MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88fe5b2ca7f722b5922170c3139b824770f73696a3cfe1b4babf1250b01f5f77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	88fe5b2ca7f722b5922170c3139b824770f73696a3cfe1b4babf1250b01f5f77
SHA3-384 hash:	448eaaffad287a009812a5c81a720c1403a37540e7087f3b07b19bef1cf4a2e60202d101e64382a4df9c618bee7d6442
SHA1 hash:	ebf6825cd48541266a0afaa6fa72afb62c1af95d
MD5 hash:	0b4bb972bbab554aa4342962fe4a561d
humanhash:	single-fourteen-california-saturn
File name:	massload
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'978 bytes
First seen:	2026-03-26 19:50:14 UTC
Last seen:	2026-03-27 07:13:02 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:rhL8QoEMpzaC56VpNpnpo3pox8kZ8mjoBp0plpoVpo/CyHOvHO8zWo3gKS7gS0QX:rhnp8+s62Rt3Bdi
TLSH	T12B512EF83F9597376782CF0670638A1DB41FAEF494A88E586C5F3CA9DCBCA04701459A
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.57.201.154/mips	04e21cacf2978094e4d6874abb7ecd61af394570a744d3fc50309eb9cc74a9ae	Mirai	elf mips mirai ua-wget
http://31.57.201.154/mpsl	32e4725e4ca7048ac4bd253155778a4ec657c55a5586aa90eda49409a3e7e8d8	Mirai	elf mips mirai ua-wget
http://31.57.201.154/arm4	fb342f73d272353e855771fc8cc4c7aea86348c3e6e8fbcdc356ad066b7bff2c	Mirai	arm elf mirai ua-wget
http://31.57.201.154/arm5	43b14f66dd5aab907c0937502ff0f4655066534799b22343198c1778757f311c	Mirai	arm elf mirai ua-wget
http://31.57.201.154/arm7	17c5f13da5b62b155dd973f9062f12061687cc44ee9150d42871005ab5b9c4b5	Mirai	arm elf mirai ua-wget

Intelligence

File Origin

# of uploads :

143

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox mirai

Link:

https://www.filescan.io/uploads/69c63029be4fad62665cc737/reports/81c5d24c-90cb-4572-a4d7-5aa1f7624b52/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/76380dd2-48a8-462e-8cbb-6aa454d88259

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/88fe5b2ca7f722b5922170c3139b824770f73696a3cfe1b4babf1250b01f5f77

Gathering data

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2026-03-27 05:18:24 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rd7fwlfh64rllerbodbrhg4ci5yponuwuph6dnf2x4jfbma7l53q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.32

Link:

https://yomi.yoroi.company/submissions/88fe5b2ca7f722b5922170c3139b824770f73696a3cfe1b4babf1250b01f5f77

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh