MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 826543629b8977a6c8f3b779f4a28cd4c9d8ab79fb42d57ebf65b21b07d60148. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 826543629b8977a6c8f3b779f4a28cd4c9d8ab79fb42d57ebf65b21b07d60148
SHA3-384 hash: e9c37714e4ddc13bcc5969ae2de38c16232797342dd0b428a2038a7d95233a35675f5686a9fac91a2b014a3f9f40c21a
SHA1 hash: 83ea504d06506adda6bd41c5991842ed7e250340
MD5 hash: 563cfdbf08d019c61e9bf3c1c6261b0a
humanhash: angel-xray-speaker-venus
File name:sensi.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'930 bytes
First seen:2026-02-07 14:28:00 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:vtnIsFn0ykwpnSKJJseoedHnhz5FnwaL6snMwkslnpEgJnZmSnzEQnW:vtdFdk6SKvRHB5FJL1VJlpEgJZlzHW
TLSH T19C413D8A14115131EDA5A927F3B9291B378899F66CD0FD2C5CFD3EA486CEF15E08CA43
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://103.252.116.60/Binarys/Owari.x86b3ad0f5d232c1b44a5f7f1acbc4a997e1eaf1e77056ebf687a930e1b5c486143 Miraielf ua-wget
http://103.252.116.60/Binarys/Owari.mips6335958f87009f0c085150fbfc91707439a9e127d561afc44c8c5a69a76077e8 Miraielf ua-wget
http://103.252.116.60/Binarys/Owari.mpsl39a45b885b06dc8837acd0d5218f1d96a8670087042b67d3c58ff6c22bdfd76f Miraielf ua-wget
http://103.252.116.60/Binarys/Owari.arm4n/an/an/a
http://103.252.116.60/Binarys/Owari.arm5ff1102d22747b85d9afd3244c02638ea0a0774d7eb287ba45aa431d0bb79fc6f Miraielf ua-wget
http://103.252.116.60/Binarys/Owari.arm6533bf88efc2f6999603395a8c061268e414c6eb31e2d06269fa4a635225ad2a6 Miraielf ua-wget
http://103.252.116.60/Binarys/Owari.arm7582dd16ae6f2671813f30f116808eec3f5bd97ceaf5d8edbfcf4d018b6b5c273 Miraielf ua-wget
http://103.252.116.60/Binarys/Owari.ppc021e5a8d5d321f04da266f9d6275b1048d821b31a638845e3a6a1df16f3479f4 Miraielf ua-wget
http://103.252.116.60/Binarys/Owari.m68k083c9ebe27e1175659961a804f3e4d540e3d5eaebf733425bca65d5384f1c95c Miraielf ua-wget
http://103.252.116.60/Binarys/Owari.sh4a3bc6a5b3b1b91c003d860111ffcb4fa55bfa317085bf5957de445365918cd8a Miraielf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
28
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Result
Gathering data
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/826543629b8977a6c8f3b779f4a28cd4c9d8ab79fb42d57ebf65b21b07d60148
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/826543629b8977a6c8f3b779f4a28cd4c9d8ab79fb42d57ebf65b21b07d60148/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/826543629b8977a6c8f3b779f4a28cd4c9d8ab79fb42d57ebf65b21b07d60148
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-02-07 14:22:31 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qjsugyu3rf32nshtw547jium2te5rk3z7nbnk7v7mwzbwb6wafea._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:owari antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260207-rs5btabt4c/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (353896) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/826543629b89/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 826543629b8977a6c8f3b779f4a28cd4c9d8ab79fb42d57ebf65b21b07d60148

(this sample)

Mirai

elf b3ad0f5d232c1b44a5f7f1acbc4a997e1eaf1e77056ebf687a930e1b5c486143

  
URLhaus
https://urlhaus.abuse.ch/url/3773924/
  
Delivery method
Distributed via web download
  
Dropping
MD5 4a5a02cdd84385d057e2f3d404c189b2
  
Dropping
SHA256 b3ad0f5d232c1b44a5f7f1acbc4a997e1eaf1e77056ebf687a930e1b5c486143
  
URLhaus
https://urlhaus.abuse.ch/url/3773958/

Comments