MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1279da77ff9bad634ad427cbdbd387d116942ac47513af1b97ded05a9128326b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	1279da77ff9bad634ad427cbdbd387d116942ac47513af1b97ded05a9128326b
SHA3-384 hash:	62a833f6dab65d427d99fd7fd69f5f91fc44d37c79a2adcbe4b7f3aeb9e5e706ccae0a86819fddd3adf91c41b394f1cb
SHA1 hash:	b6e64eddfe28aa4dee6a1ddcae69ee35c1861d47
MD5 hash:	1f5ef29dca0a297da9f8895e10c53a99
humanhash:	juliet-connecticut-sad-cat
File name:	pog.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	253 bytes
First seen:	2025-12-21 15:14:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	3:GRFdVZKaaDSIQ1CRmPSXdVZKL5KzSIOaANPSXdVZKhNIOSIHK+uF6APSXdVZKtFH:SdDPSdqLJPSdYNIl56APSdQFa0LKiJPn
TLSH	T1B6D02BCF701983B3050C4E10E0A11C40B0C992C208B05B2C689FF43F8CFA780331CEA8
Magika	batch
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.180.64/arm	b9bd8c3bc138f3a2cd136b6224358d2ac7f4a779efe65e5b8c96458e79950e88	Mirai	elf mirai ua-wget
http://130.12.180.64/arm5	b8cad988a2ec304d97b01cfc7bde3fd2d7182d6df39782ac3891053e453e4bfc	Mirai	elf mirai ua-wget
http://130.12.180.64/arm6	3e56c62db421fb2d64a341f91b8efcc433c83db5a3dfceebf6e5475419564c2d	Mirai	elf mirai ua-wget
http://130.12.180.64/arm7	a05621105654ed8765a3c2b240d7c5118929cf915f6b9374fc62be50df2d0bfd	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.DownLoader.37.31461.4751.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/69480ece3f8fdbf8e94d9f4d/reports/b0630515-8d7b-4155-890e-31423ed94cbc/overview

Verdict:

Malicious

File Type:

text

First seen:

2025-12-21T13:47:00Z UTC

Last seen:

2025-12-21T15:02:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1279da77ff9bad634ad427cbdbd387d116942ac47513af1b97ded05a9128326b/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e2c7393a-447f-43bc-a88f-8c6ebda89907

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1279da77ff9bad634ad427cbdbd387d116942ac47513af1b97ded05a9128326b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1279da77ff9bad634ad427cbdbd387d116942ac47513af1b97ded05a9128326b/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2025-12-21 15:15:44 UTC

File Type:

Text (JavaScript)

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cj45u577towwgswue7f5xu4h2eljikweouj26g4x33ifvejigjvq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251223-lmmlxssjhw/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1279da77ff9bad634ad427cbdbd387d116942ac47513af1b97ded05a9128326b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh