MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee8a417c0f8b854d1e541e78d75855507ceb08eec8427860d5562a84c6151120. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	ee8a417c0f8b854d1e541e78d75855507ceb08eec8427860d5562a84c6151120
SHA3-384 hash:	b19f7780dada4e82ff212d77cbbe018dfc873dfe9bffcd96ba708b58de107924b076ffd6d1158aa48645457b76879374
SHA1 hash:	42e9479734dfac3e0234fb47c35377ea974c8a28
MD5 hash:	e8f731797aa24113a82ed989944b4370
humanhash:	beryllium-oranges-twenty-south
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	980 bytes
First seen:	2025-12-25 09:58:17 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:poV3XZjNIBS+TQoKSrTjxHXleM8brl9AXYl9oVHTxyaPF6wHhyrQbk:pgFNII0KSr5358/l9Aq98XLOQw
TLSH	T1A7119DD921D0882A44EACC4C32A48828963BD5C579418F7CDDBD44B741E6AFCBF2CE8C
Magika	batch
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://190.123.46.72/bins/main_arm	0b423d1b9e7a9e6719bf77dfa5363998d04f9edad2ee8e2de911c7ae995a391a	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm5	5d94992dac0b6d592f86b0d59af84c52168f05d7aa1713a0c4fd62820be71630	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm6	5b1cf87888710837c0007fd20877644abec191d7fed82763a15b959d591444d4	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_arm7	cf40305398ee234528ebd18bb54b13e1bb94f90a501636857e25ba114bb1c9c6	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_sh4	fd893a3ee002cd623137b4f65fda5624232eb22e53f5fec40601bc26e7eed29a	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_m68k	7cca33815eaccd864db722658cce4a234c32280e2ee7266c9fecd8601652c95f	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_mips	261cbea15e9c316a7a13d6ee7c496feb4364d264355821dc03664c17f398bcd1	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_mpsl	2322a5098627d113e939e6ac7ddb5c80ed5e253a650c6b6e1737baa4617db415	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_x86_64	6c22bec08f6ce62b43664b22028e033d496990b06a053c4aee5168b3af787c55	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_ppc	b1d611c59c43c5f2ae26da403ac6f4c59f721d91716cd5c07e3293351db8124c	Mirai	elf mirai ua-wget
http://190.123.46.72/bins/main_x86	05466e5727f528209cff95c2e7e2b197aa0fe4e312fd3709c13a1605c8cc2555	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bash busybox lolbin mirai

Link:

https://www.filescan.io/uploads/694d0af3e126b9ff4390ede5/reports/a83dc49f-42b1-494c-abe6-30fd362e46ea/overview

Verdict:

Clean

File Type:

text

Link:

https://opentip.kaspersky.com/ee8a417c0f8b854d1e541e78d75855507ceb08eec8427860d5562a84c6151120/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b951b144-4f23-4497-9f8e-e1327e10ee8d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ee8a417c0f8b854d1e541e78d75855507ceb08eec8427860d5562a84c6151120

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee8a417c0f8b854d1e541e78d75855507ceb08eec8427860d5562a84c6151120/

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/ee8a417c0f8b854d1e541e78d75855507ceb08eec8427860d5562a84c6151120

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2025-12-25 09:49:24 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=52fec7aprocu2hsudz4nowcvkb6owchozbbhqygvkyvijrqvceqa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251225-lzmsfssmcr/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ee8a417c0f8b854d1e541e78d75855507ceb08eec8427860d5562a84c6151120

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh