MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 611efa02b3eb4e879898e4643edfee6ef9bd5592f1a1a22dd6e2c7805f2cd137. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	611efa02b3eb4e879898e4643edfee6ef9bd5592f1a1a22dd6e2c7805f2cd137
SHA3-384 hash:	bd2bc34be4a8ee79d43162679a02e3028e703fae33f41caea6d2f71499e0db85c08a6eab6d22a96819eb96162a70e121
SHA1 hash:	6bcb37330eb5aa0b90e4d3e5576c7d5552c1c09a
MD5 hash:	53a5d26bca1fc278a2e1fa87aeb93441
humanhash:	black-triple-helium-undress
File name:	sdt
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'550 bytes
First seen:	2026-08-31 16:12:27 UTC
Last seen:	2026-09-01 10:20:52 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vKUHi+UC6wUVUHUXU5dQUuU3UXOU5UHUnIUYU5bpn:v9GCOC0E5Rhkx20njzT
TLSH	T18E518EC517424FB03CB39DE777BA9C0436889EFE54C66E15A6F938E8864ED84B080B53
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://46.151.182.200/bot.x86	c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mips	2bdcd6e8a368c28488926a4773bf4cc2d5840ced8cb6499e417c3743cec7c44c	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arc	f8a45723a8bcd8f0858b958a9d61f38a7b657949ffe3d43038be0e7f562c24d0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.i468	n/a	n/a	censys elf ua-wget
http://46.151.182.200/bot.i686	d9bce6c9a1e6dc24747f2b754bc3ec0b381bac755d2dcc52db38c87fce8a46ab	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.x86_64	08ffaa3060aceda41990ab74a6f996b8fced28c3e3065e23e8cdebdb255be0e0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mpsl	d0d1bbcd8900f190bc7b24e1b15e5558fbc917e5172712075207ee3e29c16a3f	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm	3cf3edeeeac605be90d682b402ca8f34841633b05b45be6be2c50d30e5563fb2	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.arm5	70dce1cfed01b0cbaa7a50d2d23f44cd80621947a082c424a0c55a2e3fe48d61	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm6	6e2317a8a15f7dfdda44266aea43fa0579fe4319546e7a47e07b53e8e5e4fdae	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm7	bdbcb94265f715c4e044499b7f18a9193972117c06daf9097f91afe812de6207	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.ppc	d5c876aed3c43d53d1c37d5ea33a44e84fcd3af80a10c53b020fb8946bfd3765	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.spc	6dea295dace414dcecb4580a7882b707364cd31ea7708e4ec0643a022091b152	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.m68k	59b3e567a22126d9d26ab758dabe2a17908d0c48d326fdf2c260546fd8b220c8	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.sh4	4892824a9316779d423c3190df9bcaa9cdbde0756eb225b7a7ad5746dc04f654	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-31T13:54:00Z UTC

Last seen:

2026-08-31T17:10:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/611efa02b3eb4e879898e4643edfee6ef9bd5592f1a1a22dd6e2c7805f2cd137/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/181069b9-7ebe-4e73-940e-8230e96f6fba

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/611efa02b3eb4e879898e4643edfee6ef9bd5592f1a1a22dd6e2c7805f2cd137

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/611efa02b3eb4e879898e4643edfee6ef9bd5592f1a1a22dd6e2c7805f2cd137/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-08-31 16:11:52 UTC

File Type:

Text (Shell)

AV detection:

16 of 23 (69.57%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=meppuavt5nhipgey4rsd5x7on3432vms6gq2elow4ldyaxzm2e3q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260831-tn7bqawaqb/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Creates a desktop entry file

Modifies Bash startup script

Creates/modifies Cron job

Creates/modifies environment variables

Deletes log files

Modifies init.d

Modifies rc script

Modifies systemd

Write file to user bin folder

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Traces itself

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/611efa02b3eb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/611efa02b3eb4e879898e4643edfee6ef9bd5592f1a1a22dd6e2c7805f2cd137

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh