MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 567564ca8951af7b4d8d3f16d6dfef87b30fab048482dbfa5e878897e90e6814. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	567564ca8951af7b4d8d3f16d6dfef87b30fab048482dbfa5e878897e90e6814
SHA3-384 hash:	d147968f44431f347f5b7749139170be2efe26d37e8f1ba87680ce76c99b225968ebfd278c2260e93769d284abf54774
SHA1 hash:	0b31d858683f926dccf13c5083058d2c664a5c6a
MD5 hash:	c59da6b48ce08ebef39f8ef6db23d57a
humanhash:	maine-mexico-don-high
File name:	gocl
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'573 bytes
First seen:	2026-09-01 21:24:43 UTC
Last seen:	2026-09-02 16:47:28 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vguLFifLC/ctLXxoLYL5HSL5FNLsWL4LXHLuLZ2LS8FLlL5fdV:vgggC/EMa65bsI6bgZoS8JpFj
TLSH	T1B3518ED523420F713DA39CE723BA9C0835889EEF54C66E1AA5F938E4854ED81F180753
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://46.151.182.200/bot.x86	c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mips	2bdcd6e8a368c28488926a4773bf4cc2d5840ced8cb6499e417c3743cec7c44c	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arc	f8a45723a8bcd8f0858b958a9d61f38a7b657949ffe3d43038be0e7f562c24d0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.i486	20e0b568507ba65e67672f860905880e5fea56654285f9b258675b5eae473b01	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.i686	d9bce6c9a1e6dc24747f2b754bc3ec0b381bac755d2dcc52db38c87fce8a46ab	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.x86_64	08ffaa3060aceda41990ab74a6f996b8fced28c3e3065e23e8cdebdb255be0e0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mpsl	d0d1bbcd8900f190bc7b24e1b15e5558fbc917e5172712075207ee3e29c16a3f	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm	3cf3edeeeac605be90d682b402ca8f34841633b05b45be6be2c50d30e5563fb2	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.arm5	70dce1cfed01b0cbaa7a50d2d23f44cd80621947a082c424a0c55a2e3fe48d61	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm6	6e2317a8a15f7dfdda44266aea43fa0579fe4319546e7a47e07b53e8e5e4fdae	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm7	bdbcb94265f715c4e044499b7f18a9193972117c06daf9097f91afe812de6207	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.ppc	d5c876aed3c43d53d1c37d5ea33a44e84fcd3af80a10c53b020fb8946bfd3765	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.spc	6dea295dace414dcecb4580a7882b707364cd31ea7708e4ec0643a022091b152	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.m68k	59b3e567a22126d9d26ab758dabe2a17908d0c48d326fdf2c260546fd8b220c8	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.sh4	4892824a9316779d423c3190df9bcaa9cdbde0756eb225b7a7ad5746dc04f654	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader mirai

Link:

https://www.filescan.io/uploads/6a9742bfdbbbfaea5f00b21d/reports/557e5fb7-ade3-4f10-8abb-8e532174f438/overview

Verdict:

Malicious

File Type:

UnixScript

First seen:

2026-09-01T15:47:00Z UTC

Last seen:

2026-09-01T15:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/567564ca8951af7b4d8d3f16d6dfef87b30fab048482dbfa5e878897e90e6814/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/00c77a83-4811-419d-8f0c-7cfed12f85f5

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/567564ca8951af7b4d8d3f16d6dfef87b30fab048482dbfa5e878897e90e6814

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/567564ca8951af7b4d8d3f16d6dfef87b30fab048482dbfa5e878897e90e6814/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-09-01 21:25:41 UTC

File Type:

Text (Shell)

AV detection:

20 of 36 (55.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kz2wjsujkgxxwtmnh4lnnx7pq6zq7kyeqsbnx6s6q6ejp2ionaka._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260901-z9q5hsxfne/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Creates a desktop entry file

Modifies Bash startup script

Creates/modifies Cron job

Creates/modifies environment variables

Deletes log files

Modifies init.d

Modifies rc script

Modifies systemd

Write file to user bin folder

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Traces itself

Unexpected DNS network traffic destination

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/567564ca8951af7b4d8d3f16d6dfef87b30fab048482dbfa5e878897e90e6814

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh