MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797
SHA3-384 hash:	8660406e7e2d454c8d4542589b656f8077dc8e98ab7aa037795c36ce4e996270b516482b165d836d909e822cc2cbc39d
SHA1 hash:	acd41c3dbcecec4053c32e7c63c7dfddf33b4fc9
MD5 hash:	8787c21d05601ac3cb1c571b0d5ea65f
humanhash:	mango-bravo-fruit-gee
File name:	ok
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'608 bytes
First seen:	2026-08-15 03:00:41 UTC
Last seen:	2026-08-15 20:25:18 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:f+NIMmuU1UEXXxAp8sMLp0CxIPaLfcaxq:KI2U1U+Xmp8sMLpRIybd4
TLSH	T1503122DA00101A302202DD9EB362355CB68FE1EB2D9FD7E5DD890EAA46497CCF261B59
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://5.182.210.174/af8816	9c719ba3b1cd4a8cf820c5eaea04aae7d0188da53e75f18f9c04c1fbbd3cc97e	Mirai	mirai ua-wget
http://5.182.210.174/8e9f60	9d44d4d051f6aa3fbc95fab0aae818347a602d655fa7f1fba6267e728d7ff2d3	Mirai	mirai ua-wget
http://5.182.210.174/fefd81	3b2f2f02077aee3efe6dcca1bb84afc59af14fff78d1b6dd18aed0c24e08a313	Mirai	mirai ua-wget
http://5.182.210.174/d1d1d3	bf0aabf517685756f16b22f4b1907113a1cd160fa7b5ee384cb554b42b311841	Mirai	mirai ua-wget
http://5.182.210.174/b7e327	5c502903694591a219ca263247c4c159967c5838c9a85641f3fb908b983d1e32	Mirai	mirai ua-wget
http://5.182.210.174/e6af82	383819dd8c7df6077d193ace66715d7b3e5d82e0de0ad87ef8a783965786d606	Mirai	mirai ua-wget
http://5.182.210.174/a74d7e	41ac975aa0638b879bade9f672fbcdacb303bc6ceb5e92083b85af9cd440cd04	Mirai	mirai ua-wget
http://5.182.210.174/18c0c9	a75a98641037e42abb4c543d90e81dafdae3b27e90972b705a2e9242a5bee123	Mirai	mirai ua-wget
http://5.182.210.174/dfbfd1	3366350561c41f5d15994244bfd7358ca256d16a1e954d7a986bd4d2d50c895e	Mirai	mirai ua-wget
http://5.182.210.174/ef2a92	b595ef9ca4756a07bc83027a943009cb947d03c4c261a3e4cc3bec467b43c203	Mirai	mirai ua-wget
http://5.182.210.174/1493f3	abda6887930f4e2e1047b39adf23bbf8bdee9e15c7e2101245bb690be7d80488	Mirai	mirai ua-wget
http://5.182.210.174/1b2ad0	8bdbe21eafc7223a75ea9d075237d389e0c39f6370721f1ea36214989e5bab63	Mirai	mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/6a7fd6603de5dcbd206e3318/reports/fa685cce-f122-4ba8-8cf1-98969bd979f4/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-15T01:12:00Z UTC

Last seen:

2026-08-16T17:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4bf8d623-b73c-4200-9528-638b83bb79a7

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2026-08-15 03:01:57 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nksqksuv2izhpx2bpjpwttzjfym3ylxqibv4bqmije22itr446lq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260815-dhq5jsysgz/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Unexpected DNS network traffic destination

Creates a large amount of network flows

Family: Mirai

Malware Config

C2 Extraction:

kappadocia.net
141.98.10.50

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6aa5054a95d2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.