MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a08bbfe1428ccff19c582fdfb0d55ee2bc262caf59048a50dc0da5bf21a00d91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	a08bbfe1428ccff19c582fdfb0d55ee2bc262caf59048a50dc0da5bf21a00d91
SHA3-384 hash:	2e34f91355741507ac949961f22af0baed3670988b2d0e088ad38996eec136eaf20688988dede1a9d3449a12fb52b194
SHA1 hash:	1a29c3c58dae3bce7bb943e31e7ca09339898d20
MD5 hash:	df3f0c5380a52d6313b634a2e741cc45
humanhash:	maryland-victor-north-summer
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	935 bytes
First seen:	2025-12-25 09:58:18 UTC
Last seen:	2025-12-25 22:41:12 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:Gw3XHNIBS+CoKSrVxHX+MYl9AXY9o3TxykF66hyrQkn:GSHNIIKKSrL3zYl9AI9WhdOQkn
TLSH	T1EB119ED921905C3948EACC0D32E58808963BD58979619F2DDEFD442B40E7AB87F6CE8D
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://190.123.46.72/bins/main_arm	0b423d1b9e7a9e6719bf77dfa5363998d04f9edad2ee8e2de911c7ae995a391a	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm5	5d94992dac0b6d592f86b0d59af84c52168f05d7aa1713a0c4fd62820be71630	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm6	5b1cf87888710837c0007fd20877644abec191d7fed82763a15b959d591444d4	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm7	cf40305398ee234528ebd18bb54b13e1bb94f90a501636857e25ba114bb1c9c6	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_sh4	fd893a3ee002cd623137b4f65fda5624232eb22e53f5fec40601bc26e7eed29a	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_m68k	7cca33815eaccd864db722658cce4a234c32280e2ee7266c9fecd8601652c95f	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_mips	261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_mpsl	2322a5098627d113e939e6ac7ddb5c80ed5e253a650c6b6e1737baa4617db415	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_x86_64	6c22bec08f6ce62b43664b22028e033d496990b06a053c4aee5168b3af787c55	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_ppc	b1d611c59c43c5f2ae26da403ac6f4c59f721d91716cd5c07e3293351db8124c	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_x86	05466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bash lolbin mirai

Link:

https://www.filescan.io/uploads/694d0af1e126b9ff4390ede1/reports/6288e05c-5259-4b80-bc32-c6ec8273d1d7/overview

Verdict:

Clean

File Type:

text

Link:

https://opentip.kaspersky.com/a08bbfe1428ccff19c582fdfb0d55ee2bc262caf59048a50dc0da5bf21a00d91/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/72ca1be1-e39c-43a6-a34a-8381c1ff33df

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a08bbfe1428ccff19c582fdfb0d55ee2bc262caf59048a50dc0da5bf21a00d91

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a08bbfe1428ccff19c582fdfb0d55ee2bc262caf59048a50dc0da5bf21a00d91/

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/a08bbfe1428ccff19c582fdfb0d55ee2bc262caf59048a50dc0da5bf21a00d91

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2025-12-25 09:49:28 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ucf37ykcrth7dhcyf7p3bvk64k6cmlfpleciuug4bws36inabwiq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251225-lzmsfssmdj/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a08bbfe1428ccff19c582fdfb0d55ee2bc262caf59048a50dc0da5bf21a00d91

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh