MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 410428813170da2c259ac4a595384b8c1ee9627af2f43c6ec72c6dd595c88091. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	410428813170da2c259ac4a595384b8c1ee9627af2f43c6ec72c6dd595c88091
SHA3-384 hash:	94b28602929151aac24a3fa34dbb00c31ea7fd1c7f2fd730349ef5812599c205f1828cccbc442a4586fd54f723f24a1c
SHA1 hash:	131a88931259f858c499baa07436077999abb2fb
MD5 hash:	d041fc0c1ec44414918b70c42cf0e767
humanhash:	hawaii-purple-robin-carbon
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'120 bytes
First seen:	2026-01-25 00:52:40 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:yinKoSByAm6s5O9nEfYZZI3y7cs3dpjgD+:yinpS0Kfq2ZX
TLSH	T13A51E9F9BA30A130B60C4DFCF02AD488BC9394BF11746B351CE6EDB1C2AD558916967E
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://77.42.21.37/systemcl/arc	fb73d8b20485136882c270df6fc64b7499dd9af4c1361bb8893f6ff827e8926d	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/arm	0ebf87b4e6f9225a6062947618de49be2a4cdb146e9b68c07056d2fa0c91f16b	Mirai	32-bit elf mirai Mozi
http://77.42.21.37/systemcl/arm5	dfd8a925739e4df860e83995e0625d562ec32ab5f7b338b204a30939b2019f3e	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/arm6	ad083a1f9186ffc38fbd148fe515812a7ccc82f410ac74ed6ac7fbd88f135ac3	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/arm7	fa67b277479419302ccc82d5862c7c47723de5185f5798c3f21befbc0e26af9f	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/i486	n/a	n/a	elf ua-wget
http://77.42.21.37/systemcl/m68k	3c4697891ad492001f880868fe557f2b1b4627ec60a2058e6ffa57bd5934243c	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/mips	a4d03d28364c3c527fb20f3cf9984f78abaef31182f25e106cf7bffb2094cdef	Mirai	32-bit elf mirai Mozi
http://77.42.21.37/systemcl/mpsl	e5fa9517ae35e916913e60115a385e0173239103f707688804b299ddf5c3ec36	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/ppc	9e74dc5377747bdd06bd70cbcb4325e0218a8dd31f66dcccfa41069b7a11ca00	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/ppc440	n/a	n/a	elf ua-wget
http://77.42.21.37/systemcl/sh4	105e02593bad28306e810b5c3ccfd4f3c76d8b1bb33e0dba4540381289ab8bda	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/spc	911f54971bce91bd384ad1e66296f0baab373b3bfdba78a21baa0b6fd1f7f358	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/x86	b1eca05ac8f0dca29557632c95eab45b6cdedd3a594cc28c6d94ce8f7ef37bba	Mirai	32-bit elf mirai Mozi
http://77.42.21.37/systemcl/x86_64	27968814839edb77bd46fe35bb64115b75985e9069a045b86f1dd73ade0d2de6	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/x86_32	60246e66a15265caf6b8d57f52e17f1f58f33498944d18dede0b91b8d4ebd087	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.32160.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/697569815db9ae477090d626/reports/22af0d86-7cf0-44bf-ac16-c3e8376a722e/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-01-24T20:33:00Z UTC

Last seen:

2026-01-26T12:49:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/410428813170da2c259ac4a595384b8c1ee9627af2f43c6ec72c6dd595c88091/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/891b4e36-ad8c-4f16-96f3-fdf310be32f0

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/410428813170da2c259ac4a595384b8c1ee9627af2f43c6ec72c6dd595c88091

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/410428813170da2c259ac4a595384b8c1ee9627af2f43c6ec72c6dd595c88091/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/410428813170da2c259ac4a595384b8c1ee9627af2f43c6ec72c6dd595c88091

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2026-01-25 00:53:32 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ieccrajrodncyjm2ysszkoclrqposyt26l2dy3whfrw5lfoiqciq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet credential_access defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260125-a8svaaby5b/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads process memory

UPX packed file

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Traces itself

Mirai

Mirai family

Malware Config

C2 Extraction:

ahahahahahajs.unproxy.st

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/410428813170da2c259ac4a595384b8c1ee9627af2f43c6ec72c6dd595c88091

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh