MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74923e4db01d6c089eb474dbd20a2f2f7fd7a21edb9970463f119c4a4d660aa1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	74923e4db01d6c089eb474dbd20a2f2f7fd7a21edb9970463f119c4a4d660aa1
SHA3-384 hash:	2e4ce59f5bfc0758a9c9637a64df63d69e70488f4b8c27e4ce39f5a1e96c356c33ffac4e8a4f1081065b9b1f66c2f78d
SHA1 hash:	529ee4de1e5c584d0837eeda905e8471e0dde492
MD5 hash:	e8594758876a61fa4c1c3a82be63f476
humanhash:	helium-high-hydrogen-leopard
File name:	weed
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'493 bytes
First seen:	2026-08-29 06:09:50 UTC
Last seen:	2026-08-29 17:51:54 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p59W50rdW5qNIltW5XkKDCW5CW5bxW5Hw/deW59W5vycwnW5Hw/deW5YhVH8R:p2LgNIieKDn1SVw/dz+jVw/dzPR
TLSH	T1A331F9DB28529980C08A9AAD313D9855D130C1DF4ABF9BC09DDE2DBEC0ACEFC7135608
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.220.3.140/ri/la.bot.arm	f85299205e1596ab621b06343f49a58606ae480ea3a7460d9db11de62fdc97bc	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm5	8ecb1ac8be0165ab2d27abf995719a59154f5516f9408271475f52b68c640c7b	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm6	1a644b96e353f644bd85ee3c195635f749c93130f99afe544a5b624b2d987db9	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm7	1a644b96e353f644bd85ee3c195635f749c93130f99afe544a5b624b2d987db9	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.mips	e1419805e587355ca7d9d0be4faeebc4fa0e683600a62e282af58f0b88e2ba27	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.mipsel	c000f4ff8aaa12a0bc5216b658d447405a4fb3ac67d5d7dafea45751e910e8bf	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.powerpc	addec310024be796b4e327aa586b0bcad080a09cdd4c654ee70d6d0896eff568	Mirai	elf mirai
http://31.220.3.140/ri/la.bot.m68k	0b63ad7fbb676f27359d28c2c9ab4465e6e81d3765e3931541fe3b97f39e6ecd	Mirai	elf
http://31.220.3.140/ri/la.bot.x86_64	589b4a0dda2510fba387e41677898bb4d596f8676944fb24b3130f5434d0c04c	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.sparc	1995363af372df9ae64a2b641234ee8870b908702bb7b15c8dec92b52da6d0ee	Mirai	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-29T03:32:00Z UTC

Last seen:

2026-08-31T03:41:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/74923e4db01d6c089eb474dbd20a2f2f7fd7a21edb9970463f119c4a4d660aa1/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/28e522bb-e89e-4b9b-99d0-25fb7ecbb45b

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/74923e4db01d6c089eb474dbd20a2f2f7fd7a21edb9970463f119c4a4d660aa1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/74923e4db01d6c089eb474dbd20a2f2f7fd7a21edb9970463f119c4a4d660aa1/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2026-08-29 06:03:07 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=osjd4tnqdvwarhvuotn5ecrpf575piq63omxarr7cgoeutlgbkqq._file

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260829-gw843awhjh/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Unexpected DNS network traffic destination

Contacts a large (37651) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/74923e4db01d6c089eb474dbd20a2f2f7fd7a21edb9970463f119c4a4d660aa1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh