MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1338657109a743ffc7fd9ea023c161a7dfd55b44a987c102019a5e3fea6b9e46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	1338657109a743ffc7fd9ea023c161a7dfd55b44a987c102019a5e3fea6b9e46
SHA3-384 hash:	67c500f9bc6d70eed56294ae3432d64a0386b5da073d284f08bcdf07fc8d12013e183d7954cbf76559c7819703410d30
SHA1 hash:	d8b9b9fc2eaabf11aa2a56425fbde344ea048356
MD5 hash:	76d123ab88ae42afc32b5310c226e784
humanhash:	crazy-cardinal-wisconsin-oklahoma
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'870 bytes
First seen:	2026-07-29 11:17:53 UTC
Last seen:	2026-07-30 09:59:08 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:w6QFQdNIdQBKEQIvQjQbAQJQXlQ4Q9gQPHR:90/WBx2qAa2l39wx
TLSH	T129314EC62B875AE93F2C6E127949CB1C63494DDDA8017BC8A5CFC8B06EC0AD6BD05A15
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm	c7efbd6038b27b51b39b30fcddfb91bbab0418997b9d05f639d0e053f23fb621	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5	608c40e5ff9b0dd4d601d0a81751e1dc5cfa0f28dc526c1cb53d5d0898579199	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6	d58dfeb75e2341d975e48d9553767909c176df178844215bc2bdf1660f5d3969	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7	0e50f54b54e3e179fb5530db13375a7a6bc297438511d374c680f32834934aa3	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k	a5e14c19f1f736aa74a7fea4cf60dfbc22761b71cb24b64bbd77c0bf3fb1d0c1	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips	fb5c18b832e23448d78e7b2542579d1c79362636ab96b5299052614166d4e3fa	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl	197c435bd667bc44ae26a92898c34c36f8a093228409fdf5340fcae9ccabd642	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc	8b411ac80e787590b787d87f1e96814eff9c27a0284ef76f0d95ad9367171be7	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4	2d98b44c0532415ce47394f90b47da593c0619b21b486dbb80727d05498eafbb	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc	faf3988b8f6dc690efb46aae98efcbe47e489958759e0dc60cb697019fe69e81	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86	dc26c4aa0b5dd2cb74609168a68c818be6b9c3821fa56a5a9f659a5ff319a628	Mirai	mirai sh wget
http://94.154.43.148/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64	142b78add17ae70fd5e5d3d5d3d66bec9fd2ac2ea1b4a11ef2e95538de829446	Mirai	mirai sh wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

busybox downloader mirai

Link:

https://www.filescan.io/uploads/6a69e192b87dfae415c6764c/reports/bd5ce0a4-7883-4f22-8f4b-d2a7899f41fc/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-07-29T10:00:00Z UTC

Last seen:

2026-07-29T10:15:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1338657109a743ffc7fd9ea023c161a7dfd55b44a987c102019a5e3fea6b9e46/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d7268637-5973-4f96-97a7-a995e4c36630

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1338657109a743ffc7fd9ea023c161a7dfd55b44a987c102019a5e3fea6b9e46

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1338657109a743ffc7fd9ea023c161a7dfd55b44a987c102019a5e3fea6b9e46/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-07-29 11:18:48 UTC

File Type:

Text

AV detection:

12 of 24 (50.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cm4gk4iju5b77r75t2qchqlbu7p5kw2evgd4caqbtjpd72tltzda._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260729-nemcasvtcy/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1338657109a743ffc7fd9ea023c161a7dfd55b44a987c102019a5e3fea6b9e46

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh