MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09c9ee2bdfc0191610aa9ebf5077582e9feca4c368c817f5afb3f84e6574d5d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	09c9ee2bdfc0191610aa9ebf5077582e9feca4c368c817f5afb3f84e6574d5d1
SHA3-384 hash:	a35107cdb5681a3e546600d2d99951376dae7bc7bcb7d17e56e02587ea925c106c775b67e614dc60fb72f2cf4d1c7d7f
SHA1 hash:	aacbf833cdeaf7e0b905c62e643b320f1cdb64f8
MD5 hash:	66b8723c0723ed90f46cab4a3ebc3876
humanhash:	beryllium-skylark-green-salami
File name:	womp
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'072 bytes
First seen:	2026-06-21 08:01:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:Jp8pNI3K3pP2RpKs6p8FNImKuAyRpKW9Wp8Cy0NIakKiS7NXUMuUsRpKPIcdU:FFRpKsoyRpKE4sRpKHU
TLSH	T1065123C830EF25756C017D97B11249D4F506F1EB68969F85FC44CEB0C9D6AB6302C798
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.175.223.249/data_arm4	ec32ee9f654e4817249df530db663c775b81e11868c7c087888eb49f5e7485dc	Mirai	elf mirai ua-wget
http://5.175.223.249/data_arm5	0d7e6368812054f582aeebc64894770bc09353f074fb26a0281cf79e395f4963	Mirai	elf mirai ua-wget
http://5.175.223.249/data_arm6	80826c175e9ba582279f1f5b14e4aff7540aea8c8d125ae029dffdeb1235de08	Mirai	elf mirai ua-wget
http://5.175.223.249/data_arm7	9ba2316d355bef23251b64d0f39abd38b25685f5d7db78b3b4be73d1eda5dbe4	Mirai	elf mirai ua-wget
http://5.175.223.249/data_aarch64	5fb8f703c58eb7a26db0565a95dd120eec4ef55c3380fba1dd267b302f921c3c	Mirai	elf mirai ua-wget
http://5.175.223.249/data_mips	6d95be925f16dbe7cdd83de323b9a22659c2754718642c34947d15034f704b62	Mirai	elf mirai ua-wget
http://5.175.223.249/data_mipsel	7cc6bffe4402d553bb262c06a6e531a50962c756b667740dffc1f6595a57d45d	Mirai	elf mirai ua-wget
http://5.175.223.249/data_mips-uclibc	599fea2f9d0ca4a75c5826d8df45d7deab9d9f03d8f4928166ffefddce58218d	Mirai	elf mirai ua-wget
http://5.175.223.249/data_mipsel-uclibc	af46ef9ec0e2095be44fa101c3109cc7a98aa82977dc4fabf5ee37bdabea0dd1	Mirai	elf mirai ua-wget
http://5.175.223.249/data_powerpc	7cb98e74bd2710be1e515ea8d1a54f7608c4d026230076faef5e779407544b47	Mirai	elf mirai ua-wget
http://5.175.223.249/data_x86	ea47c0cf85318989bcb625474229bd9b5ab0263f8a79eb6231b44c3a0ca6bf25	Mirai	elf mirai ua-wget
http://5.175.223.249/data_x86_64	758bfd53af3403244492a07a78388568547092bd62207b48f8f438a3afa9cb3b	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a379a9d9799578a6c4374a8/reports/54e1a639-beed-4ba8-8ade-4523331d0884/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-21T05:08:00Z UTC

Last seen:

2026-06-22T23:48:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/09c9ee2bdfc0191610aa9ebf5077582e9feca4c368c817f5afb3f84e6574d5d1/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4580081c-a588-438a-b8aa-cdab4dbce580

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/09c9ee2bdfc0191610aa9ebf5077582e9feca4c368c817f5afb3f84e6574d5d1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/09c9ee2bdfc0191610aa9ebf5077582e9feca4c368c817f5afb3f84e6574d5d1/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/09c9ee2bdfc0191610aa9ebf5077582e9feca4c368c817f5afb3f84e6574d5d1

Threat name:

Script-Shell.Trojan.Vigorf

Status:

Malicious

First seen:

2026-06-21 08:03:01 UTC

File Type:

Text (Shell)

AV detection:

11 of 23 (47.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bhe64k67yamrmefkt27va52yf2p6zjgdndebp5npwp4e4zlu2xiq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/260621-jxe9gscs2p/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/09c9ee2bdfc0191610aa9ebf5077582e9feca4c368c817f5afb3f84e6574d5d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh