MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99fbcc2aa0582ff5e0a38d83b10c6b0886a45a8979d2b1e37a5e6d1dddcaa6a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99fbcc2aa0582ff5e0a38d83b10c6b0886a45a8979d2b1e37a5e6d1dddcaa6a7
SHA3-384 hash: 719689b6bd5ba9d38fadfeaeec41c16f31d47607fcbb24677ddb7250f33ce258b34adc7310427b869e8aaca955dc9729
SHA1 hash: cbc0748a227b2bd9ef0f7324b796d576f2536494
MD5 hash: 674e2d6bb4d5437971c4a9b4c96e6ccd
humanhash: oranges-moon-arizona-fanta
File name:sora.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'933 bytes
First seen:2026-02-12 17:59:47 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:v4OSLaIOSFTykaUoOSZoOSVOSPMOSzOSxOSCOSRrOl:v4RTRBURZoRVR0RzRxRCRte
TLSH T1A0417385F3426831FFB35E5A71B48404B0D0E06AEED6EE41D4EC76ED884EF08A468B53
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://158.94.210.195/bins/sora.x86d0a8ba4ff97f6604e620f7ef8abee62e0b64fbbfb5b874a04e7f952cb955ddd8 Miraielf mirai ua-wget
http://158.94.210.195/bins/sora.mips75320b569967693cba04260f49e84dd9bd01b9f8fc37e9ddfe50aa37cc0fb051 Miraielf mirai ua-wget
http://158.94.210.195/bins/sora.mpsl051deba820eb6da7240f8c1fe23b97910caa12abf38a1e2dd7059371e3240faf Miraielf mirai ua-wget
http://158.94.210.195/bins/sora.arm4n/an/aelf ua-wget
http://158.94.210.195/bins/sora.arm5n/an/aelf mirai ua-wget
http://158.94.210.195/bins/sora.arm61ad572c08af6bc4eeeb620922555f2f9269c3e11e6c300b41abc8ec773a0a5a1 Miraielf mirai ua-wget
http://158.94.210.195/bins/sora.arm794d359b64539c16be4c10131085a603d178630a215a6e49349bdb80cd8c8cf6e Miraielf mirai ua-wget
http://158.94.210.195/bins/sora.ppc4cca20c0f20c5cbfc36d5f967b7f7563d5398cedaae60754eb0481098dad54fe Miraielf mirai ua-wget
http://158.94.210.195/bins/sora.m68kn/an/aelf mirai ua-wget
http://158.94.210.195/bins/sora.sh4n/an/aelf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
32
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Result
Gathering data
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/99fbcc2aa0582ff5e0a38d83b10c6b0886a45a8979d2b1e37a5e6d1dddcaa6a7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99fbcc2aa0582ff5e0a38d83b10c6b0886a45a8979d2b1e37a5e6d1dddcaa6a7/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/99fbcc2aa0582ff5e0a38d83b10c6b0886a45a8979d2b1e37a5e6d1dddcaa6a7
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-02-12 18:00:27 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=th54ykvalax7lyfdrwb3cddlbcdkiwujphjldy32lzwr3xoku2tq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai botnet:sora antivm botnet defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260212-wlhaxsdx8f/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads system network configuration
UPX packed file
Enumerates active TCP sockets
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Contacts a large (89871) amount of remote hosts
Creates a large amount of network flows
Mirai
Mirai family
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/99fbcc2aa058/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/99fbcc2aa0582ff5e0a38d83b10c6b0886a45a8979d2b1e37a5e6d1dddcaa6a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 99fbcc2aa0582ff5e0a38d83b10c6b0886a45a8979d2b1e37a5e6d1dddcaa6a7

(this sample)

Mirai

elf d63e083dc57a23a79a551f272a5d6cac761759841a4600d25d7e9bb30bc4687b

Mirai

elf d0a8ba4ff97f6604e620f7ef8abee62e0b64fbbfb5b874a04e7f952cb955ddd8

  
URLhaus
https://urlhaus.abuse.ch/url/3774593/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3774596/
  
Dropping
MD5 073115aaecf827ef8ff9f9e8c98be6c5
  
Dropping
SHA256 d0a8ba4ff97f6604e620f7ef8abee62e0b64fbbfb5b874a04e7f952cb955ddd8

Comments