MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a40dca6a3861874aba4985d3bc84d224929ec23bd2b8dffde474bfff80d14d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	6a40dca6a3861874aba4985d3bc84d224929ec23bd2b8dffde474bfff80d14d4
SHA3-384 hash:	794b6a68f9f5f290f97a96ddd6ea68cb50c7c7d98643e0c5f3c8df294844b5476e7bd67c69b38677016d1d5083a658fc
SHA1 hash:	c4b480e2b11baca9c89bc281a37e377d353b99ba
MD5 hash:	490f7945b22c2fc532e3ed6b56ab383d
humanhash:	bluebird-green-football-blue
File name:	6a40dca6a3861874aba4985d3bc84d224929ec23bd2b8dffde474bfff80d14d4
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'929 bytes
First seen:	2026-10-08 13:42:36 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:i6Dhml6ZnEl6CCXl6WePl6atazvZl6afaFvjl69N39z4gel69jcl6ySvl6jtjzqE:iemlqEl6Xl+PlT8zvZlTyFvjlEnz4Zlz
TLSH	T158518FC7021145396C67FAA3FDFE8F6C358268DA2CE53F0495DD34B9628CE893094A5B
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	mirai sh wraith

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://104.64.0.199/hiddenbin/Space.arc	a3ac0cd17220d71f76e6ae21bc6a82a6664ced814949724c7cfbfa8df2bc244f	Mirai	mirai wraith
http://104.64.0.199/hiddenbin/Space.x86	c273b95980cca11991eaa8c914cdefc78f7ab73da6e18be7437d3eec4095a0ac	Mirai	mirai wraith
http://104.64.0.199/hiddenbin/Space.x86_64	80de518cae3595b230f8dd865d754326f30e4ea8ff9e107fda987ea7d1ca0e9d	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.i686	0bf7c786b8e4e0fa284459db0c9bc18dee0cea772e519c16601ed7caaa52138d	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.mips	8cc85c9940db9e4f50ef91df4f9569c380b7b33bd272eca35f4f4e537cf5a02b	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.mips64	n/a	n/a	elf ua-wget
http://104.64.0.199/hiddenbin/Space.mpsl	c8bd3836fbcd2fb59c6c8606e04110e370bddf25ecb2f9e4c049d4827f76b09d	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.arm	13b211b289756f6b0bca46aadc18d8abe0110db3400968a9b1d261ab1b7906cd	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.arm5	62b7b66c5424d90f7cef9de55b80dc91bc93c3dac4a9c5b15c32854bb22b1ceb	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.arm6	0a6483fcb33b2b1c41d3900d6664f2962e5ff722dec9420fb6630c0c0a6934d3	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.arm7	6fce5471f4a86a77136bb9eab33f969cebec1c1b74228da1c404b7be73739199	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.ppc	b47d3ddcbb97281a4a8604b16fd5d1eef850a0488f53c1e8a912d0edb81b6429	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.sparc	n/a	n/a	elf ua-wget
http://104.64.0.199/hiddenbin/Space.m68k	412e214fa52fb1d9beee979c95b64b99776670f4f2fb7c6812246be4c1bafa3f	Mirai	elf ua-wget
http://104.64.0.199/hiddenbin/Space.sh4	cbe1e45bf6b3a8315495ad80bf54de74ad2d3c9f4c28eef4d6a9629d4bd7efdc	Mirai	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-08T11:52:00Z UTC

Last seen:

2026-10-08T12:21:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6a40dca6a3861874aba4985d3bc84d224929ec23bd2b8dffde474bfff80d14d4/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/122a97ed-8f7c-40e5-a490-d4511d7f9543

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6a40dca6a3861874aba4985d3bc84d224929ec23bd2b8dffde474bfff80d14d4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6a40dca6a3861874aba4985d3bc84d224929ec23bd2b8dffde474bfff80d14d4/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-10-08 13:43:14 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=njanzjvdqymhjk5etbotxscnejest3bdxuvy3766i5f776anctka._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/261008-q1axhazv6k/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Family: Mirai

Mirai ARM payload

Mirai Renesas payload

Malware Config

C2 Extraction:

104.64.0.199

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6a40dca6a386/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/6a40dca6a3861874aba4985d3bc84d224929ec23bd2b8dffde474bfff80d14d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh