MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82ae5ea133f03ac753e74a7d777f5f7e1c4b654c618b6d88ce03e5e4da9898d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	82ae5ea133f03ac753e74a7d777f5f7e1c4b654c618b6d88ce03e5e4da9898d2
SHA3-384 hash:	1ed19b569a329a40900253a94043db9da08f53a54c411901c6c6a598defdda0031acfa8889e41a9c37c2577189a40364
SHA1 hash:	f3f47b818c647686f123cbe7dd807f69d25caca4
MD5 hash:	5ee6e5e194ce693123c88d8c7dea37a7
humanhash:	victor-oxygen-kilo-shade
File name:	82ae5ea133f03ac753e74a7d777f5f7e1c4b654c618b6d88ce03e5e4da9898d2.bin
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'051 bytes
First seen:	2026-09-02 00:32:07 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:EIbr5zOt+MB0k0+kdzP5nP5nkdz0IHkdzYZIHkdzYSkdC:xr5CEA0k0+kdzPdP9kdzHHkdzYZIHkdn
TLSH	T12E110ACF00D14C7128564DDBF7939924B586C5CE19C74EC9628B1E25F098D047869F6E
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	Tuxxin
Tags:	mirai script sh whack.sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://93.114.194.171/d/arm	6dd4c220510b1bd8294bb1fc9f1ab1255de175c9abaf6e5ebb5dc6eff86b5e0f	Mirai	censys elf mirai ua-wget
http://93.114.194.171/d/arm5	519037610d98b91631793c846e7ee2a362e6a719369711aa35ea05db81d7d83a	Mirai	censys elf mirai ua-wget
http://93.114.194.171/d/arm7	95a3c5a49abbd3d8bd686fcb8c68fe7318277acab933b6c178a11d592ebdab4c	Mirai	censys elf mirai ua-wget
http://93.114.194.171/d/mips	66c2cd61658c31671992e1a0d1664c6cdf478ed935c5079d5b6e835fdeabbe53	Mirai	censys elf gafgyt mirai ua-wget
http://93.114.194.171/d/mipsel	1a1c4f3e11fb296e0431e5603f3a0852cab06155814c67d453601ec851228e2b	Mirai	censys elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.32150.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox downloader dropper masquerade mirai

Link:

https://www.filescan.io/uploads/6a976e8fb8187d158601f9b6/reports/6b874f82-03ad-4ee8-92a9-32a4ae41d46c/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-01T20:05:00Z UTC

Last seen:

2026-09-03T20:11:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/82ae5ea133f03ac753e74a7d777f5f7e1c4b654c618b6d88ce03e5e4da9898d2/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/345fee01-09e0-4877-b354-a16632f2e0e1

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/82ae5ea133f03ac753e74a7d777f5f7e1c4b654c618b6d88ce03e5e4da9898d2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/82ae5ea133f03ac753e74a7d777f5f7e1c4b654c618b6d88ce03e5e4da9898d2/

Threat name:

Win32.Trojan.Malgent

Status:

Malicious

First seen:

2026-09-02 00:32:28 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qkxf5ijt6a5mou7hjj6xo727pyoewzkmmgfw3cgoaps6jwuytdja._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260902-avqsrst1hy/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Changes its process name

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.06

Link:

https://yomi.yoroi.company/submissions/82ae5ea133f03ac753e74a7d777f5f7e1c4b654c618b6d88ce03e5e4da9898d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	NSVPS_Mirai_Busybox_Staging Create hunting rule
Author:	sanad (NSVPS-SOC)
Description:	Mirai-style busybox wget/tftp payload staging seen in NSVPS honeypot