MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e06f71b325f9f47397f3319fa9e6d8156062eccfd3c2f40d265864d93e23822. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	4e06f71b325f9f47397f3319fa9e6d8156062eccfd3c2f40d265864d93e23822
SHA3-384 hash:	3852b7a85460a4ff355082e7300bdbcd21c07da04bb1cf4f795f5a4c17f6fd982f658b68374e3f67347cb258b9c8c414
SHA1 hash:	067e0a6c6b1ebd10435f8ce16e7d1513c97cf0bd
MD5 hash:	f46b57629b132da22be3d848b80c2a51
humanhash:	bakerloo-two-burger-blossom
File name:	li
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'655 bytes
First seen:	2026-09-01 21:50:07 UTC
Last seen:	2026-09-02 01:55:33 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:pKQTZtiXX3dZod+VBsBT81j+DX7IbHl1XH:pKQVaXtuMoBTIj+PIbHl13
TLSH	T13A515ED517620AB53C53ADC337AF8C447588AAFF28C29E59A9ED34E4494ECCAB084753
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://46.151.182.200/bot.x86	c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mips	2bdcd6e8a368c28488926a4773bf4cc2d5840ced8cb6499e417c3743cec7c44c	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arc	f8a45723a8bcd8f0858b958a9d61f38a7b657949ffe3d43038be0e7f562c24d0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.i486	20e0b568507ba65e67672f860905880e5fea56654285f9b258675b5eae473b01	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.i686	d9bce6c9a1e6dc24747f2b754bc3ec0b381bac755d2dcc52db38c87fce8a46ab	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.x86_64	08ffaa3060aceda41990ab74a6f996b8fced28c3e3065e23e8cdebdb255be0e0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mpsl	d0d1bbcd8900f190bc7b24e1b15e5558fbc917e5172712075207ee3e29c16a3f	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm	3cf3edeeeac605be90d682b402ca8f34841633b05b45be6be2c50d30e5563fb2	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.arm5	70dce1cfed01b0cbaa7a50d2d23f44cd80621947a082c424a0c55a2e3fe48d61	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm6	6e2317a8a15f7dfdda44266aea43fa0579fe4319546e7a47e07b53e8e5e4fdae	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm7	bdbcb94265f715c4e044499b7f18a9193972117c06daf9097f91afe812de6207	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.ppc	d5c876aed3c43d53d1c37d5ea33a44e84fcd3af80a10c53b020fb8946bfd3765	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.spc	6dea295dace414dcecb4580a7882b707364cd31ea7708e4ec0643a022091b152	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.m68k	59b3e567a22126d9d26ab758dabe2a17908d0c48d326fdf2c260546fd8b220c8	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.sh4	4892824a9316779d423c3190df9bcaa9cdbde0756eb225b7a7ad5746dc04f654	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-01T20:01:00Z UTC

Last seen:

2026-09-02T18:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4e06f71b325f9f47397f3319fa9e6d8156062eccfd3c2f40d265864d93e23822/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6b6c0b2d-2d0b-4a74-81a4-d6ff66447f61

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4e06f71b325f9f47397f3319fa9e6d8156062eccfd3c2f40d265864d93e23822

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e06f71b325f9f47397f3319fa9e6d8156062eccfd3c2f40d265864d93e23822/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-09-01 21:50:48 UTC

File Type:

Text (Shell)

AV detection:

20 of 36 (55.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jydpogzsl6puool7gmm7vhtnqflamlwm7u6c6qgsmwde3e7chara._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260901-1p4esaxhpb/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Creates a desktop entry file

Modifies Bash startup script

Creates/modifies Cron job

Creates/modifies environment variables

Deletes log files

Modifies init.d

Modifies rc script

Modifies systemd

Write file to user bin folder

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Traces itself

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4e06f71b325f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4e06f71b325f9f47397f3319fa9e6d8156062eccfd3c2f40d265864d93e23822

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh