MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62959d7bf658f6d679c35062dd2421d830c94a4fc1b2336f9241a70832a42b49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	62959d7bf658f6d679c35062dd2421d830c94a4fc1b2336f9241a70832a42b49
SHA3-384 hash:	4c4d4c2576100726b69a6bab209e8041680a59fdff08d4105a737341d39fe1343c3f6f270f86899ec06e5e55882f1115
SHA1 hash:	47fa1ca534510f22adc6fb69561c6c91f139544c
MD5 hash:	fcbe78270e72e9b3fb03dd59bd94eb4a
humanhash:	november-mexico-stairway-mexico
File name:	t.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	762 bytes
First seen:	2026-01-23 08:19:18 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:xVHI+jQVHj+jQVHjIWT2T+jQVHyeF+jQVH6tz+jQVHnSF+jQVH4VND+jQVHT+jQR:ZBKIM2Sq43ty+JzV4ZjM/Ln
TLSH	T1F701B5CF19111EB08564EF2CBA7344296009C1D1F6630BD86D47083B8DE5B0F75B6FA6
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.156.152.67/bins/4rm4	n/a	n/a	elf ua-wget
http://94.156.152.67/bins/4rm5	f7c16a1a44a9dc6b3ee1f73afffdcd425ca67e0e9c70df44544d488826ad5d8b	Mirai	mirai opendir
http://94.156.152.67/bins/4rm6	0725116cab37fe76b32f0e460f6dd085bd44618f800918722650bfcd99fbfb5a	Mirai	mirai opendir
http://94.156.152.67/bins/4rm7	269c7e600d41cd03b27026d9ea50021b37c36fbf457b44d0f1870180be7ff434	Mirai	mirai opendir
http://94.156.152.67/bins/sh4	1a5a9c16ffb10732468c63adce73c8d97117a701b17646bd6b18c868ccf3911d	Mirai	mirai opendir
http://94.156.152.67/bins/ppc	ed2400f0b058f632797e1c8d3f767473ee2bc150576f729d21990bdb67eb45d4	Mirai	mirai opendir
http://94.156.152.67/bins/m1ps	56fbe540dbc23fddc5be95941b83730ae9a7cb6e95945da3877f27bb281cb6e5	Mirai	mirai opendir
http://94.156.152.67/bins/m1ps3l	9f9f1cde25c8a1ae8e6c3386fe9b92eb41dad1f5c54145b87a5012f70f65fc95	Mirai	mirai opendir
http://94.156.152.67/bins/spc	e41e5677380874d4dc1a6cfe1de973ce81f144f6aaf70d9aa45cf32d3dff3d68	Mirai	mirai opendir
http://94.156.152.67/bins/x861	cdcec3f4fd3d942bbea8523307209f733d6c9d6914e006568a989ea48601d698	Mirai	mirai opendir
http://94.156.152.67/bins/m68k	f23f2023cb146e1f2f28301eafec0a12a0678cb0eba9da18f7622388af648060	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/69732f0c5db9ae47708f136c/reports/dbd45898-b24f-48a3-b381-61eae33b3e43/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-01-23T05:50:00Z UTC

Last seen:

2026-01-25T00:00:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/62959d7bf658f6d679c35062dd2421d830c94a4fc1b2336f9241a70832a42b49/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4af0f9c2-e5db-40fe-acc4-fbb6c70f77ed

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/62959d7bf658f6d679c35062dd2421d830c94a4fc1b2336f9241a70832a42b49

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/62959d7bf658f6d679c35062dd2421d830c94a4fc1b2336f9241a70832a42b49/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/62959d7bf658f6d679c35062dd2421d830c94a4fc1b2336f9241a70832a42b49

Threat name:

Document-HTML.Hacktool.Heuristic

Status:

Malicious

First seen:

2026-01-23 07:55:16 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mkkz267wld3nm6odkbrn2jbb3aymssspygzdg34sigtqqmvefneq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260123-j72kgafw5d/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/62959d7bf658f6d679c35062dd2421d830c94a4fc1b2336f9241a70832a42b49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh