MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 809b34d42da4c0b6cbd18acde982ed2a3893f37e9191e043ed52e5dec7cfd1df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 809b34d42da4c0b6cbd18acde982ed2a3893f37e9191e043ed52e5dec7cfd1df
SHA3-384 hash: 78fa653f7cd4b2cc03cec14c07c2bbadced30d3e4bca7e801a86ded68b35dec3830574a4ecf3c4db39500308b1d2573c
SHA1 hash: bbea8880865855222c67573d3736413c43c6056e
MD5 hash: a36e8139dd12763487db917521a55f3f
humanhash: alpha-washington-maryland-mango
File name:w.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'330 bytes
First seen:2026-01-05 12:23:42 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:cUh8se58rNIf18RKbW8OH8kS8dYD8kS8o/zgBl8wj8Q2g8k8HR:/hne5B1QmW5HfSGYDHSb/zgBlbjDNH8x
TLSH T1A92171CF1156963205CC9EC7B45B64C42A4449F367BE0AE5558B84B753C5F1C37C6E04
Magika txt
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://130.12.180.132/bins/87sbhas6as.arme772ce7b80a5d0914cba2df2489f2d76a7116a646bc44c526dc1647b3112d7b6 Miraiarm elf geofenced mirai opendir ua-wget USA
http://130.12.180.132/bins/87sbhas6as.arm5n/an/aarm elf geofenced mirai opendir ua-wget USA
http://130.12.180.132/bins/87sbhas6as.arm6a9b1f9e79de3b9f3cad71dfcde8edf81db29de8a3fe2a1789558e859b3c7c34d Miraiarm elf geofenced mirai opendir ua-wget USA
http://130.12.180.132/bins/87sbhas6as.arm7d17b691f1154d80f24baac8c7e56a61e9802e5528c396277c07916a51683136d Miraiarm elf geofenced mirai opendir ua-wget USA
http://130.12.180.132/bins/87sbhas6as.m68kc14d198279d75d641372771beb25c299662461a09163bcf7e454f8313211125b Miraielf geofenced m68k mirai opendir ua-wget USA
http://130.12.180.132/bins/87sbhas6as.mipsn/an/aelf geofenced mips mirai opendir ua-wget USA
http://130.12.180.132/bins/87sbhas6as.mpslc6e76ea7bd94127ac850f04a940417c33b48a85700674355886b40211fdc0ca4 Miraielf geofenced mips mirai opendir ua-wget USA
http://130.12.180.132/bins/87sbhas6as.ppc288678508dcaee6e8488754d6c13360ea49e69cbe7ef6d31bd2e25a2d87e7119 Miraielf geofenced mirai opendir PowerPC ua-wget USA
http://130.12.180.132/bins/87sbhas6as.sh4489420255947ccffbdeb5e152807b910a329cb9ca9c9a78a7f290cbbf96735b5 Miraielf geofenced mirai opendir SuperH ua-wget USA
http://130.12.180.132/bins/87sbhas6as.spce95f1cf56783fbc0b64f8a670aaa34db9ea36efb87f3d607d07962b5c24af03e Miraielf geofenced mirai opendir sparc ua-wget USA
http://130.12.180.132/bins/87sbhas6as.x8617cda7b9073c8d6dbf1d518d810a5b5bf67ee2f1b45e8b24f391b107ab6f42c1 Miraielf geofenced mirai opendir ua-wget USA x86
http://130.12.180.132/bins/87sbhas6as.x86_64n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox mirai
Link:
https://www.filescan.io/uploads/695bad71127d6a14e0d0e56b/reports/01b49836-add3-41f2-9289-a949fda3d9bc/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-01-05T09:41:00Z UTC
Last seen:
2026-01-06T04:26:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.cl
Link:
https://opentip.kaspersky.com/809b34d42da4c0b6cbd18acde982ed2a3893f37e9191e043ed52e5dec7cfd1df/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/790b4d3f-674b-4bc9-9b54-6e321b60089b
Behavior Graph:
Download SVG
%3 guuid=0aaf13f0-1900-0000-1971-60e3210c0000 pid=3105 /usr/bin/sudo guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111 /tmp/sample.bin guuid=0aaf13f0-1900-0000-1971-60e3210c0000 pid=3105->guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111 execve guuid=785fcef1-1900-0000-1971-60e3290c0000 pid=3113 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=785fcef1-1900-0000-1971-60e3290c0000 pid=3113 execve guuid=9afec7f4-1900-0000-1971-60e3330c0000 pid=3123 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=9afec7f4-1900-0000-1971-60e3330c0000 pid=3123 execve guuid=5de219f5-1900-0000-1971-60e3350c0000 pid=3125 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=5de219f5-1900-0000-1971-60e3350c0000 pid=3125 clone guuid=83efdaf6-1900-0000-1971-60e33b0c0000 pid=3131 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=83efdaf6-1900-0000-1971-60e33b0c0000 pid=3131 execve guuid=9f86a5f9-1900-0000-1971-60e3450c0000 pid=3141 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=9f86a5f9-1900-0000-1971-60e3450c0000 pid=3141 execve guuid=6d1e05fa-1900-0000-1971-60e3470c0000 pid=3143 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=6d1e05fa-1900-0000-1971-60e3470c0000 pid=3143 clone guuid=7c91c3fa-1900-0000-1971-60e34b0c0000 pid=3147 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=7c91c3fa-1900-0000-1971-60e34b0c0000 pid=3147 execve guuid=ccc105fe-1900-0000-1971-60e3530c0000 pid=3155 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=ccc105fe-1900-0000-1971-60e3530c0000 pid=3155 execve guuid=e0a153fe-1900-0000-1971-60e3540c0000 pid=3156 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=e0a153fe-1900-0000-1971-60e3540c0000 pid=3156 clone guuid=cd76ccfe-1900-0000-1971-60e3570c0000 pid=3159 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=cd76ccfe-1900-0000-1971-60e3570c0000 pid=3159 execve guuid=1349b901-1a00-0000-1971-60e35f0c0000 pid=3167 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=1349b901-1a00-0000-1971-60e35f0c0000 pid=3167 execve guuid=b0260602-1a00-0000-1971-60e3600c0000 pid=3168 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=b0260602-1a00-0000-1971-60e3600c0000 pid=3168 clone guuid=d1408903-1a00-0000-1971-60e3620c0000 pid=3170 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=d1408903-1a00-0000-1971-60e3620c0000 pid=3170 execve guuid=13437806-1a00-0000-1971-60e3670c0000 pid=3175 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=13437806-1a00-0000-1971-60e3670c0000 pid=3175 execve guuid=13ddc806-1a00-0000-1971-60e3690c0000 pid=3177 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=13ddc806-1a00-0000-1971-60e3690c0000 pid=3177 clone guuid=a4504507-1a00-0000-1971-60e36c0c0000 pid=3180 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=a4504507-1a00-0000-1971-60e36c0c0000 pid=3180 execve guuid=11e92c0a-1a00-0000-1971-60e36f0c0000 pid=3183 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=11e92c0a-1a00-0000-1971-60e36f0c0000 pid=3183 execve guuid=8601700a-1a00-0000-1971-60e3700c0000 pid=3184 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=8601700a-1a00-0000-1971-60e3700c0000 pid=3184 clone guuid=2b1f080b-1a00-0000-1971-60e3720c0000 pid=3186 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=2b1f080b-1a00-0000-1971-60e3720c0000 pid=3186 execve guuid=3ccf6014-1a00-0000-1971-60e3790c0000 pid=3193 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=3ccf6014-1a00-0000-1971-60e3790c0000 pid=3193 execve guuid=2263c814-1a00-0000-1971-60e37a0c0000 pid=3194 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=2263c814-1a00-0000-1971-60e37a0c0000 pid=3194 clone guuid=21ba4d15-1a00-0000-1971-60e37c0c0000 pid=3196 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=21ba4d15-1a00-0000-1971-60e37c0c0000 pid=3196 execve guuid=50e60618-1a00-0000-1971-60e3830c0000 pid=3203 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=50e60618-1a00-0000-1971-60e3830c0000 pid=3203 execve guuid=f7313f18-1a00-0000-1971-60e3850c0000 pid=3205 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=f7313f18-1a00-0000-1971-60e3850c0000 pid=3205 clone guuid=6fe81319-1a00-0000-1971-60e3870c0000 pid=3207 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=6fe81319-1a00-0000-1971-60e3870c0000 pid=3207 execve guuid=3de41a1c-1a00-0000-1971-60e3880c0000 pid=3208 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=3de41a1c-1a00-0000-1971-60e3880c0000 pid=3208 execve guuid=bb66921c-1a00-0000-1971-60e3890c0000 pid=3209 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=bb66921c-1a00-0000-1971-60e3890c0000 pid=3209 clone guuid=0b32821d-1a00-0000-1971-60e38b0c0000 pid=3211 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=0b32821d-1a00-0000-1971-60e38b0c0000 pid=3211 execve guuid=d97f7820-1a00-0000-1971-60e38c0c0000 pid=3212 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=d97f7820-1a00-0000-1971-60e38c0c0000 pid=3212 execve guuid=af2de020-1a00-0000-1971-60e38d0c0000 pid=3213 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=af2de020-1a00-0000-1971-60e38d0c0000 pid=3213 clone guuid=ea8ea821-1a00-0000-1971-60e38f0c0000 pid=3215 /usr/bin/busybox net send-data write-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=ea8ea821-1a00-0000-1971-60e38f0c0000 pid=3215 execve guuid=45600525-1a00-0000-1971-60e3900c0000 pid=3216 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=45600525-1a00-0000-1971-60e3900c0000 pid=3216 execve guuid=c4c65f25-1a00-0000-1971-60e3910c0000 pid=3217 /home/sandbox/87sbhas6as.x86 guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=c4c65f25-1a00-0000-1971-60e3910c0000 pid=3217 execve guuid=f0b3af25-1a00-0000-1971-60e3940c0000 pid=3220 /usr/bin/busybox net send-data guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=f0b3af25-1a00-0000-1971-60e3940c0000 pid=3220 execve guuid=4bccde27-1a00-0000-1971-60e3950c0000 pid=3221 /usr/bin/chmod guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=4bccde27-1a00-0000-1971-60e3950c0000 pid=3221 execve guuid=50294a28-1a00-0000-1971-60e3960c0000 pid=3222 /usr/bin/dash guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=50294a28-1a00-0000-1971-60e3960c0000 pid=3222 clone guuid=e52f7128-1a00-0000-1971-60e3970c0000 pid=3223 /usr/bin/rm delete-file guuid=ecff9bf1-1900-0000-1971-60e3270c0000 pid=3111->guuid=e52f7128-1a00-0000-1971-60e3970c0000 pid=3223 execve b104693e-fe28-56dc-bd48-05d8322e6f3c 130.12.180.132:80 guuid=785fcef1-1900-0000-1971-60e3290c0000 pid=3113->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 96B guuid=83efdaf6-1900-0000-1971-60e33b0c0000 pid=3131->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 97B guuid=7c91c3fa-1900-0000-1971-60e34b0c0000 pid=3147->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 97B guuid=cd76ccfe-1900-0000-1971-60e3570c0000 pid=3159->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 97B guuid=d1408903-1a00-0000-1971-60e3620c0000 pid=3170->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 97B guuid=a4504507-1a00-0000-1971-60e36c0c0000 pid=3180->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 97B guuid=2b1f080b-1a00-0000-1971-60e3720c0000 pid=3186->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 97B guuid=21ba4d15-1a00-0000-1971-60e37c0c0000 pid=3196->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 96B guuid=6fe81319-1a00-0000-1971-60e3870c0000 pid=3207->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 96B guuid=0b32821d-1a00-0000-1971-60e38b0c0000 pid=3211->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 96B guuid=ea8ea821-1a00-0000-1971-60e38f0c0000 pid=3215->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 96B guuid=76268a25-1a00-0000-1971-60e3920c0000 pid=3218 /home/sandbox/87sbhas6as.x86 net send-data zombie guuid=c4c65f25-1a00-0000-1971-60e3910c0000 pid=3217->guuid=76268a25-1a00-0000-1971-60e3920c0000 pid=3218 clone 3cfa5d04-5ede-5a5b-909b-9687ce977796 130.12.180.134:33966 guuid=76268a25-1a00-0000-1971-60e3920c0000 pid=3218->3cfa5d04-5ede-5a5b-909b-9687ce977796 send: 15B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=76268a25-1a00-0000-1971-60e3920c0000 pid=3218->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f1a69625-1a00-0000-1971-60e3930c0000 pid=3219 /home/sandbox/87sbhas6as.x86 guuid=76268a25-1a00-0000-1971-60e3920c0000 pid=3218->guuid=f1a69625-1a00-0000-1971-60e3930c0000 pid=3219 clone guuid=f0b3af25-1a00-0000-1971-60e3940c0000 pid=3220->b104693e-fe28-56dc-bd48-05d8322e6f3c send: 99B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/809b34d42da4c0b6cbd18acde982ed2a3893f37e9191e043ed52e5dec7cfd1df
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/809b34d42da4c0b6cbd18acde982ed2a3893f37e9191e043ed52e5dec7cfd1df/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/809b34d42da4c0b6cbd18acde982ed2a3893f37e9191e043ed52e5dec7cfd1df
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-01-05 12:24:17 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qcntjvbnutalns6rrlg6taxnfi4jh436sgi6aq7nkls55r6p2hpq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260105-plcl4sft8f/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/809b34d42da4c0b6cbd18acde982ed2a3893f37e9191e043ed52e5dec7cfd1df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 809b34d42da4c0b6cbd18acde982ed2a3893f37e9191e043ed52e5dec7cfd1df

(this sample)

Mirai

elf 0a5c6c6d1c5429756c7e36e37dffba78ccb79dfc34ee191415382c4075d7355e

Mirai

elf e772ce7b80a5d0914cba2df2489f2d76a7116a646bc44c526dc1647b3112d7b6

  
URLhaus
https://urlhaus.abuse.ch/url/3750678/
  
Delivery method
Distributed via web download
  
Dropping
MD5 3ad077e246e4ed8b83f975e2e30b969b
  
Dropping
SHA256 e772ce7b80a5d0914cba2df2489f2d76a7116a646bc44c526dc1647b3112d7b6

Comments