MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ead92bad5d294a8703f854acb7a08eff3fbd8f1ec213c05b66a746449eb511e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	6ead92bad5d294a8703f854acb7a08eff3fbd8f1ec213c05b66a746449eb511e
SHA3-384 hash:	8942885c1d84452b2e13ef8c27de50f4a9850dd20053dc0ea670d00f0d8207642ed668345b214f7d01c71155cca81ebd
SHA1 hash:	ec79e5f497c3e8ba74bbaea5d8fb5d8cb74996ae
MD5 hash:	4a941fbe43be6cfc1f0cc39a918e5239
humanhash:	spaghetti-summer-stream-carolina
File name:	l.sh
Download:	download sample
File size:	1'945 bytes
First seen:	2026-02-20 07:54:03 UTC
Last seen:	2026-02-21 04:35:35 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:fNVEcqBCdFpFABBzdEBOPqBdTZNH/qBOdkB7Lx18B4biXqTBEZp2ByULQWf423Bk:FACIsHdNd63748NdyihygC
TLSH	T1384125C8A1A045F388C89A597D63423C71AD0EE1BED27FD8684DC89D6F437A7F548B84
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://188.214.30.5/bins/StormStresser.arm6	edb0b5e6bc05322b0f389bb03734dcfff721dfad89af8ca5c5b87c1d935700bf	Mirai	mirai
http://188.214.30.5/bins/StormStresser.arm7	56b5a310c383c4f5e609ab09f0c441b781a8628f45c879fd4f268113a347f5ac	Mirai	mirai
http://188.214.30.5/bins/StormStresser.m68k	5c8d71d5c6523e8092e097bbcc5ecbdc3081b02d7e3e902089beef0333f4b0a7	Mirai	mirai
http://188.214.30.5/bins/StormStresser.mips	b8990787c2e9d8f1fc852b645aca2704bb4f7dc1a9cf54896b3c3d9a6d23efb6	Mirai	mirai
http://188.214.30.5/bins/StormStresser.mpsl	94492a228b98982f5a075e792239ba6b7c41366551df182ec6b07270770d744d	Mirai	mirai
http://188.214.30.5/bins/StormStresser.ppc	3248d8503d5742ecffadc4739878835719fbf76f91c4e8b6d4f3cc304655fe7e	Mirai	mirai
http://188.214.30.5/bins/StormStresser.sh4	c62c7c9567099175754f0ea1e0ba39ed0341a237600a838eaa1fa4f10f3ec805	Mirai	mirai
http://188.214.30.5/bins/StormStresser.spc	917f055a7ea82558a1ce794eb798c471e9dc30ead4a867b92c0f863b7b320f29	Mirai	mirai
http://188.214.30.5/bins/StormStresser.x86	c28e7804ea2a28fab3f53b5c740acaddece03c4427bfec92e0ab3e4997abf5cb	Mirai	mirai
http://188.214.30.5/bins/x86_64	62905f8a3507c4ad44848de30017efd4c89eb4f34a746eecc10600a91aafdf0a	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive mirai

Link:

https://www.filescan.io/uploads/6998132dcd25bfe1dfd616e1/reports/85ecbb8b-e2b3-4847-baf0-3362e4ddbb0a/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/759e5144-2ad8-4a09-b951-c44f295552a8

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6ead92bad5d294a8703f854acb7a08eff3fbd8f1ec213c05b66a746449eb511e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6ead92bad5d294a8703f854acb7a08eff3fbd8f1ec213c05b66a746449eb511e/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/6ead92bad5d294a8703f854acb7a08eff3fbd8f1ec213c05b66a746449eb511e

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n2wzfowv2kkkq4b7qvfmw6qi57z7xwhr5qqtybnwnj2gisplkepa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260220-jr8nvae13d/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6ead92bad5d2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6ead92bad5d294a8703f854acb7a08eff3fbd8f1ec213c05b66a746449eb511e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh