MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23d6e9098ef592b075b542d684f2d6634edbc0363ec3a2071e74e18678ce3714. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	23d6e9098ef592b075b542d684f2d6634edbc0363ec3a2071e74e18678ce3714
SHA3-384 hash:	1f9cf795b407a7c186a5d76a6fbfa169da699a66aac033ff599bcd6efcfbdef705fa8992fd17be5f4f14de9ee42fda8f
SHA1 hash:	d02565152bd157cdad898d05abe326d5e60ada90
MD5 hash:	bbc3c5f09b2de9a6342f731a7f9fe8fa
humanhash:	four-nebraska-eight-neptune
File name:	lil
Download:	download sample
Signature	Mirai Create hunting rule
File size:	689 bytes
First seen:	2025-12-10 06:59:23 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:dOXOsYxPC7JlqZ1ZUJZI4WAd9AIziBBvAIz9xBsSAIzSkRBaAIzexXR:kXCZG+1ZuZI4Wu9AIm3vAIxHrAINnaAt
TLSH	T1C1012B9990A05C1020805C6E668764977923C2C7265B0FB9FFAE193D7F9851DB078B48
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://195.177.94.107/n2	0ebeb6035d83cb19af3eb645c026c40e2e89f3bb6fee549f93c3241edbcdc6f4	Mirai	elf mirai ua-wget
http://195.177.94.107/n3	07b740bc561692f9cc10221571dfc5933c69f5786b648c2e1c53ad9bff4b4064	Mirai	elf mirai ua-wget
http://195.177.94.107/n7	09c0b01267effde638740f756034cdfb1c086baf3e53f563d3bbd5a11918d547	Mirai	elf mirai ua-wget
http://195.177.94.107/n8	f67929158c5c814df747ab237fb6797b53a1b4e80afc14889be00246250a54d7	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/69391b6d64bd958a520f6f38/reports/01d8e253-ca65-4c15-8360-f6c6b85854c5/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-10T07:53:00Z UTC

Last seen:

2025-12-10T08:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/23d6e9098ef592b075b542d684f2d6634edbc0363ec3a2071e74e18678ce3714/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/3b9c88d7-8e68-455d-94fe-f744e0bd4ef3

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/23d6e9098ef592b075b542d684f2d6634edbc0363ec3a2071e74e18678ce3714

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/23d6e9098ef592b075b542d684f2d6634edbc0363ec3a2071e74e18678ce3714/

Threat name:

Script-BAT.Trojan.Heuristic

Status:

Malicious

First seen:

2025-12-10 07:04:13 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eploscmo6wjla5nvillij4wwmnhnxqbwh3b2eby6otqym6gog4ka._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/251210-hv2t2afq9y/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Enumerates running processes

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/23d6e9098ef592b075b542d684f2d6634edbc0363ec3a2071e74e18678ce3714

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.