MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e
SHA3-384 hash:	abb0fac296e391afa220cc38d1e17710fbfd12d198f68d136ecc47f538d3a7d8edfb440628fee6ceefab860f3a3e197a
SHA1 hash:	c3d0200c509b7f4ac68ece241e415759ef3785da
MD5 hash:	28bed84beb9b71b60995f3739e6242ff
humanhash:	gee-nitrogen-juliet-purple
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'907 bytes
First seen:	2026-07-14 20:52:40 UTC
Last seen:	2026-07-15 21:57:00 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:7oHDnD2JMJgDgbiBFMQMuZ9fESfEnE2EhE8gui9Q9bwcbnt3iDiJUfFOL+n+hM3I:6D2JMu0biB+RuZJJcvyK4bwd+hM3I
TLSH	T1C5515EDB030C5B32961989CEB7F731B4714AE18266DFD705FA44082D4FCAE4C7696E61
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnaarch64xnxn	5b7b9a6449dcf0b779dd72210926d4567453aa40f16b473343a3aa4372798884	Mirai	n/a
http://41.216.189.157/bins/xnxnxnxnxnxnxnxni386xnxn	f9a1915d056acc36d5405d81c80d0065078b1e47d8003d41fcb823e9b2e27835	Mirai	n/a
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	5850b6e589ea496b093b3c162dab126789ea118276bc3c23ff4cf75c6c19c8d5	Mirai	mirai wraith
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnm68kxnxn	a6ea67372e5b31bfd633d9745541577e9f3edb39f0eea75cf9679b632ca04908	Mirai	mirai wraith
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	621b45291f917a0aa962047cfa51fa7f29e60bd0fbd0293d40078f625a34f22d	Mirai	elf ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnmipsxnxn	cbfa3cd2012dedb4c7d81d69b4a7e56873230778f692f9b320246449c21be0e9	Mirai	elf ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnor1kxnxn	776aa8fb7c02f961a7cd9fbffec0f7dc1994823564bb0687dc0b24002d1edb29	Mirai	elf ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	ac0f31ac1a7c90144fc2771972501971e60e05f9b8505ebd1ef36fd5560c9ebb	Mirai	elf ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnriscv32xnxn	36da89cd89834cf621c7d82588317fc8b89c74a9ae691a4f3022e81d25031c73	Mirai	elf ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnriscv64xnxn	e1508987f0b4575c1ef8fc3f848376372a51ea473250afe57aea6e6231cedcdf	Mirai	elf ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnsh2xnxn	5cd44dea8dc438bc481973b1707496ea610cd023570ab8a7d1f4eee2c3eabc8f	Mirai	elf ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnsh4xnxn	4e98a9b13bdb6de3b999df62d105442b001807a0292041a4d21ca74dda2bcaa5	Mirai	elf ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnx86_64xnxn	e06d110324cf8a23b160aa2ae2d8002ab076d5ddbf33684c7cc36919f8cd10d0	Gafgyt	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a56a1a0a241fbac8598c4ba/reports/6c1d7154-b531-4baf-b33d-63fc159df5d3/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-14T16:07:00Z UTC

Last seen:

2026-07-15T11:56:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/aade62e2-297a-4d1f-a91f-0f8311259b30

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e/

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-07-14 20:54:39 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qatolhc4janyfacajkzz5bilwt2bflsdzxm47pekdw5kneycsa7a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260714-zn52jsfy4w/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.