MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbc72cbdb515d3152ba2dfbbfd4cee1e7ae68d790c99372820db380ae836ba05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	cbc72cbdb515d3152ba2dfbbfd4cee1e7ae68d790c99372820db380ae836ba05
SHA3-384 hash:	6294915d1ae482ff993abe4be85236879231f8470655512d7a92a5166dee25bf78676b32baf108a51380f055305d374f
SHA1 hash:	19d583ef0ccb4b4030771f48b33f8f34a0b5e8bd
MD5 hash:	3181e592906d1a3633d8123278ad1cee
humanhash:	xray-paris-twelve-oscar
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'129 bytes
First seen:	2026-08-27 16:49:49 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:Dw6XAUjwIsUjwmv4Ujw7c0UjwUPXAUjwX2mUjwgRVR/BgRmPUjw+epw+sUjwG4w1:HlH3Nrll/rRVR/2Rms2DBJz5R
TLSH	T17A21F3CEA255C613854F8CC035CAEB9A58368AF616399F3C231C46B37D89818F823E0C
Magika	batch
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.77.246.150/AGbot.armv4l	5639cd12033d467d66b54be3dd4b8690ee37e66e22f2244517ee271d3d76696f	Mirai	mirai wraith
http://103.77.246.150/AGbot.armv5l	c12d9da55bc424428978518649958b96cc69e656becc434ebabcdff611aad275	Mirai	mirai wraith
http://103.77.246.150/AGbot.armv6l	266feb3ba73d372c4296c2c915cdca8a99385608ad5939608184bf5b6088d6b4	Mirai	mirai wraith
http://103.77.246.150/AGbot.armv7l	a68bbc13289408eee17179859665e093c1652968d3828ac3c9105103071164e5	Mirai	mirai wraith
http://103.77.246.150/AGbot.mips	2d1d15d9b95d9a0b1be2ab8123b42c574d608d33889ce0ea66ae58f85343292a	Mirai	elf mirai ua-wget
http://103.77.246.150/AGbot.mipsel	e8ea23e292f0081715d4bbf4dc5e73a31a37f9d85d0c4dcc09e2a0cea39a6943	Mirai	elf mirai ua-wget
http://103.77.246.150/AGbot.powerpc	f52b133cf9dddd23f290363558a876d4bea367f0980b552ce20b9f2c9ccf277a	Mirai	elf mirai ua-wget
http://103.77.246.150/AGbot.x86_64	e3ad6b39c29575a0a2cfbd14414297de7f7a81416ce1b7635762cc1362b55e4e	Mirai	elf mirai ua-wget
http://103.77.246.150/AGbot.i486	6d835558331d381e8066d07479c2e602f5c16cd3d14e9cf19d3e8a3cfa71f5bb	Mirai	elf mirai ua-wget
http://103.77.246.150/AGbot.i586	b717c65d1876c0945bb8824a9324734b14e0da5ccde1a73244cfeeb82bd2b1be	Mirai	elf mirai ua-wget
http://103.77.246.150/AGbot.i686	2dfb415d1a52ab0e3851c880913729634452ef4433d11ac89a3fb7d95804d046	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f93d8508-d396-4a08-940b-c7ac0cb94df1

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cbc72cbdb515d3152ba2dfbbfd4cee1e7ae68d790c99372820db380ae836ba05

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cbc72cbdb515d3152ba2dfbbfd4cee1e7ae68d790c99372820db380ae836ba05/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-08-27 16:49:23 UTC

File Type:

Text (Shell)

AV detection:

9 of 36 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zpdszpnvcxjrkk5c36572thodz5ondlzbsmtokba3m4av2bwxicq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260827-vceb8syckb/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/cbc72cbdb515d3152ba2dfbbfd4cee1e7ae68d790c99372820db380ae836ba05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh