MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e9336f205cc08240bc638cde5a91efcb162f9573f5064ddd81e34d635f0a8a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	7e9336f205cc08240bc638cde5a91efcb162f9573f5064ddd81e34d635f0a8a6
SHA3-384 hash:	1970d5c9617c216f49e0028c903f5f45ff205f7dfa98e9bbce3f19cb1b9a601ca76cdf05860c5fe0fb30f0c0068c0356
SHA1 hash:	a292b82066a6a9232c7e0ee2b5821adc04db9f87
MD5 hash:	028ebc88cecb43281035961ca27b91b9
humanhash:	social-music-papa-violet
File name:	lil
Download:	download sample
Signature	Mirai Create hunting rule
File size:	844 bytes
First seen:	2026-08-04 08:21:21 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka8Cp/RwCFrbC8tE60CX6q2CXf6X:kXCKysE2hi0ziQvZoha8ce0jtEZG69vX
TLSH	T14601EBCAD1205940809AD41E23D71064F830C3C72A8B4B75BF5CA9399B94E08B07AFE4
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://129.121.110.105/b5x	4a095b2f18caf5c97e89c61c605c294cb72f835afc76bf5e75aea009d8ec39ff	Mirai	ascii ua-wget
http://129.121.110.105/yWy4	1b0d9849aa9f3f57eff1e32595e6b102b16019fca1012ebb31a0d3ab3344446a	Mirai	ascii ua-wget
http://129.121.110.105/FKO	cc3b5315c3ea9fb7c58a4f2c6f49d5ca4f37791c2289d0ab19626dc3d7eeb50b	Mirai	ascii ua-wget
http://129.121.110.105/eAC	35ac240d345da5908152dd2362e0b426e37b3c8d7a47d84e22f1b3d81b44a011	Mirai	ascii ua-wget
http://129.121.110.105/S4Cq	180ffa949c9b8aaf004e0d68bb09feae79e1578ab3df085de22c625aa027b122	Mirai	ascii ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a71a154e2ea3b473c9ff49a/reports/89384521-8cc7-4e9d-aa86-e6e5dcd5873e/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a9aa8f1d-3e6d-4c9c-8947-c05a8e31d8f4

Behavior Graph:

Download SVG

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7e9336f205cc08240bc638cde5a91efcb162f9573f5064ddd81e34d635f0a8a6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7e9336f205cc08240bc638cde5a91efcb162f9573f5064ddd81e34d635f0a8a6/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p2jtn4qfzqecic6ghdg6lki67sywf6kxh5igjxoydy2nmnpqvcta._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260804-j9fqsavejg/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Creates/modifies Cron job

Enumerates running processes

Modifies rc script

Modifies systemd

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.