MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c6c1012ed2a0b5556b60928b72ec2d7cac56bd9fc08dd0bee21e266190fe575. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	0c6c1012ed2a0b5556b60928b72ec2d7cac56bd9fc08dd0bee21e266190fe575
SHA3-384 hash:	1bddd5a9c51d804e5819ef8a1d7b0b88f4a8d27803beb85d9d397876bd62ad0523d4bcac4a51ba3e2ff5aa29307fd2cb
SHA1 hash:	42cf105e1d65ac0f396dc82d10d84048879d2f2b
MD5 hash:	0cc4dcf0dc6afabbc5457914b434bd1f
humanhash:	xray-fourteen-november-sodium
File name:	zato.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'105 bytes
First seen:	2026-03-25 12:17:38 UTC
Last seen:	2026-03-25 12:18:47 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:JCkIZQueZAuDhXeZTN4l0leZ82eZDjZBzeZNNQWleZJVeZFTeZuMDeZl/veZK/UK:Ic8uDhoNQ0PrZBuNQWQ6ZMEb/9
TLSH	T1F3115380320673E1F537C9213AA9EC0897EAE78C23F35F6529D41867917DA403A9DF85
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	adliwahid

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://87.121.79.23/3892/3ato.x86	13e90bf340976b332d333e5351dad97ddd878022e5977fed72318ff7db1117b3	Mirai	mirai
http://87.121.79.23/3892/3ato.mips	6c452598dbaf460e880d0a7268d4e732ef342482860a973524ac678ff1854429	Mirai	n/a
http://87.121.79.23/3892/3ato.mpsl	3cce1d0142e5d21c3c33705fa8b10affa0c06469dd74e14a538224ff52cea1f6	Mirai	n/a
http://87.121.79.23/3892/3ato.arm	f7eca4fe14be362204c8a02cf34f0c33436f5f16bd159f9f7d2f715ee3fce461	Mirai	mirai
http://87.121.79.23/3892/3ato.arm5	8217adcfe254ca28e9d01cce357beeec8b39fc4a03327f0abc4f8cd481262dd1	Mirai	mirai
http://87.121.79.23/3892/3ato.arm6	f7eca4fe14be362204c8a02cf34f0c33436f5f16bd159f9f7d2f715ee3fce461	Mirai	mirai
http://87.121.79.23/3892/3ato.arm7	f7eca4fe14be362204c8a02cf34f0c33436f5f16bd159f9f7d2f715ee3fce461	Mirai	mirai
http://87.121.79.23/3892/3ato.ppc	n/a	n/a	elf ua-wget
http://87.121.79.23/3892/3ato.m68k	n/a	n/a	elf ua-wget
http://87.121.79.23/3892/3ato.sh4	n/a	n/a	elf ua-wget
http://87.121.79.23/3892/3ato.spc	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-03-23T01:50:00Z UTC

Last seen:

2026-03-25T11:53:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.p

Link:

https://opentip.kaspersky.com/0c6c1012ed2a0b5556b60928b72ec2d7cac56bd9fc08dd0bee21e266190fe575/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/4d405a00-df59-4c55-8324-a216bd36332b

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0c6c1012ed2a0b5556b60928b72ec2d7cac56bd9fc08dd0bee21e266190fe575

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c6c1012ed2a0b5556b60928b72ec2d7cac56bd9fc08dd0bee21e266190fe575/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/0c6c1012ed2a0b5556b60928b72ec2d7cac56bd9fc08dd0bee21e266190fe575

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2026-03-23 05:17:39 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=brwbaexnfifvkvvwbeulolwc27fmk26z7qen2c7oehrgmgip4v2q._file

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260325-pgvl5afv2v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (77438) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0c6c1012ed2a0b5556b60928b72ec2d7cac56bd9fc08dd0bee21e266190fe575

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh