MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01aca45b546ba7abfd0b012c8ea8869cdf50b211c3f2a60b0f88e269b3770780. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01aca45b546ba7abfd0b012c8ea8869cdf50b211c3f2a60b0f88e269b3770780
SHA3-384 hash: 1de691301d7eae29e981f28608ccb705347c8e0df5c0e7058d8d101ae33d45d6b3a883e0cd8771080024b10f9e7750d2
SHA1 hash: 8a84b2c581e83677a96772c00039dfa4792383f5
MD5 hash: 5d84955c22360f0659c57e2bddaeaa8d
humanhash: idaho-uniform-pizza-freddie
File name:l
Download: download sample
Signature Mirai
Create hunting rule
File size:1'146 bytes
First seen:2025-06-18 11:14:01 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:yRk5zFt+MB08xSx0kRSxJxDkRSxnkxnmkRSx3xJkRSx0Vx0XkR8jn:4k5REA0gO0kROzDkROomkROhJkROqwkm
TLSH T1D221F9CF50A8DDB26C404EDD35D30B1678C6C9ED06CF8FC6E48E01A9A5CC90DB661E6A
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://94.26.90.217/vv/armv7lae5dbccdfcd0e48e2065b462be5879d1c103e3dc9c553ce8eb319c6385580d78 Miraielf gafgyt mirai ua-wget
http://94.26.90.217/vv/armv4la82594f321a14d22c63b44b8b3f4e5dcb725aeda14db201cfe59d6b37cb8093f Miraielf gafgyt mirai ua-wget
http://94.26.90.217/vv/armv5ld64ce359bc97c9643e66057dbd0ea9ed69d5272487e873119dc7a01134f852bc Miraielf gafgyt mirai ua-wget
http://94.26.90.217/vv/armv6l176858d674f19ed1c385ebfd952caea9f6a76f4b44828d6b8f21985476a35df0 Miraielf gafgyt mirai ua-wget
http://94.26.90.217/vv/n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.32050.LX.Sh.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6852a0f3d506f858d62238d1linux22vpnfull_triage
Tags:
agent hype sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive
Link:
https://www.filescan.io/uploads/68529fa8171e01f9594526ed/reports/92601723-6dec-4eac-8833-63ff736145b6/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5ab99160-065f-4641-8873-6c4f5a2d25d1
Behavior Graph:
Download SVG
%3 guuid=15e3ba51-1800-0000-b850-738f4c060000 pid=1612 /usr/bin/sudo guuid=1490d553-1800-0000-b850-738f55060000 pid=1621 /tmp/sample.bin guuid=15e3ba51-1800-0000-b850-738f4c060000 pid=1612->guuid=1490d553-1800-0000-b850-738f55060000 pid=1621 execve guuid=b6b11a54-1800-0000-b850-738f57060000 pid=1623 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=b6b11a54-1800-0000-b850-738f57060000 pid=1623 clone guuid=2b5be654-1800-0000-b850-738f60060000 pid=1632 /usr/bin/rm delete-file guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=2b5be654-1800-0000-b850-738f60060000 pid=1632 execve guuid=21442055-1800-0000-b850-738f62060000 pid=1634 /usr/bin/rm delete-file guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=21442055-1800-0000-b850-738f62060000 pid=1634 execve guuid=f9866255-1800-0000-b850-738f64060000 pid=1636 /usr/bin/rm delete-file guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=f9866255-1800-0000-b850-738f64060000 pid=1636 execve guuid=ddbebe55-1800-0000-b850-738f66060000 pid=1638 /usr/bin/rm guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=ddbebe55-1800-0000-b850-738f66060000 pid=1638 execve guuid=d9a11056-1800-0000-b850-738f68060000 pid=1640 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=d9a11056-1800-0000-b850-738f68060000 pid=1640 clone guuid=cff17e57-1800-0000-b850-738f6d060000 pid=1645 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=cff17e57-1800-0000-b850-738f6d060000 pid=1645 clone guuid=b6fafb57-1800-0000-b850-738f71060000 pid=1649 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=b6fafb57-1800-0000-b850-738f71060000 pid=1649 clone guuid=8da9bb9a-1800-0000-b850-738f11070000 pid=1809 /usr/bin/chmod guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=8da9bb9a-1800-0000-b850-738f11070000 pid=1809 execve guuid=e965fb9a-1800-0000-b850-738f12070000 pid=1810 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=e965fb9a-1800-0000-b850-738f12070000 pid=1810 clone guuid=2dc38f9b-1800-0000-b850-738f17070000 pid=1815 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=2dc38f9b-1800-0000-b850-738f17070000 pid=1815 clone guuid=6c5ce9db-1800-0000-b850-738fa1070000 pid=1953 /usr/bin/chmod guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=6c5ce9db-1800-0000-b850-738fa1070000 pid=1953 execve guuid=495343dc-1800-0000-b850-738fa3070000 pid=1955 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=495343dc-1800-0000-b850-738fa3070000 pid=1955 clone guuid=132508de-1800-0000-b850-738faa070000 pid=1962 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=132508de-1800-0000-b850-738faa070000 pid=1962 clone guuid=036a9220-1900-0000-b850-738f13080000 pid=2067 /usr/bin/chmod guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=036a9220-1900-0000-b850-738f13080000 pid=2067 execve guuid=943dcd20-1900-0000-b850-738f15080000 pid=2069 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=943dcd20-1900-0000-b850-738f15080000 pid=2069 clone guuid=98bc5721-1900-0000-b850-738f18080000 pid=2072 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=98bc5721-1900-0000-b850-738f18080000 pid=2072 clone guuid=ef5a1959-1900-0000-b850-738f92080000 pid=2194 /usr/bin/chmod guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=ef5a1959-1900-0000-b850-738f92080000 pid=2194 execve guuid=98c8a059-1900-0000-b850-738f94080000 pid=2196 /usr/bin/dash guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=98c8a059-1900-0000-b850-738f94080000 pid=2196 clone guuid=70ae705a-1900-0000-b850-738f98080000 pid=2200 /usr/bin/busybox net send-data guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=70ae705a-1900-0000-b850-738f98080000 pid=2200 execve guuid=9303b38a-1900-0000-b850-738f04090000 pid=2308 /usr/bin/chmod guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=9303b38a-1900-0000-b850-738f04090000 pid=2308 execve guuid=5d9a298b-1900-0000-b850-738f05090000 pid=2309 /run/user/1000/.f guuid=1490d553-1800-0000-b850-738f55060000 pid=1621->guuid=5d9a298b-1900-0000-b850-738f05090000 pid=2309 execve guuid=7f3e2154-1800-0000-b850-738f58060000 pid=1624 /usr/bin/cat guuid=b6b11a54-1800-0000-b850-738f57060000 pid=1623->guuid=7f3e2154-1800-0000-b850-738f58060000 pid=1624 execve guuid=cf4f2654-1800-0000-b850-738f59060000 pid=1625 /usr/bin/grep guuid=b6b11a54-1800-0000-b850-738f57060000 pid=1623->guuid=cf4f2654-1800-0000-b850-738f59060000 pid=1625 execve guuid=b8912954-1800-0000-b850-738f5b060000 pid=1627 /usr/bin/grep guuid=b6b11a54-1800-0000-b850-738f57060000 pid=1623->guuid=b8912954-1800-0000-b850-738f5b060000 pid=1627 execve guuid=13c62c54-1800-0000-b850-738f5c060000 pid=1628 /usr/bin/grep guuid=b6b11a54-1800-0000-b850-738f57060000 pid=1623->guuid=13c62c54-1800-0000-b850-738f5c060000 pid=1628 execve guuid=4f5b3054-1800-0000-b850-738f5d060000 pid=1629 /usr/bin/cut guuid=b6b11a54-1800-0000-b850-738f57060000 pid=1623->guuid=4f5b3054-1800-0000-b850-738f5d060000 pid=1629 execve guuid=32d11756-1800-0000-b850-738f69060000 pid=1641 /usr/bin/cp write-file