MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d65f743a2aabc724f8b7a2dee95309a26338ea076083f1011137d3775febbaf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	d65f743a2aabc724f8b7a2dee95309a26338ea076083f1011137d3775febbaf8
SHA3-384 hash:	bf595b28d8939adf51ad27d6825b0eca2b65d96f9bac082475b4213f7fff9869f4dfd1c93252d537f4aa589ad47587fa
SHA1 hash:	87304dc570e41c9e27d2e3b70a823e5c1d7b39f1
MD5 hash:	79fb79d5c5132a6471e4b03ab65d7d77
humanhash:	orange-carpet-orange-lactose
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	960 bytes
First seen:	2026-01-10 18:32:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:HUfw+SUP+SU1k+SUDc+H+SUAAA+SUEA+SUuOs+SUAjC+SUAp+SUE1Z+SU+/pcKA7:rSLYl/ZZytBhJxn
TLSH	T1741193AE91B56546C42C5E0870AA16549B8BC7C57EFBCF54EC5C1CB35C879007069F4F
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://158.94.208.27/armv4l	6c388fd0fb424d6c7eaf86abb617ff9bea68325989e3b9b7a0365e4ef6b62954	Mirai	elf mirai ua-wget
http://158.94.208.27/armv5l	b9180c611ddf84ffbb1eedb68a12c188b684bc40867ab11e78738e417e07acaa	Mirai	elf mirai ua-wget
http://158.94.208.27/armv6l	758b1a7d6126ebf7a706f0db37fe92bddd6d8bec9cf18c7e8c68ce480f697ce6	Mirai	elf mirai ua-wget
http://158.94.208.27/armv7l	9398f4ee9fbbd3a0545c1dad7f32828a54e63dee3d9429ede67cb9b0ea6ff304	Mirai	elf mirai ua-wget
http://158.94.208.27/i586	37aa2c17037a3840080cf58523875ea9c690ed7151bdb93d8173ff4527d2c9f0	Mirai	elf mirai ua-wget
http://158.94.208.27/i686	b914b60bd6ed779eeee07d42598e861352e3cbb8e2377d13920d95b9d78aef10	Mirai	elf mirai ua-wget
http://158.94.208.27/m68k	b898eecac207321d32c8c9427b0ade7f408bab1b4db1292da972ab84a17d8b7e	Mirai	elf mirai ua-wget
http://158.94.208.27/mips	1cb169f9b7afe6d1169ea0cc5334cd86f2d9b4ad6992520d3ebebd9c5046a75f	Mirai	elf mirai ua-wget
http://158.94.208.27/mipsel	041a575f6849cb644373776a1e90252551a2a4305843b07b2b61d46007b42a13	Mirai	elf mirai ua-wget
http://158.94.208.27/powerpc	c9758e8673f82badfaceb99df6f38b837e4b567f8e6aae5fd9c4b628540633dd	Mirai	elf mirai ua-wget
http://158.94.208.27/powerpc-440fp	021681aab424f1cb19bc0d332cd98b8816753355a91b51fb960c44ac3a78add4	Mirai	elf mirai ua-wget
http://158.94.208.27/sh4	2980a32ffc3407a8aa51b5600936f840a4041c1cb07c4f23a288e502ff91e2f9	Mirai	elf mirai ua-wget
http://158.94.208.27/sparc	30efb0c3c09e70adc0c067a1109f8d81d9165859717f16f045fcd93dbc0ea664	Mirai	elf mirai ua-wget
http://158.94.208.27/x86_64	b45624c3b4cf4ecc07e00097427b19dc0e0bc83e25e3afe50a5ce74e903aac76	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/69629b3a30368802bb7f68d6/reports/44eba364-5621-4a43-a041-d3e30c766b7a/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-01-10T14:34:00Z UTC

Last seen:

2026-01-12T12:48:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/d65f743a2aabc724f8b7a2dee95309a26338ea076083f1011137d3775febbaf8/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/243b9ff8-8885-4eee-a0e6-9a7843a56205

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d65f743a2aabc724f8b7a2dee95309a26338ea076083f1011137d3775febbaf8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d65f743a2aabc724f8b7a2dee95309a26338ea076083f1011137d3775febbaf8/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/d65f743a2aabc724f8b7a2dee95309a26338ea076083f1011137d3775febbaf8

Threat name:

Document-HTML.Worm.Mirai

Status:

Malicious

First seen:

2026-01-10 18:32:28 UTC

File Type:

Text (Shell)

AV detection:

17 of 36 (47.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2zpxiorkvpdsj6fxulposuyjujrtr2qhmcb7cairg7jxox7lxl4a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260110-w6sx6ah19g/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d65f743a2aabc724f8b7a2dee95309a26338ea076083f1011137d3775febbaf8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh