MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73b222aa4cc58e4ac0dc8ff58e9740a6bb65d67f4e9e009adbe3628d9bec6def. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	73b222aa4cc58e4ac0dc8ff58e9740a6bb65d67f4e9e009adbe3628d9bec6def
SHA3-384 hash:	c6152466c7cdf26962390fa0ecd58bf72e11cf39b1fa3eac34ee011bb390fe1a798ca3a21df481188b5f7e620bd1f6da
SHA1 hash:	8f462e47d8aed67b228de4402b959ffd5746ec32
MD5 hash:	4a7a6af17674c5dc21debc427e6cf7d8
humanhash:	alpha-network-eleven-carpet
File name:	payload.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	716 bytes
First seen:	2026-01-13 15:57:37 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Wjj5rKjjDk7jj3MKxjCDAjBabNHjZjAj64n:WH5rGjA7H8K92E0FVEd
TLSH	T1270184871160B1EA1028C60FB0780474A27986BDFCAF5FCCEDC1086F6D8AA163058FB1
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://145.223.69.190/bins/plasma.arm	93d668179bb642a83136853b7708e86aa792d3992e24d80f3ff348566421646f	Mirai	elf mirai ua-wget
http://145.223.69.190/bins/plasma.arm64	9c070845474cf805818cfe1a23f6bb4e1c1dd684d799e84ce780d240417b3f78	Mirai	elf mirai ua-wget
http://145.223.69.190/bins/plasma.arm7	eca6425e4d0df750ed4cc2f8039a8ee8d298e27a74afdf772d7c872b3d8b176c	Mirai	elf mirai ua-wget
http://145.223.69.190/bins/plasma.mips	n/a	n/a	ua-wget
http://145.223.69.190/bins/plasma.mpsl	28ec63e90f1652414aea8aee820872baf0defcfddfef0660e4d76e2c5d43fa2f	Mirai	elf mirai ua-wget
http://145.223.69.190/bins/plasma.sh4	547d5e93bcabe9e36a6f5a5f3748d7d7909b37b555644ed5506c0669ce353b86	Mirai	elf mirai ua-wget
http://145.223.69.190/bins/plasma.x86	d37623cdcf916495c2a0e71a0082ae25a580685cc9241d54ab5f1c9de23e8f5f	Mirai	elf mirai ua-wget
http://145.223.69.190/bins/plasma.x86_64	ada24dcf9234ce1518803f62c6af0c883c7b89b8a13b9575c73bf920f91c46c1	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-01-13T13:04:00Z UTC

Last seen:

2026-01-14T08:36:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen

Link:

https://opentip.kaspersky.com/73b222aa4cc58e4ac0dc8ff58e9740a6bb65d67f4e9e009adbe3628d9bec6def/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/440ffce7-511e-4aa8-a2e8-e37a9db9abec

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/73b222aa4cc58e4ac0dc8ff58e9740a6bb65d67f4e9e009adbe3628d9bec6def

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/73b222aa4cc58e4ac0dc8ff58e9740a6bb65d67f4e9e009adbe3628d9bec6def/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/73b222aa4cc58e4ac0dc8ff58e9740a6bb65d67f4e9e009adbe3628d9bec6def

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2026-01-13 15:45:26 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oozcfksmywhevqg4r72y5f2au25wlvt7j2pabgw34nri3g7mnxxq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260113-tepqbabz4d/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Creates/modifies Cron job

File and Directory Permissions Modification

Flushes firewall rules

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.42

Link:

https://yomi.yoroi.company/submissions/73b222aa4cc58e4ac0dc8ff58e9740a6bb65d67f4e9e009adbe3628d9bec6def

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh