MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90832ad3f8a90b71a4d37f1740bd0f7497adbe9888ce18b026f9cdda54c94ed6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	90832ad3f8a90b71a4d37f1740bd0f7497adbe9888ce18b026f9cdda54c94ed6
SHA3-384 hash:	2bed0f0876070798ade58966e021f8e8f48b2225a2f996424578882d7177e052309f311dcbf68b17c22250d42db6421f
SHA1 hash:	dc32baed55bcb26c6597a0db7ba3cb628a2c7475
MD5 hash:	229feb789ec7eb0d2eee6383c54445f2
humanhash:	september-network-west-sodium
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	588 bytes
First seen:	2026-01-11 02:30:34 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:TJ+d9Fvh2i2Iu3Pi3/3O2mb3olioeLW3qfH8qeFa0LKieY:TJ+zFZ2i9iPi3vObokoeLKKcC0LKVY
TLSH	T154F0D1EF71545B72568CDD8161F2980DA889BAD226E40F6C6FD944A788E0B40FB8CF20
Magika	txt
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.126/mips	26e1c7ac50319b3bacf336cbaaec770caac9bc9ceb6b9b87fceca53ecef664ff	Mirai	32-bit elf mirai ua-wget
http://130.12.180.126/mpsl	50825416445643e9f0395618392e964f6668bd7090cce27dc5e61421b12523b5	Mirai	elf gafgyt mirai ua-wget
http://130.12.180.126/arm4	b3a8a0f242041630931fbe99484290b342866b3c98e658fe83961d0f4219e91d	Mirai	elf mirai ua-wget
http://130.12.180.126/arm5	fe9e87095153191ba77fd7eed720b0b1ac1ebd39176c9b9926b2af899b585075	Mirai	elf mirai ua-wget
http://130.12.180.126/arm7	80ee20cbbb9ae55730cbc841c0581642f9245b27627ae2a61f6827803d304b8e	Mirai	arm elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bash busybox expand lolbin mirai

Link:

https://www.filescan.io/uploads/69630b4f30368802bb7fb13e/reports/6d56867d-9e2d-4d1f-8e9d-dd007e04df73/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-01-10T23:49:00Z UTC

Last seen:

2026-01-11T00:08:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/90832ad3f8a90b71a4d37f1740bd0f7497adbe9888ce18b026f9cdda54c94ed6/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f4f34fb7-b3d2-40b5-b949-29b477dffea7

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/90832ad3f8a90b71a4d37f1740bd0f7497adbe9888ce18b026f9cdda54c94ed6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/90832ad3f8a90b71a4d37f1740bd0f7497adbe9888ce18b026f9cdda54c94ed6/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/90832ad3f8a90b71a4d37f1740bd0f7497adbe9888ce18b026f9cdda54c94ed6

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-01-11 03:10:09 UTC

AV detection:

7 of 24 (29.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=scbsvu7yvefxdjgtp4lubpiposl23puyrdhbrmbg7hg5uvgjj3la._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260111-czhdasdz2g/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/90832ad3f8a90b71a4d37f1740bd0f7497adbe9888ce18b026f9cdda54c94ed6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh