MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e06be431a8d427579fec15f84bb152326953a7be7a4d20060c6317614ca27843. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	e06be431a8d427579fec15f84bb152326953a7be7a4d20060c6317614ca27843
SHA3-384 hash:	e64e8f8697f23740e84e0052a7442795c6beb0554002d17be0b2c62217965e90444a8b44a6750bde9e45cbc87097b2d7
SHA1 hash:	70ae15322160a11b3dfa5bb9310f443402deacb7
MD5 hash:	99f14abe456f5e6386db48acd5c36638
humanhash:	gee-alpha-delta-social
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'498 bytes
First seen:	2026-10-16 19:24:48 UTC
Last seen:	2026-10-17 00:51:08 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:SEBvi1ieBFBvK9hK4TtqBvTm7TR1BvWP2BB7EByTvDp8prQtqBVSjRrBjtpRBVBm:SovinB7v8htcvItLvAmC07pM46InjLrm
TLSH	T148312FC11491BBBF8CC895567792A42D602CB8C56F2B9FDC94DF29D8A641B92B110D4C
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.228.72.128/jklarm	4af214411056b8239f1935c02fbadc276dcc6a501e073625fe42de53217206f8	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklarm5	8b34b15886196cfba8857b6661802c3b8f64835f438464fff346ddf7cb6d000a	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklarm6	3961cb76603e40e64368b769437a3f60665f8ed942089ea44ec53d9e594b8122	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklarm7	f1146624e0dddb086a1e1ddaf134a663241988c9c756a8f79b65606670665980	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklm68k	ed2faecb889119bb4b68abbcdbae4a766c9c698e5fca515698bac7ad2d07aa66	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklmips	9485247a2038a7d8f95b8baf7edda02da9a8ef63eb761f728878dc40b82dbfbd	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklmpsl	b20ae4658f8cc07c805fad7486cc4fa79017954bd1f49e2b5ea2eac7a76dcee3	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklppc	c73a4b3fca03917d7a618aab2c8bc34eb6a16390701ff702a05737219a6cc5dd	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklsh4	b8d32ae2c2c5aa9b07aff0911502928a6977bd9a1cb4d8e036494fa07d629cdf	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklspc	4e72f27c14874c16f63fc77929ae53c62468f0bf0515638755556b355c34f2ad	Mirai	cowrie honeypot mirai
http://185.228.72.128/jklx86	f2d4c3ce8d9a11fc7d49741daa4b3b3e3f20470da598eccf99c1c644fb436d98	Mirai	cowrie honeypot mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive expand lolbin

Link:

https://www.filescan.io/uploads/6ad27a2cc49973c23696a6b3/reports/f67bd5b7-f2df-47f6-8881-5dcc703faad0/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-16T16:52:00Z UTC

Last seen:

2026-10-18T16:45:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e06be431a8d427579fec15f84bb152326953a7be7a4d20060c6317614ca27843/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/43be0119-f7f7-4ba4-a82d-eb49a92399ea

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e06be431a8d427579fec15f84bb152326953a7be7a4d20060c6317614ca27843

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e06be431a8d427579fec15f84bb152326953a7be7a4d20060c6317614ca27843/

Threat name:

Document-HTML.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-10-16 19:25:27 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4bv6imni2qtvph7mcx4exmksgjuvhj56pjgsabqmmmlwctfcpbbq._file

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261016-x44sbacs4v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Contacts a large (96746) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/e06be431a8d427579fec15f84bb152326953a7be7a4d20060c6317614ca27843

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh