MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e
SHA3-384 hash:	abb0fac296e391afa220cc38d1e17710fbfd12d198f68d136ecc47f538d3a7d8edfb440628fee6ceefab860f3a3e197a
SHA1 hash:	c3d0200c509b7f4ac68ece241e415759ef3785da
MD5 hash:	28bed84beb9b71b60995f3739e6242ff
humanhash:	gee-nitrogen-juliet-purple
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'907 bytes
First seen:	2026-07-14 20:52:40 UTC
Last seen:	2026-08-05 18:16:27 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:7oHDnD2JMJgDgbiBFMQMuZ9fESfEnE2EhE8gui9Q9bwcbnt3iDiJUfFOL+n+hM3I:6D2JMu0biB+RuZJJcvyK4bwd+hM3I
TLSH	T1C5515EDB030C5B32961989CEB7F731B4714AE18266DFD705FA44082D4FCAE4C7696E61
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnaarch64xnxn	0d13a1b460a23967786eed1e1ea44056bffd5762a997f5e64d50b2ac4a9609c2	Mirai	mirai
http://41.216.189.157/bins/xnxnxnxnxnxnxnxni386xnxn	f7d15eb27019b9c7deb07ef57c0115a00f814234deda3117fbec169483261a07	Mirai	mirai
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnloongarch64xnxn	db0c20379b9b03ccfaebc7d076f679f2f23c46b60a24de56abb0c7a23c5a1f59	Mirai	mirai wraith
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnm68kxnxn	34e94ee838194d93e30815758a2c61c036b3c17058274f6243d85d32ef7759b8	Mirai	mirai wraith
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnmicroblazexnxn	b4764b40d8552c955e65797bcb7e80823be94ff2f436f26440da8d844ed2c018	Mirai	elf mirai ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnmipsxnxn	3848349f22cb1b97a4d864777aa128f3bd394eeb93540446a30e317fe4ba7cbb	Mirai	elf mirai ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnor1kxnxn	1d93fcf92ea05242855bc5385f53c8df09ae12fb70c6af40bac8a82d793432d9	Mirai	elf mirai ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnpowerpcxnxn	c39c2521caaf52e422e7884a380522f45e9e2571cd7ff6648fd94f81f7cbcd35	Mirai	elf mirai ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnriscv32xnxn	351f1998a9c50263bf4c5ce1b82f8a70a1dac215c3e03ecce13d8831a06552dd	Mirai	elf mirai ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnriscv64xnxn	9f0cc92f45de4c7bf9a6976c7d6030c28934ba34cb512f6464cba6c8b6aa29ee	Mirai	elf mirai ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnsh2xnxn	6b1ca6ea2ca6e455b56bcfc9e34a977a97db61751eafe91a256e92adff3563ae	Mirai	elf mirai ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnsh4xnxn	e443f459ac9a3c2882d26aee682d4608893df1c4a59f782687236100ec0eeb11	Mirai	elf mirai ua-wget
http://41.216.189.157/bins/xnxnxnxnxnxnxnxnx86_64xnxn	d8c3080005482e74669131fe1a1b149205fe732284fc799cbc6b843a71cd174b	Mirai	elf gafgyt mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a56a1a0a241fbac8598c4ba/reports/6c1d7154-b531-4baf-b33d-63fc159df5d3/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-14T16:07:00Z UTC

Last seen:

2026-07-16T08:53:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/aade62e2-297a-4d1f-a91f-0f8311259b30

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e/

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-07-14 20:54:39 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qatolhc4janyfacajkzz5bilwt2bflsdzxm47pekdw5kneycsa7a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260714-zn52jsfy4w/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8026e59c5c481b8280404ab39e850bb4f412ae43cdd9cfbc8a1dbaa69302903e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.