MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a92ed03a5a1c3933ba148caf2b79474ec166c5fdf9bb714a5541aa3d3b504286. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 4 File information Comments

SHA256 hash:	a92ed03a5a1c3933ba148caf2b79474ec166c5fdf9bb714a5541aa3d3b504286
SHA3-384 hash:	80135ca1d88acfe33b6fa1782f30eec44f8b761fd1114ce7b2a7a8eab5a8edd07486c26ac86f4b8c67e54e1dc5ea3de9
SHA1 hash:	bffc5dc2d2d96e4ae19ed1df3639564def73d9ee
MD5 hash:	c9a33f009685e1ac0048ac7ea94db89f
humanhash:	carolina-summer-undress-connecticut
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'412 bytes
First seen:	2026-10-02 18:39:49 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:Upm3pmigpm6NI7dpmSKHprJOpniJp8Pp884pNTtqptuTpGmx:UpWpPgpkdp5ypcpniJp8Pph4pNYpITpb
TLSH	T1162151CB61A255766CB8ED27717A8404B590E18F50CE6F196CCC38F9C4CEE08B410B97
Magika	txt
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.135/arm	2efd63cc32630d6a630dac0ca70afd9ff65a87826153678b0c89841a88308fc5	Mirai	elf mirai ua-wget
http://176.65.139.135/arm5	8938b1cb68b3189c93f0db674b3c0b40cf35169733b1e1d23aaa37714bcdfaf1	Mirai	elf mirai ua-wget
http://176.65.139.135/arm6	6561897bb373f25b7002a595c69a45292f2abc9e61141ca90fc39ecf8c0979ac	Mirai	elf mirai ua-wget
http://176.65.139.135/arm7	609316b027434e338a24c2a2499bb1903c1cdcf3424f13d9d33e00257d805f26	Mirai	elf mirai ua-wget
http://176.65.139.135/mips	b2b090f8e71800288cf2dfa6bde8e61c043cd34937600458b83e20939d2b1098	Mirai	elf mirai ua-wget
http://176.65.139.135/mpsl	98b43dca907880c96d2e5ec3e4c3d0cd2c13e441cd99de9523278ed4530d980c	Mirai	elf mirai ua-wget
http://176.65.139.135/x86_64	889643499f34373689fc109d7e09f764848e71082ec8d7de499b27c2c3892f4a	Mirai	elf mirai ua-wget
http://176.65.139.135/ppc	4a203def15c9d4b30d4602ed9db960d0407a6ba04114a64091b9658c5cd011f2	Mirai	elf mirai ua-wget
http://176.65.139.135/sh4	67cfc503966fd56d77c58cc8a689b94c6d9ba32e262646630cc55fc82037c06e	Mirai	elf mirai ua-wget
http://176.65.139.135/spc	93af664ca7cdd9682c89d3999802e0cdc763898a66cf5e013b58b5f4a8eccc4e	Mirai	elf mirai ua-wget
http://176.65.139.135/m68k	5c18a42bd5004985bedc476beef3c1f1ed02b09aff7b18dab323d6b19de4466f	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

ps1

First seen:

2026-10-02T16:38:00Z UTC

Last seen:

2026-10-04T04:28:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a92ed03a5a1c3933ba148caf2b79474ec166c5fdf9bb714a5541aa3d3b504286/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/cbe1c521-e784-4e4d-9369-f73a43613c07

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a92ed03a5a1c3933ba148caf2b79474ec166c5fdf9bb714a5541aa3d3b504286

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a92ed03a5a1c3933ba148caf2b79474ec166c5fdf9bb714a5541aa3d3b504286/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-10-02 18:38:24 UTC

File Type:

Text (Shell)

AV detection:

21 of 38 (55.26%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vexnaos2dq4thoqursxsw6khj3awnrp57g5xcssvigvd2o2qikda._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261002-xbemqavgla/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a92ed03a5a1c3933ba148caf2b79474ec166c5fdf9bb714a5541aa3d3b504286

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	LIN_Downloader_Unknown_WgetChmodExecute Create hunting rule
Author:	Marjoriefort
Description:	Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:	misses_archive / grappe 5.182.210.174

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh