MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32995ee3a0858c8c7f5594aa1bb4d38de616d66d60b920c5ffefe9bb41fccf38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	32995ee3a0858c8c7f5594aa1bb4d38de616d66d60b920c5ffefe9bb41fccf38
SHA3-384 hash:	b325957bf723b6dc699be132eb225ec42f6243da75550ef463c5339ba81cd510c960d47d5248ba11664d18999295f7c9
SHA1 hash:	da615b44c37fb15116e20246905753f06990e720
MD5 hash:	3e51a9fa1407971b95657e6b355aed84
humanhash:	diet-uncle-lemon-arizona
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	937 bytes
First seen:	2026-09-07 03:46:49 UTC
Last seen:	2026-09-07 18:25:31 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:8Ilc0acoEcHcbDc1Ric3c65cTKgczNI75c17c/oR:8IlcBcvcHc/c1Ric3cccTLcy5c17c/0
TLSH	T1CF1170CF16D4A053C89CCD48746FC818A64487D374961F5EEC8CA8FAA9C5B1CF166F49
Magika	txt
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.206/bins/x86	43504a845226be9206b4e894da129cf1f59128ad94e54057a1befafc1a9a1849	Mirai	mirai ua-wget
http://176.65.139.206/bins/x86_64	8b927c46033c4fbfea2fb1978c75e0b46cd5b28baf3bb6df9d581a8172acd403	Mirai	mirai
http://176.65.139.206/bins/i686	4d7a22b069c067690b721c63efc9ff9dd56808c4016663706ca2e69eb0b7ef43	Mirai	176-65-139-206 elf mirai ua-wget
http://176.65.139.206/bins/sh4	0f0bdc5b704b2ae22f25918f1773f4b17ff9fe4b352028ccb14ec7ce78e32587	Mirai	mirai ua-wget
http://176.65.139.206/bins/ppc	d557d766694f5b1a99989f583bb7ddfb182685b34dded97753ade7c21a033c10	Mirai	mirai ua-wget
http://176.65.139.206/bins/mpsl	n/a	n/a	mirai ua-wget
http://176.65.139.206/bins/mips	f88e058fc4346aa5e3268e32d3ce6ffa4f944475b6455ce3c9ace70cee071159	Mirai	mirai ua-wget
http://176.65.139.206/bins/m68k	ee96e95603c056061d87638ba5cd84ae4c607f2e8e6f4fbbc8f0b67fea8dffac	Mirai	mirai ua-wget
http://176.65.139.206/bins/arm7	de7e912de2a5f9e9a47b49ccc4d151a572a71b9b80c726ecbccf75056808e9da	Mirai	mirai ua-wget
http://176.65.139.206/bins/arm6	3411f3e9c399fa3fdc6a88b5bd9d6f159e2ea45d9d932cdc882af14bc4347d36	Mirai	mirai ua-wget
http://176.65.139.206/bins/arm5	8ecf36802e901e2ee381f52908013185e091da1e5cb5bba065ce121fce055a25	Mirai	mirai ua-wget
http://176.65.139.206/bins/arm	b61799d222f582cf567b312b825d19a2095b784a2fe531bdc299d844c0f9a554	Mirai	mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox downloader mirai

Link:

https://www.filescan.io/uploads/6a9e33c1836659e7bda69253/reports/891d7974-6fe0-401b-b87e-c13450c1db15/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-09-07T01:20:00Z UTC

Last seen:

2026-09-07T03:53:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/32995ee3a0858c8c7f5594aa1bb4d38de616d66d60b920c5ffefe9bb41fccf38/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/39eebdfc-6ce7-4b99-a2af-174f43719be1

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/32995ee3a0858c8c7f5594aa1bb4d38de616d66d60b920c5ffefe9bb41fccf38

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/32995ee3a0858c8c7f5594aa1bb4d38de616d66d60b920c5ffefe9bb41fccf38/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-09-07 03:47:17 UTC

File Type:

Text (Shell)

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gkmv5y5aqwgiy72vssvbxngtrxtbnvtnmc4sbrp757u3wqp4z44a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260907-ecaq2scj4w/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/32995ee3a0858c8c7f5594aa1bb4d38de616d66d60b920c5ffefe9bb41fccf38

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh