MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d
SHA3-384 hash: b6daf03fabb2e7f0364597f47d5ddde21d1cf631122950bf5c85124afd6257d41fbc1b85c3b6d0b7b03bad219ff07b1a
SHA1 hash: 42e4650555e699c20ccf606c3b6ab3a1175b62d3
MD5 hash: e6e39bdf9506b5a27206b489c1360b2b
humanhash: march-sweet-dakota-sodium
File name:w.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:875 bytes
First seen:2026-03-14 15:45:43 UTC
Last seen:2026-03-15 14:16:23 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UzFEwZUfEELKNI5rEiZ3cKrEy6+kafaE+wVnI2edIIe2c/wWODYI7XU:S5NIcKRPkAGwVI2E/c/ZuU
TLSH T188110CCD31A8643D5D408F4170A2CE64A104F6E7589B8FC8AC4C4D71B18BAB4713AF8C
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.175.223.124/data.arm4n/an/aelf ua-wget
http://5.175.223.124/data.arm5n/an/aelf ua-wget
http://5.175.223.124/data.arm6n/an/aelf ua-wget
http://5.175.223.124/data.arm7n/an/aelf ua-wget
http://5.175.223.124/data.aarch64n/an/aelf ua-wget
http://5.175.223.124/data.mips-uclibcn/an/aelf ua-wget
http://5.175.223.124/data.mipsel-uclibc9435f5f34f606fe496c779c808b033d86c63b2a71a2b7d3c6617c43df9226762 Miraielf geofenced mips mirai ua-wget USA
http://5.175.223.124/data.powerpcn/an/aelf ua-wget
http://5.175.223.124/data.x86n/an/aelf ua-wget
http://5.175.223.124/data.x86_64n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
57
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox mirai
Link:
https://www.filescan.io/uploads/69b582c62000fc76c3dd259c/reports/3672f314-a7bc-4833-9c45-cee6bf0fb02c/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e853af89-9470-4e4b-b56b-30f153e385f1
Behavior Graph:
Download SVG
%3 guuid=af59ddf6-1600-0000-44dd-aec1730f0000 pid=3955 /usr/bin/sudo guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961 /tmp/sample.bin guuid=af59ddf6-1600-0000-44dd-aec1730f0000 pid=3955->guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961 execve guuid=0655cbf8-1600-0000-44dd-aec17b0f0000 pid=3963 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=0655cbf8-1600-0000-44dd-aec17b0f0000 pid=3963 execve guuid=ec91de04-1700-0000-44dd-aec1a20f0000 pid=4002 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=ec91de04-1700-0000-44dd-aec1a20f0000 pid=4002 execve guuid=09cb6805-1700-0000-44dd-aec1a40f0000 pid=4004 /usr/bin/dash guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=09cb6805-1700-0000-44dd-aec1a40f0000 pid=4004 clone guuid=9edb2a07-1700-0000-44dd-aec1ad0f0000 pid=4013 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=9edb2a07-1700-0000-44dd-aec1ad0f0000 pid=4013 execve guuid=63918618-1700-0000-44dd-aec1eb0f0000 pid=4075 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=63918618-1700-0000-44dd-aec1eb0f0000 pid=4075 execve guuid=fe51e018-1700-0000-44dd-aec1ec0f0000 pid=4076 /usr/bin/dash guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=fe51e018-1700-0000-44dd-aec1ec0f0000 pid=4076 clone guuid=55e29f19-1700-0000-44dd-aec1f00f0000 pid=4080 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=55e29f19-1700-0000-44dd-aec1f00f0000 pid=4080 execve guuid=93b8cb27-1700-0000-44dd-aec132100000 pid=4146 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=93b8cb27-1700-0000-44dd-aec132100000 pid=4146 execve guuid=5d802d28-1700-0000-44dd-aec135100000 pid=4149 /usr/bin/dash guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=5d802d28-1700-0000-44dd-aec135100000 pid=4149 clone guuid=98ea2129-1700-0000-44dd-aec13b100000 pid=4155 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=98ea2129-1700-0000-44dd-aec13b100000 pid=4155 execve guuid=5c37fd33-1700-0000-44dd-aec16a100000 pid=4202 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=5c37fd33-1700-0000-44dd-aec16a100000 pid=4202 execve guuid=24da3f34-1700-0000-44dd-aec16c100000 pid=4204 /usr/bin/dash guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=24da3f34-1700-0000-44dd-aec16c100000 pid=4204 clone guuid=bc3dc034-1700-0000-44dd-aec173100000 pid=4211 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=bc3dc034-1700-0000-44dd-aec173100000 pid=4211 execve guuid=d27ee68a-1800-0000-44dd-aec170140000 pid=5232 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=d27ee68a-1800-0000-44dd-aec170140000 pid=5232 execve guuid=c309ac8b-1800-0000-44dd-aec171140000 pid=5233 /usr/bin/dash guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=c309ac8b-1800-0000-44dd-aec171140000 pid=5233 clone guuid=7a425b8d-1800-0000-44dd-aec173140000 pid=5235 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=7a425b8d-1800-0000-44dd-aec173140000 pid=5235 execve guuid=f864c59d-1800-0000-44dd-aec17c140000 pid=5244 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=f864c59d-1800-0000-44dd-aec17c140000 pid=5244 execve guuid=c30d059e-1800-0000-44dd-aec17d140000 pid=5245 /usr/bin/dash guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=c30d059e-1800-0000-44dd-aec17d140000 pid=5245 clone guuid=0d8f849e-1800-0000-44dd-aec17f140000 pid=5247 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=0d8f849e-1800-0000-44dd-aec17f140000 pid=5247 execve guuid=a0e15cb9-1800-0000-44dd-aec180140000 pid=5248 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=a0e15cb9-1800-0000-44dd-aec180140000 pid=5248 execve guuid=2cbda9b9-1800-0000-44dd-aec181140000 pid=5249 /usr/bin/dash guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=2cbda9b9-1800-0000-44dd-aec181140000 pid=5249 clone guuid=b5f400bb-1800-0000-44dd-aec183140000 pid=5251 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=b5f400bb-1800-0000-44dd-aec183140000 pid=5251 execve guuid=3c1410c6-1800-0000-44dd-aec184140000 pid=5252 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=3c1410c6-1800-0000-44dd-aec184140000 pid=5252 execve guuid=8c4942c7-1800-0000-44dd-aec185140000 pid=5253 /usr/bin/dash guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=8c4942c7-1800-0000-44dd-aec185140000 pid=5253 clone guuid=64aa29c8-1800-0000-44dd-aec187140000 pid=5255 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=64aa29c8-1800-0000-44dd-aec187140000 pid=5255 execve guuid=e486d0d8-1800-0000-44dd-aec188140000 pid=5256 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=e486d0d8-1800-0000-44dd-aec188140000 pid=5256 execve guuid=a30b97d9-1800-0000-44dd-aec189140000 pid=5257 /home/sandbox/data.x86 net guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=a30b97d9-1800-0000-44dd-aec189140000 pid=5257 execve guuid=c0e6e8d9-1800-0000-44dd-aec18b140000 pid=5259 /usr/bin/busybox net send-data write-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=c0e6e8d9-1800-0000-44dd-aec18b140000 pid=5259 execve guuid=87452cf6-1800-0000-44dd-aec197140000 pid=5271 /usr/bin/chmod guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=87452cf6-1800-0000-44dd-aec197140000 pid=5271 execve guuid=c43b75f6-1800-0000-44dd-aec198140000 pid=5272 /home/sandbox/data.x86_64 net guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=c43b75f6-1800-0000-44dd-aec198140000 pid=5272 execve guuid=1671a9f6-1800-0000-44dd-aec19b140000 pid=5275 /usr/bin/rm delete-file guuid=05739df8-1600-0000-44dd-aec1790f0000 pid=3961->guuid=1671a9f6-1800-0000-44dd-aec19b140000 pid=5275 execve 5668ce23-1c09-5b92-b500-f59a8ec6b05f 5.175.223.124:80 guuid=0655cbf8-1600-0000-44dd-aec17b0f0000 pid=3963->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 85B guuid=9edb2a07-1700-0000-44dd-aec1ad0f0000 pid=4013->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 85B guuid=55e29f19-1700-0000-44dd-aec1f00f0000 pid=4080->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 85B guuid=98ea2129-1700-0000-44dd-aec13b100000 pid=4155->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 85B guuid=bc3dc034-1700-0000-44dd-aec173100000 pid=4211->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 88B guuid=7a425b8d-1800-0000-44dd-aec173140000 pid=5235->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 92B guuid=0d8f849e-1800-0000-44dd-aec17f140000 pid=5247->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 94B guuid=b5f400bb-1800-0000-44dd-aec183140000 pid=5251->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 88B guuid=64aa29c8-1800-0000-44dd-aec187140000 pid=5255->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 84B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=a30b97d9-1800-0000-44dd-aec189140000 pid=5257->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8369ddd9-1800-0000-44dd-aec18a140000 pid=5258 /home/sandbox/data.x86 guuid=a30b97d9-1800-0000-44dd-aec189140000 pid=5257->guuid=8369ddd9-1800-0000-44dd-aec18a140000 pid=5258 clone guuid=70c2ebd9-1800-0000-44dd-aec18c140000 pid=5260 /home/sandbox/data.x86 write-file zombie guuid=8369ddd9-1800-0000-44dd-aec18a140000 pid=5258->guuid=70c2ebd9-1800-0000-44dd-aec18c140000 pid=5260 clone guuid=c0e6e8d9-1800-0000-44dd-aec18b140000 pid=5259->5668ce23-1c09-5b92-b500-f59a8ec6b05f send: 87B guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5261 /home/sandbox/data.x86 net send-data zombie guuid=70c2ebd9-1800-0000-44dd-aec18c140000 pid=5260->guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5261 clone guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5261->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 35B 79330709-4ba7-5769-b683-21ef3c41191a 45.131.65.74:8082 guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5261->79330709-4ba7-5769-b683-21ef3c41191a send: 9B guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5262 /home/sandbox/data.x86 send-data zombie guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5261->guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5262 clone guuid=1caf1adb-1800-0000-44dd-aec18f140000 pid=5263 /home/sandbox/data.x86 net send-data write-file guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5261->guuid=1caf1adb-1800-0000-44dd-aec18f140000 pid=5263 clone guuid=4fd6f4db-1800-0000-44dd-aec190140000 pid=5264 /usr/bin/dash guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5261->guuid=4fd6f4db-1800-0000-44dd-aec190140000 pid=5264 execve guuid=4ed649eb-1800-0000-44dd-aec195140000 pid=5269 /usr/bin/dash guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5261->guuid=4ed649eb-1800-0000-44dd-aec195140000 pid=5269 execve 5a1eed8a-85fe-5cc9-b13b-21dc70289ae4 0.0.0.0:0 guuid=5c69ffda-1800-0000-44dd-aec18d140000 pid=5262->5a1eed8a-85fe-5cc9-b13b-21dc70289ae4 send: 96B a15c7036-706e-5ee9-888f-734cbb9e72e7 127.0.0.1:30565 guuid=1caf1adb-1800-0000-44dd-aec18f140000 pid=5263->a15c7036-706e-5ee9-888f-734cbb9e72e7 send: 96B guuid=bd2f6cdc-1800-0000-44dd-aec191140000 pid=5265 /usr/sbin/xtables-nft-multi guuid=4fd6f4db-1800-0000-44dd-aec190140000 pid=5264->guuid=bd2f6cdc-1800-0000-44dd-aec191140000 pid=5265 execve guuid=a4c381eb-1800-0000-44dd-aec196140000 pid=5270 /usr/sbin/xtables-nft-multi guuid=4ed649eb-1800-0000-44dd-aec195140000 pid=5269->guuid=a4c381eb-1800-0000-44dd-aec196140000 pid=5270 execve guuid=c43b75f6-1800-0000-44dd-aec198140000 pid=5272->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=74979df6-1800-0000-44dd-aec199140000 pid=5273 /home/sandbox/data.x86_64 zombie guuid=c43b75f6-1800-0000-44dd-aec198140000 pid=5272->guuid=74979df6-1800-0000-44dd-aec199140000 pid=5273 clone guuid=f050a8f6-1800-0000-44dd-aec19a140000 pid=5274 /home/sandbox/data.x86_64 write-file zombie guuid=74979df6-1800-0000-44dd-aec199140000 pid=5273->guuid=f050a8f6-1800-0000-44dd-aec19a140000 pid=5274 clone guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5276 /home/sandbox/data.x86_64 net send-data zombie guuid=f050a8f6-1800-0000-44dd-aec19a140000 pid=5274->guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5276 clone guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5276->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 35B guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5276->79330709-4ba7-5769-b683-21ef3c41191a send: 14B guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5277 /home/sandbox/data.x86_64 guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5276->guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5277 clone guuid=a6fb3ef7-1800-0000-44dd-aec19e140000 pid=5278 /home/sandbox/data.x86_64 net send-data write-file guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5276->guuid=a6fb3ef7-1800-0000-44dd-aec19e140000 pid=5278 clone guuid=57ced6f7-1800-0000-44dd-aec19f140000 pid=5279 /usr/bin/dash guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5276->guuid=57ced6f7-1800-0000-44dd-aec19f140000 pid=5279 execve guuid=703e09f9-1800-0000-44dd-aec1a1140000 pid=5281 /usr/bin/dash guuid=577237f7-1800-0000-44dd-aec19c140000 pid=5276->guuid=703e09f9-1800-0000-44dd-aec1a1140000 pid=5281 execve guuid=a6fb3ef7-1800-0000-44dd-aec19e140000 pid=5278->a15c7036-706e-5ee9-888f-734cbb9e72e7 send: 297B guuid=8cf471f8-1800-0000-44dd-aec1a0140000 pid=5280 /usr/sbin/xtables-nft-multi guuid=57ced6f7-1800-0000-44dd-aec19f140000 pid=5279->guuid=8cf471f8-1800-0000-44dd-aec1a0140000 pid=5280 execve guuid=f6072ef9-1800-0000-44dd-aec1a2140000 pid=5282 /usr/sbin/xtables-nft-multi guuid=703e09f9-1800-0000-44dd-aec1a1140000 pid=5281->guuid=f6072ef9-1800-0000-44dd-aec1a2140000 pid=5282 execve
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d
Threat name:
Linux.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-14 10:17:22 UTC
File Type:
Text (Shell)
AV detection:
15 of 37 (40.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dcbn6oljta4dme72efef5mkg722zxy2dbtcxuexavvnod7snqugq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access defense_evasion discovery linux
Link:
https://tria.ge/reports/260314-s7p14shw7j/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Reads system network configuration
Reads process memory
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 1882df396998383613fa21485eb146feb59be3430cc57a12e0ad5ae1fe4d850d

(this sample)

Mirai

elf 9435f5f34f606fe496c779c808b033d86c63b2a71a2b7d3c6617c43df9226762

  
URLhaus
https://urlhaus.abuse.ch/url/3795926/
  
Delivery method
Distributed via web download
  
Dropping
MD5 51a1dc3962d2cc9c284733197e59f5e3
  
Dropping
SHA256 9435f5f34f606fe496c779c808b033d86c63b2a71a2b7d3c6617c43df9226762

Comments