MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d06e47b6a89d9069c501df5dda25f82d7cd21819ca10a6f16d562ed9053e3e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	5d06e47b6a89d9069c501df5dda25f82d7cd21819ca10a6f16d562ed9053e3e8
SHA3-384 hash:	8d6fbbcab61aabefed13f0504268b1fb875c542f13387e990a6faebec98f5542056ff6db69169bacda20a0f7ca1e73eb
SHA1 hash:	f2d486505932447e8b0ffd07809eda7d74b929aa
MD5 hash:	a6ccb4e86a1f4dd484f31a5833c99646
humanhash:	wisconsin-massachusetts-twelve-mars
File name:	nz.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'729 bytes
First seen:	2026-07-20 01:03:16 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:It6sYUIhOEh33A9PsaSTrTGF7JvVGAALoRNINksWrCj1TlyUmy7J:i7vEh3waaSTrTGFlTALLJWre1TlVPF
TLSH	T1415110C6126207722E529D23BBEB8D2971C0A0DE689BDF66A9DCBCF5518CD083C4D647
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.66.228.114/nz/nz.x86	ce23b01e50afa5dd35213b5cb7198e677e32adefbbf3ebd735e8a0a440d40bbf	Mirai	elf mirai ua-wget x86
http://45.66.228.114/nz/nz.mips	9cccf931d90f97b1380731af74213b539574e975c4e8b0c6a683aa0fc0e7183f	Mirai	elf mips mirai ua-wget
http://45.66.228.114/nz/nz.arc	01e10a0d58ddfef9d4f5c8f16f6397a8f3cde32759f0a2a9458aa4416a8fa8ce	Mirai	arc elf mirai ua-wget
http://45.66.228.114/nz/nz.i468	n/a	n/a	elf ua-wget
http://45.66.228.114/nz/nz.i686	a978a84fe498c755e481d161e22ed41087b93100a6b2648943c251208eeda3eb	Mirai	elf mirai ua-wget x86
http://45.66.228.114/nz/nz.x86_64	197cc8cb6a519636b797ba4ecb540e908486c581c99f653971bc6bb328041d17	Mirai	elf mirai ua-wget x86
http://45.66.228.114/nz/nz.mpsl	ffd0d42db56574e5cdcf9c1c898cd900ed7b71bf799f8212a6a08c235ac76d62	Mirai	elf mips mirai ua-wget
http://45.66.228.114/nz/nz.arm	f6b00f2f991671e105a03c5eb80b810e14372dcba7cc33703d428c9a264c3711	Mirai	arm elf mirai ua-wget
http://45.66.228.114/nz/nz.arm5	2ca55a0c2308734109690550078dfe7281e40755fb203d077e3b68f3115f204d	Mirai	arm elf mirai ua-wget
http://45.66.228.114/nz/nz.arm6	8e78c6d44d095554ab431b2d22a0fe6724f1b0312bbfc990f5f7339af72247a3	Mirai	arm elf mirai ua-wget
http://45.66.228.114/nz/nz.arm7	5f6cc8466655754cb6753127743d2f07d5201f1d6c0e0eb1db12c5696e4d9773	Mirai	arm elf mirai ua-wget
http://45.66.228.114/nz/nz.ppc	f77256eb64c144a1f433705087bcefffbf59c79f6953a39d7c0d745ceab31573	Mirai	elf mirai PowerPC ua-wget
http://45.66.228.114/nz/nz.spc	566ee3dfd8bee695f40e780f990946df38180dd286d3ef98123b310cc9fe80c2	Mirai	elf mirai sparc ua-wget
http://45.66.228.114/nz/nz.m68k	f93fdc21623eddd541ac3b5d92f83b31ea6ea3dd7b0359b09aaa1287ba58579f	Mirai	elf m68k mirai ua-wget
http://45.66.228.114/nz/nz.sh4	c683d44aec123273b706f948e25ac772f6275175479724a676fde168a7d42fa8	Mirai	elf mirai SuperH ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a5d758eb99fe6f869561e79/reports/9c15e4b7-15cd-4337-b28d-ff0d4b0e2b55/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-19T22:21:00Z UTC

Last seen:

2026-07-20T16:17:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5d06e47b6a89d9069c501df5dda25f82d7cd21819ca10a6f16d562ed9053e3e8/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/befdda5c-6db3-4c92-bfad-a21c4952a3db

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5d06e47b6a89d9069c501df5dda25f82d7cd21819ca10a6f16d562ed9053e3e8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5d06e47b6a89d9069c501df5dda25f82d7cd21819ca10a6f16d562ed9053e3e8/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-07-20 01:05:42 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ludoi63krhmqnhcqdx253is7qll42imbtsqqu3yw2vro3ect4pua._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260720-bev8zsay8r/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Modifies Watchdog functionality

Family: Mirai

Malware Config

C2 Extraction:

eclipse.garden

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5d06e47b6a89/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/5d06e47b6a89d9069c501df5dda25f82d7cd21819ca10a6f16d562ed9053e3e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh