MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b9c4067e620042390837d0f63d921fc47b7d675d89503b9383f7b4b6fa96f83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	4b9c4067e620042390837d0f63d921fc47b7d675d89503b9383f7b4b6fa96f83
SHA3-384 hash:	c3958ed24d0758447b3a336411662273a36e45974fc241da82c99b5e8a68e1d7148f08488fd54d62f8610ac2a084b58a
SHA1 hash:	f437425a7fc205703b7617a2569983167e0a428f
MD5 hash:	7c7dc9f3da340548bd46c86f42774d0f
humanhash:	bakerloo-apart-one-butter
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	798 bytes
First seen:	2026-01-22 12:23:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:nVH6KVHIPVHjIWLVHyeCVHJNVHo67VH4VovVHCnVH8VH33VHTgOvjn:cIE36mVo0fEjn
TLSH	T1BF0180CF91941F7086648F2CB973C41C600D89D1F68306EC964F08799EA9F15F756F89
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.156.152.67/bins/4rm	86414e5dc4a6412453c70c42545f1b17ca423a27739825730a4aa5c26b57f19c	Mirai	mirai opendir
http://94.156.152.67/bins/4rm5	f7c16a1a44a9dc6b3ee1f73afffdcd425ca67e0e9c70df44544d488826ad5d8b	Mirai	mirai opendir
http://94.156.152.67/bins/4rm6	0725116cab37fe76b32f0e460f6dd085bd44618f800918722650bfcd99fbfb5a	Mirai	mirai opendir
http://94.156.152.67/bins/4rm7	269c7e600d41cd03b27026d9ea50021b37c36fbf457b44d0f1870180be7ff434	Mirai	mirai opendir
http://94.156.152.67/bins/sh4	1a5a9c16ffb10732468c63adce73c8d97117a701b17646bd6b18c868ccf3911d	Mirai	mirai opendir
http://94.156.152.67/bins/ppc	ed2400f0b058f632797e1c8d3f767473ee2bc150576f729d21990bdb67eb45d4	Mirai	mirai opendir
http://94.156.152.67/bins/m1ps	56fbe540dbc23fddc5be95941b83730ae9a7cb6e95945da3877f27bb281cb6e5	Mirai	mirai opendir
http://94.156.152.67/bins/m1ps3l	9f9f1cde25c8a1ae8e6c3386fe9b92eb41dad1f5c54145b87a5012f70f65fc95	Mirai	mirai opendir
http://94.156.152.67/bins/spc	e41e5677380874d4dc1a6cfe1de973ce81f144f6aaf70d9aa45cf32d3dff3d68	Mirai	mirai opendir
http://94.156.152.67/bins/x861	cdcec3f4fd3d942bbea8523307209f733d6c9d6914e006568a989ea48601d698	Mirai	mirai opendir
http://94.156.152.67/bins/m68k	bfc0640f2489867fb6befa8ffe3d07610d44a47b95602091b342163828297673	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox mirai

Link:

https://www.filescan.io/uploads/697216b555805a763ff0045a/reports/e0da69f9-997a-4705-9143-43c86dbb0efa/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/cc1f2216-ae90-441a-b8db-0bdbc39a890c

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4b9c4067e620042390837d0f63d921fc47b7d675d89503b9383f7b4b6fa96f83

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4b9c4067e620042390837d0f63d921fc47b7d675d89503b9383f7b4b6fa96f83/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/4b9c4067e620042390837d0f63d921fc47b7d675d89503b9383f7b4b6fa96f83

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jooeaz7geaccheedpuhwhwjb7rd3pvtv3ckqhojyh55uw35jn6bq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260122-pkk7vsfs7b/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh