MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa84bfb56f24194e953a3b800aafe918e99ce2d00d102049ab1f4b973a9f508d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	fa84bfb56f24194e953a3b800aafe918e99ce2d00d102049ab1f4b973a9f508d
SHA3-384 hash:	a2731ae1fc52ea8f5a1f389ad57b5580a950ab7de4973887f34ece4833212879aaf33292820f54cf3e853b591e4098d7
SHA1 hash:	c093fbf3e9d43143b2e8a68a2ef4078d6b410227
MD5 hash:	eae25426745a4910cf11a0de00caabf7
humanhash:	item-equal-diet-bacon
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'419 bytes
First seen:	2026-06-20 19:55:05 UTC
Last seen:	2026-06-21 18:26:23 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:sB5gHBqV5vFBRqBC1RBgBKBdTTqBkBnIB+RBEf3BykIBUBM93BGSN:gGhqd7kC1nEadv6I8WEyfYOxRN
TLSH	T13F214BC912A067F38ED8C94039539CADB06D49D77A078AEC284C0AF36E52B96FC1CF55
Magika	txt
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.249.230.150/arc	60ded09de33be52020e12548982c9ddd52b74e159628fdebf422d56b14d7ee8b	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/arm	31764032ea9adb75b70c06c1e612606c8ea3a5f52773af8b04ab23ace6453e74	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/arm5	decb182a4acd5d57baa312dde32690d2e94df4708141ec7673480f0aa891fa0f	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/arm6	b1f0308d07368bdd9d389f0b4ab9627dd22f059021c1b3b1949357afe23cac8f	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/arm7	d30944617f3f3831f9f968f94592b8f007cb821df0c92c894c1f37ca851960f9	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/m68k	223b9372c092ab4d81d5bb257680759b2bd69d3954364dca0d92773adbe990a1	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/mips	86187dadfd543daafcdec14ea988b546467cf6b374de2ef26cd16c9de5ab3448	Gafgyt	94-249-230-150 elf gafgyt mirai
http://94.249.230.150/mpsl	d8fc0a8f98aa0af5edf98dd20ce54f40baa9a4020fd62c61cd203a416cd4daa3	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/ppc	cbfa7a258edd1c5fd2bae5c9fc07b2af7c1f7b846a086e5b842fb67e10c3ddf7	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/sh4	6dbbc710a4b25377fd2ff447e82d754e5e51c49ed224d807b04d275e53bcead4	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/spc	9ea203e9d1d9da977a7d667f10e7ceb273bbe9964589c7bf7e9d5600c498bc3c	Mirai	elf mirai ua-wget
http://94.249.230.150/x86_64	02cb2c50ef08bcbfae632316ad3e43961980bbeb1ba5213f15d3dd1801762f7e	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/i686	ffb744e91515a6bdb0bf0588065455efd591250c882026b6c16f6afca11ca98f	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/i586	e6ce3b15a94bc1bef1585cc8d8b6ed09f124ef8a4a81b1e6c329b17db0e51012	Mirai	94-249-230-150 elf mirai
http://94.249.230.150/i486	2e8441299af33b3ad8701c04b159d8a0ff5bfca6d6f1d8bc0f0bfa0c50130b15	Mirai	94-249-230-150 elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

text

First seen:

2026-06-20T17:00:00Z UTC

Last seen:

2026-06-22T18:04:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen

Link:

https://opentip.kaspersky.com/fa84bfb56f24194e953a3b800aafe918e99ce2d00d102049ab1f4b973a9f508d/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/b28070f3-8bec-4465-b846-db7f9e4cb545

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fa84bfb56f24194e953a3b800aafe918e99ce2d00d102049ab1f4b973a9f508d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fa84bfb56f24194e953a3b800aafe918e99ce2d00d102049ab1f4b973a9f508d/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/fa84bfb56f24194e953a3b800aafe918e99ce2d00d102049ab1f4b973a9f508d

Threat name:

Script-Shell.Trojan.Heuristic

Status:

Malicious

First seen:

2026-06-20 19:55:11 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7kcl7nlpeqmu5fj2hoaavl7jdduzzywqbuicasnld5fzoou7kcgq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260620-ypd4saas9v/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fa84bfb56f24194e953a3b800aafe918e99ce2d00d102049ab1f4b973a9f508d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh