MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e642ef337e1fd1a851d05e47e2e8b15fcccad868b3d441843682378c82fb593d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e642ef337e1fd1a851d05e47e2e8b15fcccad868b3d441843682378c82fb593d
SHA3-384 hash: f6ba87007c0aa9f2d47b5a0eea7fcc56bc03ce685d409a6135121a5071710021739c9067b346acb7a6887ee579c7ecfb
SHA1 hash: 56840f33dfa241494c89dd30abd47f2b9193c3a6
MD5 hash: 0f792478c897619b585a5c5fea732663
humanhash: hydrogen-london-berlin-batman
File name:wget.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'089 bytes
First seen:2026-01-09 04:46:42 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:EvvrKLhr4NI7qKxr4KOr4IrMJrOL2rEu+1rjythrz1rMJArMBRzn:E3rshr9qKxr4xr4IryrO6rS1rCrz1rMf
TLSH T1FA11DABE946812960D648D2C26DE0C54C7178BD3F4D60B2CE584657714AA2E07B8CFDE
Magika asm
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://64.188.64.41/Cameron/Skye/Manderfeld/armn/an/aelf ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/arm58382821a44e3dec617898df55426f019999f1762d371fe93fbe1a99f6212c1ad Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/arm643f31fd68ee126fe013f0a782e44a78255b1683479125170837fbdcf62b6d492 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/arm77720750a19073e4567d2cadf84bac8b7cbfc2ea89d9b5b32bb9e8af311dac236 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/m68ka5deb7f7975f60df65e86cd62fde23bca3aad63036846901079ec35412cfb7a0 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/mips54b757506a0c8f2a83984630ed6c2c874b434a5461f3cb7f49bd8c0eb7b66854 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/mpsl0daffde65bda959a5ea99459ca7cf2df430e9cedc1233531cb8c05b313e6fa32 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/ppce6d4b6f93d7ae50c79847c6b0d8b3e533bfdf5ed58a86dbbde66c58442f9f35c Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/sh4bf8c8a847289132ff9606dd7d808f91070dfff0ffdb9a8a4c6bf076697531e18 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/spcfce43a96448cf52f1ff6c6f3a7067c1c4733b573d20f5ff1725ba821af7af4e2 Miraielf mirai ua-wget
http://64.188.64.41/Cameron/Skye/Manderfeld/x867b4cd6f806b64a6023c19812cc733869df8ecfd69359004fb39f2e7058047c00 Mirai32-bit elf mirai Mozi
http://64.188.64.41/Cameron/Skye/Manderfeld/x86_6454c6150e81b420393138f9b8d23b4a6d6bc07a146a4e96004566217c1ef514dd Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai
Link:
https://www.filescan.io/uploads/6960885007ef5fa68e822b44/reports/6d9048a5-23c7-427a-addd-6babe6db8293/overview
Verdict:
Clean
File Type:
text
Link:
https://opentip.kaspersky.com/e642ef337e1fd1a851d05e47e2e8b15fcccad868b3d441843682378c82fb593d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/44ce8f4b-d765-4627-8902-7775baedd2a9
Behavior Graph:
Download SVG
%3 guuid=cf60c38a-1a00-0000-f1fe-356f100b0000 pid=2832 /usr/bin/sudo guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838 /tmp/sample.bin guuid=cf60c38a-1a00-0000-f1fe-356f100b0000 pid=2832->guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838 execve guuid=63fdc58d-1a00-0000-f1fe-356f180b0000 pid=2840 /usr/bin/wget net send-data guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=63fdc58d-1a00-0000-f1fe-356f180b0000 pid=2840 execve guuid=19018591-1a00-0000-f1fe-356f1d0b0000 pid=2845 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=19018591-1a00-0000-f1fe-356f1d0b0000 pid=2845 execve guuid=8995bc91-1a00-0000-f1fe-356f1f0b0000 pid=2847 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=8995bc91-1a00-0000-f1fe-356f1f0b0000 pid=2847 clone guuid=b49dc191-1a00-0000-f1fe-356f200b0000 pid=2848 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=b49dc191-1a00-0000-f1fe-356f200b0000 pid=2848 execve guuid=225f2294-1a00-0000-f1fe-356f250b0000 pid=2853 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=225f2294-1a00-0000-f1fe-356f250b0000 pid=2853 execve guuid=1a026a94-1a00-0000-f1fe-356f260b0000 pid=2854 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=1a026a94-1a00-0000-f1fe-356f260b0000 pid=2854 clone guuid=56dce994-1a00-0000-f1fe-356f2a0b0000 pid=2858 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=56dce994-1a00-0000-f1fe-356f2a0b0000 pid=2858 execve guuid=bda77897-1a00-0000-f1fe-356f310b0000 pid=2865 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=bda77897-1a00-0000-f1fe-356f310b0000 pid=2865 execve guuid=3c28b597-1a00-0000-f1fe-356f320b0000 pid=2866 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=3c28b597-1a00-0000-f1fe-356f320b0000 pid=2866 clone guuid=8444ab99-1a00-0000-f1fe-356f3a0b0000 pid=2874 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=8444ab99-1a00-0000-f1fe-356f3a0b0000 pid=2874 execve guuid=487aec9c-1a00-0000-f1fe-356f410b0000 pid=2881 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=487aec9c-1a00-0000-f1fe-356f410b0000 pid=2881 execve guuid=d525729d-1a00-0000-f1fe-356f430b0000 pid=2883 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=d525729d-1a00-0000-f1fe-356f430b0000 pid=2883 clone guuid=df573c9e-1a00-0000-f1fe-356f480b0000 pid=2888 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=df573c9e-1a00-0000-f1fe-356f480b0000 pid=2888 execve guuid=f0a106a1-1a00-0000-f1fe-356f510b0000 pid=2897 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=f0a106a1-1a00-0000-f1fe-356f510b0000 pid=2897 execve guuid=16365fa1-1a00-0000-f1fe-356f530b0000 pid=2899 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=16365fa1-1a00-0000-f1fe-356f530b0000 pid=2899 clone guuid=e50136a2-1a00-0000-f1fe-356f570b0000 pid=2903 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=e50136a2-1a00-0000-f1fe-356f570b0000 pid=2903 execve guuid=73c4d5a4-1a00-0000-f1fe-356f5e0b0000 pid=2910 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=73c4d5a4-1a00-0000-f1fe-356f5e0b0000 pid=2910 execve guuid=abc339a5-1a00-0000-f1fe-356f5f0b0000 pid=2911 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=abc339a5-1a00-0000-f1fe-356f5f0b0000 pid=2911 clone guuid=69f8c7a5-1a00-0000-f1fe-356f640b0000 pid=2916 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=69f8c7a5-1a00-0000-f1fe-356f640b0000 pid=2916 execve guuid=8a40c4a9-1a00-0000-f1fe-356f6d0b0000 pid=2925 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=8a40c4a9-1a00-0000-f1fe-356f6d0b0000 pid=2925 execve guuid=2bcf02aa-1a00-0000-f1fe-356f6f0b0000 pid=2927 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=2bcf02aa-1a00-0000-f1fe-356f6f0b0000 pid=2927 clone guuid=fe3b8eaa-1a00-0000-f1fe-356f720b0000 pid=2930 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=fe3b8eaa-1a00-0000-f1fe-356f720b0000 pid=2930 execve guuid=8fe01fad-1a00-0000-f1fe-356f780b0000 pid=2936 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=8fe01fad-1a00-0000-f1fe-356f780b0000 pid=2936 execve guuid=2c2b64ad-1a00-0000-f1fe-356f7a0b0000 pid=2938 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=2c2b64ad-1a00-0000-f1fe-356f7a0b0000 pid=2938 clone guuid=5448f2ad-1a00-0000-f1fe-356f7d0b0000 pid=2941 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=5448f2ad-1a00-0000-f1fe-356f7d0b0000 pid=2941 execve guuid=5737ddb0-1a00-0000-f1fe-356f850b0000 pid=2949 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=5737ddb0-1a00-0000-f1fe-356f850b0000 pid=2949 execve guuid=a5f071b1-1a00-0000-f1fe-356f860b0000 pid=2950 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=a5f071b1-1a00-0000-f1fe-356f860b0000 pid=2950 clone guuid=9c5d34b2-1a00-0000-f1fe-356f880b0000 pid=2952 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=9c5d34b2-1a00-0000-f1fe-356f880b0000 pid=2952 execve guuid=9e193eb5-1a00-0000-f1fe-356f8a0b0000 pid=2954 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=9e193eb5-1a00-0000-f1fe-356f8a0b0000 pid=2954 execve guuid=02f8c7b5-1a00-0000-f1fe-356f8b0b0000 pid=2955 /usr/bin/dash guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=02f8c7b5-1a00-0000-f1fe-356f8b0b0000 pid=2955 clone guuid=4222e2b7-1a00-0000-f1fe-356f920b0000 pid=2962 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=4222e2b7-1a00-0000-f1fe-356f920b0000 pid=2962 execve guuid=110102bb-1a00-0000-f1fe-356f970b0000 pid=2967 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=110102bb-1a00-0000-f1fe-356f970b0000 pid=2967 execve guuid=b7e268bb-1a00-0000-f1fe-356f990b0000 pid=2969 /home/sandbox/x86 net guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=b7e268bb-1a00-0000-f1fe-356f990b0000 pid=2969 execve guuid=a77c8dbb-1a00-0000-f1fe-356f9b0b0000 pid=2971 /usr/bin/wget net send-data write-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=a77c8dbb-1a00-0000-f1fe-356f9b0b0000 pid=2971 execve guuid=aea871c6-1a00-0000-f1fe-356fa30b0000 pid=2979 /usr/bin/chmod guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=aea871c6-1a00-0000-f1fe-356fa30b0000 pid=2979 execve guuid=2a3bd1c6-1a00-0000-f1fe-356fa50b0000 pid=2981 /home/sandbox/x86_64 net guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=2a3bd1c6-1a00-0000-f1fe-356fa50b0000 pid=2981 execve guuid=5461ddf1-1b00-0000-f1fe-356f950d0000 pid=3477 /usr/bin/rm delete-file guuid=faa5548d-1a00-0000-f1fe-356f160b0000 pid=2838->guuid=5461ddf1-1b00-0000-f1fe-356f950d0000 pid=3477 execve dc908936-34d2-559a-9f4d-542df65fbad6 64.188.64.41:80 guuid=63fdc58d-1a00-0000-f1fe-356f180b0000 pid=2840->dc908936-34d2-559a-9f4d-542df65fbad6 send: 154B guuid=b49dc191-1a00-0000-f1fe-356f200b0000 pid=2848->dc908936-34d2-559a-9f4d-542df65fbad6 send: 155B guuid=56dce994-1a00-0000-f1fe-356f2a0b0000 pid=2858->dc908936-34d2-559a-9f4d-542df65fbad6 send: 155B guuid=8444ab99-1a00-0000-f1fe-356f3a0b0000 pid=2874->dc908936-34d2-559a-9f4d-542df65fbad6 send: 155B guuid=df573c9e-1a00-0000-f1fe-356f480b0000 pid=2888->dc908936-34d2-559a-9f4d-542df65fbad6 send: 155B guuid=e50136a2-1a00-0000-f1fe-356f570b0000 pid=2903->dc908936-34d2-559a-9f4d-542df65fbad6 send: 155B guuid=69f8c7a5-1a00-0000-f1fe-356f640b0000 pid=2916->dc908936-34d2-559a-9f4d-542df65fbad6 send: 155B guuid=fe3b8eaa-1a00-0000-f1fe-356f720b0000 pid=2930->dc908936-34d2-559a-9f4d-542df65fbad6 send: 154B guuid=5448f2ad-1a00-0000-f1fe-356f7d0b0000 pid=2941->dc908936-34d2-559a-9f4d-542df65fbad6 send: 154B guuid=9c5d34b2-1a00-0000-f1fe-356f880b0000 pid=2952->dc908936-34d2-559a-9f4d-542df65fbad6 send: 154B guuid=4222e2b7-1a00-0000-f1fe-356f920b0000 pid=2962->dc908936-34d2-559a-9f4d-542df65fbad6 send: 154B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=b7e268bb-1a00-0000-f1fe-356f990b0000 pid=2969->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a29988bb-1a00-0000-f1fe-356f9a0b0000 pid=2970 /home/sandbox/x86 dns net send-data zombie guuid=b7e268bb-1a00-0000-f1fe-356f990b0000 pid=2969->guuid=a29988bb-1a00-0000-f1fe-356f9a0b0000 pid=2970 clone guuid=a29988bb-1a00-0000-f1fe-356f9a0b0000 pid=2970->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 34B 6f848457-d338-5fd7-8997-e964a4b9bd9d zzz.leproxy.blog:38241 guuid=a29988bb-1a00-0000-f1fe-356f9a0b0000 pid=2970->6f848457-d338-5fd7-8997-e964a4b9bd9d send: 17B guuid=f4ea95bb-1a00-0000-f1fe-356f9c0b0000 pid=2972 /home/sandbox/x86 guuid=a29988bb-1a00-0000-f1fe-356f9a0b0000 pid=2970->guuid=f4ea95bb-1a00-0000-f1fe-356f9c0b0000 pid=2972 clone guuid=a12699bb-1a00-0000-f1fe-356f9d0b0000 pid=2973 /home/sandbox/x86 net net-scan send-data guuid=a29988bb-1a00-0000-f1fe-356f9a0b0000 pid=2970->guuid=a12699bb-1a00-0000-f1fe-356f9d0b0000 pid=2973 clone guuid=c4399cbb-1a00-0000-f1fe-356f9e0b0000 pid=2974 /home/sandbox/x86 net net-scan send-data guuid=a29988bb-1a00-0000-f1fe-356f9a0b0000 pid=2970->guuid=c4399cbb-1a00-0000-f1fe-356f9e0b0000 pid=2974 clone guuid=a77c8dbb-1a00-0000-f1fe-356f9b0b0000 pid=2971->dc908936-34d2-559a-9f4d-542df65fbad6 send: 157B guuid=a12699bb-1a00-0000-f1fe-356f9d0b0000 pid=2973->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a12699bb-1a00-0000-f1fe-356f9d0b0000 pid=2973|send-data send-data to 256 IP addresses review logs to see them all guuid=a12699bb-1a00-0000-f1fe-356f9d0b0000 pid=2973->guuid=a12699bb-1a00-0000-f1fe-356f9d0b0000 pid=2973|send-data send guuid=c4399cbb-1a00-0000-f1fe-356f9e0b0000 pid=2974->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=c4399cbb-1a00-0000-f1fe-356f9e0b0000 pid=2974|send-data send-data to 512 IP addresses review logs to see them all guuid=c4399cbb-1a00-0000-f1fe-356f9e0b0000 pid=2974->guuid=c4399cbb-1a00-0000-f1fe-356f9e0b0000 pid=2974|send-data send guuid=2a3bd1c6-1a00-0000-f1fe-356fa50b0000 pid=2981->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 4945e811-daa2-5999-bd89-4cdaa6badb43 0.0.0.0:8345 guuid=2a3bd1c6-1a00-0000-f1fe-356fa50b0000 pid=2981->4945e811-daa2-5999-bd89-4cdaa6badb43 con guuid=d2cfd6f1-1b00-0000-f1fe-356f940d0000 pid=3476 /home/sandbox/x86_64 dns net send-data zombie guuid=2a3bd1c6-1a00-0000-f1fe-356fa50b0000 pid=2981->guuid=d2cfd6f1-1b00-0000-f1fe-356f940d0000 pid=3476 clone guuid=d2cfd6f1-1b00-0000-f1fe-356f940d0000 pid=3476->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 34B guuid=d2cfd6f1-1b00-0000-f1fe-356f940d0000 pid=3476->6f848457-d338-5fd7-8997-e964a4b9bd9d send: 19B guuid=5342ecf1-1b00-0000-f1fe-356f960d0000 pid=3478 /home/sandbox/x86_64 guuid=d2cfd6f1-1b00-0000-f1fe-356f940d0000 pid=3476->guuid=5342ecf1-1b00-0000-f1fe-356f960d0000 pid=3478 clone guuid=6759f1f1-1b00-0000-f1fe-356f970d0000 pid=3479 /home/sandbox/x86_64 net net-scan send-data guuid=d2cfd6f1-1b00-0000-f1fe-356f940d0000 pid=3476->guuid=6759f1f1-1b00-0000-f1fe-356f970d0000 pid=3479 clone guuid=d306f6f1-1b00-0000-f1fe-356f980d0000 pid=3480 /home/sandbox/x86_64 net net-scan send-data guuid=d2cfd6f1-1b00-0000-f1fe-356f940d0000 pid=3476->guuid=d306f6f1-1b00-0000-f1fe-356f980d0000 pid=3480 clone guuid=6759f1f1-1b00-0000-f1fe-356f970d0000 pid=3479->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=6759f1f1-1b00-0000-f1fe-356f970d0000 pid=3479|send-data send-data to 4097 IP addresses review logs to see them all guuid=6759f1f1-1b00-0000-f1fe-356f970d0000 pid=3479->guuid=6759f1f1-1b00-0000-f1fe-356f970d0000 pid=3479|send-data send guuid=d306f6f1-1b00-0000-f1fe-356f980d0000 pid=3480->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d306f6f1-1b00-0000-f1fe-356f980d0000 pid=3480|send-data send-data to 4097 IP addresses review logs to see them all guuid=d306f6f1-1b00-0000-f1fe-356f980d0000 pid=3480->guuid=d306f6f1-1b00-0000-f1fe-356f980d0000 pid=3480|send-data send
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e642ef337e1fd1a851d05e47e2e8b15fcccad868b3d441843682378c82fb593d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e642ef337e1fd1a851d05e47e2e8b15fcccad868b3d441843682378c82fb593d/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/e642ef337e1fd1a851d05e47e2e8b15fcccad868b3d441843682378c82fb593d
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-01-09 04:34:37 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zbo6m36d7i2quoqlzd6f2frl7gmvwdiwpkedbbwqi3yzax3le6q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260109-fehecaez3g/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e642ef337e1fd1a851d05e47e2e8b15fcccad868b3d441843682378c82fb593d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh e642ef337e1fd1a851d05e47e2e8b15fcccad868b3d441843682378c82fb593d

(this sample)

Mirai

elf 8382821a44e3dec617898df55426f019999f1762d371fe93fbe1a99f6212c1ad

  
URLhaus
https://urlhaus.abuse.ch/url/3753753/
  
Delivery method
Distributed via web download
  
Dropping
MD5 da36d08ea0a983e2d8ffb2e7c7ff7e5c
  
Dropping
SHA256 8382821a44e3dec617898df55426f019999f1762d371fe93fbe1a99f6212c1ad

Comments