MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bd2982940016bf69dddbc83300e500c4ee67a5629ec2cf16f2d2ce99519df6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	5bd2982940016bf69dddbc83300e500c4ee67a5629ec2cf16f2d2ce99519df6a
SHA3-384 hash:	c6cbcab7eb46a1d0b6c499f4783da59064399f59a4469c631674fd9a59dd59e0c2f0a6d01ab38ed04fd36c9cce271725
SHA1 hash:	35f9d5099bcb44217b9c5d4f068eaa620fe246da
MD5 hash:	4d7a3cc52ced06edee118360d5584358
humanhash:	two-butter-nineteen-sad
File name:	a.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'718 bytes
First seen:	2026-08-12 14:54:25 UTC
Last seen:	2026-08-13 00:27:50 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:5XREx+DvhXxFwhSxU9htxH+pJ5LpCoSvi8m9qGEqG+MGRIO1QxqqxGxF5ZMFds4f:fevopHLgo3ht/jw/j
TLSH	T16B315C863511BE71E96F6F08F2649B6D910773B0ADFF2A4298624C033896580F9DBD30
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.76/miron.armv4l	1311c2f8cc6176c6aac03d055d30656039717b1e96f719b7cfe329ca52cd02ed	Mirai	94-154-43-76 elf mirai ua-wget
http://94.154.43.76/miron.armv5l	39e632ae0014657c8a3934da83be6e3a4466536f0463bcae6c10fde37ff1ff8a	Mirai	94-154-43-76 elf mirai ua-wget
http://94.154.43.76/miron.armv6l	f95fbaf1f96a73bdea5a3f90b2c1ed8a2e33dc77a644034976a23b6f5862bd53	Mirai	94-154-43-76 elf mirai ua-wget
http://94.154.43.76/miron.armv7l	c32ba3b5f562be2e32dc4556fecde6f5e040767d80be676bf7c74d53365cc2fb	Mirai	94-154-43-76 elf mirai ua-wget
http://94.154.43.76/miron.i486	6a1aa262ce658a42362fd7489415cb93e34b7415ab972d78c63f09f413af5b55	Mirai	elf mirai ua-wget
http://94.154.43.76/miron.m68k	09768b33697871b52d87d6422395568155e6bd39950785adf4d7dcd603c88470	Mirai	elf ua-wget
http://94.154.43.76/miron.mips	cb9c5a44de04796ec2bcf12a7d2251cbb43e9a833773b5a5eeecf2a65851b9b4	Mirai	94-154-43-76 elf mirai ua-wget
http://94.154.43.76/miron.mipsel	358853b9a5dc5fd36ffdc7cd399834888450805bfdcb6a1059302d2fcaf87bf1	Mirai	94-154-43-76 elf mirai ua-wget
http://94.154.43.76/miron.mipsrouter	cb9c5a44de04796ec2bcf12a7d2251cbb43e9a833773b5a5eeecf2a65851b9b4	Mirai	elf mirai ua-wget
http://94.154.43.76/miron.powerpc	e9ef72852871ea19efabf62c7a6300602f5a40fa393ead99e80cb998b09e5644	Mirai	elf ua-wget
http://94.154.43.76/miron.sh4	ca93431a830b141f45a3a0dbd6190389f209f8eaebba8c6b7ed93481943264c8	Mirai	elf mirai ua-wget
http://94.154.43.76/miron.sparc	81edc0b4af09f855d026fac7cb8612cc760be4bda58bd5b6242effee69ea9bde	Mirai	elf ua-wget
http://94.154.43.76/miron.x86_64	d700571b75a3126ffd00c3ae8eae567e58f77a0619d18d2d27c59ebd7006e486	Mirai	94-154-43-76 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader

Link:

https://www.filescan.io/uploads/6a7c89291ff26f6ca99ea1b3/reports/95874e34-cc42-46f0-b3ae-3eebc5b41e15/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-12T12:15:00Z UTC

Last seen:

2026-08-12T23:07:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5bd2982940016bf69dddbc83300e500c4ee67a5629ec2cf16f2d2ce99519df6a/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b124b10f-8375-46f3-8072-d514adcf2a30

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5bd2982940016bf69dddbc83300e500c4ee67a5629ec2cf16f2d2ce99519df6a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5bd2982940016bf69dddbc83300e500c4ee67a5629ec2cf16f2d2ce99519df6a/

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-08-12 14:27:28 UTC

AV detection:

4 of 38 (10.53%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lpjjqkkaafv7nho5xsbtadsqbrhom6swfhwcz4lpfuwotfiz35va._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260812-r94rlszbma/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

File and Directory Permissions Modification

Family: Mirai

Malware Config

C2 Extraction:

94.154.43.76

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/5bd2982940016bf69dddbc83300e500c4ee67a5629ec2cf16f2d2ce99519df6a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh