MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e1be65b2bbbb73ff6fe6c1c9cfef0fa250b1ceaae02f89d3c3d028056ba601b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	4e1be65b2bbbb73ff6fe6c1c9cfef0fa250b1ceaae02f89d3c3d028056ba601b
SHA3-384 hash:	0f5fa7ad6be1953a10c16f9f6d2e3f942a4143abb772834f3aa6ebd1a4d80aaf77b2bd661da254b497fc27e5647d4ead
SHA1 hash:	03f463869112428e4d79b212075b9ef0f3207ea9
MD5 hash:	4d3089f13dec251924e053b35a7b09c2
humanhash:	virginia-bacon-bakerloo-berlin
File name:	ok
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'922 bytes
First seen:	2026-09-22 04:57:41 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:EsgZ0fNIzAKYyfUJqKUSwp6RQiuMxWNT2dSTsysCGTsOsRs:EsgZlAgJKUSy6RQQgTWSTsysCysOsRs
TLSH	T1754183C952700975682BD94DF2B9B888719EF1FB2E8B57E4CCCC1DA95108A46F041B4D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.182.210.174/0uparm	03c77e109a9faa3e99b0f3e9b83eea4f5f7f030662c08c374cb37a04e92c74cc	Mirai	elf ua-wget
http://5.182.210.174/0uparm5	e89455525bb56b1f18857515bbf237a0a160033bdd95b8c41f1f4ee22e8936e7	Mirai	elf ua-wget
http://5.182.210.174/0uparm6	f8e41136e3b1ef6daaff98f665139a528978bb375431014efd996de9ae79ec93	Mirai	elf ua-wget
http://5.182.210.174/0uparm7	76c3ad51a52899878a89cb49cbfc034aa810f837d893a8bff63dfa6af788f4ef	Mirai	elf ua-wget
http://5.182.210.174/0upm68k	523db43eac031043521e0a8a7d0c30eb13d5bd66bb3096cec9be38a8895ea13e	Mirai	elf ua-wget
http://5.182.210.174/0upmips	dd5af3cc7fd1a458953940f8df0155f125c4814eadcf8770491634680a28a91e	Mirai	elf ua-wget
http://5.182.210.174/0upmpsl	8288bdeec418d3a1cfdcb726beb42751361b8ff55a458e03a1b27d7a6c9da522	Mirai	elf ua-wget
http://5.182.210.174/0upppc	38474707724c5fdc9a4cba7a60797ce14e0cdaecd6f11b49acb12dddf8d3753c	Mirai	elf ua-wget
http://5.182.210.174/0upsh4	849d618e1c224d58cd269a06ded13047ab971ff611b254da4de414644069977b	Mirai	elf ua-wget
http://5.182.210.174/0upspc	6c0372b4924412776f036fed3946528ab7619c7001358d3d83700f3b88a3dc2d	Mirai	elf ua-wget
http://5.182.210.174/0upx64	e820bd6b1c285945dbd17b68ee9e2cbe063bed78578b8993e822b94ddb4a8597	Mirai	elf ua-wget
http://5.182.210.174/0upx86	f87a3f6bd5b29ccef54d8d32847993288c60289effe935519593aff5038eef0f	Mirai	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-34.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ab20ae5ac7d3eacb2fb2b7c/reports/858dc8e6-c538-4b33-9d98-1bb104671f6e/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-22T02:32:00Z UTC

Last seen:

2026-09-22T03:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4e1be65b2bbbb73ff6fe6c1c9cfef0fa250b1ceaae02f89d3c3d028056ba601b/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/22210f02-8ee5-430d-8b44-0e1a100db19b

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4e1be65b2bbbb73ff6fe6c1c9cfef0fa250b1ceaae02f89d3c3d028056ba601b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e1be65b2bbbb73ff6fe6c1c9cfef0fa250b1ceaae02f89d3c3d028056ba601b/

Threat name:

Linux.Trojan.Geninst

Status:

Malicious

First seen:

2026-09-22 04:58:22 UTC

File Type:

Text (Shell)

AV detection:

18 of 36 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jyn6mwzlxo3t75x6nqojz7xq7isqwhhkvybprhj4hubiavv2manq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260922-flyd5sgb76/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Creates a large amount of network flows

Family: Mirai

Malware Config

C2 Extraction:

realsus.net

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4e1be65b2bbb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4e1be65b2bbbb73ff6fe6c1c9cfef0fa250b1ceaae02f89d3c3d028056ba601b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh