MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3356dc6dbba6326f75f83a831046242e87ad3ffceaee457ed87e38fc98f6ad5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3356dc6dbba6326f75f83a831046242e87ad3ffceaee457ed87e38fc98f6ad5f
SHA3-384 hash: dafbc2f42603d57d0ed3e2cb46ef24e12db9fabcfff23b47131569de70c9cc1e56adf3fdf60c9548b94ee15ab9659de8
SHA1 hash: bedf9b962e138739ab113da34a3cb1c523602019
MD5 hash: 6c074869a0b99686a88c3e0b1e0351e6
humanhash: mountain-item-summer-zebra
File name:yarn
Download: download sample
Signature Mirai
Create hunting rule
File size:2'695 bytes
First seen:2026-02-03 16:39:58 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vzybRz3vRz5jRzHbRzBTRzdubRzouoRzRjRzKrRzLbRzH9Rz7x7RzAfRzj9e:vzyNz3Zz5VzHNzBFzMNzoVzRVzKdzLN5
TLSH T1DB5177C5B31049F5BFF15E96B2B48404B088A092AEC75AC9E6FC75FA844DF0C7C52967
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://94.26.106.177/bins/sora.x86e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.mips5e74a50c9255cda93e51e37903260477800d9aac1301e8447a8793a83529c07a Mirai32-bit elf mirai Mozi
http://94.26.106.177/bins/sora.x86_649494683239ff99d86db9145ddd361c5014eef8506c720ef34bae542b1f140c88 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.i468n/an/an/a
http://94.26.106.177/bins/sora.i68628d2d9759823d69e7fc46485b53a413b38ef2f8ff504dd397b6726c21c5dcd19 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.mpslc62afaff80ce42bd7e8f6f3b66e45da9a3b36d00fcd630936d28fbce2c9d8f26 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm4n/an/an/a
http://94.26.106.177/bins/sora.arm5681c788f1f1c6beb7f7ef7dce47c3971dbb506c5ce58a0caedbb7999efb9bd66 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm69633a560c9e528465418f37cb0111f6cbda015a4b46f4ab2efe27eaa0b75413b Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm7n/an/an/a
http://94.26.106.177/bins/sora.ppcf67c66b6e0cf80b0546171bc249b825601f1078f0df6fb18402441eba65ad610 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.ppc440fpn/an/an/a
http://94.26.106.177/bins/sora.m68k482fe1c5adf10b2feb46d79a6ba89ac5865e73fda816738642d61c03e2149e07 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.sh4be6d52de33de60fd6d03fc14a719eea4b605519b22370321e44acd102ba7447c Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
29
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/641018af-bfb7-40d3-a5dd-00865eeb643a
Behavior Graph:
Download SVG
%3 guuid=c92ce099-1800-0000-5e0b-615885070000 pid=1925 /usr/bin/sudo guuid=cbeed49c-1800-0000-5e0b-61588e070000 pid=1934 /tmp/sample.bin guuid=c92ce099-1800-0000-5e0b-615885070000 pid=1925->guuid=cbeed49c-1800-0000-5e0b-61588e070000 pid=1934 execve guuid=2def459d-1800-0000-5e0b-61588f070000 pid=1935 /usr/bin/wget guuid=cbeed49c-1800-0000-5e0b-61588e070000 pid=1934->guuid=2def459d-1800-0000-5e0b-61588f070000 pid=1935 execve
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3356dc6dbba6326f75f83a831046242e87ad3ffceaee457ed87e38fc98f6ad5f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3356dc6dbba6326f75f83a831046242e87ad3ffceaee457ed87e38fc98f6ad5f/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/3356dc6dbba6326f75f83a831046242e87ad3ffceaee457ed87e38fc98f6ad5f
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-02-03 16:32:46 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gnlny3n3uyzg65pyhkbrarref2d22p745lxek7wypy4pzghwvvpq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260203-t6ttcahz9b/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 3356dc6dbba6326f75f83a831046242e87ad3ffceaee457ed87e38fc98f6ad5f

(this sample)

Mirai

elf c6addcb5c29a71af7c97ff54bb61a8ff2b05449c778f96ab495d8ff1e46e3c61

Mirai

elf e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd

  
URLhaus
https://urlhaus.abuse.ch/url/3771582/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3771583/
  
URLhaus
https://urlhaus.abuse.ch/url/3771586/
  
URLhaus
https://urlhaus.abuse.ch/url/3771588/
  
Dropping
MD5 047966b2c20f2cffffca8e41a6683874
  
Dropping
SHA256 e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd

Comments