MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a6a7f3fc8aeb12a77a9c9e93e40a35ae33dae15634ca554395243b7064f68fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a6a7f3fc8aeb12a77a9c9e93e40a35ae33dae15634ca554395243b7064f68fe
SHA3-384 hash: b0e0e0e4772b2bfd7b6513c581a5ccac2fe6e0510c8730a679ebb2797a43db93c93ee8411bcb987a4a2d5b1d897cd56e
SHA1 hash: 5eb86b8aff072d924ae958eb8dac1b514120b8fc
MD5 hash: 6ef1d0012a8651cd1af1af7285c1bd48
humanhash: nitrogen-lima-robin-equal
File name:magic
Download: download sample
File size:373 bytes
First seen:2026-07-18 01:42:33 UTC
Last seen:2026-07-18 22:12:13 UTC
File type: sh
MIME type:text/plain
ssdeep 6:eJ+jphviRej6+RFphviRetYTRFphviRevaa0LKiSeRFphviR+IrRFphviRIWTDY4:eJ+jphviRp+RThviRAYTRThviR60LKDq
TLSH T166E09BAD6434199A0910EE61F4714B16A6ABFB805121A71CE28D362F8C9C500B53CAC7
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://217.60.195.160/gigatex/arm4f77798ec288b63a181271d679c45b6e1a95ced69ee8121497ea19d450b8233f Miraielf mirai ua-wget
http://217.60.195.160/gigatex/arm54319b75ce855f62b6d4078674fddee0d8989c8472c319bb3e72f7742d3801924 Miraielf mirai ua-wget
http://217.60.195.160/gigatex/arm73d33d72fea57c4c28dda41d4f410a4cf5ddf7dd4d5e7ecfa45a27543a746551c Miraielf mirai ua-wget
http://217.60.195.160/gigatex/mipsea4820cb526fb38338854fb399d1973416f00cb43761c93bd3c3984073699483 Miraielf mirai ua-wget
http://217.60.195.160/gigatex/mpsl6008b72b141eb3af8452450a16c797bb04147530f0f19707df66ec3196b0f14c Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
409
# of downloads :
13
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
text
First seen:
2026-07-17T23:55:00Z UTC
Last seen:
2026-07-19T22:12:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4a6a7f3fc8aeb12a77a9c9e93e40a35ae33dae15634ca554395243b7064f68fe/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/72ba1bcd-1103-4b19-acde-de95c34d7260
Behavior Graph:
Download SVG
%3 guuid=da0bef6c-1b00-0000-f680-d530d00a0000 pid=2768 /usr/bin/sudo guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776 /tmp/sample.bin guuid=da0bef6c-1b00-0000-f680-d530d00a0000 pid=2768->guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776 execve guuid=d145626f-1b00-0000-f680-d530da0a0000 pid=2778 /usr/bin/rm guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=d145626f-1b00-0000-f680-d530da0a0000 pid=2778 execve guuid=89b3a66f-1b00-0000-f680-d530db0a0000 pid=2779 /usr/bin/wget net send-data write-file guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=89b3a66f-1b00-0000-f680-d530db0a0000 pid=2779 execve guuid=ad42a87b-1b00-0000-f680-d530fb0a0000 pid=2811 /usr/bin/chmod guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=ad42a87b-1b00-0000-f680-d530fb0a0000 pid=2811 execve guuid=7be0f57b-1b00-0000-f680-d530fc0a0000 pid=2812 /usr/bin/dash guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=7be0f57b-1b00-0000-f680-d530fc0a0000 pid=2812 clone guuid=052d9c7c-1b00-0000-f680-d530010b0000 pid=2817 /usr/bin/wget net send-data write-file guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=052d9c7c-1b00-0000-f680-d530010b0000 pid=2817 execve guuid=f4525887-1b00-0000-f680-d530170b0000 pid=2839 /usr/bin/chmod guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=f4525887-1b00-0000-f680-d530170b0000 pid=2839 execve guuid=9902bc87-1b00-0000-f680-d530190b0000 pid=2841 /usr/bin/dash guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=9902bc87-1b00-0000-f680-d530190b0000 pid=2841 clone guuid=62cee188-1b00-0000-f680-d5301d0b0000 pid=2845 /usr/bin/wget net send-data write-file guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=62cee188-1b00-0000-f680-d5301d0b0000 pid=2845 execve guuid=052b0694-1b00-0000-f680-d5302c0b0000 pid=2860 /usr/bin/chmod guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=052b0694-1b00-0000-f680-d5302c0b0000 pid=2860 execve guuid=79e27d94-1b00-0000-f680-d5302e0b0000 pid=2862 /usr/bin/dash guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=79e27d94-1b00-0000-f680-d5302e0b0000 pid=2862 clone guuid=1f9a7295-1b00-0000-f680-d530300b0000 pid=2864 /usr/bin/wget net send-data write-file guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=1f9a7295-1b00-0000-f680-d530300b0000 pid=2864 execve guuid=c4bba9a2-1b00-0000-f680-d5304c0b0000 pid=2892 /usr/bin/chmod guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=c4bba9a2-1b00-0000-f680-d5304c0b0000 pid=2892 execve guuid=fbd7fea2-1b00-0000-f680-d5304d0b0000 pid=2893 /usr/bin/dash guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=fbd7fea2-1b00-0000-f680-d5304d0b0000 pid=2893 clone guuid=26a5b5a4-1b00-0000-f680-d530520b0000 pid=2898 /usr/bin/wget net send-data write-file guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=26a5b5a4-1b00-0000-f680-d530520b0000 pid=2898 execve guuid=d6042db0-1b00-0000-f680-d530680b0000 pid=2920 /usr/bin/chmod guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=d6042db0-1b00-0000-f680-d530680b0000 pid=2920 execve guuid=836a95b0-1b00-0000-f680-d5306a0b0000 pid=2922 /usr/bin/dash guuid=2d6e236f-1b00-0000-f680-d530d80a0000 pid=2776->guuid=836a95b0-1b00-0000-f680-d5306a0b0000 pid=2922 clone bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 217.60.195.160:80 guuid=89b3a66f-1b00-0000-f680-d530db0a0000 pid=2779->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 140B guuid=052d9c7c-1b00-0000-f680-d530010b0000 pid=2817->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 141B guuid=62cee188-1b00-0000-f680-d5301d0b0000 pid=2845->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 141B guuid=1f9a7295-1b00-0000-f680-d530300b0000 pid=2864->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 141B guuid=26a5b5a4-1b00-0000-f680-d530520b0000 pid=2898->bd4cd58e-4bf4-5e45-aa20-cbdbc74c7fd7 send: 141B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4a6a7f3fc8aeb12a77a9c9e93e40a35ae33dae15634ca554395243b7064f68fe
Gathering data
Threat name:
Script.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2026-07-18 05:46:26 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jjvh6p6iv2ysu55jzhut4qfdllrt3lqvmngkkvbzkjb3obspnd7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 4a6a7f3fc8aeb12a77a9c9e93e40a35ae33dae15634ca554395243b7064f68fe

(this sample)

Mirai

elf 4f77798ec288b63a181271d679c45b6e1a95ced69ee8121497ea19d450b8233f

  
URLhaus
https://urlhaus.abuse.ch/url/3887885/
  
Delivery method
Distributed via web download
  
Dropping
MD5 ff8901b9111ed0dd63c602e35875a96e
  
Dropping
SHA256 4f77798ec288b63a181271d679c45b6e1a95ced69ee8121497ea19d450b8233f

Comments