MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ed61165beb338d3c8dbb0f71b328ac71d382ac3dad6a1145aaf16bfeb894010. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	4ed61165beb338d3c8dbb0f71b328ac71d382ac3dad6a1145aaf16bfeb894010
SHA3-384 hash:	da922359f1e372bcf9ea19f7ab141dd756c9dd0ceaaa3c29b7e36e71843793b7f36adcd6444b3316765d2ad16f114df4
SHA1 hash:	1fa6de99c20f3136b43443321e69c4791c5fe98d
MD5 hash:	89e2c08184ef47a20501cf0f05b10e37
humanhash:	artist-december-lake-jupiter
File name:	ok
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'644 bytes
First seen:	2026-06-16 15:58:58 UTC
Last seen:	2026-06-16 16:24:12 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:xPtMj3EzEuyFkzMMIbfQ4DzlGIevqwTbI:xPtMj3EzEIgMIbfTDzloCw4
TLSH	T159314FDF45146A391B02CADE73723048B10C42EB185FE3D48C595FAD868899DB293FEA
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.182.210.61/aba2dd	e217a281270dc8762820e5edc7dea14d7cd271c2d2e059719ae917761c7956a8	Mirai	elf mirai ua-wget
http://5.182.210.61/b30ea3	1637e7ba1a81d9d1e6dd228d601c62f2a28daf03f2534cb09038da6185d3e789	Mirai	elf mirai ua-wget
http://5.182.210.61/2fb9dc	43b5ab7423408f298026435733151fbc031c8f00ad9e6e6b43f3987cace89620	Mirai	elf mirai ua-wget
http://5.182.210.61/a802ee	c8f99502782a92da92143a2d77d5f90f5167a1ab3cd59ebe4fe4815e40a49aa6	Mirai	elf mirai ua-wget
http://5.182.210.61/d0e001	6691d368dd2efa53408a5ee23b01d9bf1c74a51c6899ca59a91448dfc74c4422	Mirai	elf mirai ua-wget
http://5.182.210.61/5f0ed5	ab9595e8292ee3c3df40a28815641b73273a2914f83dc8b5d43e70481f2c414c	Mirai	elf mirai ua-wget
http://5.182.210.61/eac594	0286a2b15bca44bb27a6a4da44c46f31ad96ff307d9fe68d92e4b22aec8345b3	Mirai	elf mirai ua-wget
http://5.182.210.61/8636e6	95bae1bc1eb147ed4b0bbfef6641ac62e6a0aa583ab7398067e1d54a78d9c3a6	Mirai	elf mirai ua-wget
http://5.182.210.61/ac03c5	6f32da872345812dbe8756b23f7c99c73acfc541a04bf4f7d1cc80ef5d888e83	Mirai	elf mirai ua-wget
http://5.182.210.61/44a752	0310eed14d111822310e3a77c855988a2f999a9e2f5c7789d6ff378417e5ef17	Mirai	elf mirai ua-wget
http://5.182.210.61/ca382f	487a1d887710fd9eeb08359a909cd930d04719a637538edfc227602812b1ffd8	Mirai	elf mirai ua-wget
http://5.182.210.61/cb2c1f	df5bdee1b0bdc5ddd8c83b7cd9fd2a59fbc6032f204162fdbd9ec6ab9c79a90b	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a3172e11f652d68658443ed/reports/47c45e47-3f75-49bc-97fa-f1d1de66f34d/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-16T13:06:00Z UTC

Last seen:

2026-06-17T19:54:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/4ed61165beb338d3c8dbb0f71b328ac71d382ac3dad6a1145aaf16bfeb894010/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/0de02727-6a40-44d9-a581-b4a62cd317e4

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4ed61165beb338d3c8dbb0f71b328ac71d382ac3dad6a1145aaf16bfeb894010

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ed61165beb338d3c8dbb0f71b328ac71d382ac3dad6a1145aaf16bfeb894010/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/4ed61165beb338d3c8dbb0f71b328ac71d382ac3dad6a1145aaf16bfeb894010

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2026-06-16 15:59:34 UTC

File Type:

Text (Shell)

AV detection:

12 of 23 (52.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j3lbczn6wm4nhsg3wd3rwmuky4otqkwd3llkcfc2v4ll724jiaia._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260616-tfayjsf14w/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Family: Mirai

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/4ed61165beb338d3c8dbb0f71b328ac71d382ac3dad6a1145aaf16bfeb894010

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.