MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db66446868eb968c3fdacc972a4e7cf247116700c9dddced29a638ab857e109e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	db66446868eb968c3fdacc972a4e7cf247116700c9dddced29a638ab857e109e
SHA3-384 hash:	e3d2cbdc995d01bd0d7d6772b4faa986a595e989ffea296aa0ff80d90829c7546205f7e5a4cf5285ba5aa3de491fc7b9
SHA1 hash:	2a2ddffed0a6e6b54efbf9a73f3f05b05bf4bea5
MD5 hash:	7461410c5456c52fab94438cd776b1b6
humanhash:	arizona-glucose-berlin-jersey
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'152 bytes
First seen:	2026-09-16 12:48:00 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:c+RzfD+Zf7KpzUp0USVz8C7Dxm8gY22Ng:c6jDoWte0bAoD88gY22Ng
TLSH	T1A92162C6D3502E3688448B4A7347887CE62167CD69C74BFC5C8E097DA9F8A85F9A4F41
Magika	batch
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.37/.Sx86_64	8a21c0400d2a5dc83ec25f2e6fd1d05a3d0c4fc252e5f419e5009124f4c05ef9	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Smpsl	6b59cf6e2192de665a7bc4dd3fe2476878d4509473e986f3fc86c3177ac98b4e	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Smips	5d7193c7df5579edede71ae817ca64d5573b21f5092c2f52f79af3cdb13fe7bf	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Sarm4	n/a	n/a	94-154-43-37 ua-wget
http://94.154.43.37/.Sarm5	d3452b649991dbda04c3ea503b0435cb199a4f3bc41a7a9bff2c14b7a7040927	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Sarm6	f92758d74b48c8b1fc9af556e6ea175f507861fe77fcc13b1d56e862b43f564f	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Sarm7	9e9833e71dcab15ec5d413ee05554545f20d35da52764bb1debad441df7a6f46	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Sm68k	60c1179f230227e036b10deab605b1f2e5b212f9744c54cb2e5f7a7acec22964	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Sx86	8ce66c4d4cc017eebc9fd412595f2b380d7b6523b69c4add61c665bcb88acb57	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Sspc	f61f2f908f47fe14121b3779ef5e1e1066c95e9f8cf1aee7d61d56c78f7c1df5	Mirai	94-154-43-37 elf mirai ua-wget
http://94.154.43.37/.Sppc	66cb0b98333cd9548830b8862b7dbeb4687cda8579e6a57aafde3dc345ac7504	Mirai	94-154-43-37 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6ec8437d-f676-4912-b874-372bbad767af

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/db66446868eb968c3fdacc972a4e7cf247116700c9dddced29a638ab857e109e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db66446868eb968c3fdacc972a4e7cf247116700c9dddced29a638ab857e109e/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-09-16 12:47:52 UTC

File Type:

Text (Shell)

AV detection:

16 of 36 (44.44%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ntei2di5oliyp62zslsutt46jdrczyazho5z3jjuy4kxbl6ccpa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260916-p1xwlayves/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/db66446868eb968c3fdacc972a4e7cf247116700c9dddced29a638ab857e109e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh

Rule name:	NSVPS_Mirai_Busybox_Staging Create hunting rule
Author:	sanad (NSVPS-SOC)
Description:	Mirai-style busybox wget/tftp payload staging seen in NSVPS honeypot