MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf46ba17e4b2f087500651a7ef14bd8e4f47d55e0492c705c3e036210fcc82b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	bf46ba17e4b2f087500651a7ef14bd8e4f47d55e0492c705c3e036210fcc82b6
SHA3-384 hash:	d4e9a36f76028eb2e894d760e3cc3eeab73ac801ebc9626a54736ab4607a868b1411adbb3f405cf83115ef71466e2310
SHA1 hash:	a21f8ab64410a18d99d76432d416ed17a360ad93
MD5 hash:	3d6c379459997e84df1c2748a9c46005
humanhash:	lake-item-sweet-seventeen
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'183 bytes
First seen:	2026-10-20 05:04:09 UTC
Last seen:	2026-10-23 05:01:50 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:+f2vx7f2q5uvwy7f23SEI7f27NIua0Ey7f2oBYKR7f2FR7f28UQ7f2Bd7f2Mj7fy:qcp5Cw+jENIGE+4KJAtcRjvBF4h
TLSH	T1D62106DEC193B4528428DF45B4A358419080F2D1E99D3BCAEFC8D835C9E6E54703EB46
Magika	batch
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.131/bins/kushnet.arm4l	000d8b06db0f227f54e426f21534ea718d61d7381fd1c3a054ce0d354fd3d423	Mirai	cowrie honeypot mirai
http://176.65.139.131/bins/kushnet.arm4tl	000d8b06db0f227f54e426f21534ea718d61d7381fd1c3a054ce0d354fd3d423	Mirai	cowrie honeypot mirai
http://176.65.139.131/bins/kushnet.arm5	000d8b06db0f227f54e426f21534ea718d61d7381fd1c3a054ce0d354fd3d423	Mirai	cowrie honeypot mirai
http://176.65.139.131/bins/kushnet.arm6	0f91064227795d7522d34744b74fd065b7b8c76c8cbc33b21ce8dff3707015d6	Mirai	cowrie honeypot mirai
http://176.65.139.131/bins/kushnet.arm7	8561161f1ad07e2fd0773de22b260185a87bc130d44aa73a2a3f54f643c83a86	Mirai	mirai ua-wget
http://176.65.139.131/bins/kushnet.m68k	7a8aad2cc1f3cbba0045969dc79014a5726b89764de168ea64213acf7b7ab9a0	Mirai	mirai ua-wget
http://176.65.139.131/bins/kushnet.mips	7a6fc3319747e9229d705451ec1d5e25d687d665a49e612167b05de4bae5cdc9	Mirai	mirai ua-wget
http://176.65.139.131/bins/kushnet.mipsel	dad8ea41c4694c8e7b7a7f24c478f6691221377e4161b4f78f25916f4ea84f37	Mirai	mirai ua-wget
http://176.65.139.131/bins/kushnet.ppc	d0fb911c4954492dda294ceee6aec1d796d35fbb91a0232b12c3e2399351ca0c	Mirai	mirai ua-wget
http://176.65.139.131/bins/kushnet.ppc440	d0fb911c4954492dda294ceee6aec1d796d35fbb91a0232b12c3e2399351ca0c	Mirai	mirai ua-wget
http://176.65.139.131/bins/kushnet.sh4	a2437337621d69e4ed99496bbe99d7ca7a1f0f02eb2bccd483198b89ab21d952	Mirai	mirai ua-wget
http://176.65.139.131/bins/kushnet.x32	2c3b5565bc55d911a73ea2e18410400770250a903249e410155f019667eeda69	Mirai	mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader mirai

Link:

https://www.filescan.io/uploads/6ad6f65691eca11039538fbe/reports/654c9337-e6ba-463f-8143-4f25cd35b629/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-10-20T02:17:00Z UTC

Last seen:

2026-10-20T15:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bf46ba17e4b2f087500651a7ef14bd8e4f47d55e0492c705c3e036210fcc82b6/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/062ba183-e855-4ab4-9951-8baa1d630cd8

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bf46ba17e4b2f087500651a7ef14bd8e4f47d55e0492c705c3e036210fcc82b6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf46ba17e4b2f087500651a7ef14bd8e4f47d55e0492c705c3e036210fcc82b6/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-10-20 02:26:35 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x5dluf7ewlyiouagkgt66ff5rzhupvk6asjmobod4a3ccd6mqk3a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261020-fqegtsvv6l/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bf46ba17e4b2f087500651a7ef14bd8e4f47d55e0492c705c3e036210fcc82b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh