MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 121977ee65404b3fa16e3a218fa4c5d5f07779a0ce0a72b051effed747b05a6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	121977ee65404b3fa16e3a218fa4c5d5f07779a0ce0a72b051effed747b05a6f
SHA3-384 hash:	e1bee6a4c166669b8bbda01b6aad977d008b18ae4eadbe89d8e504cacee2664bcbb579cb1fec2215f977e071aab59d97
SHA1 hash:	fa988a5d0f1f4f2f95ca4712ef9f7076f1f53390
MD5 hash:	67b1e0670d799211df5831ed5da72475
humanhash:	seventeen-violet-hamper-golf
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	813 bytes
First seen:	2026-04-07 03:48:52 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:eEeE9UvNIxE/MEIKndiGk8FADZIMUO7sW7Oln:eEeE9fE0EIWdlkN9IDOgWil
TLSH	T13D011BCF11A13F71D20C8FECB66144505856E9F2F56336CAA94F047A4ED8748B718EDA
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.156.152.233/bins/narm	d72769153376557c9fef0be797771a3dbf2b748e229459ea42eb42f24a4ba1fc	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/narm5	20f0d750693f4bd1ec3e0479f4a6d7b5fbb087ccc852881fb356d6a247eb1b70	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/narm6	010e9519a33344bc8d60513baa0f8751f1846a7f1cb69712f10c25cc66ebff95	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/narm7	fb23d25776eba426752a7733dc5828d1c149696b0a7926cb579239efadd55bbf	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/nm68k	644a2f95c8b2df0374b694ea3577822b51b6031ebb86a9a82c4501211ef42b9a	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/nmips	22698b276f1330cc5bba78d3f16381a1ecc6b200a92b936ae63fe714439f31a5	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/nmpsl	e65d632f973d01bc21af09c7c4a6fa549d2de676a01c63c2ea7c97b3eaf115af	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/nppc	ddbf3d2f7f177fdc92852e146d43dfcab6dac117c27378cdd91d4be3a222bfa9	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/nsh4	23e4e5a25b2ea7c3a014f6334581cfe8e996d6eb4447653a187aba94846daa03	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/nspc	n/a	n/a	elf ua-wget
http://94.156.152.233/bins/nx86	2bbb387226de2faa8f60eaa2988e6a9a05c6d41b191ef0f24f029b184f260677	Mirai	elf mirai ua-wget
http://94.156.152.233/bins/nx86_64	9d36aecf683aea4077b365d5136374eb3a58b79e208f86a8a5885d7534b33ea6	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-07T01:01:00Z UTC

Last seen:

2026-04-07T02:44:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/121977ee65404b3fa16e3a218fa4c5d5f07779a0ce0a72b051effed747b05a6f/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/46ac874b-d7a8-45b0-8832-0404c91c583b

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/121977ee65404b3fa16e3a218fa4c5d5f07779a0ce0a72b051effed747b05a6f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/121977ee65404b3fa16e3a218fa4c5d5f07779a0ce0a72b051effed747b05a6f/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/121977ee65404b3fa16e3a218fa4c5d5f07779a0ce0a72b051effed747b05a6f

Threat name:

Document-HTML.Trojan.Vigorf

Status:

Malicious

First seen:

2026-04-07 03:49:36 UTC

File Type:

Text (Shell)

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cimxp3tfibft7ilohiqy7jgf2xyho6nazyfhfmcr577nor5qljxq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260407-edhs2sfz7m/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/121977ee65404b3fa16e3a218fa4c5d5f07779a0ce0a72b051effed747b05a6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh