MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4adc49e6a8128f659d6642f7addb22b8eb109553cea022c2df2465098f50b5ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	4adc49e6a8128f659d6642f7addb22b8eb109553cea022c2df2465098f50b5ba
SHA3-384 hash:	ff58086ba6cca2a0489f7bec67fcb1985f4038d2ed3eb5ca15d36485b02ecf720dde19f428c623cd0c70aa7c2ef38378
SHA1 hash:	2a69ba6bacb717110150a4e8cd15670eb0789eff
MD5 hash:	00f476ed09ae7d45d678e4b7e1d0872b
humanhash:	jersey-ohio-princess-five
File name:	goahead
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'863 bytes
First seen:	2025-10-14 20:15:01 UTC
Last seen:	2025-11-19 08:34:25 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vToYoqoEoOoNkzEoJoqojoEoSoLRUfoZoGL:vToYoqoEoOomEoJoqojoEoSoLRUfoZoC
TLSH	T1735160C5722603747FE25D777DB5406CB6C5E1D2BAC58E8AD4ECA8B881CDF0814A06B3
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://64.91.237.162/bins/sora.x86	9209da6b229bc24256cf26833723fc3a7c89272a5af754861c095d350b99de10	Mirai	mirai opendir
http://64.91.237.162/bins/sora.mips	29c7491b527a0e18a776b8cc1831a8ba4b97d917fd76d047c96cc5ae21a79924	Mirai	mirai opendir
http://64.91.237.162/bins/sora.x86_64	7e8a271658bd0f9be6bf33a2ea92ce4fad4774aafac33c5b2caedf6417fd15ac	Mirai	mirai opendir
http://64.91.237.162/bins/sora.i468	n/a	n/a	elf ua-wget
http://64.91.237.162/bins/sora.i686	92575fbaacd79518241425e42a4cdacbf65def900864a48fc0b27504f78cbff4	Mirai	mirai opendir
http://64.91.237.162/bins/sora.mpsl	a3b52b958c8ea783c24f7a02fb57b5228fc1969791021519b42e14e58124e30d	Mirai	mirai opendir
http://64.91.237.162/bins/sora.arm4	n/a	n/a	elf ua-wget
http://64.91.237.162/bins/sora.arm5	6357efa12b55a6c1f2d555f6dbbe40a0ed2d5c1e2dced815347fa98881eeefcb	Mirai	mirai opendir
http://64.91.237.162/bins/sora.arm6	579e9db35f7d3e276a6fd3b2bb98091a12c58d4cb0cd0ed3ae3cdbfd19304b0a	Mirai	mirai opendir
http://64.91.237.162/bins/sora.arm7	a2a3eda8d88cb807ffc26480a5a40cf79ac74b135b8aadaa225fed856da77cef	Mirai	mirai opendir
http://64.91.237.162/bins/sora.ppc	773298e6d3a314ffe9554eeea412ac65fbb16cf4030acf0e2553c42a1f159bb2	Mirai	mirai opendir
http://64.91.237.162/bins/sora.ppc440fp	n/a	n/a	elf ua-wget
http://64.91.237.162/bins/sora.m68k	a25e8659220a59deaae914fc945fa6b31667bc0c7146a968bec1c4be9ffee9ed	Mirai	mirai opendir
http://64.91.237.162/bins/sora.sh4	0dd50416937f0bbb202464b09fb982739b34bde7d11834b78a137fc4659502de	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-14T17:40:00Z UTC

Last seen:

2025-10-14T19:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4adc49e6a8128f659d6642f7addb22b8eb109553cea022c2df2465098f50b5ba/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/64c8d91f-7a7c-4340-8a54-86fdaa7f8991

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4adc49e6a8128f659d6642f7addb22b8eb109553cea022c2df2465098f50b5ba

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4adc49e6a8128f659d6642f7addb22b8eb109553cea022c2df2465098f50b5ba/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-10-14 20:22:28 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jloetzvickhwlhlgil323wzcxdvrbfktz2qcfqw7ersqtd2qww5a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:sora antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251014-y4lgeabs4c/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

UPX packed file

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (47425) amount of remote hosts

Creates a large amount of network flows

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4adc49e6a812/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/4adc49e6a8128f659d6642f7addb22b8eb109553cea022c2df2465098f50b5ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.