guuid=d9a11056-1800-0000-b850-738f68060000 pid=1640->guuid=32d11756-1800-0000-b850-738f69060000 pid=1641 execve guuid=ea638657-1800-0000-b850-738f6e060000 pid=1646 /usr/bin/chmod guuid=cff17e57-1800-0000-b850-738f6d060000 pid=1645->guuid=ea638657-1800-0000-b850-738f6e060000 pid=1646 execve guuid=00050b58-1800-0000-b850-738f73060000 pid=1651 /usr/bin/wget net send-data write-file guuid=b6fafb57-1800-0000-b850-738f71060000 pid=1649->guuid=00050b58-1800-0000-b850-738f73060000 pid=1651 execve fbb9a6c5-a595-5199-8d51-c1632aa72f16 94.26.90.217:80 guuid=00050b58-1800-0000-b850-738f73060000 pid=1651->fbb9a6c5-a595-5199-8d51-c1632aa72f16 send: 136B guuid=351e9b9b-1800-0000-b850-738f18070000 pid=1816 /usr/bin/wget net send-data write-file guuid=2dc38f9b-1800-0000-b850-738f17070000 pid=1815->guuid=351e9b9b-1800-0000-b850-738f18070000 pid=1816 execve guuid=351e9b9b-1800-0000-b850-738f18070000 pid=1816->fbb9a6c5-a595-5199-8d51-c1632aa72f16 send: 136B guuid=d98613de-1800-0000-b850-738fab070000 pid=1963 /usr/bin/wget net send-data write-file guuid=132508de-1800-0000-b850-738faa070000 pid=1962->guuid=d98613de-1800-0000-b850-738fab070000 pid=1963 execve guuid=d98613de-1800-0000-b850-738fab070000 pid=1963->fbb9a6c5-a595-5199-8d51-c1632aa72f16 send: 136B guuid=59856321-1900-0000-b850-738f19080000 pid=2073 /usr/bin/wget net send-data write-file guuid=98bc5721-1900-0000-b850-738f18080000 pid=2072->guuid=59856321-1900-0000-b850-738f19080000 pid=2073 execve guuid=59856321-1900-0000-b850-738f19080000 pid=2073->fbb9a6c5-a595-5199-8d51-c1632aa72f16 send: 136B guuid=70ae705a-1900-0000-b850-738f98080000 pid=2200->fbb9a6c5-a595-5199-8d51-c1632aa72f16 send: 84B guuid=86047c5a-1900-0000-b850-738f99080000 pid=2201 /usr/bin/uname guuid=70ae705a-1900-0000-b850-738f98080000 pid=2200->guuid=86047c5a-1900-0000-b850-738f99080000 pid=2201 execve guuid=75b1d15a-1900-0000-b850-738f9b080000 pid=2203 /usr/bin/wget net send-data guuid=70ae705a-1900-0000-b850-738f98080000 pid=2200->guuid=75b1d15a-1900-0000-b850-738f9b080000 pid=2203 execve guuid=2b04fd72-1900-0000-b850-738fd3080000 pid=2259 /usr/bin/uname guuid=70ae705a-1900-0000-b850-738f98080000 pid=2200->guuid=2b04fd72-1900-0000-b850-738fd3080000 pid=2259 execve guuid=75b1d15a-1900-0000-b850-738f9b080000 pid=2203->fbb9a6c5-a595-5199-8d51-c1632aa72f16 send: 136B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/01aca45b546ba7abfd0b012c8ea8869cdf50b211c3f2a60b0f88e269b3770780
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01aca45b546ba7abfd0b012c8ea8869cdf50b211c3f2a60b0f88e269b3770780/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-06-18 11:21:04 UTC
File Type:
Text (Shell)
AV detection:
8 of 23 (34.78%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=agwkiw2unot2x7ilaewi5kegttpvbmqrypzkmcyprdrgtm3xa6aa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250618-nehdcacq61/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/01aca45b546ba7abfd0b012c8ea8869cdf50b211c3f2a60b0f88e269b3770780

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 01aca45b546ba7abfd0b012c8ea8869cdf50b211c3f2a60b0f88e269b3770780

(this sample)

Mirai

elf ae5dbccdfcd0e48e2065b462be5879d1c103e3dc9c553ce8eb319c6385580d78

  
URLhaus
https://urlhaus.abuse.ch/url/3531257/
  
Delivery method
Distributed via web download
  
Dropping
MD5 4fbb5c5a0cfeb4132d1cac1d9efb6279
  
Dropping
SHA256 ae5dbccdfcd0e48e2065b462be5879d1c103e3dc9c553ce8eb319c6385580d78

Comments