MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12cb2fc108d6e276c9b142a2d5ca887a77cd6fd4e6ea4eb6d735505577ee02c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	12cb2fc108d6e276c9b142a2d5ca887a77cd6fd4e6ea4eb6d735505577ee02c5
SHA3-384 hash:	afe41eba5ec96f46ae8b73ebb8f3d3d9c253374bc7a374367e24a0c519bb7326382d010a21f577f79b5fe65be3a40540
SHA1 hash:	7fa63c04fc6a7a7843a98ba74c40e96037f2ed4e
MD5 hash:	db4e1a73eebf9d074b7b970a91210f70
humanhash:	louisiana-lake-william-river
File name:	wget.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'783 bytes
First seen:	2026-05-02 15:43:53 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:q0FV3+L3Kg0FV3JL3Y9g0FV39iL3+a6g0FV3jexL3jed7/g0FV3nLL3DWg0FV3LD:v1kvDN3NM67JYVz1adFnOtzp
TLSH	T11431F9C5135145F93DE6ADEBB9A58A0473A070A56CC1BE8CACD83CF9858DE1D3044E73
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://161.97.163.222/bins/jew.x86	43999e54b0a43902d3b97409eeee33b6eb18586b31d4a28cb8978bc0cd6dcf40	Mirai	elf mirai opendir ua-wget x86
http://161.97.163.222/bins/jew.mips	090106580395f02f8224c2186d322f46929d8ebdebdb86dd7bb59ab4d0cf4313	Mirai	elf mips mirai opendir ua-wget
http://161.97.163.222/bins/jew.mpsl	06c3b54fbe5454c8db506947a902a6b9424a446650c1d13d319a4e970ab755b2	Mirai	elf mips mirai opendir ua-wget
http://161.97.163.222/bins/jew.arm4	n/a	n/a	ua-wget
http://161.97.163.222/bins/jew.arm5	7755520fc3fc74c815f972a54f9e7c7ccae95c8c4cd4c1f5043a903af222e711	Mirai	arm elf mirai opendir ua-wget
http://161.97.163.222/bins/jew.arm6	24112c8277c661c71002d06ace82e1ce89f455ad7aa5f3c19c7f4c76a804790a	Mirai	arm elf mirai opendir ua-wget
http://161.97.163.222/bins/jew.arm7	a39b9ca61cb94cecdb77632ed54c26e69626d3569f1ff04956de52f51db2474e	Mirai	arm elf mirai opendir ua-wget
http://161.97.163.222/bins/jew.ppc	ec1f7f42a7a4634251b22b1b681a798386295a44cab22792d6ba5bc2bb3cb966	Mirai	elf mirai opendir PowerPC ua-wget
http://161.97.163.222/bins/jew.m68k	7ddbd84d464d3924ed0fb31c638ac95d3a83c367f0d428830d4cacfe36c2e1ce	Mirai	elf m68k mirai opendir ua-wget
http://161.97.163.222/bins/jew.sh4	35e068d9614a0a2d71ac4a935b45ff11d9e674c124da14e0df092d72003f0d0e	Mirai	elf mirai opendir SuperH ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-05-02T04:26:00Z UTC

Last seen:

2026-05-03T04:55:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/12cb2fc108d6e276c9b142a2d5ca887a77cd6fd4e6ea4eb6d735505577ee02c5/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/e0fc647b-8a0d-4ea6-95de-cd647361d7c9

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/12cb2fc108d6e276c9b142a2d5ca887a77cd6fd4e6ea4eb6d735505577ee02c5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/12cb2fc108d6e276c9b142a2d5ca887a77cd6fd4e6ea4eb6d735505577ee02c5/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/12cb2fc108d6e276c9b142a2d5ca887a77cd6fd4e6ea4eb6d735505577ee02c5

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-05-02 09:54:41 UTC

File Type:

Text (Shell)

AV detection:

22 of 36 (61.11%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=clfs7qii23rhnsnrikrnlsuipj34236u43ve5nwxgvifk57oalcq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:kurc antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260502-s6qw1sfx2r/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (112687) amount of remote hosts

Creates a large amount of network flows

Family: Mirai

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/12cb2fc108d6e276c9b142a2d5ca887a77cd6fd4e6ea4eb6d735505577ee02c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh