MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e395e3055bec188bd0d904eace0862d2cd01eb810703a25e254e2de344fbc4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	3e395e3055bec188bd0d904eace0862d2cd01eb810703a25e254e2de344fbc4e
SHA3-384 hash:	866c57a2cb36f2ff16826b193861e5cb5da5fa2e2296cf5491c789a52961aebb48563e5c8b2d78e1bdd1062ca72b8dc4
SHA1 hash:	6ceb54be3611ae12c567460e594ba18e72584022
MD5 hash:	24aa6f63746125bd2cc2e65314ba88ab
humanhash:	snake-michigan-charlie-alaska
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	729 bytes
First seen:	2026-01-21 22:34:59 UTC
Last seen:	2026-01-22 11:17:19 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:xVHDVHTSVHjIWNVHyeYVH6tVRKVHnSYVH4VYVHeVHpUVH3RVHTgOqXUn:WIqjtIOVr3TUn
TLSH	T192010CCE69913EA586348F28B9734528700D81E5FA634688D997083A8CE4B057558F86
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.156.152.67/bins/4rm4	n/a	n/a	elf ua-wget
http://94.156.152.67/bins/4rm5	f7c16a1a44a9dc6b3ee1f73afffdcd425ca67e0e9c70df44544d488826ad5d8b	Mirai	mirai opendir
http://94.156.152.67/bins/4rm6	0725116cab37fe76b32f0e460f6dd085bd44618f800918722650bfcd99fbfb5a	Mirai	mirai opendir
http://94.156.152.67/bins/4rm7	269c7e600d41cd03b27026d9ea50021b37c36fbf457b44d0f1870180be7ff434	Mirai	mirai opendir
http://94.156.152.67/bins/sh4	1a5a9c16ffb10732468c63adce73c8d97117a701b17646bd6b18c868ccf3911d	Mirai	mirai opendir
http://94.156.152.67/bins/ppc	ed2400f0b058f632797e1c8d3f767473ee2bc150576f729d21990bdb67eb45d4	Mirai	mirai opendir
http://94.156.152.67/bins/m1ps	56fbe540dbc23fddc5be95941b83730ae9a7cb6e95945da3877f27bb281cb6e5	Mirai	mirai opendir
http://94.156.152.67/bins/m1ps3l	9f9f1cde25c8a1ae8e6c3386fe9b92eb41dad1f5c54145b87a5012f70f65fc95	Mirai	mirai opendir
http://94.156.152.67/bins/spc	e41e5677380874d4dc1a6cfe1de973ce81f144f6aaf70d9aa45cf32d3dff3d68	Mirai	mirai opendir
http://94.156.152.67/bins/x861	cdcec3f4fd3d942bbea8523307209f733d6c9d6914e006568a989ea48601d698	Mirai	mirai opendir
http://94.156.152.67/bins/m68k	bfc0640f2489867fb6befa8ffe3d07610d44a47b95602091b342163828297673	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/697154ec607e8377fade3196/reports/00ccd809-79f0-42b2-b40c-4d170fc2769c/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-01-21T15:59:00Z UTC

Last seen:

2026-01-21T17:10:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/3e395e3055bec188bd0d904eace0862d2cd01eb810703a25e254e2de344fbc4e/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b0f83f7a-3563-4b17-bb01-10d71b1dfbb0

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3e395e3055bec188bd0d904eace0862d2cd01eb810703a25e254e2de344fbc4e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3e395e3055bec188bd0d904eace0862d2cd01eb810703a25e254e2de344fbc4e/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/3e395e3055bec188bd0d904eace0862d2cd01eb810703a25e254e2de344fbc4e

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2026-01-21 18:40:16 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hy4v4mcvx3ayrpinsbhkzyegfuwnahvycbydujpcktrn4ncpxrha._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260121-2nwh8acz2b/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3e395e3055bec188bd0d904eace0862d2cd01eb810703a25e254e2de344fbc4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh