MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f59787f0d557d701ba036a08e294ab16c4a4df63a8bfda4e8c72382e19b28c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	1f59787f0d557d701ba036a08e294ab16c4a4df63a8bfda4e8c72382e19b28c3
SHA3-384 hash:	c35106976984d3aa651789f69eb76fce3bbdf3b9bc6931b663d96e87188978f1019aafdbb07acddb82741068f9a5d7fb
SHA1 hash:	cbef73b7f9135066f9c451724c8e05ee309d2407
MD5 hash:	dd6099afecd9dbc66aea39e9f48f1b08
humanhash:	berlin-kilo-lake-carbon
File name:	a.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'599 bytes
First seen:	2026-08-16 17:20:42 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:eBZMZiVZkZhVZUZUVZsZTVZ4HHZ4kZSxZJcZUZdZQZIVZGXZ+Z0HZiZkZFZkZZZD:USgVqfVauVCtVSv8xDcK7GqViw4gC3KZ
TLSH	T1463112C525196E21965F8F4CB1B44FADD00A37F8BDFF1646D8465C4369C4A8478CAE32
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.237/miron.armv4l	7349831d0b29757a9a3ffb1b11e6a2cecc8427c6e68ee7bc93fa1c0542d31d67	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.armv5l	260c68f899d55de1ca2acec4608a098e2333149c26cc40d099e8f59cdfc8420e	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.armv6l	76bd0622efad1a26e1779a7983513c103537b96c42cda04f79573c179defded4	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.armv7l	e6e7a7a95958ef7949afc2ab832a6c9c10fa233a1100a5c5839b736bcd961fbf	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.i486	d9388cf80b2a67d092e8f57eac895247c227f3875ef8da1b871a50b6b61900bb	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.m68k	341005869a492bce0269482759ecef45877aea2a40bb2f0bc0c4fa12847eff02	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.mips	08c4a76f8266722694961c1ae5e43fe29be4ebabc3418ee897b32d6a1490a296	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.mipsel	0e1bd1cf275f029ed286a56cbc56f095cafedb38bc8493a2b8c590173208b722	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.mipsrouter	08c4a76f8266722694961c1ae5e43fe29be4ebabc3418ee897b32d6a1490a296	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.powerpc	dc9ff58f9d5a12d90e23ccd29049d8b417f37ab07bb5c9c6157329f259df2a25	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.sh4	8709150d32a7aaf0191d532b612b9b38e45b2398287a57cf1127b034608aa0b8	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.sparc	dc42d433baaeac6aa5b9a953a16e0e05409fd9e6b89d1ff80024ebfcd5c16add	Mirai	94-154-43-237 elf mirai ua-wget
http://94.154.43.237/miron.x86_64	e3d67c1d2972aa9118b539114288a446cdb66e5b30e29e08600bd4308f15d292	Mirai	94-154-43-237 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-16T15:28:00Z UTC

Last seen:

2026-08-17T13:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1f59787f0d557d701ba036a08e294ab16c4a4df63a8bfda4e8c72382e19b28c3/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/6494d937-868d-426e-b952-00f4308b883b

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1f59787f0d557d701ba036a08e294ab16c4a4df63a8bfda4e8c72382e19b28c3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1f59787f0d557d701ba036a08e294ab16c4a4df63a8bfda4e8c72382e19b28c3/

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-08-16 17:20:25 UTC

File Type:

Text (Shell)

AV detection:

3 of 36 (8.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d5mxq7ynkv6xag5ag2qi4kkkwfweutpwhkf73jhiy4ryfym3fdbq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260816-vw74nasgpf/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

UPX packed file

File and Directory Permissions Modification

Executes dropped EXE

Traces itself

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh