MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91cf5ce57984450cd6d1a0d2ddefa31605ebc50897eb129828ae0e25c3fa9ec3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	91cf5ce57984450cd6d1a0d2ddefa31605ebc50897eb129828ae0e25c3fa9ec3
SHA3-384 hash:	eeea78b2b299c5571b80c64510b5293ed5d0a6f8947cdaf833d5f10a5df7823ffe53f5aab849917e27ea2767c873beb5
SHA1 hash:	cf8f09e27bbfc2bd469c43bdf30be6db467ba5f4
MD5 hash:	fee1d0b52f41b3a74e54bea746d28778
humanhash:	georgia-west-stream-sixteen
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	519 bytes
First seen:	2026-01-31 06:24:58 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:jdgytwdgy34XdgyhNIl5qGjdgyq0LK0DdgU6mXdg5aKGv:jdRKdR30dRhNI7ldRxK0DdSed0FGv
TLSH	T105F096DEB8114AD3060C4E85B3AA9484B8D1D299D1A1EF586DD464BE0EE7B087718674
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.20:36695/arm4	1ac2472a7266925354978d482153be974077046d46a8126b9fbd19bd4646eab2	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20:36695/arm5	645e42550a44d8d0e0a2abe2b214eed4a608425b4107b9eac8d13a3121f1971a	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20:36695/arm6	89d0c7f66ee96d3d02258a2369e482376291517e3d383a3fb2364ec8abbca6af	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20:36695/arm7	5f522e269bf35cf78d80e6341ec953775adbffaf35871f710255f81d5ca0723c	Mirai	arm elf geofenced mirai ua-wget USA
http://130.12.180.20:36695/x86_64	b6db8bb39c7305a6a0a1024ab9b51e7d7b4c016455865504909644b4381ede78	Mirai	elf geofenced mirai ua-wget USA x86
http://130.12.180.20:36695/aarch64	n/a	n/a	arm elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.BV.Downloader-AEH.23645728.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/697da059552d46acbfefd98d/reports/145153c9-29c1-48c6-a2ea-97f4172be318/overview

Verdict:

Malicious

File Type:

ps1

First seen:

2026-01-31T03:31:00Z UTC

Last seen:

2026-02-01T05:05:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan.Linux.Agent.gen HEUR:Backdoor.Linux.Mirai.hw

Link:

https://opentip.kaspersky.com/91cf5ce57984450cd6d1a0d2ddefa31605ebc50897eb129828ae0e25c3fa9ec3/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/f6995189-57e0-43ba-9ad4-85c04226c1d6

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/91cf5ce57984450cd6d1a0d2ddefa31605ebc50897eb129828ae0e25c3fa9ec3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/91cf5ce57984450cd6d1a0d2ddefa31605ebc50897eb129828ae0e25c3fa9ec3/

Verdict:

Malicious

Threat:

Backdoor.Linux.Mirai

Link:

https://tip.neiki.dev/file/91cf5ce57984450cd6d1a0d2ddefa31605ebc50897eb129828ae0e25c3fa9ec3

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-01-31 06:25:43 UTC

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=shhvzzlzqrcqzvwrudjn335dcyc6xriis7vrfgbivyhclq72t3bq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260131-g6waysaz6e/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/91cf5ce57984450cd6d1a0d2ddefa31605ebc50897eb129828ae0e25c3fa9ec3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh