MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1aad28b739cee9c56b143ac86a504d2c3521868b08566f8236e418609e4463d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	1aad28b739cee9c56b143ac86a504d2c3521868b08566f8236e418609e4463d0
SHA3-384 hash:	877d65ef6f524343f70811e4a008ed72bb62d7023627f44fff1d2ee2cab8eafb57d5bf4606e0947c1cfe1bc3d173757a
SHA1 hash:	580e7ac12b539f5a544ded4948e4f74a3d1215af
MD5 hash:	1c79a0ee168b9c2a467b3b71af21587e
humanhash:	whiskey-summer-oxygen-seventeen
File name:	t.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	751 bytes
First seen:	2026-01-23 19:52:29 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:xVHMVH5VHjIWKVHyeH3VH6tJVHnSXVH4VXVHB3VHFVH32VHTgOWn:CIxHQtvrVLdn
TLSH	T159019ECF61141EBB85648F28B96364A8730DC1D5F46326486A57083B8CE4B0D7564FC6
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.156.152.67/bins/4rm4	n/a	n/a	elf ua-wget
http://94.156.152.67/bins/4rm5	f7c16a1a44a9dc6b3ee1f73afffdcd425ca67e0e9c70df44544d488826ad5d8b	Mirai	mirai opendir
http://94.156.152.67/bins/4rm6	0725116cab37fe76b32f0e460f6dd085bd44618f800918722650bfcd99fbfb5a	Mirai	mirai opendir
http://94.156.152.67/bins/4rm7	269c7e600d41cd03b27026d9ea50021b37c36fbf457b44d0f1870180be7ff434	Mirai	mirai opendir
http://94.156.152.67/bins/sh4	1a5a9c16ffb10732468c63adce73c8d97117a701b17646bd6b18c868ccf3911d	Mirai	mirai opendir
http://94.156.152.67/bins/ppc	ed2400f0b058f632797e1c8d3f767473ee2bc150576f729d21990bdb67eb45d4	Mirai	mirai opendir
http://94.156.152.67/bins/m1ps	56fbe540dbc23fddc5be95941b83730ae9a7cb6e95945da3877f27bb281cb6e5	Mirai	mirai opendir
http://94.156.152.67/bins/m1ps3l	9f9f1cde25c8a1ae8e6c3386fe9b92eb41dad1f5c54145b87a5012f70f65fc95	Mirai	mirai opendir
http://94.156.152.67/bins/spc	e41e5677380874d4dc1a6cfe1de973ce81f144f6aaf70d9aa45cf32d3dff3d68	Mirai	mirai opendir
http://94.156.152.67/bins/x861	cdcec3f4fd3d942bbea8523307209f733d6c9d6914e006568a989ea48601d698	Mirai	mirai opendir
http://94.156.152.67/bins/m68k	f23f2023cb146e1f2f28301eafec0a12a0678cb0eba9da18f7622388af648060	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/6973d1b955805a763ff32f15/reports/6d290a84-8259-48c0-b3e7-ee6a98124f7a/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-01-23T17:05:00Z UTC

Last seen:

2026-01-25T06:10:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/1aad28b739cee9c56b143ac86a504d2c3521868b08566f8236e418609e4463d0/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b3a1c997-1007-4d1e-be78-481d8bde46ce

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1aad28b739cee9c56b143ac86a504d2c3521868b08566f8236e418609e4463d0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1aad28b739cee9c56b143ac86a504d2c3521868b08566f8236e418609e4463d0/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/1aad28b739cee9c56b143ac86a504d2c3521868b08566f8236e418609e4463d0

Threat name:

Document-HTML.Trojan.Heuristic

Status:

Malicious

First seen:

2026-01-23 19:54:06 UTC

File Type:

Text (Shell)

AV detection:

10 of 24 (41.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dkwsrnzzz3u4k2yuhleguucnfq2sdbulbblg7arw4qmgbhsempia._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260123-yl7xpagz3f/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1aad28b739cee9c56b143ac86a504d2c3521868b08566f8236e418609e4463d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh