MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c03fe2649d4b7a6e0255500ccc6d5d4a6fc41a4db5388bdabcf2d69c2a940ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	7c03fe2649d4b7a6e0255500ccc6d5d4a6fc41a4db5388bdabcf2d69c2a940ef
SHA3-384 hash:	13cc3c0f340922fec783203a7cf3c88cd38ee3610e7aa7f9bf4cab17903d0d81ae26c3413c961e5503870aed44b4bfdc
SHA1 hash:	6a65f7c7efcd3a6d7a0b1a0cbc1d415f3b104485
MD5 hash:	c2d67336c8aadf52ed47fe159433f512
humanhash:	comet-nine-alanine-two
File name:	lil
Download:	download sample
Signature	Mirai Create hunting rule
File size:	836 bytes
First seen:	2026-06-28 06:19:59 UTC
Last seen:	2026-06-28 08:34:55 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaWCirdKgACEFfCYSaUOCbgvCnn6X:kXCKysE2hi0ziQvZohaWXohOo/wn6X
TLSH	T1D60148CE85046D10509A9A2C32975455F420C3CE294A8FB9BFAC6EB9FBC5904B076E88
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://129.121.114.124/B16	e56d34da542f3a9b7865bd302da2967e3d84f46dde7183fc75147890fcfcbc50	Mirai	elf mirai ua-wget
http://129.121.114.124/sxR	686c9f6ea24a16f1cabc40d7787ed700377d0289a00f0f5bfc49a2c5d88cc4da	Mirai	elf mirai ua-wget
http://129.121.114.124/8Xx	985caa66c6d413fcb1b88743fa36a74b5f325b2574d061b3eccaf63a61a8da5e	Mirai	elf ua-wget
http://129.121.114.124/eQA	25a8145fe4b271a2468953a1a74a48f273402e0abaa185fe868f0131d4658c75	Mirai	elf ua-wget
http://129.121.114.124/6F8	55d38ae5923cd336221378583617758a55ee114fe777eb3cb5ca04bc6200356f	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a40bd39e01da56f025d5612/reports/4e226821-6a2f-4d2d-a783-f717e39c5d61/overview

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/b7799576-38f4-4fa8-a0a9-217bc749bf9a

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7c03fe2649d4b7a6e0255500ccc6d5d4a6fc41a4db5388bdabcf2d69c2a940ef

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7c03fe2649d4b7a6e0255500ccc6d5d4a6fc41a4db5388bdabcf2d69c2a940ef/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/7c03fe2649d4b7a6e0255500ccc6d5d4a6fc41a4db5388bdabcf2d69c2a940ef

Threat name:

Document-HTML.Downloader.Bash

Status:

Malicious

First seen:

2026-06-28 06:21:22 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pqb74jsj2s32nybfkuamzrwv2stpyqne3njyrpnlz4wwtqvjidxq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260628-g351zsfy5s/

Behaviour

Reads runtime system information

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/7c03fe2649d4b7a6e0255500ccc6d5d4a6fc41a4db5388bdabcf2d69c2a940ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.