🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29b9e559fcfd59c54f49b366b8ae6982bf8262a5ab3401e31da72f6a3e826808. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29b9e559fcfd59c54f49b366b8ae6982bf8262a5ab3401e31da72f6a3e826808
SHA3-384 hash: 02ff71a4ce5a9d7e067ede179d62f3d1417f09cea2963ed1358a2c446f7aa9ee22e06b412c99b8ec14c242b1d9d0a08f
SHA1 hash: b56b1b0d0357f470df6b2ed06e923d93fd103a69
MD5 hash: b89f6731e3d489da5444481bc07e89f0
humanhash: pluto-cup-may-cat
File name:mbupload-zcrnhvow.bin
Download: download sample
Signature Mirai
Create hunting rule
File size:5'106 bytes
First seen:2026-10-17 16:51:15 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 96:HWQm/65Wza4/GlJI995EV/5+w7x5iRY7DSoz2Ju:H0hxc5+mLiRYvSfu
TLSH T1E8B1CFF4FC74867279CC5A3AE248682A2DC32C7F2A763B14302FFC643B5D049951A236
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter wristhulk
Tags:cowrie Downloader honeypot mirai sh


Avatar
wristhulk
Captured by a Cowrie honeypot at 2026-10-17 16:50:57 UTC, downloaded from http://176.65.139.196/bins/kla.sh by 108.59.244.5.

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
busybox masquerade
Link:
https://www.filescan.io/uploads/6ad3a7864244762a80bfd6a7/reports/8e7d1aa8-c2c3-464e-952b-39b4e60233ed/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3953dfb1-14d2-4773-8194-564a1874b001
Behavior Graph:
Download SVG
%3 guuid=602582e1-1800-0000-7e1e-82ba700d0000 pid=3440 /usr/bin/sudo guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446 /tmp/sample.bin guuid=602582e1-1800-0000-7e1e-82ba700d0000 pid=3440->guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446 execve guuid=bf10f7e3-1800-0000-7e1e-82ba770d0000 pid=3447 /usr/bin/cp guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=bf10f7e3-1800-0000-7e1e-82ba770d0000 pid=3447 execve guuid=1385aeea-1800-0000-7e1e-82ba8b0d0000 pid=3467 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=1385aeea-1800-0000-7e1e-82ba8b0d0000 pid=3467 execve guuid=166800ec-1800-0000-7e1e-82ba900d0000 pid=3472 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=166800ec-1800-0000-7e1e-82ba900d0000 pid=3472 execve guuid=4801b6ec-1800-0000-7e1e-82ba930d0000 pid=3475 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=4801b6ec-1800-0000-7e1e-82ba930d0000 pid=3475 execve guuid=6659c7ed-1800-0000-7e1e-82ba970d0000 pid=3479 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=6659c7ed-1800-0000-7e1e-82ba970d0000 pid=3479 execve guuid=0f7c6bee-1800-0000-7e1e-82ba9a0d0000 pid=3482 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=0f7c6bee-1800-0000-7e1e-82ba9a0d0000 pid=3482 execve guuid=d9f413ef-1800-0000-7e1e-82ba9e0d0000 pid=3486 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=d9f413ef-1800-0000-7e1e-82ba9e0d0000 pid=3486 execve guuid=f5f46ef0-1800-0000-7e1e-82baa10d0000 pid=3489 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=f5f46ef0-1800-0000-7e1e-82baa10d0000 pid=3489 execve guuid=b24f39f1-1800-0000-7e1e-82baa30d0000 pid=3491 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=b24f39f1-1800-0000-7e1e-82baa30d0000 pid=3491 execve guuid=fbfce3f1-1800-0000-7e1e-82baa70d0000 pid=3495 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=fbfce3f1-1800-0000-7e1e-82baa70d0000 pid=3495 execve guuid=09338ff2-1800-0000-7e1e-82baaa0d0000 pid=3498 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=09338ff2-1800-0000-7e1e-82baaa0d0000 pid=3498 execve guuid=ac382df3-1800-0000-7e1e-82baad0d0000 pid=3501 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=ac382df3-1800-0000-7e1e-82baad0d0000 pid=3501 execve guuid=6992c9f3-1800-0000-7e1e-82bab00d0000 pid=3504 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=6992c9f3-1800-0000-7e1e-82bab00d0000 pid=3504 execve guuid=fc6f78f4-1800-0000-7e1e-82bab40d0000 pid=3508 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=fc6f78f4-1800-0000-7e1e-82bab40d0000 pid=3508 execve guuid=73482ef5-1800-0000-7e1e-82bab50d0000 pid=3509 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=73482ef5-1800-0000-7e1e-82bab50d0000 pid=3509 execve guuid=04a7d9f5-1800-0000-7e1e-82bab90d0000 pid=3513 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=04a7d9f5-1800-0000-7e1e-82bab90d0000 pid=3513 execve guuid=d82e78f6-1800-0000-7e1e-82babd0d0000 pid=3517 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=d82e78f6-1800-0000-7e1e-82babd0d0000 pid=3517 execve guuid=72dd12f7-1800-0000-7e1e-82bac10d0000 pid=3521 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=72dd12f7-1800-0000-7e1e-82bac10d0000 pid=3521 execve guuid=79b0caf7-1800-0000-7e1e-82bac50d0000 pid=3525 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=79b0caf7-1800-0000-7e1e-82bac50d0000 pid=3525 execve guuid=758768f8-1800-0000-7e1e-82bac80d0000 pid=3528 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=758768f8-1800-0000-7e1e-82bac80d0000 pid=3528 execve guuid=a4f007f9-1800-0000-7e1e-82bacc0d0000 pid=3532 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=a4f007f9-1800-0000-7e1e-82bacc0d0000 pid=3532 execve guuid=da68a0f9-1800-0000-7e1e-82bad00d0000 pid=3536 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=da68a0f9-1800-0000-7e1e-82bad00d0000 pid=3536 execve guuid=26b978fa-1800-0000-7e1e-82bad10d0000 pid=3537 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=26b978fa-1800-0000-7e1e-82bad10d0000 pid=3537 execve guuid=8de869fb-1800-0000-7e1e-82bad20d0000 pid=3538 /usr/bin/killall guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=8de869fb-1800-0000-7e1e-82bad20d0000 pid=3538 execve guuid=467721fc-1800-0000-7e1e-82bad60d0000 pid=3542 /usr/bin/dash guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=467721fc-1800-0000-7e1e-82bad60d0000 pid=3542 clone guuid=0fd0a1fc-1800-0000-7e1e-82badc0d0000 pid=3548 /usr/bin/rm guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=0fd0a1fc-1800-0000-7e1e-82badc0d0000 pid=3548 execve guuid=4ad0d7fc-1800-0000-7e1e-82badd0d0000 pid=3549 /usr/bin/dash guuid=cd7492e3-1800-0000-7e1e-82ba760d0000 pid=3446->guuid=4ad0d7fc-1800-0000-7e1e-82badd0d0000 pid=3549 clone guuid=0a0a29fc-1800-0000-7e1e-82bad70d0000 pid=3543 /usr/bin/uname guuid=467721fc-1800-0000-7e1e-82bad60d0000 pid=3542->guuid=0a0a29fc-1800-0000-7e1e-82bad70d0000 pid=3543 execve guuid=01b62cfc-1800-0000-7e1e-82bad80d0000 pid=3544 /usr/bin/tr guuid=467721fc-1800-0000-7e1e-82bad60d0000 pid=3542->guuid=01b62cfc-1800-0000-7e1e-82bad80d0000 pid=3544 execve guuid=06dfddfc-1800-0000-7e1e-82bade0d0000 pid=3550 /usr/bin/wget dns net send-data guuid=4ad0d7fc-1800-0000-7e1e-82badd0d0000 pid=3549->guuid=06dfddfc-1800-0000-7e1e-82bade0d0000 pid=3550 execve guuid=b7a0060e-1900-0000-7e1e-82baf30d0000 pid=3571 /usr/bin/curl guuid=4ad0d7fc-1800-0000-7e1e-82badd0d0000 pid=3549->guuid=b7a0060e-1900-0000-7e1e-82baf30d0000 pid=3571 execve 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=06dfddfc-1800-0000-7e1e-82bade0d0000 pid=3550->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 58B fa0ce5f8-017e-5167-aa16-707aaedc5e2c minefox.lol:80 guuid=06dfddfc-1800-0000-7e1e-82bade0d0000 pid=3550->fa0ce5f8-017e-5167-aa16-707aaedc5e2c con
Score:
23%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/29b9e559fcfd59c54f49b366b8ae6982bf8262a5ab3401e31da72f6a3e826808
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29b9e559fcfd59c54f49b366b8ae6982bf8262a5ab3401e31da72f6a3e826808/
Threat name:
Script.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-10-15 13:51:31 UTC
File Type:
Text (Shell)
AV detection:
5 of 36 (13.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fg46kwp47vm4kt2jwntlrltjqk7yeyvfvm2adyy5u4xwupucnaea._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery linux
Link:
https://tria.ge/reports/261017-vcyqwats5m/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Enumerates running processes
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/29b9e559fcfd59c54f49b366b8ae6982bf8262a5ab3401e31da72f6a3e826808

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NSVPS_Mirai_Busybox_Staging
Create hunting rule
Author:sanad (NSVPS-SOC)
Description:Mirai-style busybox wget/tftp payload staging seen in NSVPS honeypot

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 29b9e559fcfd59c54f49b366b8ae6982bf8262a5ab3401e31da72f6a3e826808

(this sample)

  
Delivery method
Distributed via web download

Comments