MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ccc999c0f8f96df44bcfb6657392964dca46bcd8208cfe6b919f30e79b3c664. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	0ccc999c0f8f96df44bcfb6657392964dca46bcd8208cfe6b919f30e79b3c664
SHA3-384 hash:	c40f775c734f4a990a75fc82cf9ec6690749a51203f7f972bf5143575188315eabc70cf55a707ceabb6ed992dde4e1bc
SHA1 hash:	79d089b27654e491ebcd0b7c6d1241e70e18fe0f
MD5 hash:	980e97f39c0e13227254d55a298df0d0
humanhash:	aspen-fish-louisiana-double
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'875 bytes
First seen:	2026-08-17 20:08:54 UTC
Last seen:	2026-08-18 17:25:34 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Upekfape0dt6hJpIpgNaKOOJpJ6TppODOqJpOpDDUJpyflpUMGJpBK1ppBk1ZJpY:QfacVFOeDuhwKrknKW2t2MtaECj0D
TLSH	T11231548930B4D111E2C4EF21B0E946D65276FE8572B46ABBF4433E39B099D40301DA3D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.77.227.119/iran.x86_64	951e756a773bf9a393f0af98c6e18d5c11c4f7eb96068ce055315672d581c1dd	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.aarch64	n/a	n/a	elf ua-wget
http://31.77.227.119/iran.m68k	dcd547b488a16a9da77f7b456a9c88b85a0be46352a831c9aaea207326b384df	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.mips	f9320908e7cf1f7fb7da438ca953658c219bd09a9f208a8c3b5ef68f8a53aca1	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.mipsel	b905ff92426bd8ea7a2c3846790d5458c053f996448d25637caf4be4569cdfa4	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.powerpc	7c86a266bffdfd2af9068169b9ddd3cc01fc2af5bc0400c574c257d826810be2	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.sparc	8626f7c314bcc0e6e03e17a05bc3df20b8aec0861155f29321364cb43a7137f2	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.sh4	8b605293f44876a772582d5809bc11218e5eb6ed03dca507f75ee24afd83ac08	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.arc	cc6f394e7ab43785247b4614076cbcac9a1d47839569de8a81be2ad1bafff7ae	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.i486	77538963181372af124b31b06ff05a449aadadbacf93d22f9dad46e1abf7018b	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.armv4l	503a270cb6e53daaf5b2c951b9e6b4a34d9a8c1bb854ea7ed9bf8c030c03ea17	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.armv5l	d835a7b69e2a5554b9390fbc03fe175f47e0c47b64dcce8b1bf5ca6fc6d9c134	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.armv6l	68bf45b6a1114f68e32bbe36bd51a93f90e4acdf59dda9fbe75e84af042eb2bf	Mirai	elf mirai ua-wget
http://31.77.227.119/iran.armv7l	3dc384b44e2e6c37ba4529b86740771f9f942bc0b01a9830110cb4f86739c131	Mirai	botnet bruteforce iran mirai ssh

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

bash downloader lolbin mirai

Link:

https://www.filescan.io/uploads/6a836a6c76e4bad1841a6e57/reports/eced58d5-f355-4002-b745-5fcba6abae11/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-03T20:57:00Z UTC

Last seen:

2026-08-03T21:51:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0ccc999c0f8f96df44bcfb6657392964dca46bcd8208cfe6b919f30e79b3c664/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8812f25f-fcf7-4265-aa4b-7c5aab69bd98

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0ccc999c0f8f96df44bcfb6657392964dca46bcd8208cfe6b919f30e79b3c664

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ccc999c0f8f96df44bcfb6657392964dca46bcd8208cfe6b919f30e79b3c664/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-08-06 09:10:09 UTC

AV detection:

11 of 38 (28.95%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=btgjthapr6ln6rf47ntfoojjmtoki26nqiem7zvzdhzq46ntyzsa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/260817-yxarbshk2x/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Enumerates running processes

Modifies init.d

File and Directory Permissions Modification

Executes dropped EXE

Malware family:

BASHLITE

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0ccc999c0f8f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/0ccc999c0f8f96df44bcfb6657392964dca46bcd8208cfe6b919f30e79b3c664

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh