MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff276c20c8b8fc0983e2855763b8ce79067506fbbbce189c9aa87bf503beabf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff276c20c8b8fc0983e2855763b8ce79067506fbbbce189c9aa87bf503beabf5
SHA3-384 hash: 4c422b07b5a6a7610b81288fe5c2b44af353bbe607643c8249c8a8c8f3527472118c9c99585a18f49421904a91e36420
SHA1 hash: 4c8e9fab2d9ad09901bf19f9d34f79209cb85ae3
MD5 hash: d710179a915a7264572818d10c37e412
humanhash: bakerloo-three-magazine-hotel
File name:wget.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:848 bytes
First seen:2026-01-09 02:00:09 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 12:HUMxq+SUCRH+SUzNIjlTBA+SUAiKl2E+SUf1+SUX9q+SUGFGOq+SUF6Z+SUmdKAq:XxoqNIpbKlDhs6U4cnxn
TLSH T12A01FAEA427658068228CD4C34AB4A245786D2C5FEB7CE8DDC5C047B5CC764AB069F4B
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://158.94.208.27/bins/parm74274cc3016ed06a7b19211372807dbf087efe4fc19643d8615e740890995c20 Miraielf mirai ua-wget
http://158.94.208.27/bins/parm555ef872e61c4b4b37f629c02efca7e2b1cbea444da91af9dd1aaf1675366db3a Miraielf mirai ua-wget
http://158.94.208.27/bins/parm6b5ecd9986333d5dbf1e62c879bf196676deb09fc40c1e55ae641210cad53d978 Miraielf mirai ua-wget
http://158.94.208.27/bins/parm73d39bbd00e38822b51e2c63dd338a5751d6c05634bd6c7293ef1177d1d3f8a14 Miraielf mirai ua-wget
http://158.94.208.27/bins/pm68k374b27b29be2d11caa68c2d48e1b9f9935ac0ae37abe50ee5073942cc65f9e23 Miraielf mirai ua-wget
http://158.94.208.27/bins/pmipsf8a94465e9304bde873bd3c8cd1f939097b7312fc1c7845c8499b274e16bd869 Miraielf mirai ua-wget
http://158.94.208.27/bins/pmpsl4947526318630ed5a8f64b762c62eec0e127a0aafdcba72cf860a26375906109 Miraielf mirai ua-wget
http://158.94.208.27/bins/pppc2c05935c19ede9cccaa1a274c93c7deab438e27f141120642aafd377ae4463bf Miraielf mirai ua-wget
http://158.94.208.27/bins/psh458d58774c2c497deb1f96eb0cadc065dc8699a04c38111d212fcc68808a85cbe Miraielf mirai ua-wget
http://158.94.208.27/bins/pspcb13baeead8922b19bd7a24a12d7fd3a1c7d5e9845012a65fcde792b9527a7b5b Miraielf mirai ua-wget
http://158.94.208.27/bins/px8622e5a9e790fe5bcfd184634d3d779ddea70bcb4e216ac7fe346679c15f2b610c Miraielf mirai ua-wget
http://158.94.208.27/bins/px86_64n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
mirai
Link:
https://www.filescan.io/uploads/6960615b30368802bb7cd487/reports/9bb40906-e118-4bdf-991a-821bfbb989fb/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-01-08T23:05:00Z UTC
Last seen:
2026-01-09T00:49:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/ff276c20c8b8fc0983e2855763b8ce79067506fbbbce189c9aa87bf503beabf5/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ff276c20c8b8fc0983e2855763b8ce79067506fbbbce189c9aa87bf503beabf5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff276c20c8b8fc0983e2855763b8ce79067506fbbbce189c9aa87bf503beabf5/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/ff276c20c8b8fc0983e2855763b8ce79067506fbbbce189c9aa87bf503beabf5
Threat name:
Document-HTML.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-01-09 02:00:22 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=74twyigixd6ata7cqvlwhogopedhkbx3xphbrhe2vb57ka56vp2q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260109-cfg87aat6a/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ff276c20c8b8fc0983e2855763b8ce79067506fbbbce189c9aa87bf503beabf5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh ff276c20c8b8fc0983e2855763b8ce79067506fbbbce189c9aa87bf503beabf5

(this sample)

Mirai

elf f81ccaf08eb38ce38873b1538bb50a98141cb576a8c85da5eec0fd2377c84b0b

Mirai

elf 46f64bc18582fbf0fc364191d3f564b332e5f86733f3d9e25705cfc8c9e54183

  
URLhaus
https://urlhaus.abuse.ch/url/3747932/
  
Delivery method
Distributed via web download
  
Dropping
MD5 881b337ec29e04f4af66ddf20fb32e63
  
Dropping
SHA256 46f64bc18582fbf0fc364191d3f564b332e5f86733f3d9e25705cfc8c9e54183

Comments