MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3
SHA3-384 hash:	13acfc2200985eb1190d74a4ebddca750a2b80cee5798eca278d7f6bae6f433d9a35eba20ee1d136ee3581f56588bf75
SHA1 hash:	5015b7ca5419ca97cb1de8be1f18f1f505cf5c27
MD5 hash:	80057273bef6ac78f1a6f4e209264a25
humanhash:	wisconsin-london-spring-oxygen
File name:	72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'180 bytes
First seen:	2026-09-05 09:33:19 UTC
Last seen:	2026-09-05 10:11:21 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:bGoesdyun+QEnJswt6tYNCMnJdKG+1j+o+a+q+eUeepeXe123es2XeBeferkjnV1:Mmco70
TLSH	T1A741339F00B05191861BD98874E54FE6BB6DC56C91EE6631E8D0CFB1484CE70F06AB35
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	sh wraith

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://74.81.40.155/iran.x86_64	17cef7494d5c744d34630815ca83080e01066e8c0f4d0baabbd0ef5dd902dd1c	Mirai	cowrie honeypot mirai
http://74.81.40.155/iran.aarch64	068a9dd4151375ff833ab4fa5f74304f2130b37d7684c0812445767f1a2ca69b	Mirai	cowrie honeypot mirai
http://74.81.40.155/iran.m68k	6640aee98df245e00493c4e15cf1db321851c1e230ba5f38251bde08ff93d81c	Mirai	mirai wraith
http://74.81.40.155/iran.mips	1a85c9bc34c4a186fff513c7855a9032958957ba8ecaa5354c9b56a6d2f12e11	Mirai	mirai wraith
http://74.81.40.155/iran.mipsel	e5afda318d17166b0646bf2267c77326558fff6f21c95a523c3a9c40098f053e	Mirai	mirai wraith
http://74.81.40.155/iran.powerpc	476adfb2f3469270d2ee4ffbc1d41669e7c98e0040b8c8182fb2b107161a4088	Mirai	elf mirai ua-wget
http://74.81.40.155/iran.sparc	769cde247ddd79af14ebee3cdb834c46befbc20ebffd124f1b058c92ada67438	Mirai	elf mirai ua-wget
http://74.81.40.155/iran.sh4	61e906b24f4d87af918ee9dfbd9f7e2c6214a6b1168b0f8c13e436f34a7049f1	Mirai	elf mirai ua-wget
http://74.81.40.155/iran.arc	739850115d488f077fa9694e226c052ecc5422f3917fa40eb4e31ba3c58edd28	Mirai	elf mirai ua-wget
http://74.81.40.155/iran.i486	a59416f4878e86e1ce999c7cddcebd46840663d40a09a8a108198101ee357493	Mirai	elf mirai ua-wget
http://74.81.40.155/iran.armv4l	b4964a378a272a0cfe3256c10c5bae7ed6698340b2963202d65274e03226f908	Mirai	elf mirai ua-wget
http://74.81.40.155/iran.armv5l	0eb796700c7b821ef80380a532c66e45f6692ca3ecdf958282a72d725a9d0338	Mirai	elf mirai ua-wget
http://74.81.40.155/iran.armv6l	775cced827201e88646784366f341211e4006eba3f80d7d290f742521c8d1fef	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a9be21c925c0d2db2370bee/reports/ce793138-f6ed-4020-9b80-17e4c634eda1/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-04T18:05:00Z UTC

Last seen:

2026-09-06T19:23:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f09a2ef1-b272-4e40-a748-c7f663fd161a

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3/

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2026-09-05 02:12:03 UTC

File Type:

Text (Shell)

AV detection:

10 of 24 (41.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oilyveczpmplwx2memp4vclipdu7v5wrqe44zevdlr62d7sirszq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/260905-ljv4wsda65/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Enumerates running processes

Modifies init.d

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh