MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a6f1135fc2c48b4fe2de478e87dc158b78b708c7879ba6a0bca58087434fe27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a6f1135fc2c48b4fe2de478e87dc158b78b708c7879ba6a0bca58087434fe27
SHA3-384 hash: fc55d5ebc051e368043cc448efcafbdc70ab4a7f589238c32f4dccb15b92d074391acdf76edae2c98392d6f303976dd9
SHA1 hash: e2cf8a874d193b91a2d06cc7cffd93a19756d95c
MD5 hash: efb11e6c6b2d00aef0c5002cc601846f
humanhash: victor-fifteen-bakerloo-arizona
File name:wget.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:825 bytes
First seen:2026-09-01 05:14:44 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 12:+f22j+lf2oq+lf2UNNIl5zA+lf2d0LKj+lf2TgOs+lf2leC+lf2PON/+lf2nSE+J:q/G1tzNI7fTKGX8bF1qmC/tBTYZEjxn
TLSH T19301CCCD26916147C56CCD08746F8A04964683C6F4BB5E1EEC8868FB9CD5708F069F4B
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.206/bins/arm42ebea5ca669eae9043edca463c69a690a32317db6ae57c76b1453d58632e402 Miraimirai ua-wget
http://176.65.139.206/bins/arm5a1faf2b491e419e489ddba998d76fa1727280dd3c6ad36245dbadc8eade33b5a Miraimirai ua-wget
http://176.65.139.206/bins/arm6c96943e73a2933970fd9a19ed41c49eaf5388702b5cf6b71a5db6ff178399b16 Miraimirai ua-wget
http://176.65.139.206/bins/arm79e6a0d9a92fd4677bc8c385b122ae73cfa53338a00e1871d03badd7eb44a9140 Miraimirai ua-wget
http://176.65.139.206/bins/m68kf6d147b56b72a89e08ac0133ef10fe52a92c9c2887b61331adfc397fc5163890 Miraimirai ua-wget
http://176.65.139.206/bins/mips150972b5dcc9044403fe06fd737ee919b5fdccde2727e198d55c2205a422050b Miraimirai ua-wget
http://176.65.139.206/bins/mpsl06667d9c74f1394d350601694a3ff107ad81d078bd37ecd5c126cc240983b5b4 Miraimirai ua-wget
http://176.65.139.206/bins/ppcaf843e6ea196cdeec80d2ed9313e5ceeb63794db9d0cac6b6071643fc469da23 Miraimirai ua-wget
http://176.65.139.206/bins/sh4510c4e2bdddbd218ba7f108f89f941fa709b067a97415ccab2cdc66f05510422 Miraimirai ua-wget
http://176.65.139.206/bins/spcn/an/an/a
http://176.65.139.206/bins/x863b97184a7fd015b8d1da8936513d8881be85dda9be0254922a2bee9170076384 Miraimirai ua-wget
http://176.65.139.206/bins/x86_64n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader mirai
Link:
https://www.filescan.io/uploads/6a965f6690e453b113d728d7/reports/d21974b1-c7d1-45c2-ae99-30a169f95271/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4accbfe1-7aa8-4e09-a794-fe7c3e66ab5d
Behavior Graph:
Download SVG
%3 guuid=a27b5cc5-1600-0000-5f32-a7b9700d0000 pid=3440 /usr/bin/sudo guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444 /tmp/sample.bin guuid=a27b5cc5-1600-0000-5f32-a7b9700d0000 pid=3440->guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444 execve guuid=21b23dc7-1600-0000-5f32-a7b9760d0000 pid=3446 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=21b23dc7-1600-0000-5f32-a7b9760d0000 pid=3446 execve guuid=aa3d3ccf-1600-0000-5f32-a7b9880d0000 pid=3464 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=aa3d3ccf-1600-0000-5f32-a7b9880d0000 pid=3464 execve guuid=65abbccf-1600-0000-5f32-a7b98a0d0000 pid=3466 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=65abbccf-1600-0000-5f32-a7b98a0d0000 pid=3466 clone guuid=0c39c5d0-1600-0000-5f32-a7b9900d0000 pid=3472 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=0c39c5d0-1600-0000-5f32-a7b9900d0000 pid=3472 execve guuid=2055f4d5-1600-0000-5f32-a7b9a00d0000 pid=3488 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=2055f4d5-1600-0000-5f32-a7b9a00d0000 pid=3488 execve guuid=67843ed6-1600-0000-5f32-a7b9a10d0000 pid=3489 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=67843ed6-1600-0000-5f32-a7b9a10d0000 pid=3489 clone guuid=6021c6d7-1600-0000-5f32-a7b9a80d0000 pid=3496 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=6021c6d7-1600-0000-5f32-a7b9a80d0000 pid=3496 execve guuid=8d8bd6dc-1600-0000-5f32-a7b9bb0d0000 pid=3515 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=8d8bd6dc-1600-0000-5f32-a7b9bb0d0000 pid=3515 execve guuid=54df41dd-1600-0000-5f32-a7b9bf0d0000 pid=3519 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=54df41dd-1600-0000-5f32-a7b9bf0d0000 pid=3519 clone guuid=220480de-1600-0000-5f32-a7b9c50d0000 pid=3525 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=220480de-1600-0000-5f32-a7b9c50d0000 pid=3525 execve guuid=1eae34e3-1600-0000-5f32-a7b9d20d0000 pid=3538 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=1eae34e3-1600-0000-5f32-a7b9d20d0000 pid=3538 execve guuid=3ecc7de3-1600-0000-5f32-a7b9d40d0000 pid=3540 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=3ecc7de3-1600-0000-5f32-a7b9d40d0000 pid=3540 clone guuid=acc4f1e4-1600-0000-5f32-a7b9da0d0000 pid=3546 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=acc4f1e4-1600-0000-5f32-a7b9da0d0000 pid=3546 execve guuid=df2787e9-1600-0000-5f32-a7b9e80d0000 pid=3560 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=df2787e9-1600-0000-5f32-a7b9e80d0000 pid=3560 execve guuid=f47ecce9-1600-0000-5f32-a7b9e90d0000 pid=3561 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=f47ecce9-1600-0000-5f32-a7b9e90d0000 pid=3561 clone guuid=11df6dea-1600-0000-5f32-a7b9eb0d0000 pid=3563 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=11df6dea-1600-0000-5f32-a7b9eb0d0000 pid=3563 execve guuid=9ef43bef-1600-0000-5f32-a7b9ec0d0000 pid=3564 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=9ef43bef-1600-0000-5f32-a7b9ec0d0000 pid=3564 execve guuid=23dca3ef-1600-0000-5f32-a7b9ed0d0000 pid=3565 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=23dca3ef-1600-0000-5f32-a7b9ed0d0000 pid=3565 clone guuid=31e3d2f0-1600-0000-5f32-a7b9ef0d0000 pid=3567 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=31e3d2f0-1600-0000-5f32-a7b9ef0d0000 pid=3567 execve guuid=5e6a12f6-1600-0000-5f32-a7b9f30d0000 pid=3571 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=5e6a12f6-1600-0000-5f32-a7b9f30d0000 pid=3571 execve guuid=33aa6af6-1600-0000-5f32-a7b9f40d0000 pid=3572 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=33aa6af6-1600-0000-5f32-a7b9f40d0000 pid=3572 clone guuid=46f40cf7-1600-0000-5f32-a7b9f90d0000 pid=3577 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=46f40cf7-1600-0000-5f32-a7b9f90d0000 pid=3577 execve guuid=981be1fb-1600-0000-5f32-a7b9000e0000 pid=3584 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=981be1fb-1600-0000-5f32-a7b9000e0000 pid=3584 execve guuid=a2ba5efc-1600-0000-5f32-a7b9010e0000 pid=3585 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=a2ba5efc-1600-0000-5f32-a7b9010e0000 pid=3585 clone guuid=7a1f94fe-1600-0000-5f32-a7b9030e0000 pid=3587 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=7a1f94fe-1600-0000-5f32-a7b9030e0000 pid=3587 execve guuid=72dc5003-1700-0000-5f32-a7b90f0e0000 pid=3599 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=72dc5003-1700-0000-5f32-a7b90f0e0000 pid=3599 execve guuid=3eefab03-1700-0000-5f32-a7b9110e0000 pid=3601 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=3eefab03-1700-0000-5f32-a7b9110e0000 pid=3601 clone guuid=b0a56705-1700-0000-5f32-a7b9160e0000 pid=3606 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=b0a56705-1700-0000-5f32-a7b9160e0000 pid=3606 execve guuid=d3a8e60a-1700-0000-5f32-a7b9250e0000 pid=3621 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=d3a8e60a-1700-0000-5f32-a7b9250e0000 pid=3621 execve guuid=7035d20b-1700-0000-5f32-a7b9290e0000 pid=3625 /usr/bin/dash guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=7035d20b-1700-0000-5f32-a7b9290e0000 pid=3625 clone guuid=fbcd760d-1700-0000-5f32-a7b9330e0000 pid=3635 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=fbcd760d-1700-0000-5f32-a7b9330e0000 pid=3635 execve guuid=25a32e1d-1700-0000-5f32-a7b95c0e0000 pid=3676 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=25a32e1d-1700-0000-5f32-a7b95c0e0000 pid=3676 execve guuid=b754b71e-1700-0000-5f32-a7b95f0e0000 pid=3679 /home/sandbox/x86 net guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=b754b71e-1700-0000-5f32-a7b95f0e0000 pid=3679 execve guuid=d197a696-1700-0000-5f32-a7b91d100000 pid=4125 /usr/bin/wget net send-data write-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=d197a696-1700-0000-5f32-a7b91d100000 pid=4125 execve guuid=57fcc09a-1700-0000-5f32-a7b92b100000 pid=4139 /usr/bin/chmod guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=57fcc09a-1700-0000-5f32-a7b92b100000 pid=4139 execve guuid=fd4ef39a-1700-0000-5f32-a7b92c100000 pid=4140 /home/sandbox/x86_64 net guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=fd4ef39a-1700-0000-5f32-a7b92c100000 pid=4140 execve guuid=57c96712-1800-0000-5f32-a7b9f2110000 pid=4594 /usr/bin/rm delete-file guuid=8a0d0ac7-1600-0000-5f32-a7b9740d0000 pid=3444->guuid=57c96712-1800-0000-5f32-a7b9f2110000 pid=4594 execve 154ae0c8-0a48-5314-8e17-6b610ebcef8a 176.65.139.206:80 guuid=21b23dc7-1600-0000-5f32-a7b9760d0000 pid=3446->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 137B guuid=0c39c5d0-1600-0000-5f32-a7b9900d0000 pid=3472->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 138B guuid=6021c6d7-1600-0000-5f32-a7b9a80d0000 pid=3496->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 138B guuid=220480de-1600-0000-5f32-a7b9c50d0000 pid=3525->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 138B guuid=acc4f1e4-1600-0000-5f32-a7b9da0d0000 pid=3546->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 138B guuid=11df6dea-1600-0000-5f32-a7b9eb0d0000 pid=3563->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 138B guuid=31e3d2f0-1600-0000-5f32-a7b9ef0d0000 pid=3567->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 138B guuid=46f40cf7-1600-0000-5f32-a7b9f90d0000 pid=3577->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 137B guuid=7a1f94fe-1600-0000-5f32-a7b9030e0000 pid=3587->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 137B guuid=b0a56705-1700-0000-5f32-a7b9160e0000 pid=3606->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 137B guuid=fbcd760d-1700-0000-5f32-a7b9330e0000 pid=3635->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 137B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=b754b71e-1700-0000-5f32-a7b95f0e0000 pid=3679->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=22d8361f-1700-0000-5f32-a7b9620e0000 pid=3682 /home/sandbox/x86 guuid=b754b71e-1700-0000-5f32-a7b95f0e0000 pid=3679->guuid=22d8361f-1700-0000-5f32-a7b9620e0000 pid=3682 clone guuid=ca6fed5a-1700-0000-5f32-a7b9330f0000 pid=3891 /home/sandbox/x86 guuid=b754b71e-1700-0000-5f32-a7b95f0e0000 pid=3679->guuid=ca6fed5a-1700-0000-5f32-a7b9330f0000 pid=3891 clone guuid=069b9496-1700-0000-5f32-a7b91a100000 pid=4122 /home/sandbox/x86 guuid=b754b71e-1700-0000-5f32-a7b95f0e0000 pid=3679->guuid=069b9496-1700-0000-5f32-a7b91a100000 pid=4122 clone guuid=7e169896-1700-0000-5f32-a7b91b100000 pid=4123 /home/sandbox/x86 net send-data zombie guuid=b754b71e-1700-0000-5f32-a7b95f0e0000 pid=3679->guuid=7e169896-1700-0000-5f32-a7b91b100000 pid=4123 clone guuid=7e169896-1700-0000-5f32-a7b91b100000 pid=4123->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con a5e769a7-bf1b-548d-90b5-22b4d61a6c57 176.65.139.206:1999 guuid=7e169896-1700-0000-5f32-a7b91b100000 pid=4123->a5e769a7-bf1b-548d-90b5-22b4d61a6c57 send: 324B guuid=d197a696-1700-0000-5f32-a7b91d100000 pid=4125->154ae0c8-0a48-5314-8e17-6b610ebcef8a send: 140B guuid=fd4ef39a-1700-0000-5f32-a7b92c100000 pid=4140->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ddd3019b-1700-0000-5f32-a7b92e100000 pid=4142 /home/sandbox/x86_64 guuid=fd4ef39a-1700-0000-5f32-a7b92c100000 pid=4140->guuid=ddd3019b-1700-0000-5f32-a7b92e100000 pid=4142 clone guuid=a56ca4d6-1700-0000-5f32-a7b91d110000 pid=4381 /home/sandbox/x86_64 guuid=fd4ef39a-1700-0000-5f32-a7b92c100000 pid=4140->guuid=a56ca4d6-1700-0000-5f32-a7b91d110000 pid=4381 clone guuid=b4234e12-1800-0000-5f32-a7b9f0110000 pid=4592 /home/sandbox/x86_64 guuid=fd4ef39a-1700-0000-5f32-a7b92c100000 pid=4140->guuid=b4234e12-1800-0000-5f32-a7b9f0110000 pid=4592 clone guuid=fd065612-1800-0000-5f32-a7b9f1110000 pid=4593 /home/sandbox/x86_64 net send-data zombie guuid=fd4ef39a-1700-0000-5f32-a7b92c100000 pid=4140->guuid=fd065612-1800-0000-5f32-a7b9f1110000 pid=4593 clone guuid=fd065612-1800-0000-5f32-a7b9f1110000 pid=4593->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=fd065612-1800-0000-5f32-a7b9f1110000 pid=4593->a5e769a7-bf1b-548d-90b5-22b4d61a6c57 send: 324B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8a6f1135fc2c48b4fe2de478e87dc158b78b708c7879ba6a0bca58087434fe27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a6f1135fc2c48b4fe2de478e87dc158b78b708c7879ba6a0bca58087434fe27/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rjxrcnp4frelj7rn4r4oq7oblc3yw4empb43u2qlzjmaq5bu7ytq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260901-fxpalsbc89/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 8a6f1135fc2c48b4fe2de478e87dc158b78b708c7879ba6a0bca58087434fe27

(this sample)

Mirai

elf 42ebea5ca669eae9043edca463c69a690a32317db6ae57c76b1453d58632e402

  
URLhaus
https://urlhaus.abuse.ch/url/3910652/
  
Delivery method
Distributed via web download
  
Dropping
MD5 45f5946f171892ea672ed49e7446a5bf
  
Dropping
SHA256 42ebea5ca669eae9043edca463c69a690a32317db6ae57c76b1453d58632e402

Comments