MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 791076f484b2d1c719fedc6d80dae349e3c817ec6cc2bda7e79da30118c554dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	791076f484b2d1c719fedc6d80dae349e3c817ec6cc2bda7e79da30118c554dd
SHA3-384 hash:	65ad861032f2539d45dd9e3117180ff8b655b711cba24a84dea929036a6c4dd74c371b57364104a08f76c188c9dc7509
SHA1 hash:	f28c0760886e7f21d1f47eca4f7df792200463c5
MD5 hash:	c3d71863a47e37abe1cf720913bf4058
humanhash:	snake-oranges-indigo-mirror
File name:	to
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'418 bytes
First seen:	2026-05-26 03:45:41 UTC
Last seen:	2026-05-26 04:19:39 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:vPKGuwyDwLNIWQ/wEzK2wgR/w9HWKYwAyW5wB7PKCy6LNIWQmEzKRgRm9HWyjAyA:XSuQZzPRYHWgNjQ0Qfz5RKHW2b8
TLSH	T1E921F8AD0873D4FB9E195A0172637405D24FE1F15378C72C68190C33A49FA316D6AAF9
Magika	javascript
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://85.239.151.41/gbhnj.arm	d7e7a36a49d4f9dc77413f69310c572c09523167e45d6ad0de0a2d449a28cd7d	Mirai	arm elf mirai opendir ua-wget
http://85.239.151.41/gbhnj.arm5	ede275f0c055a98c48b1c89ad5df875296136b4472659ca74f68137b986c60e0	Mirai	arm elf mirai opendir ua-wget
http://85.239.151.41/gbhnj.arm6	4002173ecdb571c78392c5d7f541d29da96b2b5e439b506b1524975b69eb7e7e	Mirai	arm elf mirai opendir ua-wget
http://85.239.151.41/gbhnj.arm7	599163df3c7bfa0e5495a557fab7e27ae27f701d500c7a0d3e641c0a5d39b56d	Mirai	arm elf mirai opendir ua-wget
http://85.239.151.41/gbhnj.mips	23569d2456ed3c7b435647eaa5ac12aa797eba408cbfbca57d5f61af45d713eb	Mirai	elf mips mirai opendir ua-wget
http://85.239.151.41/gbhnj.mpsl	513574a81074cd82b3a9f87d0c8c4fb2a4c99f4db44e14b1f4fa8413f2ad0577	Mirai	elf mips mirai opendir ua-wget
http://85.239.151.41/gbhnj.x86	bdfb82c74f3b88c66a03c49e53eb74117025fab26adceffe483019973dd2f619	Mirai	elf mirai opendir ua-wget x86
http://85.239.151.41/gbhnj.arc	b35229df8a3fa6327897e9269db8e7e59bfe9cea7e6f11eeb32a3d6decf1c937	Mirai	arc elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Shell.Downloader.Gen-1.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a15471f46e44aecc0bbd3d6/reports/a7c99617-14b7-42b8-90fd-4e81cee1a5db/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-05-26T01:16:00Z UTC

Last seen:

2026-05-26T07:11:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.gen

Link:

https://opentip.kaspersky.com/791076f484b2d1c719fedc6d80dae349e3c817ec6cc2bda7e79da30118c554dd/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2335782e-40e4-4b05-961e-04179d94b2d8

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/791076f484b2d1c719fedc6d80dae349e3c817ec6cc2bda7e79da30118c554dd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/791076f484b2d1c719fedc6d80dae349e3c817ec6cc2bda7e79da30118c554dd/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/791076f484b2d1c719fedc6d80dae349e3c817ec6cc2bda7e79da30118c554dd

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-05-26 04:21:03 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=peihn5eewli4ogp63rwybwxdjhr4qf7mntbl3j7htwrqcggfktoq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260526-eyshzsbw9m/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/791076f484b2d1c719fedc6d80dae349e3c817ec6cc2bda7e79da30118c554dd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh