MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bb490ab60ac11b74e0b3d485d25c4d8c37ff65eab29fb29f6bd7d0255fa2573. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	9bb490ab60ac11b74e0b3d485d25c4d8c37ff65eab29fb29f6bd7d0255fa2573
SHA3-384 hash:	f7bb36fab8bb466e143b3eac62879bdcd756496b2b06fa6c410f41067aa4001fe6cc92d2f77f7abb68a2efd5f096547a
SHA1 hash:	e7a5768a15fcbf41891a89e5c35c8dcd2ba6ed69
MD5 hash:	631ea35a4d5d4d6d12316571e26c12b9
humanhash:	low-glucose-fillet-sodium
File name:	s.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'200 bytes
First seen:	2026-02-21 06:12:40 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:wlzBI8KNlaGwatuc0WZ8st4htDQIhVU8NI786uu7NC2l:2Ft3isQ0EsM
TLSH	T1AC2136CD916190D305489EB8F87345A4B04C9EF4FCA0AF24A44DDD295C9B749B058A97
Magika	asm
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://188.214.30.5/bins/mpsl	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/arm7	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/spc	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/sh4	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/ppc	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/mips	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/m68k	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/arm6	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/arm5	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/arm	n/a	n/a	elf ua-wget
http://188.214.30.5/bins/x86_64	62905f8a3507c4ad44848de30017efd4c89eb4f34a746eecc10600a91aafdf0a	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/69994cfe97feb4afd65042eb/reports/73ed340d-bea9-466a-8b0a-58ebd09e75a6/overview

Result

Gathering data

Verdict:

Malicious

File Type:

text

Link:

https://opentip.kaspersky.com/9bb490ab60ac11b74e0b3d485d25c4d8c37ff65eab29fb29f6bd7d0255fa2573/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4e46ce8b-7232-4407-a449-9dd995bc3280

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9bb490ab60ac11b74e0b3d485d25c4d8c37ff65eab29fb29f6bd7d0255fa2573

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9bb490ab60ac11b74e0b3d485d25c4d8c37ff65eab29fb29f6bd7d0255fa2573/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/9bb490ab60ac11b74e0b3d485d25c4d8c37ff65eab29fb29f6bd7d0255fa2573

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2026-02-20 20:10:34 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=to2jbk3avqi3otqlhvef2joe3dbx75s6vmu7wkpwxv6qevp2evzq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260221-gywxhsaz2c/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9bb490ab60ac11b74e0b3d485d25c4d8c37ff65eab29fb29f6bd7d0255fa2573

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh