MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14ae5c712bb4e4fcee19cb6d154557c98099cf8b82d194bd6778aa6ac79107bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	14ae5c712bb4e4fcee19cb6d154557c98099cf8b82d194bd6778aa6ac79107bc
SHA3-384 hash:	7ea266733071bebd3e62c088184c84cb42cc057ea98b355e7d296151363254261e3b6fd1103fdad90de769cff4b9bbf3
SHA1 hash:	c0fc7e5a878809321dc08326194e5d3660a03c5f
MD5 hash:	64734c6d28a17952df0baab7050a6cf7
humanhash:	bacon-november-coffee-delta
File name:	netis.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	678 bytes
First seen:	2026-06-04 10:52:42 UTC
Last seen:	2026-06-05 04:55:10 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:QvWXOp3dKU2hCUKAMzhKdqxOJ+YGZeBGK8BGec0LKPBGSudBGMLn:QvQhBh9M0okwYhBb8BVKPBZkBLLn
TLSH	T19E017BC8B9D1377148946D4CF1929D06D116DBCD32910758EBCA67BA7C68A10BD31F68
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://92.42.100.131/tplink/arm	5917065d40454761105511f6c63d590cf9174d02453ad2f94d228fe9c996a090	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/arm5	42dbf83c051ae621848e31e12f62a32f187637114b73f870f5de378793b17c56	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/arm7	908ca3ed1a482d3af80ea0fabaf9bcb6199ccfb7c820be4c82c6f879007c8ffd	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/mips	d4437715c226b314218b891c243b2792245fec8ffdb7248223673fc0c1082186	Mirai	elf mirai ua-wget
http://92.42.100.131/tplink/mpsl	556b7a458618f304c9de732039469781b9fc4a3515557b0aa367b4dac1d93a4b	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6a215928099ef368af1d8143/reports/4766e074-6de7-4496-90f5-5f09039fadcb/overview

Verdict:

Clean

File Type:

text

Link:

https://opentip.kaspersky.com/14ae5c712bb4e4fcee19cb6d154557c98099cf8b82d194bd6778aa6ac79107bc/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d8a0af5b-e45a-429a-9eef-112f84aeb0d7

Behavior Graph:

Download SVG

Score:

86%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/14ae5c712bb4e4fcee19cb6d154557c98099cf8b82d194bd6778aa6ac79107bc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/14ae5c712bb4e4fcee19cb6d154557c98099cf8b82d194bd6778aa6ac79107bc/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/14ae5c712bb4e4fcee19cb6d154557c98099cf8b82d194bd6778aa6ac79107bc

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-06-04 10:53:41 UTC

File Type:

Text (Shell)

AV detection:

6 of 36 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=csxfy4jlwtspz3qzznwrkrkxzgajtt4lqlizjplhpcvgvr4ra66a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260604-my9q9sdy2q/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/14ae5c712bb4e4fcee19cb6d154557c98099cf8b82d194bd6778aa6ac79107bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh