MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 770db614b0e7b3cd571f12eb94bc8b06c7c151f37c4ecc41656476bbb4d3084e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	770db614b0e7b3cd571f12eb94bc8b06c7c151f37c4ecc41656476bbb4d3084e
SHA3-384 hash:	8128f3482d4b3533df4df30ceb48847c33b14b82155eea512a9e16cf7f181356ee04dfdfc1096024562d6e886bfce1ef
SHA1 hash:	6ec536fa006254cfe7c1a10b096832e29b030c43
MD5 hash:	44f4dafb99216514a2d1476e4303f59f
humanhash:	washington-berlin-bulldog-victor
File name:	lil
Download:	download sample
Signature	Mirai Create hunting rule
File size:	848 bytes
First seen:	2026-07-03 01:59:52 UTC
Last seen:	2026-07-03 13:15:23 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:kXCKysE2hi0ziQvZohaIjSIFD/X5yjVq9NOX:e9Qp+MsI2IFD/XExqNOX
TLSH	T1E901C2C68650BD4080AADA1D25976458F861C3CF16468F74FF6C6D7DEBA8C04B027F98
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://129.121.114.124/E8mc	c71b437679db06f6f7bda909fdde306aa0080047fa6b3d63ba0cf0b66cdd062d	Mirai	elf mirai ua-wget
http://129.121.114.124/TwnE	5346c531627987f260c115b3839aeb729cdc1d43ab2fe79f522b8da6672e3bf7	Mirai	elf mirai ua-wget
http://129.121.114.124/fO0	1b68b78ec310e5043964aefd6b72c217b29b79ba8e372a939994b9264b2a4d31	Mirai	elf mirai ua-wget
http://129.121.114.124/Jvbm	609ebd0f88a38653e61a25d6d68ec130c006eafb891085b7ce6dbcb299dfdc61	Mirai	elf mirai ua-wget
http://129.121.114.124/0Rw	55a195fd83d3cbe9a5d0b4f88c59833776d32a65e807d137bcfa4f9a7c8e1f12	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a4717d609a84fd02da3b0ad/reports/d339e4ef-f496-4607-82f0-c3717effd53c/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-02T23:10:00Z UTC

Last seen:

2026-07-04T18:52:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/770db614b0e7b3cd571f12eb94bc8b06c7c151f37c4ecc41656476bbb4d3084e/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e31a06a1-bf24-47ee-8eb4-c4823c57bc7d

Behavior Graph:

Download SVG

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/770db614b0e7b3cd571f12eb94bc8b06c7c151f37c4ecc41656476bbb4d3084e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/770db614b0e7b3cd571f12eb94bc8b06c7c151f37c4ecc41656476bbb4d3084e/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/770db614b0e7b3cd571f12eb94bc8b06c7c151f37c4ecc41656476bbb4d3084e

Threat name:

Document-HTML.Trojan.Bash

Status:

Malicious

First seen:

2026-07-03 02:01:04 UTC

File Type:

Text (Shell)

AV detection:

11 of 23 (47.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o4g3mffq46z42vy7clvzjpela3d4cuptprhmyqlfmr3lxngtbbha._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260703-cfgmnaey8j/

Behaviour

Reads runtime system information

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/770db614b0e7b3cd571f12eb94bc8b06c7c151f37c4ecc41656476bbb4d3084e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.