MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3eaee77ccf4bd95e51f8f69b632df63edc477a40ed7b2b15e4e156364ec26ac0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	3eaee77ccf4bd95e51f8f69b632df63edc477a40ed7b2b15e4e156364ec26ac0
SHA3-384 hash:	f262fd7453e0f3bef5571575153af04ac654627585dcfef1dcc1f182d10372a6ce85f771a63d3f0380cc314e2f4faf53
SHA1 hash:	97198c50b6e2c1ed653d5b30fcf35c3b9e2ed12e
MD5 hash:	b2d4b9007f86f2893cd74e3e3641c87e
humanhash:	arizona-fanta-arkansas-fifteen
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	880 bytes
First seen:	2025-12-25 17:39:29 UTC
Last seen:	2025-12-26 13:05:59 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:zD3XiNIBS+JoKSrSxHXjMdl9AXn9oaTxyTF6thyrQkn:z7iNIIXKSrQ3wdl9A3936WOQkn
TLSH	T1FD11CEAD2190582988EACC0D32E90800A63FD58979619F38DDF9443740F7ABC7F6CE8D
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://190.123.46.72/bins/main_arm	0b423d1b9e7a9e6719bf77dfa5363998d04f9edad2ee8e2de911c7ae995a391a	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm5	5d94992dac0b6d592f86b0d59af84c52168f05d7aa1713a0c4fd62820be71630	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm6	5b1cf87888710837c0007fd20877644abec191d7fed82763a15b959d591444d4	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm7	cf40305398ee234528ebd18bb54b13e1bb94f90a501636857e25ba114bb1c9c6	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_sh4	fd893a3ee002cd623137b4f65fda5624232eb22e53f5fec40601bc26e7eed29a	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_m68k	7cca33815eaccd864db722658cce4a234c32280e2ee7266c9fecd8601652c95f	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_mips	261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_mpsl	2322a5098627d113e939e6ac7ddb5c80ed5e253a650c6b6e1737baa4617db415	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_x86_64	6c22bec08f6ce62b43664b22028e033d496990b06a053c4aee5168b3af787c55	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_ppc	b1d611c59c43c5f2ae26da403ac6f4c59f721d91716cd5c07e3293351db8124c	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_x86	05466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bash lolbin mirai

Link:

https://www.filescan.io/uploads/694d7703a7163552ba04e452/reports/8ece9282-b357-4e6f-a1fe-124556517923/overview

Verdict:

Clean

File Type:

text

Link:

https://opentip.kaspersky.com/3eaee77ccf4bd95e51f8f69b632df63edc477a40ed7b2b15e4e156364ec26ac0/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8a1b133e-c4a4-482f-b09c-76bdbfc895a1

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3eaee77ccf4bd95e51f8f69b632df63edc477a40ed7b2b15e4e156364ec26ac0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3eaee77ccf4bd95e51f8f69b632df63edc477a40ed7b2b15e4e156364ec26ac0/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/3eaee77ccf4bd95e51f8f69b632df63edc477a40ed7b2b15e4e156364ec26ac0

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2025-12-25 16:02:16 UTC

File Type:

Text (Shell)

AV detection:

10 of 38 (26.32%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h2xoo7gpjpmv4upy62nwglpwh3oeo6sa5v5swfpe4fldmtwcnlaa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251225-v8z9ksdj7y/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3eaee77ccf4bd95e51f8f69b632df63edc477a40ed7b2b15e4e156364ec26ac0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh