Behaviour

Reads runtime system information

Writes file to tmp directory

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fe98fedbcff5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh