MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0eef5bc2152e354f4650dc37092aca64aa5419fcbcb874f9605a26d3a5389999. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	0eef5bc2152e354f4650dc37092aca64aa5419fcbcb874f9605a26d3a5389999
SHA3-384 hash:	ee85601cb64a2c10ba394c1655ca3a1399d7022eba6496847d781f58f63ed74ceee2fbb92f1f5a10ab0b5a5bd4d2ee48
SHA1 hash:	4af17c22f356e09346114a15317a35f27935a9ff
MD5 hash:	d31a5728884170e6036524cb564f227b
humanhash:	echo-kentucky-montana-gee
File name:	lil
Download:	download sample
Signature	Mirai Create hunting rule
File size:	852 bytes
First seen:	2026-07-01 02:16:15 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaCRjCgB1CDFFCFCgBnY8CRJKCSosYX:kXCKysE2hi0ziQvZohaC1h1VZ+81Jo/X
TLSH	T193018CC98044991040AE895D22976455F82183CE1A4B4B75FFAC693EAB88D04F136F94
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://129.121.114.124/82Y	f3045b343fdc468cd99623a18639a0a70d38878490afe972c345ca5a38896fa5	Mirai	elf ua-wget
http://129.121.114.124/HqhC	d126777fa2a74d017281d8b9a054d88dc5eb1424f80b278539ee3b351820ac4b	Mirai	elf ua-wget
http://129.121.114.124/mnkk	9377d9f02a48345858ba2ad213de0e42a6919b7ceb0101b25083cbb61f3ad641	Mirai	elf ua-wget
http://129.121.114.124/tJTB	98d29e3e1965a2319a0242d0162d8f33e0bfedfc305a2af99b19e5cbdf15eec9	Mirai	elf ua-wget
http://129.121.114.124/XzsJ	81d2ae507145f612d97819fd248f278e80b190332bd9520a76534ff3d0ac4cda	Mirai	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a44787e429328dbf31bb333/reports/e4e0a1ec-bbd1-4a34-a44f-024a8d1149b2/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-01T14:10:00Z UTC

Last seen:

2026-07-01T15:54:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/0eef5bc2152e354f4650dc37092aca64aa5419fcbcb874f9605a26d3a5389999/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/a2693b36-33fa-4515-8aae-0ab306d03e4a

Score:

92%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0eef5bc2152e354f4650dc37092aca64aa5419fcbcb874f9605a26d3a5389999

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0eef5bc2152e354f4650dc37092aca64aa5419fcbcb874f9605a26d3a5389999/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/0eef5bc2152e354f4650dc37092aca64aa5419fcbcb874f9605a26d3a5389999

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2026-07-01 02:17:35 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b3xvxqqvfy2u6rsq3q3qskwkmsvfigp4xs4hj6lalitnhjjytgmq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260701-cqdnraev2w/

Behaviour

Reads runtime system information

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/0eef5bc2152e354f4650dc37092aca64aa5419fcbcb874f9605a26d3a5389999

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.