MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05bb46c2da318f9fd81b6e61aa5ba9c88d236e6665fb8d834e46ea6ed66207c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	05bb46c2da318f9fd81b6e61aa5ba9c88d236e6665fb8d834e46ea6ed66207c8
SHA3-384 hash:	faa1bb799a5b51d87c42088857b50f6677d218bb588a33ac52fc3f46a0c4536c5810a03a9c0dd6501ca063d09bc3f618
SHA1 hash:	bea225db387e70ba8ffd4bdd932137a523172563
MD5 hash:	1af794c89543dfbf7c8c4c6b86d90e66
humanhash:	september-helium-early-winter
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	801 bytes
First seen:	2026-01-10 13:34:02 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:dUMxqU9UUeKlCEU9UAiKl2EU9UmdKAU9UYU9UX9qU9UGFG10qU9Uf1U9UBh7IAUe:dx7dlC5eKlQ8lSu5wQTUKUnHR
TLSH	T1B501C0EB02BA9412866CCD8C34AB48386544D6C47DB38E8CDC5C04B96DC7A1E7116F4B
Magika	html
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://158.94.208.27/bins/parm	74274cc3016ed06a7b19211372807dbf087efe4fc19643d8615e740890995c20	Mirai	elf mirai ua-wget
http://158.94.208.27/bins/parms	n/a	n/a	n/a
http://158.94.208.27/bins/parm7	3d39bbd00e38822b51e2c63dd338a5751d6c05634bd6c7293ef1177d1d3f8a14	Mirai	elf mirai ua-wget
http://158.94.208.27/bins/psh4	58d58774c2c497deb1f96eb0cadc065dc8699a04c38111d212fcc68808a85cbe	Mirai	elf mirai ua-wget
http://158.94.208.27/bins/pnpc	n/a	n/a	n/a
http://158.94.208.27/bins/pmips	f8a94465e9304bde873bd3c8cd1f939097b7312fc1c7845c8499b274e16bd869	Mirai	elf mirai ua-wget
http://158.94.208.27/bins/pmpsl	4947526318630ed5a8f64b762c62eec0e127a0aafdcba72cf860a26375906109	Mirai	elf mirai ua-wget
http://158.94.208.27/bins/pm68k	374b27b29be2d11caa68c2d48e1b9f9935ac0ae37abe50ee5073942cc65f9e23	Mirai	elf mirai ua-wget
http://158.94.208.27/bins/px86	22e5a9e790fe5bcfd184634d3d779ddea70bcb4e216ac7fe346679c15f2b610c	Mirai	elf mirai ua-wget
http://158.94.208.27/bins/px86_64	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox mirai

Link:

https://www.filescan.io/uploads/6962556207ef5fa68e83b983/reports/0e0cdfde-437a-4a34-80ec-0ad3aae62a0c/overview

Verdict:

Clean

File Type:

unix shell

Link:

https://opentip.kaspersky.com/05bb46c2da318f9fd81b6e61aa5ba9c88d236e6665fb8d834e46ea6ed66207c8/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b8c2f782-f899-48d5-982d-cfee893d9727

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/05bb46c2da318f9fd81b6e61aa5ba9c88d236e6665fb8d834e46ea6ed66207c8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/05bb46c2da318f9fd81b6e61aa5ba9c88d236e6665fb8d834e46ea6ed66207c8/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/05bb46c2da318f9fd81b6e61aa5ba9c88d236e6665fb8d834e46ea6ed66207c8

Threat name:

Document-HTML.Worm.Mirai

Status:

Malicious

First seen:

2026-01-10 13:34:30 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aw5unqw2gghz7wa3nzq2uw5jzcgsg3tgmx5y3a2oi3vg5vtca7ea._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260110-qvbxlsas9f/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/05bb46c2da318f9fd81b6e61aa5ba9c88d236e6665fb8d834e46ea6ed66207c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh