MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c85fd1ad4c6db031e37f1af23287facda3c501d63b7edf7c17793fbc1c07208. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	2c85fd1ad4c6db031e37f1af23287facda3c501d63b7edf7c17793fbc1c07208
SHA3-384 hash:	c0ce8826ed124490b917c537c0dabe1ba02d2e298a0948f4685c0f91b7831f65be1126c5ba06841a8de21d8055212554
SHA1 hash:	6dda7d2f5f246d5296108042f02778de4569c6af
MD5 hash:	567ea6fdda42c1c8ca7f887e49f87b2b
humanhash:	mars-pip-ink-orange
File name:	2c85fd1ad4c6db031e37f1af23287facda3c501d63b7edf7c17793fbc1c07208.bin
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'126 bytes
First seen:	2026-10-03 20:23:47 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ZoQRSo5R1oPRTocNRsorRXoTsRio7/R/oURelo5RXLZooRP1:Zn4yzeF9yQhb82p1oS5lxL
TLSH	T13B4140D4E9ACD379398DD43E321842E2B5D258FF58C6382CB966FCB4406A88E314B765
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	whack_sh
Tags:	mirai script sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://178.132.198.200/bins/vcimanagement.mips	6949df88641f3d3df4507f325756a559a21a203515f40cc3f1f51a5994622e22	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.mpsl	85086a5650260d18d91a08a61c9f77a4458dbbd7a609c7a525fd5f069281bb8f	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.arm	c33b0fcd30301b5c3bf6b516d6ff03709a10aad67072f41012bcaf3d34b23acc	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.arm5	fa7de484231cf722c583d28bf2e05e7e55ff238fe929c2b14f9f8f19703f3937	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.arm6	fa42ab9f9d75b9a05d790bd25a772d95fac43427b54d28b9676ccc6c696da5b1	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.arm7	01b5a60b54ff4a0f670e39a6d567f02bc69338ccfae2d679a17ed09247e284e6	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.x86	82ec9cb67031727ee0b90d9d736befd9bbfb0eb6b0f995f35c5382c6a7073d01	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.ppc	fc1e2f6587a2b88a678c2688536209a9fbb7af36de466a4abb9a28a94a8e092d	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.m68k	53e4bc2cdaf78fd36fdf3770b6e4ce72c8c0001fa0a17f9618d98ad7de283746	Mirai	censys elf mirai ua-wget
http://178.132.198.200/bins/vcimanagement.sh4	a6634dd56d922fa0f8741a4d7feb314fad9da9095d8bcdd6a23ae66160f2a11a	Mirai	censys elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive masquerade

Link:

https://www.filescan.io/uploads/6ac1646faf54e52581019683/reports/ca40eabc-75c6-480c-8378-96a39d0ed488/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-28T19:47:00Z UTC

Last seen:

2026-10-04T01:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2c85fd1ad4c6db031e37f1af23287facda3c501d63b7edf7c17793fbc1c07208/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7dcf8f5d-3db7-4441-bd08-ce5ddf94b2ad

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2c85fd1ad4c6db031e37f1af23287facda3c501d63b7edf7c17793fbc1c07208

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2c85fd1ad4c6db031e37f1af23287facda3c501d63b7edf7c17793fbc1c07208/

Threat name:

Document-HTML.Trojan.Heuristic

Status:

Malicious

First seen:

2026-09-28 00:14:00 UTC

File Type:

Text (Shell)

AV detection:

10 of 36 (27.78%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fsc72gwuy3nqghrx6gxsgkd7vtndyua5mo36356bo6j7xqoaoiea._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:echobot family:mirai botnet command_and_control credential_access defense_evasion discovery execution linux persistence privilege_escalation trojan

Link:

https://tria.ge/reports/261003-y6s92awgqc/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads process memory

Creates/modifies Cron job

Enumerates active TCP sockets

Enumerates running processes

Modifies init.d

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Outbound SSH connection to public host

Contacts a large (138874) amount of remote hosts

Creates a large amount of network flows

Detected Echobot

Family: Echobot

Family: Mirai

Mirai ARM payload

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2c85fd1ad4c6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/2c85fd1ad4c6db031e37f1af23287facda3c501d63b7edf7c17793fbc1c07208

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh