MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 669d311967eb7abe0f2b1a8155f5f90d8042b657c97943d9b448da8a62595bc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	669d311967eb7abe0f2b1a8155f5f90d8042b657c97943d9b448da8a62595bc7
SHA3-384 hash:	86bd5bf747edd8c501dd4b03c39e11ac101b3a0ab28a92e17bafa9dd49117ee418e0e041759870c4e6d03e7357211a95
SHA1 hash:	28c0344ebd66a837787a7fe034a74626797dd78c
MD5 hash:	d8324f553a62e387101c4ca2f00d9f96
humanhash:	nine-venus-arkansas-asparagus
File name:	womp
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'905 bytes
First seen:	2026-06-18 07:24:16 UTC
Last seen:	2026-06-18 08:21:25 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:973PpZSG7MvNIsV0LKucaSrbiL97iXWZ9M9VyRpKbwinuQpZSFNIstLKuavD9jX/:Jp8pNI3K3pP2RpKs6p8FNImKuAyRpKGU
TLSH	T14C41DBDD30EF24B65D02BE42B15188D4F549F2EBB8969F44FC448EB1C597AB6302CB84
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.175.223.249/data_arm4	ec32ee9f654e4817249df530db663c775b81e11868c7c087888eb49f5e7485dc	Mirai	elf mirai ua-wget
http://5.175.223.249/data_arm5	0d7e6368812054f582aeebc64894770bc09353f074fb26a0281cf79e395f4963	Mirai	elf mirai ua-wget
http://5.175.223.249/data_arm6	80826c175e9ba582279f1f5b14e4aff7540aea8c8d125ae029dffdeb1235de08	Mirai	elf mirai ua-wget
http://5.175.223.249/data_arm7	9ba2316d355bef23251b64d0f39abd38b25685f5d7db78b3b4be73d1eda5dbe4	Mirai	elf mirai ua-wget
http://5.175.223.249/data_aarch64	5fb8f703c58eb7a26db0565a95dd120eec4ef55c3380fba1dd267b302f921c3c	Mirai	elf mirai ua-wget
http://5.175.223.249/data_mips	6d95be925f16dbe7cdd83de323b9a22659c2754718642c34947d15034f704b62	Mirai	elf mirai ua-wget
http://5.175.223.249/data_mipsel	7cc6bffe4402d553bb262c06a6e531a50962c756b667740dffc1f6595a57d45d	Mirai	elf mirai ua-wget
http://5.175.223.249/data_mips-uclibc	599fea2f9d0ca4a75c5826d8df45d7deab9d9f03d8f4928166ffefddce58218d	Mirai	elf mirai ua-wget
http://5.175.223.249/data_mipsel-uclibc	af46ef9ec0e2095be44fa101c3109cc7a98aa82977dc4fabf5ee37bdabea0dd1	Mirai	elf mirai ua-wget
http://5.175.223.249/data_powerpc	7cb98e74bd2710be1e515ea8d1a54f7608c4d026230076faef5e779407544b47	Mirai	elf mirai ua-wget
http://5.175.223.249/data_x86	ea47c0cf85318989bcb625474229bd9b5ab0263f8a79eb6231b44c3a0ca6bf25	Mirai	elf mirai ua-wget
http://5.175.223.249/data_x86_64	758bfd53af3403244492a07a78388568547092bd62207b48f8f438a3afa9cb3b	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-18T04:34:00Z UTC

Last seen:

2026-06-19T21:08:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/669d311967eb7abe0f2b1a8155f5f90d8042b657c97943d9b448da8a62595bc7/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d60395d0-5b37-43fa-bf2b-adf711da4441

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/669d311967eb7abe0f2b1a8155f5f90d8042b657c97943d9b448da8a62595bc7

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/669d311967eb7abe0f2b1a8155f5f90d8042b657c97943d9b448da8a62595bc7/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/669d311967eb7abe0f2b1a8155f5f90d8042b657c97943d9b448da8a62595bc7

Threat name:

Script-Shell.Trojan.Vigorf

Status:

Malicious

First seen:

2026-06-18 07:29:24 UTC

File Type:

Text (Shell)

AV detection:

10 of 22 (45.45%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m2otcglh5n5l4dzldkavl5pzbwaefnsxzf4uhwnujdniuyszlpdq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/260618-h9sjxahw8w/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/669d311967eb7abe0f2b1a8155f5f90d8042b657c97943d9b448da8a62595bc7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh