MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fb421bbe4fed5fad81ad941a761aa8044eea53ca71cd4f4eb7ebcdfa68b8c2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fb421bbe4fed5fad81ad941a761aa8044eea53ca71cd4f4eb7ebcdfa68b8c2f
SHA3-384 hash: f9821df526dcc135c2038679e442861ddfaf17c828165795c4276d259091904a5b69fed6033d08949dd4ac5e1f0bba26
SHA1 hash: f1f6726dc6af6bbc61d1d7f3346d84c2228e3777
MD5 hash: a1dabdeddb651ea6adb6456149d470ef
humanhash: glucose-queen-oscar-leopard
File name:w.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'198 bytes
First seen:2026-01-09 04:46:45 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:OvvaKLha4NI7qKxa4KOa4IaMJaOL2aEu+1ajythaz1aMJAaMBRNR:O3asha9qKxa4xa4IayaO6aS1aCaz1aMe
TLSH T14021C9FD846C16A50D948D6C119E4C68870B8FD2F0C10F2CE54CA4B725A66B4B749F9D
Magika txt
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://64.188.64.41/Cameron/Skye/Manderfeld/armn/an/aelf ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/arm58382821a44e3dec617898df55426f019999f1762d371fe93fbe1a99f6212c1ad Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/arm643f31fd68ee126fe013f0a782e44a78255b1683479125170837fbdcf62b6d492 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/arm77720750a19073e4567d2cadf84bac8b7cbfc2ea89d9b5b32bb9e8af311dac236 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/m68ka5deb7f7975f60df65e86cd62fde23bca3aad63036846901079ec35412cfb7a0 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/mips54b757506a0c8f2a83984630ed6c2c874b434a5461f3cb7f49bd8c0eb7b66854 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/mpsl0daffde65bda959a5ea99459ca7cf2df430e9cedc1233531cb8c05b313e6fa32 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/ppce6d4b6f93d7ae50c79847c6b0d8b3e533bfdf5ed58a86dbbde66c58442f9f35c Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/sh4bf8c8a847289132ff9606dd7d808f91070dfff0ffdb9a8a4c6bf076697531e18 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/spcfce43a96448cf52f1ff6c6f3a7067c1c4733b573d20f5ff1725ba821af7af4e2 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/x867b4cd6f806b64a6023c19812cc733869df8ecfd69359004fb39f2e7058047c00 Mirai32-bit elf mirai Mozi
http://64.188.64.41/Cameron/Skye/Manderfeld/x86_6454c6150e81b420393138f9b8d23b4a6d6bc07a146a4e96004566217c1ef514dd Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
busybox mirai
Link:
https://www.filescan.io/uploads/6960883f07ef5fa68e822b28/reports/3b3a8fc6-96f8-4b90-af84-b4b968f44121/overview
Verdict:
Clean
File Type:
unix shell
First seen:
2026-01-09T02:01:00Z UTC
Last seen:
2026-01-09T03:00:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4fb421bbe4fed5fad81ad941a761aa8044eea53ca71cd4f4eb7ebcdfa68b8c2f/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/f62e2c57-3e9f-4997-8b5d-808774c48ebb
Behavior Graph:
Download SVG
%3 guuid=21d55b9c-1a00-0000-ec86-f08b1b0a0000 pid=2587 /usr/bin/sudo guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595 /tmp/sample.bin guuid=21d55b9c-1a00-0000-ec86-f08b1b0a0000 pid=2587->guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595 execve guuid=0636459f-1a00-0000-ec86-f08b240a0000 pid=2596 /usr/bin/busybox net send-data guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=0636459f-1a00-0000-ec86-f08b240a0000 pid=2596 execve guuid=e616f0a0-1a00-0000-ec86-f08b2a0a0000 pid=2602 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=e616f0a0-1a00-0000-ec86-f08b2a0a0000 pid=2602 execve guuid=e1fd44a1-1a00-0000-ec86-f08b2c0a0000 pid=2604 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=e1fd44a1-1a00-0000-ec86-f08b2c0a0000 pid=2604 clone guuid=427451a1-1a00-0000-ec86-f08b2d0a0000 pid=2605 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=427451a1-1a00-0000-ec86-f08b2d0a0000 pid=2605 execve guuid=6d6939a3-1a00-0000-ec86-f08b340a0000 pid=2612 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=6d6939a3-1a00-0000-ec86-f08b340a0000 pid=2612 execve guuid=ca0c81a3-1a00-0000-ec86-f08b360a0000 pid=2614 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=ca0c81a3-1a00-0000-ec86-f08b360a0000 pid=2614 clone guuid=ebc2e9a4-1a00-0000-ec86-f08b3c0a0000 pid=2620 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=ebc2e9a4-1a00-0000-ec86-f08b3c0a0000 pid=2620 execve guuid=587538a7-1a00-0000-ec86-f08b430a0000 pid=2627 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=587538a7-1a00-0000-ec86-f08b430a0000 pid=2627 execve guuid=07d08da7-1a00-0000-ec86-f08b450a0000 pid=2629 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=07d08da7-1a00-0000-ec86-f08b450a0000 pid=2629 clone guuid=dff93da8-1a00-0000-ec86-f08b490a0000 pid=2633 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=dff93da8-1a00-0000-ec86-f08b490a0000 pid=2633 execve guuid=ce14aeaa-1a00-0000-ec86-f08b500a0000 pid=2640 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=ce14aeaa-1a00-0000-ec86-f08b500a0000 pid=2640 execve guuid=1fbd0cab-1a00-0000-ec86-f08b520a0000 pid=2642 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=1fbd0cab-1a00-0000-ec86-f08b520a0000 pid=2642 clone guuid=f350e6ab-1a00-0000-ec86-f08b550a0000 pid=2645 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=f350e6ab-1a00-0000-ec86-f08b550a0000 pid=2645 execve guuid=5a39eaad-1a00-0000-ec86-f08b5b0a0000 pid=2651 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=5a39eaad-1a00-0000-ec86-f08b5b0a0000 pid=2651 execve guuid=0aaf4fae-1a00-0000-ec86-f08b5c0a0000 pid=2652 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=0aaf4fae-1a00-0000-ec86-f08b5c0a0000 pid=2652 clone guuid=7fd2d5af-1a00-0000-ec86-f08b630a0000 pid=2659 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=7fd2d5af-1a00-0000-ec86-f08b630a0000 pid=2659 execve guuid=756912b2-1a00-0000-ec86-f08b690a0000 pid=2665 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=756912b2-1a00-0000-ec86-f08b690a0000 pid=2665 execve guuid=2f7d51b2-1a00-0000-ec86-f08b6b0a0000 pid=2667 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=2f7d51b2-1a00-0000-ec86-f08b6b0a0000 pid=2667 clone guuid=ed6dcfb2-1a00-0000-ec86-f08b6f0a0000 pid=2671 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=ed6dcfb2-1a00-0000-ec86-f08b6f0a0000 pid=2671 execve guuid=8dd201b5-1a00-0000-ec86-f08b750a0000 pid=2677 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=8dd201b5-1a00-0000-ec86-f08b750a0000 pid=2677 execve guuid=c2f43eb5-1a00-0000-ec86-f08b770a0000 pid=2679 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=c2f43eb5-1a00-0000-ec86-f08b770a0000 pid=2679 clone guuid=d45ce4b5-1a00-0000-ec86-f08b7a0a0000 pid=2682 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=d45ce4b5-1a00-0000-ec86-f08b7a0a0000 pid=2682 execve guuid=6072ebb7-1a00-0000-ec86-f08b810a0000 pid=2689 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=6072ebb7-1a00-0000-ec86-f08b810a0000 pid=2689 execve guuid=7bbb2fb8-1a00-0000-ec86-f08b820a0000 pid=2690 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=7bbb2fb8-1a00-0000-ec86-f08b820a0000 pid=2690 clone guuid=ea4b59b9-1a00-0000-ec86-f08b870a0000 pid=2695 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=ea4b59b9-1a00-0000-ec86-f08b870a0000 pid=2695 execve guuid=e34f31bb-1a00-0000-ec86-f08b8d0a0000 pid=2701 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=e34f31bb-1a00-0000-ec86-f08b8d0a0000 pid=2701 execve guuid=1b7784bb-1a00-0000-ec86-f08b900a0000 pid=2704 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=1b7784bb-1a00-0000-ec86-f08b900a0000 pid=2704 clone guuid=e13c7abc-1a00-0000-ec86-f08b930a0000 pid=2707 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=e13c7abc-1a00-0000-ec86-f08b930a0000 pid=2707 execve guuid=d7034dbe-1a00-0000-ec86-f08b9a0a0000 pid=2714 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=d7034dbe-1a00-0000-ec86-f08b9a0a0000 pid=2714 execve guuid=313b87be-1a00-0000-ec86-f08b9c0a0000 pid=2716 /usr/bin/dash guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=313b87be-1a00-0000-ec86-f08b9c0a0000 pid=2716 clone guuid=4fa356bf-1a00-0000-ec86-f08ba00a0000 pid=2720 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=4fa356bf-1a00-0000-ec86-f08ba00a0000 pid=2720 execve guuid=334e2fc1-1a00-0000-ec86-f08ba60a0000 pid=2726 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=334e2fc1-1a00-0000-ec86-f08ba60a0000 pid=2726 execve guuid=1e1169c1-1a00-0000-ec86-f08ba80a0000 pid=2728 /home/sandbox/x86 net guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=1e1169c1-1a00-0000-ec86-f08ba80a0000 pid=2728 execve guuid=97a18fc1-1a00-0000-ec86-f08bab0a0000 pid=2731 /usr/bin/busybox net send-data write-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=97a18fc1-1a00-0000-ec86-f08bab0a0000 pid=2731 execve guuid=f0d5f8cc-1a00-0000-ec86-f08bce0a0000 pid=2766 /usr/bin/chmod guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=f0d5f8cc-1a00-0000-ec86-f08bce0a0000 pid=2766 execve guuid=906732cd-1a00-0000-ec86-f08bcf0a0000 pid=2767 /home/sandbox/x86_64 net guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=906732cd-1a00-0000-ec86-f08bcf0a0000 pid=2767 execve guuid=becae5f7-1b00-0000-ec86-f08bbd0c0000 pid=3261 /usr/bin/rm delete-file guuid=8593049f-1a00-0000-ec86-f08b230a0000 pid=2595->guuid=becae5f7-1b00-0000-ec86-f08bbd0c0000 pid=3261 execve dc908936-34d2-559a-9f4d-542df65fbad6 64.188.64.41:80 guuid=0636459f-1a00-0000-ec86-f08b240a0000 pid=2596->dc908936-34d2-559a-9f4d-542df65fbad6 send: 102B guuid=427451a1-1a00-0000-ec86-f08b2d0a0000 pid=2605->dc908936-34d2-559a-9f4d-542df65fbad6 send: 103B guuid=ebc2e9a4-1a00-0000-ec86-f08b3c0a0000 pid=2620->dc908936-34d2-559a-9f4d-542df65fbad6 send: 103B guuid=dff93da8-1a00-0000-ec86-f08b490a0000 pid=2633->dc908936-34d2-559a-9f4d-542df65fbad6 send: 103B guuid=f350e6ab-1a00-0000-ec86-f08b550a0000 pid=2645->dc908936-34d2-559a-9f4d-542df65fbad6 send: 103B guuid=7fd2d5af-1a00-0000-ec86-f08b630a0000 pid=2659->dc908936-34d2-559a-9f4d-542df65fbad6 send: 103B guuid=ed6dcfb2-1a00-0000-ec86-f08b6f0a0000 pid=2671->dc908936-34d2-559a-9f4d-542df65fbad6 send: 103B guuid=d45ce4b5-1a00-0000-ec86-f08b7a0a0000 pid=2682->dc908936-34d2-559a-9f4d-542df65fbad6 send: 102B guuid=ea4b59b9-1a00-0000-ec86-f08b870a0000 pid=2695->dc908936-34d2-559a-9f4d-542df65fbad6 send: 102B guuid=e13c7abc-1a00-0000-ec86-f08b930a0000 pid=2707->dc908936-34d2-559a-9f4d-542df65fbad6 send: 102B guuid=4fa356bf-1a00-0000-ec86-f08ba00a0000 pid=2720->dc908936-34d2-559a-9f4d-542df65fbad6 send: 102B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=1e1169c1-1a00-0000-ec86-f08ba80a0000 pid=2728->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=e9b28ac1-1a00-0000-ec86-f08baa0a0000 pid=2730 /home/sandbox/x86 dns net send-data zombie guuid=1e1169c1-1a00-0000-ec86-f08ba80a0000 pid=2728->guuid=e9b28ac1-1a00-0000-ec86-f08baa0a0000 pid=2730 clone guuid=e9b28ac1-1a00-0000-ec86-f08baa0a0000 pid=2730->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 34B 6f848457-d338-5fd7-8997-e964a4b9bd9d zzz.leproxy.blog:38241 guuid=e9b28ac1-1a00-0000-ec86-f08baa0a0000 pid=2730->6f848457-d338-5fd7-8997-e964a4b9bd9d send: 18B guuid=9ddb97c1-1a00-0000-ec86-f08bac0a0000 pid=2732 /home/sandbox/x86 guuid=e9b28ac1-1a00-0000-ec86-f08baa0a0000 pid=2730->guuid=9ddb97c1-1a00-0000-ec86-f08bac0a0000 pid=2732 clone guuid=a10e9bc1-1a00-0000-ec86-f08bad0a0000 pid=2733 /home/sandbox/x86 net net-scan send-data guuid=e9b28ac1-1a00-0000-ec86-f08baa0a0000 pid=2730->guuid=a10e9bc1-1a00-0000-ec86-f08bad0a0000 pid=2733 clone guuid=8ecb9ec1-1a00-0000-ec86-f08bae0a0000 pid=2734 /home/sandbox/x86 net net-scan send-data guuid=e9b28ac1-1a00-0000-ec86-f08baa0a0000 pid=2730->guuid=8ecb9ec1-1a00-0000-ec86-f08bae0a0000 pid=2734 clone guuid=97a18fc1-1a00-0000-ec86-f08bab0a0000 pid=2731->dc908936-34d2-559a-9f4d-542df65fbad6 send: 105B guuid=a10e9bc1-1a00-0000-ec86-f08bad0a0000 pid=2733->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a10e9bc1-1a00-0000-ec86-f08bad0a0000 pid=2733|send-data send-data to 256 IP addresses review logs to see them all guuid=a10e9bc1-1a00-0000-ec86-f08bad0a0000 pid=2733->guuid=a10e9bc1-1a00-0000-ec86-f08bad0a0000 pid=2733|send-data send guuid=8ecb9ec1-1a00-0000-ec86-f08bae0a0000 pid=2734->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8ecb9ec1-1a00-0000-ec86-f08bae0a0000 pid=2734|send-data send-data to 512 IP addresses review logs to see them all guuid=8ecb9ec1-1a00-0000-ec86-f08bae0a0000 pid=2734->guuid=8ecb9ec1-1a00-0000-ec86-f08bae0a0000 pid=2734|send-data send guuid=906732cd-1a00-0000-ec86-f08bcf0a0000 pid=2767->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 4945e811-daa2-5999-bd89-4cdaa6badb43 0.0.0.0:8345 guuid=906732cd-1a00-0000-ec86-f08bcf0a0000 pid=2767->4945e811-daa2-5999-bd89-4cdaa6badb43 con guuid=0d3ddbf7-1b00-0000-ec86-f08bbc0c0000 pid=3260 /home/sandbox/x86_64 dns net send-data zombie guuid=906732cd-1a00-0000-ec86-f08bcf0a0000 pid=2767->guuid=0d3ddbf7-1b00-0000-ec86-f08bbc0c0000 pid=3260 clone guuid=0d3ddbf7-1b00-0000-ec86-f08bbc0c0000 pid=3260->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 34B guuid=0d3ddbf7-1b00-0000-ec86-f08bbc0c0000 pid=3260->6f848457-d338-5fd7-8997-e964a4b9bd9d send: 22B guuid=db99eef7-1b00-0000-ec86-f08bbe0c0000 pid=3262 /home/sandbox/x86_64 guuid=0d3ddbf7-1b00-0000-ec86-f08bbc0c0000 pid=3260->guuid=db99eef7-1b00-0000-ec86-f08bbe0c0000 pid=3262 clone guuid=8a60f2f7-1b00-0000-ec86-f08bbf0c0000 pid=3263 /home/sandbox/x86_64 net net-scan send-data guuid=0d3ddbf7-1b00-0000-ec86-f08bbc0c0000 pid=3260->guuid=8a60f2f7-1b00-0000-ec86-f08bbf0c0000 pid=3263 clone guuid=bbe8f7f7-1b00-0000-ec86-f08bc00c0000 pid=3264 /home/sandbox/x86_64 net net-scan send-data guuid=0d3ddbf7-1b00-0000-ec86-f08bbc0c0000 pid=3260->guuid=bbe8f7f7-1b00-0000-ec86-f08bc00c0000 pid=3264 clone guuid=8a60f2f7-1b00-0000-ec86-f08bbf0c0000 pid=3263->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8a60f2f7-1b00-0000-ec86-f08bbf0c0000 pid=3263|send-data send-data to 4097 IP addresses review logs to see them all guuid=8a60f2f7-1b00-0000-ec86-f08bbf0c0000 pid=3263->guuid=8a60f2f7-1b00-0000-ec86-f08bbf0c0000 pid=3263|send-data send guuid=bbe8f7f7-1b00-0000-ec86-f08bc00c0000 pid=3264->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=bbe8f7f7-1b00-0000-ec86-f08bc00c0000 pid=3264|send-data send-data to 4097 IP addresses review logs to see them all guuid=bbe8f7f7-1b00-0000-ec86-f08bc00c0000 pid=3264->guuid=bbe8f7f7-1b00-0000-ec86-f08bc00c0000 pid=3264|send-data send
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4fb421bbe4fed5fad81ad941a761aa8044eea53ca71cd4f4eb7ebcdfa68b8c2f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fb421bbe4fed5fad81ad941a761aa8044eea53ca71cd4f4eb7ebcdfa68b8c2f/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/4fb421bbe4fed5fad81ad941a761aa8044eea53ca71cd4f4eb7ebcdfa68b8c2f
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-01-09 04:34:04 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j62cdo7e73k7vwa23fa2oynkqbco5jj4u4onj5hlp26n7julrqxq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260109-felrrsez4e/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4fb421bbe4fed5fad81ad941a761aa8044eea53ca71cd4f4eb7ebcdfa68b8c2f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 4fb421bbe4fed5fad81ad941a761aa8044eea53ca71cd4f4eb7ebcdfa68b8c2f

(this sample)

Mirai

elf 8382821a44e3dec617898df55426f019999f1762d371fe93fbe1a99f6212c1ad

  
URLhaus
https://urlhaus.abuse.ch/url/3753756/
  
Delivery method
Distributed via web download
  
Dropping
MD5 da36d08ea0a983e2d8ffb2e7c7ff7e5c
  
Dropping
SHA256 8382821a44e3dec617898df55426f019999f1762d371fe93fbe1a99f6212c1ad

Comments