MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22ffb913cddde125d7e9e25aa5e9ec6c5bb70395ea990aed9996c96cb9de6d4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	22ffb913cddde125d7e9e25aa5e9ec6c5bb70395ea990aed9996c96cb9de6d4e
SHA3-384 hash:	0c6dfe2d18e3322b59c2171a1977d842c69a6569878885932e2d50fcd88aa49ea1891dd0c451f8cc8f73319285c12ea2
SHA1 hash:	2f649a24ef487608bfe7c8ddc81f1ff0260efdf1
MD5 hash:	5eb273ea32c028b86082407e10cc61b2
humanhash:	oklahoma-florida-video-video
File name:	l.sh.bak.1793325322
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'841 bytes
First seen:	2026-10-30 22:33:13 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:bab0ZV47ASr05BxWibuhCGRAMry6Y0kLqdo3z0ZFNJ5q5pozwhzafGsfpyOc:WGV7xHACXlrLqsMt/z6TsMOc
TLSH	T1F95189E5FC32CDB338D9C479B7DE7254FBC249AF04943A1A6086BC34A24C65C916D3A9
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	skocherhan
Tags:	77-239-124-141 mirai opendir sh

skocherhan

http://77.239.124.141/l.sh.bak.1793325322

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

76

Origin country :

GB

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.26221.22178.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6ae51b65ad82d36c33aba026/reports/9a1e3ace-f477-4f6e-9330-f3c3fbd0d926/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-30T14:47:00Z UTC

Last seen:

2026-10-31T05:51:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/22ffb913cddde125d7e9e25aa5e9ec6c5bb70395ea990aed9996c96cb9de6d4e/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/bb555038-453c-40c2-904b-4ba865be7131

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

13%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/22ffb913cddde125d7e9e25aa5e9ec6c5bb70395ea990aed9996c96cb9de6d4e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22ffb913cddde125d7e9e25aa5e9ec6c5bb70395ea990aed9996c96cb9de6d4e/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-30 22:34:17 UTC

File Type:

Text (Shell)

AV detection:

6 of 23 (26.09%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=el73se6n3xqslv7j4jnkl2pmnrn3oa4v5kmqv3mzs3ewzoo6nvha._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:mirai botnet defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/261030-2gmbzafv9s/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Changes its process name

Creates/modifies Cron job

Enumerates running processes

Modifies init.d

Modifies rc script

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Modifies Watchdog functionality

Family: Mirai

Mirai ARM payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/22ffb913cddde125d7e9e25aa5e9ec6c5bb70395ea990aed9996c96cb9de6d4e