MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d479a9f348ca2f64e26a75eb1ac5451cc98d2a2919973b700f4eaabc5678ccc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	7d479a9f348ca2f64e26a75eb1ac5451cc98d2a2919973b700f4eaabc5678ccc
SHA3-384 hash:	439724cadac8847af57198ff9a7b2fd25a0a52f8ab51371d7ac53c75acf966eae42ff15062a14f2426a894ee1e78c034
SHA1 hash:	6d192170a1946ed06671c9f9d8800621b22b4fa9
MD5 hash:	3856377fc629e356ef03dbb441741073
humanhash:	stairway-michigan-uranus-grey
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'045 bytes
First seen:	2026-10-04 07:04:40 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:siVTxCWEfNI9kxwAEySKxWHFxRI4qKAaGoBWnXPCRoeVn68x7+cAGJeqyFUv:XhONIq+Kxi1xrfWG4GJv
TLSH	T1B51159CC3254A684041ECEC6375D4D0CA2449EE0E8D49B39A89E0EB77AD6F24FD45F1D
Magika	txt
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://143.20.154.42/bins/bot.arm	n/a	n/a	elf ua-wget
http://143.20.154.42/bins/bot.arm5	749b170f0b22c17e812bc46a2eae2bd2aa262107e1ad8b82a5685cb6f1485504	Mirai	cowrie honeypot
http://143.20.154.42/bins/bot.arm6	a5a3748bd02cd2fdd437f1951ab8649107d76c942f9717a4197fcd5e0a2ab09f	Mirai	cowrie honeypot
http://143.20.154.42/bins/bot.arm7	c680d68751452168707fb5235bacbcfe766bb34ad2b7d14f04c4746a14c1735a	Mirai	cowrie honeypot
http://143.20.154.42/bins/bot.sh4	3e5ecb384cf34e56b7b77db65dc2d3780b0e192aa174a5c34efaa678a5e59b44	Mirai	elf ua-wget
http://143.20.154.42/bins/bot.arc	07fc2e0cdebffaa01fb8bdccdb16e89db4653b6d0bfa56d182c31e0ceff82282	Mirai	cowrie honeypot
http://143.20.154.42/bins/bot.mips	9d95e2ad6eff4c6763624ee22b30e593e3cc437dcac1ea507bdd4b4bfb1d3c70	Mirai	cowrie honeypot
http://143.20.154.42/bins/bot.mpsl	1edf639a68f13c8be1f3ad91f7687953c4c49d7988903e8edfb3fd2a6fdc14a7	Mirai	elf ua-wget
http://143.20.154.42/bins/bot.ppc	7de3374ebf3967054093d99ecd0df2cdea9db5edf1634b5bbd216c59842af244	Mirai	elf ua-wget
http://143.20.154.42/bins/bot.x86	e3c4eab8fdd4782669a2101e8ead8fabf8f24f65da4099e31be43b4fc5c32658	Mirai	elf ua-wget
http://143.20.154.42/bins/bot.spc	5abf5f183d69b05feed570c1c52fb216fa0aeab4a714e7bebbad1f885251184c	Mirai	elf ua-wget
http://143.20.154.42/bins/bot.m68k	af750bda6c631c6dd416775b92a14b558ddfec18ce5721c9cde4b8bb222450ed	Mirai	cowrie honeypot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30762.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6ac1fab99b7eea2e048d3ff2/reports/d81a745b-228f-446d-8510-3b71fa134e0c/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/bf929954-b7e6-49c3-afc7-0c10841a80fa

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7d479a9f348ca2f64e26a75eb1ac5451cc98d2a2919973b700f4eaabc5678ccc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7d479a9f348ca2f64e26a75eb1ac5451cc98d2a2919973b700f4eaabc5678ccc/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-10-03 22:53:20 UTC

File Type:

Text (Shell)

AV detection:

16 of 36 (44.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pvdzvhzursrpmtrgu5pldlcukhgjruvcsgmxhnya6tvkxrlhrtga._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261004-hwpabsxs9q/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7d479a9f348ca2f64e26a75eb1ac5451cc98d2a2919973b700f4eaabc5678ccc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh