MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2f932a755c6d338e036abaef06b937aaf9577a7f9b43eab6758131fbf181bc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	c2f932a755c6d338e036abaef06b937aaf9577a7f9b43eab6758131fbf181bc3
SHA3-384 hash:	839977aba76b8fabf9bd49d81cb146eb5df80e67ecb3404bc725cd4fad984935a34fa3a825bdb8ffdc16ee3f50bef49d
SHA1 hash:	9dccdae71a9feec74c3f13e60197c203509889bf
MD5 hash:	236cb6c24b2bfb92323fadaf805af7a7
humanhash:	summer-october-delta-four
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'054 bytes
First seen:	2026-09-15 06:08:54 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:86feWc64tpc66NIBEMc6u4KHjcKr66cVcjScMwcHlcYcVjgcK0HR:8yc7cocKicKr66cVcjScRcHlcYcVMcK8
TLSH	T1AC1167DA0395A043499CCF82307A840A6256C6E120ED1F4CBD9DF4F1E6D8E36B16DFC8
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.251/wife.arm	n/a	n/a	elf ua-wget
http://176.65.139.251/wife.arm5	05e283d5e4e2e4a7574636df3cbcb9d9d93a57909f23d947e6d94aa2b567d008	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.arm6	4573e9cd46d8b30dc1ff7f5f881f9b106005cbab336b4ab7a301626547d19d64	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.arm7	2e8fac87da722d44f55b8b701d24ebbd1061493e998b39e4a92e60eeb0e11caf	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.m68k	eca0b1a8f28971b7cbbfc8468379fe90d9275c816d7be47dd0e6310750aad10c	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.mips	f217f6fc7ed38e68ab54661dd50dc9098bd64a59e39326a71bffb5a7ba114441	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.mpsl	33deb68cdd626df7490ef569c882958e7f87b9ec34c5d87454345457c674c313	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.ppc	bd07435af715bb44d774943c183b4859ca63d3ac6b6a14cf56936a15a9bae59e	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.sh4	1433836d5a2ec3edee0a89e99b3f701150e6bf75b4aa005eed64e26d2b2ad916	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.spc	468ea407334f629d1ec99041cf28d9c3c76ac5229f2c619b2729052249f021e8	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.x86	62f1b573699b791b5dd9ee4027647753118bf0ec7f41f310d7b12356f25519e4	Mirai	elf mirai ua-wget
http://176.65.139.251/wife.x86_64	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Unknown

Threat level:

n/a -.1.0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aa8e10e0ae6f04f07d9549d/reports/de100e14-c534-4b13-9389-befb40651fdb/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5ad1e082-5b37-4a7b-ae03-739f919e690b

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c2f932a755c6d338e036abaef06b937aaf9577a7f9b43eab6758131fbf181bc3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c2f932a755c6d338e036abaef06b937aaf9577a7f9b43eab6758131fbf181bc3/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-09-15 04:03:05 UTC

File Type:

Text (Shell)

AV detection:

14 of 36 (38.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yl4tfj2vy3jtrybwvoxpa24tpkxzk55h7g2d5k3hlajr7pyydpbq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260915-gwkfpsdh38/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh